Edit tour

Windows Analysis Report
Setup 2.exe

Overview

General Information

Sample Name:	Setup 2.exe
Analysis ID:	637848
MD5:	ec427b1bf867dc6fdfdfc2b5219f44de
SHA1:	d23dfcbd02089bc6f13db8dd4cf1f9c5a085d275
SHA256:	9b1d8b1bafd4f496de3e996dc6778ff0c75f37f2e5eaa5a60049d7c8338e7ef5
Infos:

Detection

Score:	57
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	47
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Multi AV Scanner detection for dropped file

Contains functionality to infect the boot sector

Found API chain indicative of debugger detection

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

AV process strings found (often used to terminate AV products)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Binary contains a suspicious time stamp

Contains capabilities to detect virtual machines

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries disk information (often used to detect virtual machines)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is start

Setup 2.exe (PID: 2852 cmdline: "C:\Users\user\Desktop\Setup 2.exe" MD5: EC427B1BF867DC6FDFDFC2B5219F44DE)

chrome.exe (PID: 7884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation --single-argument https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94 MD5: 74859601FB4BEEA84B40D874CCB56CAB)

chrome.exe (PID: 3896 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,14935635805379620180,7098128812871956072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:8 MD5: 74859601FB4BEEA84B40D874CCB56CAB)

SetupEngine.exe (PID: 4152 cmdline: "C:\Users\user\AppData\Local\Temp\SetupEngine.exe" MD5: 5633DE5AF2C7D8E011EFE802CEC7B83E)

cmd.exe (PID: 5304 cmdline: cmd /c "C:\Users\user\AppData\Local\Temp\diskspd.exe -c100M -b4K -t1 -r -o32 -d10 -ag -h -Rxml C:\Users\user\AppData\Local\Temp\testfile.temp" > C:\Users\user\AppData\Local\Temp\dskres.xml MD5: 4943BA1A9B41D69643F69685E35B2943)

conhost.exe (PID: 4772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C5E9B1D1103EDCEA2E408E9497A5A88F)

diskspd.exe (PID: 3924 cmdline: C:\Users\user\AppData\Local\Temp\diskspd.exe -c100M -b4K -t1 -r -o32 -d10 -ag -h -Rxml C:\Users\user\AppData\Local\Temp\testfile.temp MD5: FC41CABDD3C18079985AC5F648F58A90)

SetupResources.exe (PID: 5888 cmdline: C:\Users\user\AppData\Local\Temp\SetupResources.exe MD5: 884E1463B4CB20B28C3A80960E02AC2D)

svchost.exe (PID: 3032 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 9520A99E77D6196D0D09833146424113)

svchost.exe (PID: 1292 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 9520A99E77D6196D0D09833146424113)

svchost.exe (PID: 7468 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc MD5: 9520A99E77D6196D0D09833146424113)

svchost.exe (PID: 6812 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: 9520A99E77D6196D0D09833146424113)

svchost.exe (PID: 3524 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv MD5: 9520A99E77D6196D0D09833146424113)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Setup 2.exe

ReversingLabs: Detection: 23%

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Fast!\fast!.exe	ReversingLabs: Detection: 12%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BJM855OV\SetupEngine[1].exe	ReversingLabs: Detection: 19%

Compliance

Uses 32bit PE files

Source: Setup 2.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 34.195.48.210:443 -> 192.168.2.3:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.197.24:443 -> 192.168.2.3:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.98.23:443 -> 192.168.2.3:49320 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.195.48.210:443 -> 192.168.2.3:54146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.195.48.210:443 -> 192.168.2.3:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.195.48.210:443 -> 192.168.2.3:50538 version: TLS 1.2

PE / OLE file has a valid certificate

Source: Setup 2.exe

Static PE information: certificate valid

Binary contains paths to debug symbols

Source:	Binary string: z:\rs1.obj.x86fre\sdktools\srvperf\diskspd.oss\cmdrequestcreator\objfre\i386\diskspd.pdb source: diskspd.exe, diskspd.exe, 0000000E.00000000.2147109058.0000000000B41000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\veryfast\veryfast.io\FastSRV\Release\FastSRV.pdb source: FastSRV.exe.11.dr
Source:	Binary string: z:\rs1.obj.x86fre\sdktools\srvperf\diskspd.oss\cmdrequestcreator\objfre\i386\diskspd.pdbGCTL source: diskspd.exe, 0000000E.00000000.2147109058.0000000000B41000.00000020.00000001.01000000.00000011.sdmp

Spreading

Source: C:\Users\user\Desktop\Setup 2.exe	Code function: 1_2_004054C6 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_004054C6
Source: C:\Users\user\Desktop\Setup 2.exe	Code function: 1_2_00405E9C FindFirstFileA,FindClose,	1_2_00405E9C
Source: C:\Users\user\Desktop\Setup 2.exe	Code function: 1_2_00402654 FindFirstFileA,	1_2_00402654
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Code function: 11_2_004054C6 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	11_2_004054C6
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Code function: 11_2_00405E9C FindFirstFileA,FindClose,	11_2_00405E9C
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Code function: 11_2_00402654 FindFirstFileA,	11_2_00402654
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Code function: 23_2_00402654 FindFirstFileA,	23_2_00402654
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Code function: 23_2_004054C6 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	23_2_004054C6
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Code function: 23_2_00405E9C FindFirstFileA,FindClose,	23_2_00405E9C

Networking

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 34.195.48.210 34.195.48.210
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50537
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55949
Source: unknown	Network traffic detected: HTTP traffic on port 57495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54731
Source: unknown	Network traffic detected: HTTP traffic on port 57453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56320
Source: unknown	Network traffic detected: HTTP traffic on port 55949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57453
Source: unknown	Network traffic detected: HTTP traffic on port 60815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59033
Source: unknown	Network traffic detected: HTTP traffic on port 62528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57975
Source: unknown	Network traffic detected: HTTP traffic on port 56863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62528
Source: unknown	Network traffic detected: HTTP traffic on port 63065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49320
Source: unknown	Network traffic detected: HTTP traffic on port 58241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61293
Source: unknown	Network traffic detected: HTTP traffic on port 54146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52582
Source: unknown	Network traffic detected: HTTP traffic on port 50538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 57975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49273
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62701
Source: unknown	Network traffic detected: HTTP traffic on port 52582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61293 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: credits.html.23.dr	String found in binary or memory: http://android-gifview.googlecode.com/svn/
Source: credits.html.23.dr	String found in binary or memory: http://bgoffice.sourceforge.net/
Source: credits.html.23.dr	String found in binary or memory: http://caminobrowser.org/
Source: credits.html.23.dr	String found in binary or memory: http://casper.beckman.uiuc.edu/~c-tsai4
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://certificates.godaddy.com/repository/0
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://certificates.godaddy.com/repository/gdig2.crt0
Source: Setup 2.exe, 00000001.00000003.1931681159.0000000004329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://certs.starfieldtech.com/repository/1402
Source: credits.html.23.dr	String found in binary or memory: http://cgit.freedesktop.org/~aplattner/nvidia-settings/
Source: credits.html.23.dr	String found in binary or memory: http://chasen.aist-nara.ac.jp/chasen/distribution.html
Source: credits.html.23.dr	String found in binary or memory: http://code.google.com/p/angleproject/
Source: credits.html.23.dr	String found in binary or memory: http://code.google.com/p/data-race-test/wiki/DynamicAnnotations
Source: credits.html.23.dr	String found in binary or memory: http://code.google.com/p/google-axs-chrome/
Source: credits.html.23.dr	String found in binary or memory: http://code.google.com/p/google-jstemplate/
Source: credits.html.23.dr	String found in binary or memory: http://code.google.com/p/lao-dictionary/
Source: credits.html.23.dr	String found in binary or memory: http://code.google.com/p/libyuv/
Source: credits.html.23.dr	String found in binary or memory: http://code.google.com/p/nativeclient
Source: credits.html.23.dr	String found in binary or memory: http://code.google.com/p/pdfium/
Source: credits.html.23.dr	String found in binary or memory: http://code.google.com/p/smhasher/
Source: credits.html.23.dr	String found in binary or memory: http://code.google.com/p/v8
Source: credits.html.23.dr	String found in binary or memory: http://code.google.com/p/y2038
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp, Setup 2.exe, 00000001.00000003.1698082939.0000000000754000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2981300131.000001E5D7286000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000002.2970923182.0000000000620000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000003.2628240089.0000000000620000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2975373849.00000266223A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp, Setup 2.exe, 00000001.00000003.1698082939.0000000000754000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2981300131.000001E5D7286000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000002.2970923182.0000000000620000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000003.2628240089.0000000000620000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2974592830.000002662236D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Setup 2.exe, 00000001.00000003.1931681159.0000000004329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.godaddy.com/gdig2s5-2.crl0
Source: Setup 2.exe, 00000001.00000003.1811691500.000000000431B000.00000004.00000800.00020000.00000000.sdmp, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://crl.godaddy.com/gdig2s5-4.crl0
Source: Setup 2.exe	String found in binary or memory: http://crl.godaddy.com/gdig2s5-5.crl0
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
Source: svchost.exe, 00000015.00000003.2930758824.0000026627317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://crl.starfieldtech.com/repository/0
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://crl.starfieldtech.com/repository/masterstarfield2issuing.crl0P
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://crl.starfieldtech.com/repository/sf_issuing_ca-g2.crt0T
Source: Setup 2.exe, 00000001.00000003.1931681159.0000000004329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.starfieldtech.com/repository/sfsroot.crl0P
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://crl.starfieldtech.com/sfroot-g2.crl0L
Source: svchost.exe, 00000002.00000002.2981300131.000001E5D7286000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2974592830.000002662236D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: credits.html.23.dr	String found in binary or memory: http://ctrio.sourceforge.net/
Source: credits.html.23.dr	String found in binary or memory: http://devel.freebsoft.org/speechd
Source: credits.html.23.dr	String found in binary or memory: http://developer.apple.com/
Source: credits.html.23.dr	String found in binary or memory: http://developer.intel.com/vtune/cbts/strmsimd/922down.htm
Source: credits.html.23.dr	String found in binary or memory: http://developer.intel.com/vtune/cbts/strmsimd/appnotes.htm)
Source: credits.html.23.dr	String found in binary or memory: http://developer.mozilla.org/en-US/docs/Accessibility/AT-APIs
Source: credits.html.23.dr	String found in binary or memory: http://developers.google.com/speed/webp
Source: svchost.exe, 00000015.00000003.2834662534.0000026626E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.c
Source: svchost.exe, 00000015.00000002.2979629606.0000026622740000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2834662534.0000026626E40000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2997325142.0000026626FB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2021/05/am_engine_5ce8698a166915
Source: svchost.exe, 00000015.00000002.2979629606.0000026622740000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2834662534.0000026626E40000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.3007436146.00000266274E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2021/06/am_base_patch1_0338cab85
Source: svchost.exe, 00000015.00000003.2834662534.0000026626E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2021/06/am_delta_1df5ba061216d97
Source: svchost.exe, 00000015.00000003.2834662534.0000026626E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2021/06/am_delta_4a2d644d24e875f
Source: svchost.exe, 00000015.00000003.2834662534.0000026626E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2021/06/am_delta_58ed78f1c6bbfa6
Source: svchost.exe, 00000015.00000002.2979629606.0000026622740000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.2834662534.0000026626E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/defu/2021/06/am_delta_88a5992ddbd90d0
Source: svchost.exe, 00000015.00000003.2834662534.0000026626E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download.windowsupdate.com/c/msdownload/update/software/updt/2020/02/updateplatform_0456e6719
Source: credits.html.23.dr	String found in binary or memory: http://downloads.xiph.org/releases/flac/flac-1.3.1.tar.xz
Source: svchost.exe, 00000002.00000002.2990114827.000001E5D7302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: svchost.exe, 00000002.00000002.2990114827.000001E5D7302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/.dll
Source: svchost.exe, 00000002.00000002.2971313046.000001E5D6500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1682801778.000001E5DB44C000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2725024766.000001E5D71E5000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2405944791.000001E5D71E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000002.00000003.1681971198.000001E5DB414000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/AJzR0Zz0SQOCHzc0sR3MfHk_91.0.4472.77/91.0.4472.77_c
Source: svchost.exe, 00000002.00000003.1682801778.000001E5DB44C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ANlaTV2JH2WK9RCoHi__mxg_1.0.6/S3ybLvFx94H
Source: svchost.exe, 00000002.00000003.1682801778.000001E5DB44C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/APVOrL1aIZFPVuxAFYGUnkE_20210520.37540039
Source: svchost.exe, 00000002.00000003.1682801778.000001E5DB44C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/APXXLABkvVhhXtYF5CAJK8E_43/G7yvLIv4RYlDG8
Source: svchost.exe, 00000002.00000002.2993572735.000001E5D7323000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12M
Source: credits.html.23.dr	String found in binary or memory: http://errorprone.info/
Source: credits.html.23.dr	String found in binary or memory: http://ffmpeg.org/
Source: credits.html.23.dr	String found in binary or memory: http://freedesktop.org
Source: credits.html.23.dr	String found in binary or memory: http://freetype.sourceforge.net/license.html:
Source: credits.html.23.dr	String found in binary or memory: http://fsf.org/>
Source: credits.html.23.dr	String found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: credits.html.23.dr	String found in binary or memory: http://github.com/google/closure-compiler
Source: credits.html.23.dr	String found in binary or memory: http://github.com/sctplab/usrsctp
Source: credits.html.23.dr	String found in binary or memory: http://google.github.io/snappy/
Source: credits.html.23.dr	String found in binary or memory: http://gperftools.googlecode.com/
Source: credits.html.23.dr	String found in binary or memory: http://harfbuzz.org
Source: credits.html.23.dr	String found in binary or memory: http://hunspell.sourceforge.net/
Source: credits.html.23.dr	String found in binary or memory: http://icu-project.org/userguide/icufaq.html
Source: credits.html.23.dr	String found in binary or memory: http://jquery.com/
Source: credits.html.23.dr	String found in binary or memory: http://lao-dictionary.googlecode.com/git/Lao-Dictionary-LICENSE.txt
Source: credits.html.23.dr	String found in binary or memory: http://lao-dictionary.googlecode.com/git/Lao-Dictionary.txt
Source: credits.html.23.dr	String found in binary or memory: http://lcamtuf.coredump.cx/afl/
Source: credits.html.23.dr	String found in binary or memory: http://libcxx.llvm.org/
Source: credits.html.23.dr	String found in binary or memory: http://libcxxabi.llvm.org/
Source: credits.html.23.dr	String found in binary or memory: http://libevent.org/
Source: credits.html.23.dr	String found in binary or memory: http://libpng.org/
Source: credits.html.23.dr	String found in binary or memory: http://libusb.org
Source: credits.html.23.dr	String found in binary or memory: http://llvm.org
Source: SetupResources.exe, 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmp	String found in binary or memory: http://llvm.org/):
Source: credits.html.23.dr	String found in binary or memory: http://llvm.org/docs/LibFuzzer.html
Source: credits.html.23.dr	String found in binary or memory: http://ltp.sourceforge.net/coverage/lcov.php
Source: credits.html.23.dr	String found in binary or memory: http://lxr.mozilla.org/mozilla/source/toolkit/mozapps/update/src/updater/
Source: credits.html.23.dr	String found in binary or memory: http://modp.com/release/base64
Source: credits.html.23.dr	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: credits.html.23.dr	String found in binary or memory: http://mxr.mozilla.org/comm-central/source/mozilla/netwerk/base/src/nsURLParsers.cpp
Source: credits.html.23.dr	String found in binary or memory: http://nodejs.org/
Source: SetupResources.exe, SetupResources.exe, 00000017.00000000.2857348548.0000000000409000.00000008.00000001.01000000.00000014.sdmp, SetupResources.exe, 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmp, Setup 2.exe, SetupEngine[1].exe.1.dr, SetupResources.exe.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, SetupResources.exe.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: credits.html.23.dr	String found in binary or memory: http://nwjs.io
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://ocsp.godaddy.com/0
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://ocsp.godaddy.com/05
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://ocsp.starfieldtech.com/0;
Source: Setup 2.exe, 00000001.00000003.1931681159.0000000004329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.starfieldtech.com/0D
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: http://ocsp.starfieldtech.com/0H
Source: credits.html.23.dr	String found in binary or memory: http://opensource.org/licenses/bsd-license.php
Source: credits.html.23.dr	String found in binary or memory: http://opensource.org/licenses/mit
Source: credits.html.23.dr	String found in binary or memory: http://oss.sgi.com/projects/FreeB/
Source: svchost.exe, 00000002.00000003.1681971198.000001E5DB414000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHF
Source: svchost.exe, 00000002.00000003.1682801778.000001E5DB44C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/AIZk8O7Cv2UUbxc_aaUykKI_7/ALzUVHP-vRgKCz
Source: svchost.exe, 00000002.00000003.1682801778.000001E5DB44C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/AT25IXegX04GPhlqizv_jg_281/cp83jQFxy4Co7
Source: svchost.exe, 00000002.00000003.1682801778.000001E5DB44C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/CLzUPOY7PeNCWmHSoqszxQ_9.27.0/ANtasjH7xN
Source: credits.html.23.dr	String found in binary or memory: http://rentzsch.com
Source: credits.html.23.dr	String found in binary or memory: http://site.icu-project.org/
Source: credits.html.23.dr	String found in binary or memory: http://skal.planet-d.net/coding/dct.html
Source: credits.html.23.dr	String found in binary or memory: http://software.blackmagicdesign.com/DeckLink/v10.7/Blackmagic_DeckLink_SDK_10.7.zip
Source: credits.html.23.dr	String found in binary or memory: http://source.android.com
Source: credits.html.23.dr	String found in binary or memory: http://source.icu-project.org/repos/icu/icu/trunk/license.html
Source: credits.html.23.dr	String found in binary or memory: http://sourceforge.net/projects/expat/
Source: credits.html.23.dr	String found in binary or memory: http://sourceware.org/ml/newlib/
Source: credits.html.23.dr	String found in binary or memory: http://sourceware.org/newlib/docs.html
Source: credits.html.23.dr	String found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/xz/COPYING
Source: svchost.exe, 00000015.00000003.2835560627.0000026626F3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tlu.dl.d;#
Source: credits.html.23.dr	String found in binary or memory: http://trevp.net/tlslite/
Source: credits.html.23.dr	String found in binary or memory: http://tukaani.org/xz/
Source: credits.html.23.dr	String found in binary or memory: http://valgrind.org
Source: credits.html.23.dr	String found in binary or memory: http://webkit.org/
Source: credits.html.23.dr	String found in binary or memory: http://wtl.sourceforge.net/
Source: svchost.exe, 00000015.00000003.2930758824.0000026627317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www..
Source: credits.html.23.dr	String found in binary or memory: http://www.7-zip.org/sdk.html
Source: credits.html.23.dr	String found in binary or memory: http://www.adel.nursat.kz/apg/
Source: credits.html.23.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: credits.html.23.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: credits.html.23.dr	String found in binary or memory: http://www.apple.com/legal/guidelinesfor3rdparties.html.
Source: credits.html.23.dr	String found in binary or memory: http://www.azillionmonkeys.com/qed/hash.html
Source: credits.html.23.dr	String found in binary or memory: http://www.chromium.org
Source: credits.html.23.dr	String found in binary or memory: http://www.chromium.org/blink
Source: credits.html.23.dr	String found in binary or memory: http://www.cisl.ucar.edu/css/software/fftpack5/ftpk.html
Source: credits.html.23.dr	String found in binary or memory: http://www.dabeaz.com/ply/ply-3.4.tar.gz
Source: credits.html.23.dr	String found in binary or memory: http://www.daemonology.net/bsdiff/
Source: credits.html.23.dr	String found in binary or memory: http://www.elecard.com/peter/idct.html
Source: credits.html.23.dr	String found in binary or memory: http://www.flotcharts.org
Source: credits.html.23.dr	String found in binary or memory: http://www.freedesktop.org/wiki/Software/systemd/
Source: credits.html.23.dr	String found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: credits.html.23.dr	String found in binary or memory: http://www.freetype.org
Source: credits.html.23.dr	String found in binary or memory: http://www.freetype.org/
Source: credits.html.23.dr	String found in binary or memory: http://www.gnu.org/licenses/>.
Source: credits.html.23.dr	String found in binary or memory: http://www.gnu.org/philosophy/why-not-lgpl.html>.
Source: credits.html.23.dr	String found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: credits.html.23.dr	String found in binary or memory: http://www.ijg.org
Source: credits.html.23.dr	String found in binary or memory: http://www.ijg.org/
Source: credits.html.23.dr	String found in binary or memory: http://www.khronos.org/registry
Source: credits.html.23.dr	String found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: credits.html.23.dr	String found in binary or memory: http://www.linuxfoundation.org/collaborate/workgroups/accessibility/iaccessible2
Source: credits.html.23.dr	String found in binary or memory: http://www.linuxvideo.org/mpeg2dec/
Source: credits.html.23.dr	String found in binary or memory: http://www.logilab.org/
Source: credits.html.23.dr	String found in binary or memory: http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/MT2002/emt19937ar.html
Source: credits.html.23.dr	String found in binary or memory: http://www.mesa3d.org/
Source: credits.html.23.dr	String found in binary or memory: http://www.mozilla.org/MPL/
Source: credits.html.23.dr	String found in binary or memory: http://www.mozilla.org/MPL/2.0/
Source: credits.html.23.dr	String found in binary or memory: http://www.mozilla.org/MPL/2.0/FAQ.html
Source: credits.html.23.dr	String found in binary or memory: http://www.mozilla.org/projects/nspr/
Source: credits.html.23.dr	String found in binary or memory: http://www.mozilla.org/projects/security/pki/nss/
Source: credits.html.23.dr	String found in binary or memory: http://www.netlib.org/fdlibm/
Source: credits.html.23.dr	String found in binary or memory: http://www.netlib.org/fp/
Source: credits.html.23.dr	String found in binary or memory: http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/getentropy.2
Source: credits.html.23.dr	String found in binary or memory: http://www.openh264.org/
Source: credits.html.23.dr	String found in binary or memory: http://www.opensource.apple.com/
Source: credits.html.23.dr	String found in binary or memory: http://www.opensource.apple.com/apsl/
Source: credits.html.23.dr	String found in binary or memory: http://www.opensource.org/licenses/bsd-license.php
Source: credits.html.23.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: credits.html.23.dr	String found in binary or memory: http://www.openssl.org/)
Source: credits.html.23.dr	String found in binary or memory: http://www.ploscompbiol.org/static/license
Source: credits.html.23.dr	String found in binary or memory: http://www.polymer-project.org
Source: credits.html.23.dr	String found in binary or memory: http://www.pylint.org/
Source: credits.html.23.dr	String found in binary or memory: http://www.seanpatrickobrien.com/journal/posts/3
Source: credits.html.23.dr	String found in binary or memory: http://www.strongtalk.org/
Source: credits.html.23.dr	String found in binary or memory: http://www.suitable.com
Source: credits.html.23.dr	String found in binary or memory: http://www.suitable.com/tools/smslib.html
Source: credits.html.23.dr	String found in binary or memory: http://www.suitable.com/tools/smslib.html>
Source: credits.html.23.dr	String found in binary or memory: http://www.torchmobile.com/
Source: credits.html.23.dr	String found in binary or memory: http://www.tortall.net/projects/yasm/
Source: credits.html.23.dr	String found in binary or memory: http://www.unicode.org/Public/
Source: credits.html.23.dr	String found in binary or memory: http://www.unicode.org/cldr/data/
Source: credits.html.23.dr	String found in binary or memory: http://www.unicode.org/cldr/data/.
Source: credits.html.23.dr	String found in binary or memory: http://www.unicode.org/copyright.html
Source: credits.html.23.dr	String found in binary or memory: http://www.unicode.org/copyright.html.
Source: credits.html.23.dr	String found in binary or memory: http://www.unicode.org/reports/
Source: credits.html.23.dr	String found in binary or memory: http://www.webmproject.org
Source: credits.html.23.dr	String found in binary or memory: http://www.webmproject.org/code/
Source: credits.html.23.dr	String found in binary or memory: http://www.webrtc.org
Source: credits.html.23.dr	String found in binary or memory: http://xmlsoft.org
Source: credits.html.23.dr	String found in binary or memory: http://xmlsoft.org/XSLT
Source: credits.html.23.dr	String found in binary or memory: http://zlib.net/
Source: svchost.exe, 00000007.00000002.2969185454.00000236FFE43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000007.00000002.2969185454.00000236FFE43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000007.00000002.2969185454.00000236FFE43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2969011331.00000236FFE2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2969576047.00000236FFE70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: credits.html.23.dr	String found in binary or memory: https://android.googlesource.com/platform/bionic/
Source: credits.html.23.dr	String found in binary or memory: https://android.googlesource.com/platform/development/
Source: credits.html.23.dr	String found in binary or memory: https://android.googlesource.com/platform/frameworks/support
Source: credits.html.23.dr	String found in binary or memory: https://android.googlesource.com/platform/packages/apps/Settings/
Source: svchost.exe, 00000007.00000002.2969185454.00000236FFE43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bn2-df.notify.windows.com/v2/register/xplatform/device
Source: credits.html.23.dr	String found in binary or memory: https://boringssl.googlesource.com/boringssl
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: https://certs.godaddy.com/repository/0
Source: Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	String found in binary or memory: https://certs.starfieldtech.com/repository/0
Source: pnacl_public_x86_64_libgcc_a.8.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libgcc_a.8.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: credits.html.23.dr	String found in binary or memory: https://chromium.googlesource.com/android_tools.git/
Source: credits.html.23.dr	String found in binary or memory: https://chromium.googlesource.com/breakpad/breakpad
Source: credits.html.23.dr	String found in binary or memory: https://chromium.googlesource.com/chromium/src.git/
Source: credits.html.23.dr	String found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: credits.html.23.dr	String found in binary or memory: https://chromium.googlesource.com/chromiumos/platform/gestures
Source: credits.html.23.dr	String found in binary or memory: https://chromium.googlesource.com/chromiumos/platform/libevdev
Source: credits.html.23.dr	String found in binary or memory: https://chromium.googlesource.com/chromiumos/platform/minigbm
Source: credits.html.23.dr	String found in binary or memory: https://chromium.googlesource.com/deps/inspector_protocol/
Source: credits.html.23.dr	String found in binary or memory: https://chromium.googlesource.com/external/github.com/GoogleChrome/custom-tabs-client
Source: credits.html.23.dr	String found in binary or memory: https://chromium.googlesource.com/external/webrtc
Source: credits.html.23.dr	String found in binary or memory: https://cla.developers.google.com/clas
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: credits.html.23.dr	String found in binary or memory: https://code.google.com/p/sctp-refimpl/source/browse/trunk/COPYRIGHT)
Source: credits.html.23.dr	String found in binary or memory: https://crashpad.chromium.org/
Source: credits.html.23.dr	String found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: Setup 2.exe, 00000001.00000002.2973592569.00000000042F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d1uyoz7mfvzv4e.cloudfront.net/
Source: SetupEngine.exe, 0000000B.00000002.2969397595.00000000005AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d1uyoz7mfvzv4e.cloudfront.net/download/SetupResources.exe
Source: Setup 2.exe, 00000001.00000002.2970247822.00000000006AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d1uyoz7mfvzv4e.cloudfront.net/download/SetupResources.exeSStore
Source: credits.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: credits.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: credits.html.23.dr	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: credits.html.23.dr	String found in binary or memory: https://developer.android.com/reference/android/support/design/widget/BottomNavigationView.html
Source: credits.html.23.dr	String found in binary or memory: https://dxr.mozilla.org/mozilla-central/source/security/manager/
Source: svchost.exe, 00000002.00000003.1683538484.000001E5DB492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProduction?OneDriveUpdate=8832247681fc94bb89bb92977c3-C
Source: svchost.exe, 00000002.00000003.1683538484.000001E5DB492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProduction?OneDriveUpdate=a8436e7320e39c903a35da9b911
Source: svchost.exe, 00000002.00000003.1683216726.000001E5DB47B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProduction?OneDriveUpdate=f48c47f7803b912ab9b4c1a01f72
Source: svchost.exe, 00000002.00000003.1683216726.000001E5DB47B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod
Source: svchost.exe, 00000002.00000003.1683538484.000001E5DB492000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1683097884.000001E5DB473000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1682376177.000001E5DB437000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1681752757.000001E5DB408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000002.00000003.1683538484.000001E5DB492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod?OneDriveUpdate=60c3c2b058b5ae1621bf716ac53a-C:
Source: credits.html.23.dr	String found in binary or memory: https://git.gnome.org/browse/libsecret/
Source: credits.html.23.dr	String found in binary or memory: https://git.xiph.org/?p=opus.git;a=snapshot;h=3fe744ea04fdcc418fb85c2c133d13372ebb019b;sf=tgz
Source: credits.html.23.dr	String found in binary or memory: https://github.com/CLD2Owners/cld2
Source: credits.html.23.dr	String found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: credits.html.23.dr	String found in binary or memory: https://github.com/LunarG/VulkanTools/tree/master/include/vulkan
Source: credits.html.23.dr	String found in binary or memory: https://github.com/ValveSoftware/openvr
Source: credits.html.23.dr	String found in binary or memory: https://github.com/bazelbuild/bazel
Source: credits.html.23.dr	String found in binary or memory: https://github.com/chjj/)
Source: credits.html.23.dr	String found in binary or memory: https://github.com/chromium/dom-distiller
Source: credits.html.23.dr	String found in binary or memory: https://github.com/cisco/libsrtp
Source: credits.html.23.dr	String found in binary or memory: https://github.com/client9/stringencoders
Source: credits.html.23.dr	String found in binary or memory: https://github.com/dequelabs/axe-core/
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/brotli
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/cld3
Source: craw_background.js.8.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/compact_enc_det
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/crc32c
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/flatbuffers
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/glog
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/glslang
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/google-toolbox-for-mac
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/leveldb.git
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/libprotobuf-mutator
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/material-design-icons
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/open-vcdiff
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/protobuf
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/re2
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/shaderc
Source: credits.html.23.dr	String found in binary or memory: https://github.com/google/woff2
Source: credits.html.23.dr	String found in binary or memory: https://github.com/googlei18n/google-input-tools.git
Source: credits.html.23.dr	String found in binary or memory: https://github.com/googlei18n/libaddressinput
Source: credits.html.23.dr	String found in binary or memory: https://github.com/googlei18n/libphonenumber/
Source: credits.html.23.dr	String found in binary or memory: https://github.com/googlei18n/sfntly
Source: credits.html.23.dr	String found in binary or memory: https://github.com/googlevr/gvr-android-sdk
Source: credits.html.23.dr	String found in binary or memory: https://github.com/joyent/node
Source: credits.html.23.dr	String found in binary or memory: https://github.com/jquery/jquery/blob/master/MIT-LICENSE.txt
Source: credits.html.23.dr	String found in binary or memory: https://github.com/jquery/sizzle/blob/master/LICENSE
Source: credits.html.23.dr	String found in binary or memory: https://github.com/jrmuizel/qcms/tree/v4
Source: credits.html.23.dr	String found in binary or memory: https://github.com/khaledhosny/ots.git
Source: credits.html.23.dr	String found in binary or memory: https://github.com/libjpeg-turbo/libjpeg-turbo/
Source: credits.html.23.dr	String found in binary or memory: https://github.com/liblouis/liblouis
Source: credits.html.23.dr	String found in binary or memory: https://github.com/material-components/material-components-ios
Source: credits.html.23.dr	String found in binary or memory: https://github.com/material-foundation/material-font-disk-loader-ios
Source: credits.html.23.dr	String found in binary or memory: https://github.com/material-foundation/material-roboto-font-loader-ios
Source: credits.html.23.dr	String found in binary or memory: https://github.com/material-foundation/material-sprited-animation-view-ios
Source: credits.html.23.dr	String found in binary or memory: https://github.com/material-foundation/material-text-accessibility-ios
Source: credits.html.23.dr	String found in binary or memory: https://github.com/mbostock/d3
Source: credits.html.23.dr	String found in binary or memory: https://github.com/open-source-parsers/jsoncpp
Source: credits.html.23.dr	String found in binary or memory: https://github.com/rentzsch/mach_override
Source: credits.html.23.dr	String found in binary or memory: https://github.com/simplejson/simplejson
Source: credits.html.23.dr	String found in binary or memory: https://github.com/square/haha
Source: credits.html.23.dr	String found in binary or memory: https://github.com/square/leakcanary
Source: credits.html.23.dr	String found in binary or memory: https://github.com/virustotal/yara
Source: credits.html.23.dr	String found in binary or memory: https://github.com/web-animations/web-animations-js
Source: credits.html.23.dr	String found in binary or memory: https://github.com/y-256/libdivsufsort
Source: svchost.exe, 00000007.00000002.2969185454.00000236FFE43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://global.notify.windows.com/v2/register/xplatform/device
Source: credits.html.23.dr	String found in binary or memory: https://iojs.org
Source: credits.html.23.dr	String found in binary or memory: https://jelloween.deviantart.com
Source: credits.html.23.dr	String found in binary or memory: https://joyent.com
Source: credits.html.23.dr	String found in binary or memory: https://jquery.org/
Source: credits.html.23.dr	String found in binary or memory: https://llvm.org/svn/llvm-project/libunwind/trunk/
Source: credits.html.23.dr	String found in binary or memory: https://mathiasbynens.be/>
Source: credits.html.23.dr	String found in binary or memory: https://nodejs.org
Source: svchost.exe, 00000002.00000003.1683216726.000001E5DB47B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.073.0411.0002/OneDriveSetup.exe
Source: svchost.exe, 00000002.00000003.1682376177.000001E5DB437000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.073.0411.0002/OneDriveSetup.exe-C:
Source: svchost.exe, 00000002.00000003.1683538484.000001E5DB492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.083.0425.0003/OneDriveSetup.exe
Source: credits.html.23.dr	String found in binary or memory: https://raw.githubusercontent.com/GoogleChrome/accessibility-developer-tools/master/dist/js/axs_test
Source: credits.html.23.dr	String found in binary or memory: https://registry.npmjs.org
Source: Setup 2.exe, 00000001.00000002.2973592569.00000000042F0000.00000004.00000800.00020000.00000000.sdmp, Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s3.amazonaws.com/veryfast/download/2.166.2/SetupEngine.exe
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s3.amazonaws.com/veryfast/download/2.166.2/SetupEngine.exev
Source: credits.html.23.dr	String found in binary or memory: https://silver.arm.com/download/Software/Graphics/OX000-BU-00010-r1p0-00bet0/OX000-BU-00010-r1p0-00b
Source: credits.html.23.dr	String found in binary or memory: https://sites.google.com/site/gaviotachessengine/Home/endgame-tablebases-1
Source: credits.html.23.dr	String found in binary or memory: https://skia.org/
Source: credits.html.23.dr	String found in binary or memory: https://source.android.com/
Source: credits.html.23.dr	String found in binary or memory: https://source.android.com/devices/graphics/testing.html
Source: credits.html.23.dr	String found in binary or memory: https://sourceforge.net/project/?group_id=1519
Source: credits.html.23.dr	String found in binary or memory: https://sqlite.org/
Source: credits.html.23.dr	String found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: Setup 2.exe, 00000001.00000002.2970995818.000000000071E000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000002.2970923182.0000000000620000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000003.2628240089.0000000000620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/
Source: Setup 2.exe, 00000001.00000002.2970995818.000000000071E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/Wg
Source: ui.bin.11.dr	String found in binary or memory: https://veryfast.io/activated.html?guid=
Source: Setup 2.exe, 00000001.00000002.2970247822.00000000006AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/cpg.php?guid=
Source: Setup 2.exe, 00000001.00000002.2970247822.00000000006AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/download.php?engine=1&guid=
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/download.php?engine=1&guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/download.php?engine=1&guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94Y
Source: SetupEngine.exe, 0000000B.00000002.2969397595.00000000005AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installed.php?guid=
Source: SetupEngine.exe, 0000000B.00000002.2973644826.0000000004620000.00000004.00000800.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000002.2974117364.0000000004643000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installed.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94
Source: SetupEngine.exe, 0000000B.00000002.2973644826.0000000004620000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installed.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D942o
Source: SetupEngine.exe, 0000000B.00000002.2974117364.0000000004643000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installed.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D948
Source: SetupEngine.exe, 0000000B.00000002.2973644826.0000000004620000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installed.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94Fo
Source: SetupEngine.exe, 0000000B.00000002.2973644826.0000000004620000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installed.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94oj
Source: SetupEngine.exe, 0000000B.00000002.2973644826.0000000004620000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installed.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94z
Source: Setup 2.exe, 00000001.00000002.2970247822.00000000006AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installing.html?guid=
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94=
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94AZ_
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94Z
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94f;
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94r9
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94x
Source: ui.bin.11.dr	String found in binary or memory: https://veryfast.io/keys/
Source: ui.bin.11.dr	String found in binary or memory: https://veryfast.io/licrequire.php?guid=
Source: ui.bin.11.dr	String found in binary or memory: https://veryfast.io/pay.html?guid=
Source: ui.bin.11.dr	String found in binary or memory: https://veryfast.io/pay_onetime.php?guid=
Source: SetupEngine.exe, 0000000B.00000002.2969397595.00000000005AD000.00000004.00000020.00020000.00000000.sdmp, ui.bin.11.dr	String found in binary or memory: https://veryfast.io/pixel.gif?guid=
Source: Setup 2.exe, 00000001.00000002.2970995818.000000000071E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/pixel.gif?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&evt_src=installer&evt_action
Source: SetupEngine.exe, 0000000B.00000003.2628009243.0000000004626000.00000004.00000800.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000002.2969267169.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000003.2628047560.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/pixel.gif?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&version=2.166.2&evt_src=inst
Source: ui.bin.11.dr	String found in binary or memory: https://veryfast.io/pixel.gif?guid=:
Source: ui.bin.11.dr	String found in binary or memory: https://veryfast.io/productvalidate.html?guid=
Source: ui.bin.11.dr	String found in binary or memory: https://veryfast.io/productvalidate.html?guid=?
Source: SetupEngine.exe, 0000000B.00000002.2969397595.00000000005AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/register.php?guid=
Source: SetupEngine.exe, 0000000B.00000003.2628009243.0000000004626000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://veryfast.io/register.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&ch=&version=2.166.2&dsk_i
Source: ui.bin.11.dr	String found in binary or memory: https://veryfast.io/usage.php?guid=
Source: e98a4c5a-f168-45c2-a609-aa35e4f0d9f0.tmp.8.dr	String found in binary or memory: https://veryfast.io:443
Source: craw_background.js.8.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: craw_background.js.8.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: craw_background.js.8.dr	String found in binary or memory: https://www.googleapis.com
Source: credits.html.23.dr	String found in binary or memory: https://www.khronos.org/registry/
Source: credits.html.23.dr	String found in binary or memory: https://www.npmjs.com

Source: unknown

DNS traffic detected: queries for: veryfast.io

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 34.195.48.210:443 -> 192.168.2.3:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.197.24:443 -> 192.168.2.3:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.98.23:443 -> 192.168.2.3:49320 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.195.48.210:443 -> 192.168.2.3:54146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.195.48.210:443 -> 192.168.2.3:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.195.48.210:443 -> 192.168.2.3:50538 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\Setup 2.exe

Code function: 1_2_00404FCB GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

1_2_00404FCB

System Summary

Uses 32bit PE files

Source: Setup 2.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\Setup 2.exe	Code function: 1_2_0040310D EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,	1_2_0040310D
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Code function: 11_2_0040310D EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,	11_2_0040310D
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Code function: 23_2_0040310D EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,	23_2_0040310D

Creates files inside the system directory

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\Setup 2.exe	Code function: 1_2_00406B01	1_2_00406B01
Source: C:\Users\user\Desktop\Setup 2.exe	Code function: 1_2_0040632A	1_2_0040632A
Source: C:\Users\user\Desktop\Setup 2.exe	Code function: 1_2_004047DC	1_2_004047DC
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Code function: 11_2_00406B01	11_2_00406B01
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Code function: 11_2_0040632A	11_2_0040632A
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Code function: 11_2_004047DC	11_2_004047DC
Source: C:\Users\user\AppData\Local\Temp\diskspd.exe	Code function: 14_2_00B51F60	14_2_00B51F60
Source: C:\Users\user\AppData\Local\Temp\diskspd.exe	Code function: 14_2_00B4D640	14_2_00B4D640
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Code function: 23_2_00406B01	23_2_00406B01
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Code function: 23_2_0040632A	23_2_0040632A
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Code function: 23_2_004047DC	23_2_004047DC

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\diskspd.exe	Code function: String function: 00B4C52F appears 37 times
Source: C:\Users\user\AppData\Local\Temp\diskspd.exe	Code function: String function: 00B49AB6 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\diskspd.exe	Code function: String function: 00B5834C appears 49 times

Contains functionality to call native functions

Source: C:\Users\user\AppData\Local\Temp\diskspd.exe

Code function: 14_2_00B51446 NtQuerySystemInformation,NtQuerySystemInformation,

14_2_00B51446

Contains functionality to communicate with device drivers

Source: C:\Users\user\AppData\Local\Temp\diskspd.exe

Code function: 14_2_00B51085: CreateEventA,GetLastError,DeviceIoControl,GetLastError,WaitForSingleObject,GetLastError,CloseHandle,

14_2_00B51085

PE file contains strange resources

Source: Setup 2.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SetupEngine[1].exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SetupEngine.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SetupResources[1].exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SetupResources.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fast!.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Tries to load missing DLLs

Source: C:\Windows\System32\svchost.exe

Section loaded: cdpsgshims.dll

Jump to behavior

Source: Setup 2.exe

ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\Setup 2.exe

File read: C:\Users\user\Desktop\Setup 2.exe

Jump to behavior

Source: Setup 2.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Setup 2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup 2.exe "C:\Users\user\Desktop\Setup 2.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
Source: C:\Users\user\Desktop\Setup 2.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation --single-argument https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,14935635805379620180,7098128812871956072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:8
Source: C:\Users\user\Desktop\Setup 2.exe	Process created: C:\Users\user\AppData\Local\Temp\SetupEngine.exe "C:\Users\user\AppData\Local\Temp\SetupEngine.exe"
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\AppData\Local\Temp\diskspd.exe -c100M -b4K -t1 -r -o32 -d10 -ag -h -Rxml C:\Users\user\AppData\Local\Temp\testfile.temp" > C:\Users\user\AppData\Local\Temp\dskres.xml
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\diskspd.exe C:\Users\user\AppData\Local\Temp\diskspd.exe -c100M -b4K -t1 -r -o32 -d10 -ag -h -Rxml C:\Users\user\AppData\Local\Temp\testfile.temp
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Process created: C:\Users\user\AppData\Local\Temp\SetupResources.exe C:\Users\user\AppData\Local\Temp\SetupResources.exe
Source: C:\Users\user\Desktop\Setup 2.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation --single-argument https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process created: C:\Users\user\AppData\Local\Temp\SetupEngine.exe "C:\Users\user\AppData\Local\Temp\SetupEngine.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,14935635805379620180,7098128812871956072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\AppData\Local\Temp\diskspd.exe -c100M -b4K -t1 -r -o32 -d10 -ag -h -Rxml C:\Users\user\AppData\Local\Temp\testfile.temp" > C:\Users\user\AppData\Local\Temp\dskres.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Process created: C:\Users\user\AppData\Local\Temp\SetupResources.exe C:\Users\user\AppData\Local\Temp\SetupResources.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\diskspd.exe C:\Users\user\AppData\Local\Temp\diskspd.exe -c100M -b4K -t1 -r -o32 -d10 -ag -h -Rxml C:\Users\user\AppData\Local\Temp\testfile.temp	Jump to behavior

Source: C:\Users\user\Desktop\Setup 2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\diskspd.exe

Code function: 14_2_00B51175 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueA,GetLastError,AdjustTokenPrivileges,GetLastError,GetLastError,FindCloseChangeNotification,

14_2_00B51175

Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Setup 2.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QFX1KV1T\pixel[1].gif

Jump to behavior

Source: C:\Users\user\Desktop\Setup 2.exe

File created: C:\Users\user\AppData\Local\Temp\nsyD27A.tmp

Jump to behavior

Source: classification engine

Classification label: mal57.evad.winEXE@42/190@11/9

Source: C:\Users\user\Desktop\Setup 2.exe

Code function: 1_2_00402036 CoCreateInstance,MultiByteToWideChar,

1_2_00402036

Source: C:\Users\user\Desktop\Setup 2.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Setup 2.exe

Code function: 1_2_0040429B GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

1_2_0040429B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4772:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4772:120:WilError_02

Source: C:\Users\user\Desktop\Setup 2.exe

File created: C:\Program Files (x86)\Fast!

Jump to behavior

Source: diskspd.exe	String found in binary or memory: <LoadImage>%I64u</LoadImage>
Source: diskspd.exe	String found in binary or memory: Error creating/opening wait-for-start event: '%s'
Source: diskspd.exe	String found in binary or memory: Error creating/opening force-stop event: '%s'

Source: C:\Users\user\Desktop\Setup 2.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE / OLE file has a valid certificate

Source: Setup 2.exe

Static PE information: certificate valid

Binary contains paths to debug symbols

Source:	Binary string: z:\rs1.obj.x86fre\sdktools\srvperf\diskspd.oss\cmdrequestcreator\objfre\i386\diskspd.pdb source: diskspd.exe, diskspd.exe, 0000000E.00000000.2147109058.0000000000B41000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\veryfast\veryfast.io\FastSRV\Release\FastSRV.pdb source: FastSRV.exe.11.dr
Source:	Binary string: z:\rs1.obj.x86fre\sdktools\srvperf\diskspd.oss\cmdrequestcreator\objfre\i386\diskspd.pdbGCTL source: diskspd.exe, 0000000E.00000000.2147109058.0000000000B41000.00000020.00000001.01000000.00000011.sdmp

Data Obfuscation

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Setup 2.exe	Code function: 1_2_02AB29F0 push eax; ret	1_2_02AB2A1E
Source: C:\Users\user\AppData\Local\Temp\diskspd.exe	Code function: 14_2_00B5D0E7 push ecx; ret	14_2_00B5D0FA
Source: C:\Users\user\AppData\Local\Temp\diskspd.exe	Code function: 14_2_00B5D7A9 push ecx; ret	14_2_00B5D7BC

PE file contains sections with non-standard names

Source: ffmpeg.dll.23.dr

Static PE information: section name: .rodata

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\Setup 2.exe

Code function: 1_2_02AB1D3B GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,lstrcatA,GetProcAddress,

1_2_02AB1D3B

Binary contains a suspicious time stamp

Source: d3dcompiler_47.dll.23.dr

Static PE information: 0x9255B290 [Sat Oct 19 09:23:28 2047 UTC]

Source: initial sample

Static PE information: section name: .text entropy: 6.84740099116

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\diskspd.exe

Code function: __EH_prolog3_GS,srand,GetCurrentThread,SetThreadGroupAffinity,atoi,sprintf_s,isalpha,sprintf_s,CreateFileA,SetFileInformationByHandle,GetFileSize,GetLastError,__aulldiv,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetFilePointerEx,GetLastError,GetLastError,GetLastError,GetLastError,WaitForSingleObject,GetLastError,Sleep,ReadFile,WriteFile,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetFilePointerEx,GetLastError,CreateIoCompletionPort,GetLastError,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,WaitForSingleObject,VirtualFree,FindCloseChangeNotification,CloseHandle,??3@YAXPAX@Z, \\.\PhysicalDrive%u

14_2_00B51F60

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	File created: C:\Program Files (x86)\Fast!\fast!.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	File created: C:\Users\user\AppData\Local\Temp\diskspd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Setup 2.exe	File created: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\WmiInspector.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	File created: C:\Program Files (x86)\Fast!\FastSRV.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	File created: C:\Program Files (x86)\Fast!\nwjs\node.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup 2.exe	File created: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	File created: C:\Program Files (x86)\Fast!\nwjs\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup 2.exe	File created: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup 2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CE8D676K\SetupResources[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	File created: C:\Users\user\AppData\Local\Temp\nsr5A0A.tmp\WmiInspector.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	File created: C:\Program Files (x86)\Fast!\nwjs\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	File created: C:\Program Files (x86)\Fast!\nwjs\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	File created: C:\Program Files (x86)\Fast!\nwjs\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	File created: C:\Users\user\AppData\Local\Temp\nsr5A0A.tmp\SimpleSC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	File created: C:\Users\user\AppData\Local\Temp\nsr5A0A.tmp\KillProc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup 2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BJM855OV\SetupEngine[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	File created: C:\Users\user\AppData\Local\Temp\nsr5A0A.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup 2.exe	File created: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Setup 2.exe	File created: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	File created: C:\Users\user\AppData\Local\Temp\nsr5A0A.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup 2.exe	File created: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\nsDialogs.dll	Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\diskspd.exe

14_2_00B51F60

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\svchost.exe TID: 7348	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7628	Thread sleep time: -30000s >= -30000s

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Fast!\fast!.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Fast!\FastSRV.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Fast!\nwjs\node.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Fast!\nwjs\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Fast!\nwjs\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Fast!\nwjs\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Fast!\nwjs\libGLESv2.dll	Jump to dropped file

Contains capabilities to detect virtual machines

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Found large amount of non-executed APIs

Source: C:\Users\user\AppData\Local\Temp\diskspd.exe

API coverage: 9.8 %

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Setup 2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup 2.exe	Code function: 1_2_004054C6 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_004054C6
Source: C:\Users\user\Desktop\Setup 2.exe	Code function: 1_2_00405E9C FindFirstFileA,FindClose,	1_2_00405E9C
Source: C:\Users\user\Desktop\Setup 2.exe	Code function: 1_2_00402654 FindFirstFileA,	1_2_00402654
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Code function: 11_2_004054C6 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	11_2_004054C6
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Code function: 11_2_00405E9C FindFirstFileA,FindClose,	11_2_00405E9C
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Code function: 11_2_00402654 FindFirstFileA,	11_2_00402654
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Code function: 23_2_00402654 FindFirstFileA,	23_2_00402654
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Code function: 23_2_004054C6 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	23_2_004054C6
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	Code function: 23_2_00405E9C FindFirstFileA,FindClose,	23_2_00405E9C

Source: C:\Users\user\Desktop\Setup 2.exe	API call chain: ExitProcess graph end node	graph_1-4662
Source: C:\Users\user\Desktop\Setup 2.exe	API call chain: ExitProcess graph end node	graph_1-4664
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	API call chain: ExitProcess graph end node	graph_11-3064
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	API call chain: ExitProcess graph end node	graph_11-3065
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	API call chain: ExitProcess graph end node	graph_23-2934
Source: C:\Users\user\AppData\Local\Temp\SetupResources.exe	API call chain: ExitProcess graph end node	graph_23-2935

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation

Source: SetupEngine.exe, 0000000B.00000002.2970923182.0000000000620000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000003.2628240089.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-USnf
Source: svchost.exe, 00000011.00000002.2971038267.000001BDD3A55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: SetupEngine.exe, 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: -FB9922C35D94&ch=&version=2.166.2&dsk_iosec=5150&dsk_mbsec=20&os_name=Microsoft Windows 10 Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware, Inc.&pc_version=None&gpu_name=YLRZUD3D SVGA 3D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9 SCSI Disk Device&disk_size=412300001200&sec_as=&sec_av=Windows Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=
Source: SetupEngine.exe, 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: 016iosec=5150&dsk_mbsec=20&os_name=Microsoft Windows 10 Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware, Inc.&pc_version=None&gpu_name=YLRZUD3D SVGA 3D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9 SCSI Disk Device&disk_size=412300001200&sec_as=&sec_av=Windows Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=ixel_url=0\Users\user\AppData\Local\Temp\SetupEngine.exe"
Source: SetupEngine.exe, 0000000B.00000003.2628047560.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: osoft%20Windows%2010%20Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=
Source: svchost.exe, 00000011.00000002.2971038267.000001BDD3A55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000011.00000002.2971404822.000001BDD3A92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}indows
Source: SetupEngine.exe, 0000000B.00000003.2627832783.000000000462F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: _mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=
Source: SetupEngine.exe, 0000000B.00000003.2627974293.000000000463C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: veryfast.io/register.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&ch=&version=2.166.2&dsk_iosec=5150&dsk_mbsec=20&os_name=Microsoft%20Windows%2010%20Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=o1*0(
Source: credits.html.23.dr	Binary or memory string: * Neither the name of the VMware, Inc. nor the names of its contributors
Source: Setup 2.exe, 00000001.00000002.2970247822.00000000006AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2976962466.000001E5D7254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2976962466.000001E5D7254000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000002.2971422795.0000000000676000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000003.2628814870.0000000000676000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2974398342.0000026622366000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW&
Source: svchost.exe, 00000002.00000002.2969010414.000001E5D5E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\L
Source: SetupEngine.exe, 0000000B.00000003.2628009243.0000000004626000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: https://veryfast.io/register.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&ch=&version=2.166.2&dsk_iosec=5150&dsk_mbsec=20&os_name=Microsoft%20Windows%2010%20Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=
Source: SetupEngine.exe, 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: &os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware, Inc.&pc_version=None&gpu_name=YLRZUD3D SVGA 3D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9 SCSI Disk Device&disk_size=412300001200&sec_as=&sec_av=Windows Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=
Source: SetupEngine.exe, 0000000B.00000003.2628009243.0000000004626000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: https://veryfast.io/register.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&ch=&version=2.166.2&dsk_iosec=5150&dsk_mbsec=20&os_name=Microsoft%20Windows%2010%20Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=_i
Source: SetupEngine.exe, 0000000B.00000002.2970240191.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lproc=1&pc_vendor=VMware,%20Inc.
Source: SetupEngine.exe, 0000000B.00000003.2628009243.0000000004626000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: s://veryfast.io/register.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&ch=&version=2.166.2&dsk_iosec=5150&dsk_mbsec=20&os_name=Microsoft%20Windows%2010%20Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=
Source: SetupEngine.exe, 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: C:\Users\user\AppData\Local\Temp\SetupResources.exesdll&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware, Inc.&pc_version=None&gpu_name=YLRZUD3D SVGA 3D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9 SCSI Disk Device&disk_size=412300001200&sec_as=&sec_av=Windows Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=C:\Users\user\AppData\Local\Temp\SetupResources.exec.dlldll55410880user\AppData\Local\Temp\nsr5A0A.tmp.exe" 55410880.4.min.jsata\Local\Temp\nsr5A0A.tmp\KillProc.dlldllPlease wait while Fast! is being installed.
Source: credits.html.23.dr	Binary or memory string: Copyright (c) 2011, VMware, Inc.
Source: SetupEngine.exe, 0000000B.00000002.2970240191.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1&pc_vendor=VMware,%20Inc.&pc_ve
Source: svchost.exe, 00000015.00000002.2971168434.0000026621A82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: SetupEngine.exe, 0000000B.00000003.2627832783.000000000462F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: _mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=:3
Source: svchost.exe, 00000011.00000002.2971488432.000001BDD3B02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000005.00000002.2970060991.0000015D9B63C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2969576047.00000236FFE70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SetupEngine.exe, 0000000B.00000003.2628009243.0000000004626000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hostveryfast.ioGET /register.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&ch=&version=2.166.2&dsk_iosec=5150&dsk_mbsec=20&os_name=Microsoft%20Windows%2010%20Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser= HTTP/1.17cb
Source: SetupEngine.exe, 0000000B.00000003.2628047560.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =20&os_name=Microsoft%20Windows%2010%20Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=
Source: SetupEngine.exe, 0000000B.00000002.2970923182.0000000000620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: st.io/register.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&ch=&version=2.166.2&dsk_iosec=5150&dsk_mbsec=20&os_name=Microsoft%20Windows%2010%20Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=
Source: SetupEngine.exe, 0000000B.00000003.2628009243.0000000004626000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&ch=&version=2.166.2&dsk_iosec=5150&dsk_mbsec=20&os_name=Microsoft%20Windows%2010%20Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=Wi
Source: svchost.exe, 00000011.00000002.2970588204.000001BDD3A2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000015.00000002.2970352145.0000026621A48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @Hyper-V RAWen-USn
Source: SetupEngine.exe, 0000000B.00000003.2628047560.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: is=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=
Source: svchost.exe, 00000011.00000002.2971038267.000001BDD3A55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000es
Source: Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW Scheduler-0000
Source: svchost.exe, 00000011.00000002.2971379459.000001BDD3A88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: SetupEngine.exe, 0000000B.00000003.2628047560.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: https://veryfast.io/pixel.gif?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&version=2.166.2&evt_src=installer&evt_action=systeminfo&dsk_iosec=5150&dsk_mbsec=20&os_name=Microsoft%20Windows%2010%20Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=
Source: credits.html.23.dr	Binary or memory string: ARE DISCLAIMED. IN NO EVENT SHALL VMWARE, INC. OR CONTRIBUTORS BE LIABLE FOR
Source: SetupEngine.exe, 0000000B.00000003.2628009243.0000000004626000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&version=2.166.2&evt_src=installer&evt_action=systeminfo&dsk_iosec=5150&dsk_mbsec=20&os_name=Microsoft%20Windows%2010%20Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=Ni
Source: SetupEngine.exe, 0000000B.00000002.2970240191.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: me=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser= HTTP/1.1
Source: SetupEngine.exe, 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: iosec=5150&dsk_mbsec=20&os_name=Microsoft Windows 10 Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware, Inc.&pc_version=None&gpu_name=YLRZUD3D SVGA 3D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9 SCSI Disk Device&disk_size=412300001200&sec_as=&sec_av=Windows Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=
Source: SetupEngine.exe, 0000000B.00000003.2627974293.000000000463C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: veryfast.io/register.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&ch=&version=2.166.2&dsk_iosec=5150&dsk_mbsec=20&os_name=Microsoft%20Windows%2010%20Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=
Source: SetupEngine.exe, 0000000B.00000003.2628009243.0000000004626000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: https://veryfast.io/pixel.gif?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&version=2.166.2&evt_src=installer&evt_action=systeminfo&dsk_iosec=5150&dsk_mbsec=20&os_name=Microsoft%20Windows%2010%20Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware,%20Inc.&pc_version=None&gpu_name=YLRZUD3D%20SVGA%203D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9%20SCSI%20Disk%20Device&disk_size=412300001200&sec_as=&sec_av=Windows%20Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=Vi
Source: SetupEngine.exe, 0000000B.00000002.2970717496.0000000000607000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000003.2628163228.0000000000607000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@vf%SystemRoot%\system32\mswsock.dlloi
Source: svchost.exe, 00000011.00000002.2969757917.000001BDD3A00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionStorSvcNetmanTabletInputServicevmicvssPcaSvcNgcSvcIPxlatCfgSvcEmbeddedModewlansvcsvsvcsysmainWwanSvcDeviceAssociationServiceDisplayEnhancementServiceNcbServiceSensorServiceDevQueryBrokerCscServiceWPDBusEnum
Source: SetupEngine.exe, 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: Execute: lfredo\AppData\Local\Temp\SetupResources.exec.dll-FB9922C35D94&ch=&version=2.166.2&dsk_iosec=5150&dsk_mbsec=20&os_name=Microsoft Windows 10 Pro&os_installdate=20210527061606.000000-480&os_processes=122&os_architecture=64-bit&os_virtmem=5635096&os_mem=4193304&cpu_name=Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz&cpu_maxclock=2195&cpu_cores=4&cpu_logicalproc=1&pc_vendor=VMware, Inc.&pc_version=None&gpu_name=YLRZUD3D SVGA 3D&gpu_ram=1073741824&gpu_bitsperpixel=32&gpu_x=1280&gpu_y=1024&disk_name=3GU5G8G9 SCSI Disk Device&disk_size=412300001200&sec_as=&sec_av=Windows Defender&sec_fw=&bios_releasedate=20210625000000.000000+000&install_browser=0000.000000+000&install_browser=

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\Temp\diskspd.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_14-5636

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\Setup 2.exe

1_2_02AB1D3B

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\Setup 2.exe

Code function: 1_2_10001855 CreateControl,GetProcessHeap,GetProcessHeap,HeapAlloc,GetProcessHeap,GetProcessHeap,HeapReAlloc,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,lstrcmpiA,CreateWindowExA,SetPropA,SendMessageA,SendMessageA,SendMessageA,SetWindowLongA,GetProcessHeap,HeapFree,

1_2_10001855

Source: C:\Users\user\AppData\Local\Temp\diskspd.exe

Code function: 14_2_00B5D5FA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

14_2_00B5D5FA

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\Setup 2.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation --single-argument https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94	Jump to behavior
Source: C:\Users\user\Desktop\Setup 2.exe	Process created: C:\Users\user\AppData\Local\Temp\SetupEngine.exe "C:\Users\user\AppData\Local\Temp\SetupEngine.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\AppData\Local\Temp\diskspd.exe -c100M -b4K -t1 -r -o32 -d10 -ag -h -Rxml C:\Users\user\AppData\Local\Temp\testfile.temp" > C:\Users\user\AppData\Local\Temp\dskres.xml	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\diskspd.exe C:\Users\user\AppData\Local\Temp\diskspd.exe -c100M -b4K -t1 -r -o32 -d10 -ag -h -Rxml C:\Users\user\AppData\Local\Temp\testfile.temp	Jump to behavior

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\SoftwareDistribution\DataStore\DataStore.edb VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\SoftwareDistribution\DataStore\DataStore.edb VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\SoftwareDistribution\DataStore\DataStore.edb VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\diskspd.exe

Code function: 14_2_00B5D498 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

14_2_00B5D498

Source: C:\Users\user\Desktop\Setup 2.exe

Code function: 1_2_0040310D EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

1_2_0040310D

Lowering of HIPS / PFW / Operating System Security Settings

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\SetupEngine.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

AV process strings found (often used to terminate AV products)

Source: SetupEngine.exe, 0000000B.00000002.2969397595.00000000005AD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	331 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	12 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Native API	1 Bootkit	1 Access Token Manipulation	31 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	11 Software Packing	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Timestomp	NTDS	471 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	35 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	12 Masquerading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	35 Virtualization/Sandbox Evasion	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	11 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Bootkit	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Setup 2.exe	9%	Metadefender		Browse
Setup 2.exe	23%	ReversingLabs	Win32.Adware.FstApp

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\Fast!\FastSRV.exe	0%	Metadefender		Browse
C:\Program Files (x86)\Fast!\FastSRV.exe	12%	ReversingLabs	Win32.Adware.FstApp
C:\Program Files (x86)\Fast!\fast!.exe	0%	Metadefender		Browse
C:\Program Files (x86)\Fast!\fast!.exe	12%	ReversingLabs	Win32.Adware.FstApp
C:\Program Files (x86)\Fast!\nwjs\d3dcompiler_47.dll	0%	Metadefender		Browse
C:\Program Files (x86)\Fast!\nwjs\d3dcompiler_47.dll	0%	ReversingLabs
C:\Program Files (x86)\Fast!\nwjs\ffmpeg.dll	0%	Metadefender		Browse
C:\Program Files (x86)\Fast!\nwjs\ffmpeg.dll	3%	ReversingLabs
C:\Program Files (x86)\Fast!\nwjs\libEGL.dll	0%	Metadefender		Browse
C:\Program Files (x86)\Fast!\nwjs\libEGL.dll	0%	ReversingLabs
C:\Program Files (x86)\Fast!\nwjs\libGLESv2.dll	0%	Metadefender		Browse
C:\Program Files (x86)\Fast!\nwjs\libGLESv2.dll	0%	ReversingLabs
C:\Program Files (x86)\Fast!\nwjs\node.dll	0%	Metadefender		Browse
C:\Program Files (x86)\Fast!\nwjs\node.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BJM855OV\SetupEngine[1].exe	5%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BJM855OV\SetupEngine[1].exe	19%	ReversingLabs	Win32.Adware.FstApp

Unpacked PE Files

Source	Detection	Scanner	Label	Download
11.0.SetupEngine.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491	Download File
23.2.SetupResources.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491	Download File
23.0.SetupResources.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491	Download File
1.0.Setup 2.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491	Download File
11.2.SetupEngine.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491	Download File
1.2.Setup 2.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.mesa3d.org/	0%	Avira URL Cloud	safe
http://www.seanpatrickobrien.com/journal/posts/3	0%	Avira URL Cloud	safe
http://www.adel.nursat.kz/apg/	0%	Avira URL Cloud	safe
http://tukaani.org/xz/	0%	Avira URL Cloud	safe
http://caminobrowser.org/	0%	Avira URL Cloud	safe
http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/MT2002/emt19937ar.html	0%	Avira URL Cloud	safe
http://modp.com/release/base64	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://www.ploscompbiol.org/static/license	0%	Avira URL Cloud	safe
http://lao-dictionary.googlecode.com/git/Lao-Dictionary-LICENSE.txt	0%	Avira URL Cloud	safe
http://harfbuzz.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
gstaticadssl.l.google.com	142.250.186.99	true	false	high
scontent.xx.fbcdn.net	31.13.92.14	true	false	high
s3.amazonaws.com	52.217.197.24	true	false	high
accounts.google.com	142.250.181.237	true	false	high
veryfast.io	34.195.48.210	true	false	high
clients.l.google.com	142.250.184.206	true	false	high
d1uyoz7mfvzv4e.cloudfront.net	143.204.98.23	true	false	high
clients2.google.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ctrio.sourceforge.net/	credits.html.23.dr	false		high
http://libevent.org/	credits.html.23.dr	false		high
https://chromium.googlesource.com/chromium/src.git/	credits.html.23.dr	false		high
https://github.com/liblouis/liblouis	credits.html.23.dr	false		high
https://github.com/simplejson/simplejson	credits.html.23.dr	false		high
https://github.com/chromium/dom-distiller	credits.html.23.dr	false		high
http://crl.godaddy.com/gdig2s5-4.crl0	Setup 2.exe, 00000001.00000003.1811691500.000000000431B000.00000004.00000800.00020000.00000000.sdmp, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	false		high
https://github.com/square/haha	credits.html.23.dr	false		high
http://webkit.org/	credits.html.23.dr	false		high
http://www.freedesktop.org/wiki/Software/xdg-user-dirs	credits.html.23.dr	false		high
https://veryfast.io/pixel.gif?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&evt_src=installer&evt_action	Setup 2.exe, 00000001.00000002.2970995818.000000000071E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://code.google.com/p/angleproject/	credits.html.23.dr	false		high
https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94Z	Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	false		high
https://veryfast.io/pay.html?guid=	ui.bin.11.dr	false		high
http://ocsp.starfieldtech.com/0;	Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	false		high
https://veryfast.io/installed.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94z	SetupEngine.exe, 0000000B.00000002.2973644826.0000000004620000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.npmjs.com	credits.html.23.dr	false		high
https://silver.arm.com/download/Software/Graphics/OX000-BU-00010-r1p0-00bet0/OX000-BU-00010-r1p0-00b	credits.html.23.dr	false		high
http://ocsp.starfieldtech.com/0D	Setup 2.exe, 00000001.00000003.1931681159.0000000004329000.00000004.00000800.00020000.00000000.sdmp	false		high
http://code.google.com/p/google-jstemplate/	credits.html.23.dr	false		high
https://datatracker.ietf.org/ipr/1526/	credits.html.23.dr	false		high
http://ocsp.starfieldtech.com/0H	Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	false		high
http://www.chromium.org/blink	credits.html.23.dr	false		high
http://www.mesa3d.org/	credits.html.23.dr	false	Avira URL Cloud: safe	unknown
http://www.opensource.org/licenses/mit-license.php	credits.html.23.dr	false		high
http://www.seanpatrickobrien.com/journal/posts/3	credits.html.23.dr	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProduction?OneDriveUpdate=f48c47f7803b912ab9b4c1a01f72	svchost.exe, 00000002.00000003.1683216726.000001E5DB47B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.adel.nursat.kz/apg/	credits.html.23.dr	false	Avira URL Cloud: safe	unknown
http://www.linux-usb.org/usb-ids.html	credits.html.23.dr	false		high
https://chromium.googlesource.com/android_tools.git/	credits.html.23.dr	false		high
http://tukaani.org/xz/	credits.html.23.dr	false	Avira URL Cloud: safe	unknown
https://veryfast.io/cpg.php?guid=	Setup 2.exe, 00000001.00000002.2970247822.00000000006AD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://caminobrowser.org/	credits.html.23.dr	false	Avira URL Cloud: safe	unknown
http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/MT2002/emt19937ar.html	credits.html.23.dr	false	Avira URL Cloud: safe	unknown
https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94=	Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/ValveSoftware/openvr	credits.html.23.dr	false		high
http://modp.com/release/base64	credits.html.23.dr	false	Avira URL Cloud: safe	unknown
https://veryfast.io/download.php?engine=1&guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94Y	Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	false		high
https://d1uyoz7mfvzv4e.cloudfront.net/	Setup 2.exe, 00000001.00000002.2973592569.00000000042F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://boringssl.googlesource.com/boringssl	credits.html.23.dr	false		high
http://ltp.sourceforge.net/coverage/lcov.php	credits.html.23.dr	false		high
http://bgoffice.sourceforge.net/	credits.html.23.dr	false		high
https://github.com/jrmuizel/qcms/tree/v4	credits.html.23.dr	false		high
https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94f;	Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/googlei18n/libphonenumber/	credits.html.23.dr	false		high
http://www.unicode.org/cldr/data/	credits.html.23.dr	false		high
https://chromium.googlesource.com/chromium/src/	credits.html.23.dr	false		high
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_background.js.8.dr	false		high
https://crashpad.chromium.org/	credits.html.23.dr	false		high
https://veryfast.io/pixel.gif?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&version=2.166.2&evt_src=inst	SetupEngine.exe, 0000000B.00000003.2628009243.0000000004626000.00000004.00000800.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000002.2969267169.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000003.2628047560.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://certs.godaddy.com/repository/1301	Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	false		high
https://chromium.googlesource.com/external/webrtc	credits.html.23.dr	false		high
http://crl.ver)	svchost.exe, 00000002.00000002.2981300131.000001E5D7286000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.2974592830.000002662236D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://developers.google.com/speed/webp	credits.html.23.dr	false		high
https://certs.godaddy.com/repository/0	Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	false		high
https://veryfast.io:443	e98a4c5a-f168-45c2-a609-aa35e4f0d9f0.tmp.8.dr	false		high
http://www.webrtc.org	credits.html.23.dr	false		high
http://libpng.org/	credits.html.23.dr	false		high
http://www.unicode.org/cldr/data/.	credits.html.23.dr	false		high
https://sqlite.org/	credits.html.23.dr	false		high
http://crl.godaddy.com/gdroot-g2.crl0F	Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	false		high
https://source.android.com/devices/graphics/testing.html	credits.html.23.dr	false		high
http://site.icu-project.org/	credits.html.23.dr	false		high
http://nsis.sf.net/NSIS_Error	SetupResources.exe, SetupResources.exe, 00000017.00000000.2857348548.0000000000409000.00000008.00000001.01000000.00000014.sdmp, SetupResources.exe, 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmp, Setup 2.exe, SetupEngine[1].exe.1.dr, SetupResources.exe.1.dr	false		high
https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94AZ_	Setup 2.exe, 00000001.00000002.2971113482.0000000000733000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod-C:	svchost.exe, 00000002.00000003.1683538484.000001E5DB492000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1683097884.000001E5DB473000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1682376177.000001E5DB437000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1681752757.000001E5DB408000.00000004.00000800.00020000.00000000.sdmp	false		high
http://code.google.com/p/google-axs-chrome/	credits.html.23.dr	false		high
https://github.com/jquery/sizzle/blob/master/LICENSE	credits.html.23.dr	false		high
http://www.ploscompbiol.org/static/license	credits.html.23.dr	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/ipr/1524/	credits.html.23.dr	false		high
http://sourceware.org/newlib/docs.html	credits.html.23.dr	false		high
https://veryfast.io/register.php?guid=	SetupEngine.exe, 0000000B.00000002.2969397595.00000000005AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://veryfast.io/installed.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D942o	SetupEngine.exe, 0000000B.00000002.2973644826.0000000004620000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cgit.freedesktop.org/~aplattner/nvidia-settings/	credits.html.23.dr	false		high
https://veryfast.io/register.php?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94&ch=&version=2.166.2&dsk_i	SetupEngine.exe, 0000000B.00000003.2628009243.0000000004626000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/)	credits.html.23.dr	false		high
http://source.android.com	credits.html.23.dr	false		high
https://dxr.mozilla.org/mozilla-central/source/security/manager/	credits.html.23.dr	false		high
https://source.android.com/	credits.html.23.dr	false		high
https://veryfast.io/productvalidate.html?guid=?	ui.bin.11.dr	false		high
https://github.com/open-source-parsers/jsoncpp	credits.html.23.dr	false		high
http://lao-dictionary.googlecode.com/git/Lao-Dictionary-LICENSE.txt	credits.html.23.dr	false	Avira URL Cloud: safe	unknown
http://code.google.com/p/y2038	credits.html.23.dr	false		high
http://harfbuzz.org	credits.html.23.dr	false	Avira URL Cloud: safe	unknown
http://nodejs.org/	credits.html.23.dr	false		high
https://certs.starfieldtech.com/repository/0	Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	false		high
https://veryfast.io/download.php?engine=1&guid=	Setup 2.exe, 00000001.00000002.2970247822.00000000006AD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://certificates.godaddy.com/repository/0	Setup 2.exe, SetupEngine[1].exe.1.dr, FastSRV.exe.11.dr	false		high
https://veryfast.io/	Setup 2.exe, 00000001.00000002.2970995818.000000000071E000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000002.2970923182.0000000000620000.00000004.00000020.00020000.00000000.sdmp, SetupEngine.exe, 0000000B.00000003.2628240089.0000000000620000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.unicode.org/copyright.html	credits.html.23.dr	false		high
http://libcxxabi.llvm.org/	credits.html.23.dr	false		high
https://iojs.org	credits.html.23.dr	false		high
https://registry.npmjs.org	credits.html.23.dr	false		high
http://www.freetype.org/	credits.html.23.dr	false		high
http://llvm.org	credits.html.23.dr	false		high
https://github.com/LunarG/VulkanTools/tree/master/include/vulkan	credits.html.23.dr	false		high
http://zlib.net/	credits.html.23.dr	false		high
https://chromium.googlesource.com/external/github.com/GoogleChrome/custom-tabs-client	credits.html.23.dr	false		high
http://mozilla.org/MPL/2.0/.	credits.html.23.dr	false		high
https://github.com/material-foundation/material-roboto-font-loader-ios	credits.html.23.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.195.48.210	veryfast.io	United States	14618	AMAZON-AESUS	false
142.250.181.237	accounts.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
143.204.98.23	d1uyoz7mfvzv4e.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.184.206	clients.l.google.com	United States	15169	GOOGLEUS	false
52.217.197.24	s3.amazonaws.com	United States	16509	AMAZON-02US	false
142.250.186.99	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	637848
Start date and time: 01/06/202222:48:58	2022-06-01 22:48:58 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Setup 2.exe
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal57.evad.winEXE@42/190@11/9
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 63.2% (good quality ratio 60.3%) Quality average: 79.3% Quality standard deviation: 27.7%
HCA Information:	Successful, ratio: 90% Number of executed functions: 114 Number of non-executed functions: 128
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, RuntimeBroker.exe, CompPkgSrv.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 52.152.110.14, 104.102.28.73, 172.217.18.3, 34.104.35.123, 142.250.186.74, 172.217.23.99, 216.58.212.163, 52.242.101.226
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fonts.googleapis.com, fs.microsoft.com, slscr.update.microsoft.com, fonts.gstatic.com, e1723.g.akamaiedge.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, edgedl.me.gvt1.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, update.googleapis.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, www.gstatic.com, cdn.onenote.net, prod.fs.microsoft.com.akadns.net, nexusrules.officeapps.live.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
VT rate limit hit for: Setup 2.exe

Simulations

Behavior and APIs

Time	Type	Description
22:49:35	API Interceptor	3x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
34.195.48.210	SetupFA.exe	Get hash	malicious	Browse
	appstore.exe	Get hash	malicious	Browse
	appstore.exe	Get hash	malicious	Browse
	fa_rss.exe	Get hash	malicious	Browse
	SetupFA.exe	Get hash	malicious	Browse
	Fast! Installer.exe	Get hash	malicious	Browse
	{C57CA5B7-A655-48F9-AF02-CA9C6BB0E91B}.exe	Get hash	malicious	Browse
	fa_rss.exe	Get hash	malicious	Browse
	v77C369u1p.exe	Get hash	malicious	Browse
	Setup.exe	Get hash	malicious	Browse
239.255.255.250	https://viways.co.ke/RSVP_365/	Get hash	malicious	Browse
	NYSI233385 (1).html	Get hash	malicious	Browse
	Invoice #26908 CN20220240 5-04-2022.html	Get hash	malicious	Browse
	Remittance June 1, 2022, 08_15_10 AM JTvQSYKSfRvGXRxUBtaVBDHMhIBGSmXMtwyDQPTyhxtjoCdhps.HTM	Get hash	malicious	Browse
	http://telenco.com	Get hash	malicious	Browse
	https://flujolaminar.com/daleyins/aska	Get hash	malicious	Browse
	https://pluviophile.net/982922.html	Get hash	malicious	Browse
	https://villaincity.com/new2/DOS83/DOS83/new_87392/data/	Get hash	malicious	Browse
	ATT_Messages_Carlos.depuig_.html	Get hash	malicious	Browse
	https://u26408528.ct.sendgrid.net/ls/click?upn=18Dov5FlRodwHWOUtjLA-2FOV-2BFPZseswPMwoi2y80z2JBiEbY3upuSrIjZlS4SC-2B6IaW1qfc4oSo9OSkh8LToaMZEMQ99yQANL-2Bh7W4krk2UNje0LveXM-2B-2F7c-2BUFtv6xjbhg7IE2z8IJGiM9fX6GFwhgroKhjqVtjlBzGR6YmPTwA4ChzWKbxwrkbb17qvkIC-WZw_m65qjtdkG5yijv419cegl4NBCbOO-2F5z-2BvVWmsqeoJ5pEqhozVwGWNn6NA9tpbFSbDTmqjU4zBZ34urnsfMGP0brzhjo0AQ3pJYxlcnueFquvKMO7Se8Qv7EKnC2UL42nnHaQwMGptzA-2BL80RA3LWSGO9krpV4VdvFoyiOzjxZFXial-2BRhRadEJvfKH6xGKdKAxQMSrurEg18rbKwrFGwRR1gu2cJ-2BnaWmcnWumOBtis-3D	Get hash	malicious	Browse
	http://countmake.cool/	Get hash	malicious	Browse
	http://2.news-kipiye.cc/	Get hash	malicious	Browse
	https://u26408528.ct.sendgrid.net/ls/click?upn=18Dov5FlRodwHWOUtjLA-2FOV-2BFPZseswPMwoi2y80z2JBiEbY3upuSrIjZlS4SC-2B6IaW1qfc4oSo9OSkh8LToaMZEMQ99yQANL-2Bh7W4krk2UNje0LveXM-2B-2F7c-2BUFtv6xjd-2BtNiZEK2NXfhZIjuj39B5mNA8hdsK94PxTMLxrBd7xfKMQJZJNQy5uo79sOxyTK6Qxm_n50ohuyFPyzeoOCVFlIJ9jk0aSHfSu0ojB7lZ35Rm7ASTKWXb7opSR-2Bo9AAk5WN44T6TycOOopMV8fgLnhoyvfYpDoszIGnB3OxelXJcO-2FidcUP3dX2RPEHRjdX-2B-2BhIekLhD5E7e-2F4GQ8i-2Bqa78Teb5OL1rKzBdwtBat-2BVLi-2BBkNWJkbPUtbJgz3St69jW9mZmbXeFMmbU3DPuZ-2BrS8ksN-2Bn3AfRVBrMtDXjZZ-2F3xwwxxosXE1Z-2BKcnXP9WBqx74	Get hash	malicious	Browse
	http://3dnamics.com/	Get hash	malicious	Browse
	ssh-audit.exe	Get hash	malicious	Browse
	https://gcp.olympus.io/api/v1/share/file/download-via-public-link?linkId=d3bb9731-f6cd-49f7-b935-f5c866e7c082&responseType=file	Get hash	malicious	Browse
	http://cook-masterclass.com	Get hash	malicious	Browse
	https://firebasestorage.googleapis.com/v0/b/bul3105ge.appspot.com/o/index4bul.html?alt=media&token=2b82b53d-4348-46ce-9644-a2e72769a03d#lochoa@cool-pak.com	Get hash	malicious	Browse
	https://u26408528.ct.sendgrid.net/ls/click?upn=18Dov5FlRodwHWOUtjLA-2FGN5piodPvBx0Y5vNwxP1Yrs5ohRIfRINpZQvi-2FWRAK0yp3KYmxkkuhyWUq0db-2Bg6siCuQNZY1zJOqx3Sjn7u21eNFSYJlhTS6iPAgDbaYFeZFmOvDyFSYSH3brZBBMNzA-3D-3D-xTN_YJ-2BpZeUdBTiuMPBlmHPd9iJxGvBnayxDpVMZIk8Bp7Tyv8iCsDVcYMO0ye8Rt-2Fsd6SOd58MSqbrIWTP5AyteacbS5EayzRKscHymUNdDep5e8qm6W5TqeEjeUmiwO6Wtfcg5Eqz8SyFApyrbujMgSDHlRLgTwmgCOndiT6iH-2F1FzLaQcRGmIsFUYe9bb66CUcMsEUEYjvfAGoTsTnAp-2Fdg-3D-3D	Get hash	malicious	Browse
	https://https.docusign.click/XZEZwU1NVVnBlR2xzYmt0bmEzUnVkMDQzYm1RNGJUZHlkemMzU1c1eUswSnNSek5ZUVcwMWJ6aExSRmwxZEhCWU5rNU9LMGRuWVRFek5rSlJWRVZoUm5WbmEyNU1kWG80Y2xkdmFtSTFZbFZrV2xrM1VXOVVlRmR5UWxkeVoxWllVV0ZOT0M5eWRuaDFTellyVTFOeGJHWTJZMjFYTUd3emJrNVZWell4TXk5d0x6ZFZPVTE0WVd3emVXaHVUMFJrZG5CWlRWaHRjbWd5Vm05SE9VOWhNMnczYVVWb09WUmlNRGh5Y3pCTFJUWjBZVGM1U1hkSVNuTmhUSFkxYTBwNkxTMWphakZETWl0emJFMDRSamRxSzJ0VVYyWndUMWxCUFQwPS0tZmRhOTYyYjljNzQyNDlkZjU0YzY3YWYxYzA3Mzk2ZGU3NjJlNWMwZQ==?cid=112144364__;!!P6jpYKK6mafehyc!ibvPmKEwtlOSywVXjZxMA3GAT7wmysn2WW4AbwERGtVs7Wby_yqvZInE4S5Q7iMmKBKbCHZ6GY7GbMbLGATRfQFa6pTnuS71YJqFHQs$	Get hash	malicious	Browse
143.204.98.23	MiYUB3l97m	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
s3.amazonaws.com	https://https.docusign.click/XZEZwU1NVVnBlR2xzYmt0bmEzUnVkMDQzYm1RNGJUZHlkemMzU1c1eUswSnNSek5ZUVcwMWJ6aExSRmwxZEhCWU5rNU9LMGRuWVRFek5rSlJWRVZoUm5WbmEyNU1kWG80Y2xkdmFtSTFZbFZrV2xrM1VXOVVlRmR5UWxkeVoxWllVV0ZOT0M5eWRuaDFTellyVTFOeGJHWTJZMjFYTUd3emJrNVZWell4TXk5d0x6ZFZPVTE0WVd3emVXaHVUMFJrZG5CWlRWaHRjbWd5Vm05SE9VOWhNMnczYVVWb09WUmlNRGh5Y3pCTFJUWjBZVGM1U1hkSVNuTmhUSFkxYTBwNkxTMWphakZETWl0emJFMDRSamRxSzJ0VVYyWndUMWxCUFQwPS0tZmRhOTYyYjljNzQyNDlkZjU0YzY3YWYxYzA3Mzk2ZGU3NjJlNWMwZQ==?cid=112144364__;!!P6jpYKK6mafehyc!ibvPmKEwtlOSywVXjZxMA3GAT7wmysn2WW4AbwERGtVs7Wby_yqvZInE4S5Q7iMmKBKbCHZ6GY7GbMbLGATRfQFa6pTnuS71YJqFHQs$	Get hash	malicious	Browse	52.216.30.70
	https://indd.adobe.com/view/a97953e1-dcc6-4971-9e52-a6eea3e65fef	Get hash	malicious	Browse	52.216.133.229
	https://app.pandadoc.com/document/acf75b891ce02d0a8fc639e9e6a23af3e9cbc766	Get hash	malicious	Browse	52.217.228.208
	INVOICE_PDF.Html	Get hash	malicious	Browse	54.231.226.208
	https://urlsand.esvalabs.com/?u=https%3A%2F%2Fexpress.adobe.com%2Fpage%2FfeoM5782aYABf%2F&e=d02f10fa&h=34edaf6a&f=y&p=y	Get hash	malicious	Browse	52.216.205.5
scontent.xx.fbcdn.net	https://pluviophile.net/982922.html	Get hash	malicious	Browse	31.13.92.14
	https://indd.adobe.com/view/a97953e1-dcc6-4971-9e52-a6eea3e65fef	Get hash	malicious	Browse	31.13.92.14
	https://irinwellness.com/wp-content/colour/orange/empty/colour/orange/empty/newabdcolour/next.php	Get hash	malicious	Browse	31.13.92.14
	https://bh.contextweb.com/bh/rtset?pid=&ev=1&daaqp=1&rurl=http://bKSBN.bKSBN.artificialgrasssomersetwest.co.za/?id=p_c@manulifeam.com	Get hash	malicious	Browse	31.13.92.14
	https://indd.adobe.com/view/2b66ded6-84c1-474a-b063-58dd44f84edd	Get hash	malicious	Browse	31.13.92.14
	http://info-sf1.sugarcrm.com/jc.aspx?d=CXGMWDUCGAIILYLXTE2YCFRIMBLV4VS6QJYWDVHOJIUUQASWNQUYTRTXO5OH3E74E7ZQCBM442GC2SAANIBL5SDTTLRDSAEPCGEZLEREREYRXYCAEEAI3VWSO52TR25KLJNNPXP3KCMSDFATK2FXLBJ2ST6NP6AUEZFLY7EZRN4WIQWZOW4W2WPTPQFXPEEFDZMH7GSTX5YZSKDOH3KVDTGGKYEBHHOHPVKV5D5W3A27B7IB	Get hash	malicious	Browse	157.240.236.1
	https://click.smartsheet.com/f/a/1XIucl39hzgzUvOOPd2reQ~~/AARF7wA~/RgRkeRsAP0Q_aHR0cHM6Ly9kb2MuY2xpY2t1cC5jb20vMzY3NTQyNTMvZC9oLzEzMW11ZC0yNjIvYTRlYjliNWQ5YTJiZDhhVwNzcGNCCmKGAJaWYq_h5zJSHWV4Y2VwdGlvbmFsbmVlZHNAbWluZGEuYXNuLmF1WAQAAAAA	Get hash	malicious	Browse	31.13.92.14
	http://80.209.229.151	Get hash	malicious	Browse	31.13.92.14
	https://lnkd.in/gVF7Z4VE?=yMtLbgw2tZh0wb	Get hash	malicious	Browse	31.13.92.14
	https://bh.contextweb.com/bh/rtset?pid=&ev=1&daaqp=1&rurl=http://hBTvQ.hBTvQ.artificialgrasssomersetwest.co.za/?id=ryan.kimmel@doubleline.com	Get hash	malicious	Browse	157.240.17.15
	https://click.smartsheet.com/f/a/KLvh_Fs7syvS0q-qXqgNgg~~/AARF7wA~/RgRkd97SP0Q_aHR0cHM6Ly9kb2MuY2xpY2t1cC5jb20vMzY3NTAzNDEvZC9oLzEzMWgwNS0zMDIvMjI3NzQ5OTEyODdjMWE0VwNzcGNCCmKG0lmVYqwwjY5SIWRhbmllbC5zYXdAZXNzZW50aWFsZW5lcmd5LmNvbS5hdVgEAAAAAA~~	Get hash	malicious	Browse	157.240.17.15
	http://alrsusu.dynssl.com/	Get hash	malicious	Browse	157.240.17.15
	https://secureddocument33.mypixieset.com/	Get hash	malicious	Browse	157.240.17.15
	https://www.paymentsjournal.com/analysts-coverage/	Get hash	malicious	Browse	157.240.17.15
	https://servermail.nicepage.io/Home.html	Get hash	malicious	Browse	157.240.17.15
	http://vade4608fb187.qpostie18.com/track/click/SlC9afG1pBGQGsS3nu0U7pxJdsY/1/aHR0cHM6Ly9jbGF0aWQuaW8vd2ViaW5hci9pcnMtZm9ybS13LTQtOTQxLXF1YXJ0ZXItMi1hbmQtMTA5OS1uZWMtaW4tMjAyMg==/	Get hash	malicious	Browse	157.240.17.15
	http://vade4608fb187.qpostie18.com/track/click/SlC9afG1pBGQGsS3nu0U7pxJdsY/1/aHR0cHM6Ly9jbGF0aWQuaW8vd2ViaW5hci9pcnMtZm9ybS13LTQtOTQxLXF1YXJ0ZXItMi1hbmQtMTA5OS1uZWMtaW4tMjAyMg==/	Get hash	malicious	Browse	157.240.17.15
	https://na3.docusign.net/Member/EmailStart.aspx?a=e48f9a7e-7630-4f4a-9e73-9ae4c68238d0&acct=6d128e02-3d7d-42e7-b7c2-14e521db149f&er=ca6b7a2d-cdb3-4ab1-8f2e-072215336210	Get hash	malicious	Browse	157.240.17.15
	https://telegra.ph/Income-from-1200-per-day-05-23-4?id79864	Get hash	malicious	Browse	157.240.17.15
	https://katrina-v.company.com	Get hash	malicious	Browse	157.240.20.19

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-AESUS	http://cook-masterclass.com	Get hash	malicious	Browse	34.204.155.126
	https://powerful-bow-guppy.glitch.me/plan.html	Get hash	malicious	Browse	52.5.22.88
	http://express.adobe.com/page/KxwWXXKVM91n5	Get hash	malicious	Browse	52.203.39.37
	https://bf7ap57p67.filecloudonline.com/app/websharepro/share?disposition=attachment&filename=FNTemplate.dotm&path=%2FSHARED%2F%21ZU5UPXWQrdw6p7v7J%2FrnuD3Yh6LthrpFVp&redirect=0	Get hash	malicious	Browse	34.197.99.39
	https://kinnicum.us1.outplayr.com/clk/595759784E6E4D744E4738305A446B744D6A4A735932453D#dgarcia-mendez@greendot.com&p2300-1	Get hash	malicious	Browse	3.221.61.115
	Crippling sanctions on Russia.docx	Get hash	malicious	Browse	34.197.99.39
	https://express.adobe.com/page/KxwWXXKVM91n5/	Get hash	malicious	Browse	52.203.39.37
	https://googleweblight.com/i?u=https://storageapi.fleek.co/f898fa0c-1b8c-4b3a-ae09-58cd15bfa8ef-bucket/api/index.html?submit=david.cantrell@southside.com	Get hash	malicious	Browse	52.20.78.240
	https://6003ev37gp1l4t0lrd4ar9uqvia8qm8rhiq72frceq5pqrls4dqc48o.siasky.net/#dbraun@casanafurniture.com	Get hash	malicious	Browse	52.20.78.240
	INV_R004671.xlsx	Get hash	malicious	Browse	3.212.179.151
	INV_R004671.xlsx	Get hash	malicious	Browse	3.224.10.203
	https://secure-1c1b5.kxcdn.com/d-8h6k.html?cep=pjfpnU8ajS5tDHkSR-lkrmEelh_pjLiNIVheQajTZtwcNbMye05jGS-9ntfrs3fveHF9Xh_r1zLaIXGThcgUHqf2PgLxiVlHidLOySHXOxXuckpU_ekWk8LiqiP7y_IHB22rKeH_Y4UIyzoIN0x1QtC58sYdbAgBionFPBpPm2dt9FhqsSXH3yPWX70YEM_D2UpsIUV-XCnRyaQ1EK1pahXPkV8gs0x6RWNvjPf6sLWGte5VdOvfp1GkkcVcgh3xEFPxyQsBT-dIQ55ahkfMoVvHJsCjScJiZ5zT26oYerHr74RQYLfbuDhgG_hq5w0BNNGB-v4c_ExS0O3BT-fAYQYzEo5TEBHTqEgZbpN36ttXdjSNRLj0m_82UTMHv96SQXpSQaGncWCW4oYyxRmhZGuLB5sq-4Sw-Jp7_jzwcTk4FjJAbWuyKRltCsIKtRQhdc0-o3GNxFgzlZUl0x4gpD4ccspXc8bW8f_H3qsWTQSBgrMXZulrEx9MTE41lK7ir5ohjQPcsbCjjEvIf4KRC-LMKKfTccyxcjvchV9VbN15mqoyx56nIt9Gb_oqXNipraJ_cVPeic_GAB_ToGnI-rPSsgj-s2KdcXHGA_K72y3ayuWeBKueV2WQU6-J2NMocbm_9LKP-Zl49xCIVjOihemDwmW3h8mz2F0Cpz9T14hSM8inOvIzqXRrG1VTQWqDGDaSUjKWq-dkgXBi7H55Qxq6w10WF04e_iamVw-IL94&lptoken=16df54af084f37c90654	Get hash	malicious	Browse	3.222.249.115
	https://bh.contextweb.com/bh/rtset?pid=&ev=1&daaqp=1&rurl=http://bKSBN.bKSBN.artificialgrasssomersetwest.co.za/?id=p_c@manulifeam.com	Get hash	malicious	Browse	54.172.53.210
	https://loginping.com/qdos-british-gas	Get hash	malicious	Browse	107.21.118.205
	http://info-sf1.sugarcrm.com/jc.aspx?d=CXGMWDUCGAIILYLXTE2YCFRIMBLV4VS6QJYWDVHOJIUUQASWNQUYTRTXO5OH3E74E7ZQCBM442GC2SAANIBL5SDTTLRDSAEPCGEZLEREREYRXYCAEEAI3VWSO52TR25KLJNNPXP3KCMSDFATK2FXLBJ2ST6NP6AUEZFLY7EZRN4WIQWZOW4W2WPTPQFXPEEFDZMH7GSTX5YZSKDOH3KVDTGGKYEBHHOHPVKV5D5W3A27B7IB	Get hash	malicious	Browse	3.94.218.138
	https://click.smartsheet.com/f/a/1XIucl39hzgzUvOOPd2reQ~~/AARF7wA~/RgRkeRsAP0Q_aHR0cHM6Ly9kb2MuY2xpY2t1cC5jb20vMzY3NTQyNTMvZC9oLzEzMW11ZC0yNjIvYTRlYjliNWQ5YTJiZDhhVwNzcGNCCmKGAJaWYq_h5zJSHWV4Y2VwdGlvbmFsbmVlZHNAbWluZGEuYXNuLmF1WAQAAAAA	Get hash	malicious	Browse	3.226.130.133
	Yds2dGdQeB	Get hash	malicious	Browse	34.195.202.90
	4I9zpWsNRB	Get hash	malicious	Browse	184.73.67.234
	Cb5ktP6FvG	Get hash	malicious	Browse	34.231.184.228
	https://app.pandadoc.com/document/acf75b891ce02d0a8fc639e9e6a23af3e9cbc766	Get hash	malicious	Browse	52.205.227.118
AMAZON-02US	https://viways.co.ke/RSVP_365/	Get hash	malicious	Browse	13.224.103.98
	https://pluviophile.net/982922.html	Get hash	malicious	Browse	13.224.103.50
	https://appsendgridapi.azurefd.net/#hello@trueaccord.com	Get hash	malicious	Browse	52.216.86.139
	http://cook-masterclass.com	Get hash	malicious	Browse	13.224.103.45
	https://https.docusign.click/XZEZwU1NVVnBlR2xzYmt0bmEzUnVkMDQzYm1RNGJUZHlkemMzU1c1eUswSnNSek5ZUVcwMWJ6aExSRmwxZEhCWU5rNU9LMGRuWVRFek5rSlJWRVZoUm5WbmEyNU1kWG80Y2xkdmFtSTFZbFZrV2xrM1VXOVVlRmR5UWxkeVoxWllVV0ZOT0M5eWRuaDFTellyVTFOeGJHWTJZMjFYTUd3emJrNVZWell4TXk5d0x6ZFZPVTE0WVd3emVXaHVUMFJrZG5CWlRWaHRjbWd5Vm05SE9VOWhNMnczYVVWb09WUmlNRGh5Y3pCTFJUWjBZVGM1U1hkSVNuTmhUSFkxYTBwNkxTMWphakZETWl0emJFMDRSamRxSzJ0VVYyWndUMWxCUFQwPS0tZmRhOTYyYjljNzQyNDlkZjU0YzY3YWYxYzA3Mzk2ZGU3NjJlNWMwZQ==?cid=112144364__;!!P6jpYKK6mafehyc!ibvPmKEwtlOSywVXjZxMA3GAT7wmysn2WW4AbwERGtVs7Wby_yqvZInE4S5Q7iMmKBKbCHZ6GY7GbMbLGATRfQFa6pTnuS71YJqFHQs$	Get hash	malicious	Browse	54.228.40.246
	https://powerful-bow-guppy.glitch.me/plan.html	Get hash	malicious	Browse	13.224.98.147
	http://express.adobe.com/page/KxwWXXKVM91n5	Get hash	malicious	Browse	13.224.98.147
	https://indd.adobe.com/view/a97953e1-dcc6-4971-9e52-a6eea3e65fef	Get hash	malicious	Browse	52.216.133.229
	https://catch-fresh.com/Cold/4/index.php	Get hash	malicious	Browse	13.224.103.129
	https://kinnicum.us1.outplayr.com/clk/595759784E6E4D744E4738305A446B744D6A4A735932453D#dgarcia-mendez@greendot.com&p2300-1	Get hash	malicious	Browse	13.224.103.49
	https://express.adobe.com/page/KxwWXXKVM91n5/	Get hash	malicious	Browse	13.224.103.68
	it.comunemilano.appcittadino_2.9_base.apk	Get hash	malicious	Browse	52.18.84.33
	https://frohairs.us1.outplayr.com/clk/59574933626D45744E47786D635751744D6A49344D6D773D#jlin2@moog.com&073883-9	Get hash	malicious	Browse	13.224.103.49
	Enq012073.exe	Get hash	malicious	Browse	52.59.30.24
	https://1drv.ms/b/s!AlFgYLw9U48yapmqAhjp6-7fAwM	Get hash	malicious	Browse	52.30.67.107
	MT76013288.exe	Get hash	malicious	Browse	52.59.30.24
	Shipment Consignment Notification-#U00a0 6183111.exe	Get hash	malicious	Browse	35.165.255.15
	http://t.email1.samsung.ca/r/?id=ff1b346f%2C303d531%2C303d53e&p1=8107023398&p2=8107023398&p3=DM15290&p4=https://adx.g.doubleclick.net//pcs/view%3Fxai%3DAKAOjsvSc_HvuQdRvX1aSoLPMgMMy-T8xM65Y_09AIvG1ApfApuPo9FtYnF9W2EEqi6GwE47pf6Th4xg4FDvHaAKOPaQtQr4xJKBJ08mjD4W7LwmVigyiXIBwAQ9Ga5qLY2ORq_WeFgyIWJSATEw4kSs6iyyE2VnWoVF9g8X4brSZg-d2kHwxDG0kckzm_IBbsku6Nh62dAZfWL-lHrXgRphSSKKd6Y1I4VMYqP0oHOKcOJeyFNW4nOJQAXibQCw0CJ4E55vFlHRK6xhA7WDmVjY1LQsVW9a7ArJ_CC7RxC6OkK7Rw%26sig%3DCg0ArKJSzPyCsO5VugncEAE%26urlfix%3D1%26adurl%3Dhttps%3A%2F%2Fstorage.yandexcloud.net/login-sfeu4cy23cer4px4wpobd92fl0fctyulgenyypvbqsc/index.html%23alp@gatehouse.com	Get hash	malicious	Browse	34.241.232.111
	http://t.email1.samsung.ca/r/?id=ff1b346f%2C303d531%2C303d53e&p1=8107023398&p2=8107023398&p3=DM15290&p4=https://adx.g.doubleclick.net//pcs/view%3Fxai%3DAKAOjsvSc_HvuQdRvX1aSoLPMgMMy-T8xM65Y_09AIvG1ApfApuPo9FtYnF9W2EEqi6GwE47pf6Th4xg4FDvHaAKOPaQtQr4xJKBJ08mjD4W7LwmVigyiXIBwAQ9Ga5qLY2ORq_WeFgyIWJSATEw4kSs6iyyE2VnWoVF9g8X4brSZg-d2kHwxDG0kckzm_IBbsku6Nh62dAZfWL-lHrXgRphSSKKd6Y1I4VMYqP0oHOKcOJeyFNW4nOJQAXibQCw0CJ4E55vFlHRK6xhA7WDmVjY1LQsVW9a7ArJ_CC7RxC6OkK7Rw%26sig%3DCg0ArKJSzPyCsO5VugncEAE%26urlfix%3D1%26adurl%3Dhttps%3A%2F%2Fstorage.yandexcloud.net/login-sfeu4cy23cer4px4wpobd92fl0fctyulgenyypvbqsc/index.html%23alp@gatehouse.com	Get hash	malicious	Browse	52.215.111.225
	351hnH2DuFZoUZ0.exe	Get hash	malicious	Browse	13.224.103.54

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Program Files (x86)\Fast!\nwjs\d3dcompiler_47.dll	SetupFA.exe	Get hash	malicious	Browse
	SetupFA.exe	Get hash	malicious	Browse
	Fast! Installer.exe	Get hash	malicious	Browse
	{C57CA5B7-A655-48F9-AF02-CA9C6BB0E91B}.exe	Get hash	malicious	Browse
	https://quip.com/bsalAnQMfvNm	Get hash	malicious	Browse
	https://fax.quip.com/bsalAnQMfvNm	Get hash	malicious	Browse
	https://quip.com/bsalAnQMfvNm	Get hash	malicious	Browse
	https://0fficefax365.quip.com/FENkAKwe58Ee	Get hash	malicious	Browse
	http://quip.com/LLroAibwIjjK	Get hash	malicious	Browse
	uTorrent.exe	Get hash	malicious	Browse
	Setup.exe	Get hash	malicious	Browse
	Chime.4.30.9381.exe	Get hash	malicious	Browse
	http://download1.a9t9.com/kantu/kantux-setup.exe	Get hash	malicious	Browse
	uTorrent.exe	Get hash	malicious	Browse
	Prezi WIN Copy of ERM Module 8.exe	Get hash	malicious	Browse
	Prezi WIN Copy of ERM Module 8.exe	Get hash	malicious	Browse
	Prezi WIN Copy of ERM Module 8.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Program Files (x86)\Fast!\FastSRV.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95936
Entropy (8bit):	6.567389828914908
Encrypted:	false
SSDEEP:	1536:gJCJtqjNNlsJbFs5qvtmT53dIEOLQjSaniPuV+76wgbPkHDsWiNycdlpvmSl99uJ:xJONLYbFsC43djOLQjS/uV+76wG6EzlW
MD5:	A1508FB72D1A12709BD069A6EDFC29B5
SHA1:	BBE76275D8A44310ED3A82BE510F4A69EAAF76C1
SHA-256:	B7D5365F9094911AE0B7E65B86254135F0B02E0BA15F3DF19E85BAE23185C67A
SHA-512:	DA9B79490BCD5BCD27C1737126911AB449B1178C990E43BB16FB29AF324077CF72BD9A1B9F44F4A400A7B77420E126903399D27E0A79D029B45A3C13F7AA1F9F
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[..^............D.......D.......D...........................6...D...........w...........'............Rich............PE..L......^..........................................@.......................................@..................................)..x....`...............B...4...p.. ...@ ..p...................T!....... ..@...............l............................text............................... ..`.rdata...a.......b..................@..@.data...P....@.......&..............@....rsrc........`.......0..............@..@.reloc.. ....p.......2..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Fast!\fast!.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1946816
Entropy (8bit):	6.559169663740982
Encrypted:	false
SSDEEP:	49152:3OlXdF6xex6f17G/002D4ztnjcyA5rAel:3OlXeex6ty/002D4ztjcyA5H
MD5:	499E3F85CE57EDC3FE3A6D004797FC67
SHA1:	03076B8A5F77CA44829C6A154AB2E0B480C02D5F
SHA-256:	B3ADFE4212450747D8D2E9245022AC7C81CFB85E6EFB6359E38D431FD87C3A6E
SHA-512:	870AC44EDA08ED4850C8D742987E7AC5C150C30D1C19149BBCC3B118F9B00DE4CE58D84FFFBCA16BE278C907E4D784874CA5900F2993DB53BFCB5DF91E486D40
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]>..._dC._dC._dCB7gB._dCB7aB._dC.2`B._dC.2gB._dC.2aBs^dCB7`B8_dCB7eB<_dC._eC=\dCB7bB._dC.2mB._dC.2.C._dC._.C._dC.2fB._dCRich._dC........................PE..L......^.................8..........A........P....@.......................... ......j'....@.....................................h........................4..............p...................$...........@............P...............................text...l6.......8.................. ..`.rdata.......P.......<..............@..@.data........0...R..................@....rsrc................`..............@..@.reloc...............x..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Fast!\nwjs\credits.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupResources.exe
File Type:	HTML document, UTF-8 Unicode text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	1922937
Entropy (8bit):	5.0265097704672135
Encrypted:	false
SSDEEP:	12288:+mEufVjmNmimymFm3mt+3UCHzA+Sx2cXrDCRm0FtZZmS6h3BbZrS7Ui61GQqbdWD:D8mnLiLDJjwfuVBHrQrEK30cfkUJMQ4y
MD5:	F9D0858C1D14035F1E31A05A01D96631
SHA1:	8025032D219A17CFB137931F8E46CF48BDE2BBCE
SHA-256:	C2996A2628CD1F104281A210963D99EEE56A919958B518E4E2F07323B23C252C
SHA-512:	03E2549E2FE6A21EBB87199B5C5315241CA9918DE080CEE9DB4893AFB727ABD1B6E282013C2B4772E0A9A65FDB48ED5BE3FD0A3A0B530CF0EBB923E5A3C623E6
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>..<html>..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width">..<title>Credits</title>..<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">..<style>..body {.. background-color: white;.. font-size: 84%;.. max-width: 1020px;..}...page-title {.. font-size: 164%;.. font-weight: bold;..}...product {.. background-color: #c3d9ff;.. border-radius: 5px;.. margin-top: 16px;.. overflow: auto;.. padding: 2px;..}...product .title {.. float: left;.. font-size: 110%;.. font-weight: bold;.. margin: 3px;..}...product .homepage {.. color: blue;.. float: right;.. margin: 3px;.. text-align: right;..}...product .homepage::before {.. content: " - ";..}...product .show {.. color: blue;.. float: right;.. margin: 3px;.. text-align: right;.. text-decoration: underline;..}...licence {.. background-color: #e8eef7;.. border-radius: 3px;.. clear: both;.. padding: 16px;..}...li

C:\Program Files (x86)\Fast!\nwjs\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupResources.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3661112
Entropy (8bit):	6.573095716724625
Encrypted:	false
SSDEEP:	49152:1VBD1/zMxpjAeHhtiv2dGDwhMeX1/iK6AoVCdUTFE:17ZMxpjAeHhtivBDwh1c51
MD5:	D808ACB53436CA8BF04F88D3B40200CB
SHA1:	493344C681A2269BB8C202F020AE0583814D2816
SHA-256:	381EC497D7D40B83616B0E82E15C597D04433ACC20E94EBE5611F954B2E5309B
SHA-512:	86DC1CE2AE6C7A36B2F7D4A18278CEC99A9A8743DF657B2546EF46F0E8007C94D55354FE765A9C17A2FD5B15F21693691D177407B141BE23BCDE24635093EFB5
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SetupFA.exe, Detection: malicious, Browse Filename: SetupFA.exe, Detection: malicious, Browse Filename: Fast! Installer.exe, Detection: malicious, Browse Filename: {C57CA5B7-A655-48F9-AF02-CA9C6BB0E91B}.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: uTorrent.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Chime.4.30.9381.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: uTorrent.exe, Detection: malicious, Browse Filename: Prezi WIN Copy of ERM Module 8.exe, Detection: malicious, Browse Filename: Prezi WIN Copy of ERM Module 8.exe, Detection: malicious, Browse Filename: Prezi WIN Copy of ERM Module 8.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?W8.^9k.^9k.^9k.&.k.^9km..k.^9km..k.^9k.<=j.^9k.<:j.^9k.^8k.^9k.<8j.^9k.<<j.^9k.<9j.^9k.<0jU^9k.<.k.^9k.<;j.^9kRich.^9k........PE..L.....U............!.....F5...........*......`5..............................`8......n8...@A.........................P5.u....S6.d....p6.@.............7.8=....6........T...............................@............P6..............................text...eD5......F5................. ..`.data........`5..d...J5.............@....idata.......P6.......5.............@..@.rsrc...@....p6.......5.............@..@.reloc........6.......5.............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Fast!\nwjs\ffmpeg.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupResources.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1157120
Entropy (8bit):	6.720388521100998
Encrypted:	false
SSDEEP:	24576:/UNzPn6vLg6LbipXvpBvbcE1Ztkwb0gvhjPGmLKPRFQU8gn3s:/U5/6vLg6LOKE1ZtbvhzG/JFQU83
MD5:	1A5F9ED8803FBB93655A123C208DB365
SHA1:	A4BB2F6AEFD020570A954E95ABCB45C94DF34D63
SHA-256:	EED485D2D5D5D731AA34F7C2A25691BB4EFFD0CBAF4E77A95D8FE704DFD01538
SHA-512:	E217104FA1F545C929FC85845DE6D403011C11C0233E73CC0A75DA5788C800501E9FEEF7793C8A5A45D34D253357FB7E2779BEAD6B9A4FEC42EE85D10504C07D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7O..s..Ks..Ks..K.s.J\..K.s.J...K.s.JG..K.:Kp..KHp.Jj..KHp.Je..KHp.Jc..Ks..K`..K.s.Jv..Ks..K...K.p.J...K.p.Jr..K.p.Jr..KRichs..K................PE..L...Ro.Z.........."!.........l...............................................@'...........@.........................0...<...l...<.............................&..k......8...............................@...............l............................text............................... ..`.rdata...r.......t..................@..@.data...0{...0......................@....rodata.......&......,..............@..@.gfids........&......:..............@..@.reloc...k....&..l...<..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Fast!\nwjs\icudtl.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupResources.exe
File Type:	data
Category:	dropped
Size (bytes):	10196592
Entropy (8bit):	6.187370398127412
Encrypted:	false
SSDEEP:	196608:AkUPty2AZfpN9wliXUxjdyRWhlEzkuaxQ2:u12Zh8liXUxjdyRWhlEzkJxt
MD5:	BE464D15F6FB048F06C686CF84A5E8A5
SHA1:	FDF57B70D4F3BF029B164E8AD2E2914912D80404
SHA-256:	2399E3149C121DDA8C30C622574F1EF9D0B26E4BB665E80E4643E6CF6597602F
SHA-512:	74130FFB3A43A76B286F55885D4FC0DED83DBC8389C734A0BC79D1981A6F64DC1928CCB8774A0901B76BE5C492E84FCA7BC4EFE27F430E5D3941C8BC3FB1B52C
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .&...4... ^..D...p^..T....^..d.......t...p.......@...............`.......p.......................`.................../.......@.......P...`...`.......q...........`........".......C...... D.......&......`........?&.%....J&.<....K&.S....R&.m....S&......[&......\&......a&.....`d&......e&.......'.....`.(.5...Pe*.W...@H,.w...0....... ./.......1.......1.....p.1.......1."...`.1.;...pM2.W.....2.u...`.4.......5.......6.....@!6......"6......"6......J6......K6."...@m6.7....6.L.....6.a...0 7.v....D7......h7.......7......'8......'8......M8......N8......P8.-....P8.E....P8.Z.....8.p....8.....p.8.....P.8.....P.8.....P.9.......9......9.. ...9.) ..0.9.> ..P.9.V ....9.k ....:.. ...d:.. ...:.. ..P.:.. ....:.. ....:.. ..`.:..!...:..!..0.:.1!....:.F!.. .<.[!....<.p!....@..!..@.A..!...9A..!...UA..!...VA..!...qA..!...qA.."....A.."....A.0"..0LB.E"...LB.]"...LB.r"..

C:\Program Files (x86)\Fast!\nwjs\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupResources.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	6.272851032614018
Encrypted:	false
SSDEEP:	1536:PbX1lRbkAcXNeW9Wq3uYrDf8QuBOpTnsWGrcdmrFsvkrbUyD6:DlZ6+42kJzm2crAym
MD5:	3D91701E1DB09BAF08072A8BA4966B4A
SHA1:	E8DF6EDBEB2D3114F84E41FAD0172183959C3055
SHA-256:	33F1CDAFA504D9B6AD973B499991AD7D39D71C1E7A875DAFC963CF8853113DE3
SHA-512:	44DA984D540EB566713C0C6000899C8A20FA27D84C68D45BBCCEB170C737A4DA73470B91E300DA3682E17EB370D46F3F11CACF7ECE996A21895BEF0B091DC480
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`9pk$X.8$X.8$X.8I..9-X.8I..9QX.8I..9<X.8...95X.8...92X.8...9+X.8...9'X.8I..9&X.8$X.8.X.8...9%X.8...9%X.8...8%X.8...9%X.8Rich$X.8................PE..L....*.Z.........."!......................................................................@.................................X...<....`.. ....................p..8...P...8...............................@...............$............................text............................... ..`.rdata..Nl.......n..................@..@.data........0......................@....gfids.......P....... ..............@..@.rsrc... ....`......."..............@..@.reloc..8....p.......(..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Fast!\nwjs\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupResources.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3175936
Entropy (8bit):	6.741601405971993
Encrypted:	false
SSDEEP:	49152:PKlgHyXxQppGCYBidljbsROv/ZLDTMxrhxLd5nn6pHgoTdt8V98fWiorrTp6b0hQ:PagHyXxgpGCYBsbom/ZLgnqn4VWfA
MD5:	7E5AC4F889AB8A2078E3C6232FE8A22E
SHA1:	F43974B6D7FBC49995D0633F70AE52DDC74B65A6
SHA-256:	A7402A23ADDCA3EB67154519542797199E282A731275965EBB2EDCDDD430BA63
SHA-512:	85D608FEDEAF67FC063F4FAE4C0C43D65DEACD694491F8970B148CF22FC6390AE269E9F031E144B3AB164547C93CDEC2B1F5EDC057415FCCA6B57024ECFDB14A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q.NZ0h.Z0h.Z0h.7mk.k0h.7mm..0h.7ml.k0h.ank.A0h.anm.)0h.anl.y0h..nl.P0h.7mi.W0h.Z0i..0h..nm..1h..nh.[0h..n..[0h..nj.[0h.RichZ0h.................PE..L....*.Z.........."!......$........... .......$...............................1...........@..........................;..8h..(........p/.8...................../..~....-.8.....................-.....8.-.@.............$..............................text...".$.......$................. ..`.rdata........$.......$.............@..@.data...........D..................@....tls.........P/.....................@....gfids.......`/.....................@..@.rsrc...8....p/.....................@..@.reloc...~..../.....................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Fast!\nwjs\natives_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupResources.exe
File Type:	data
Category:	dropped
Size (bytes):	218275
Entropy (8bit):	5.34737925007636
Encrypted:	false
SSDEEP:	3072:uUKt1rxNpyXcsR/H/UxRjh7uHRcdA4SSSLl/sL8:uUKvrxNpyXcsRf/UxRjhwcdAuY
MD5:	100F66BE85612F7DD095E0F468497F68
SHA1:	6D0B30428726D079AF3DEB3279033C268733DC22
SHA-256:	E8472A5C9291C2B46B7BE611EC994D5E37ED9EC1B473E50DFC9A94C9A923CEC2
SHA-512:	841A90B6B54FEAF47973990882D9A274B4E9F8E850E21A2B94A41B8FFD501969C77003C19B961D180CB2A0062B7E32A5AA6514FB34ABE8F1BA818795A2B91FBD
Malicious:	false
Preview:	..mirrors....(function(a,b){."use strict";.var c=a.Array;.var d=a.isNaN;.var e=a.JSON.stringify;.var f=a.Map.prototype.entries;.var g=(new a.Map).entries().next;.var h=(new a.Set).values().next;.var i=a.Set.prototype.values;.var j={.UNDEFINED_TYPE:'undefined',.NULL_TYPE:'null',.BOOLEAN_TYPE:'boolean',.NUMBER_TYPE:'number',.STRING_TYPE:'string',.SYMBOL_TYPE:'symbol',.OBJECT_TYPE:'object',.FUNCTION_TYPE:'function',.REGEXP_TYPE:'regexp',.ERROR_TYPE:'error',.PROPERTY_TYPE:'property',.INTERNAL_PROPERTY_TYPE:'internalProperty',.FRAME_TYPE:'frame',.SCRIPT_TYPE:'script',.CONTEXT_TYPE:'context',.SCOPE_TYPE:'scope',.PROMISE_TYPE:'promise',.MAP_TYPE:'map',.SET_TYPE:'set',.ITERATOR_TYPE:'iterator',.GENERATOR_TYPE:'generator',.}.function MakeMirror(k){.var l;.if((k===(void 0))){.l=new UndefinedMirror();.}else if((k===null)){.l=new NullMirror();.}else if((typeof(k)==='boolean')){.l=new BooleanMirror(k);.}else if((typeof(k)==='number')){.l=new NumberMirror(k);.}else if((typeof(k)==='string')){.l=new

C:\Program Files (x86)\Fast!\nwjs\node.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupResources.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5777408
Entropy (8bit):	6.740926769702569
Encrypted:	false
SSDEEP:	49152:4XJr2urEwqgM301JURAXYOVghR87GwaLH+exYsD1ExXP2Cw+QmRrksH3snn/pJg8:4phQw/M3iJUyYOKHzxxYhbrP
MD5:	F89681A61E9A1BC85B02867D0008C190
SHA1:	8E8609240C242C696004908AB2D2D0040D5C3916
SHA-256:	7C058B8643EC33B1FD46C099A48A8F1D7E1E380AD488111F2007651C84F37F7B
SHA-512:	776E9E5AC0963A109F372B2A1DD2BEFB373120B637272DF8044985B47310C0FBCAF18B25F13D2F6674C1B668B9318834830EE0141CD544CE97CC60A42087D651
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...........V..GV..GV..Gt..F}..Gt..F...Gt..FH..G.A.G\..Gm..FM..Gm..Fe..Gm..Ft..G..FD..G...FU..G...FX..Gt..FD..GV..G...G...F...G...FW..G.4GW..G...FW..GRichV..G................PE..L.....Z...........!.....h'..:1.....p.$.......'...............................X...........@..........................RR.....`<T......0V......................@V......=R.T....................=R.....h=R.@.............'.T............................text....f'......h'................. ..`.rdata..0<-...'..>-..l'.............@..@.data...PF....T.......T.............@....gfids.. .....V......tU.............@..@.tls......... V......xU.............@....rsrc........0V......zU.............@..@.reloc.......@V......\|U.............@..B................................................................................................................................................................................

C:\Program Files (x86)\Fast!\ui\css\font-awesome.min.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	31000
Entropy (8bit):	4.746143404849733
Encrypted:	false
SSDEEP:	384:wHu5yWeTUKW+KlkJ5de2UYDyVfwYUas2l8yQ/8dwmaU8G:wwlr+Klk3Yi+fwYUf2l8yQ/e9vf
MD5:	269550530CC127B6AA5A35925A7DE6CE
SHA1:	512C7D79033E3028A9BE61B540CF1A6870C896F8
SHA-256:	799AEB25CC0373FDEE0E1B1DB7AD6C2F6A0E058DFADAA3379689F583213190BD
SHA-512:	49F4E24E55FA924FAA8AD7DEBE5FFB2E26D439E25696DF6B6F20E7F766B50EA58EC3DBD61B6305A1ACACD2C80E6E659ACCEE4140F885B9C9E71008E9001FBF4B
Malicious:	false
Preview:	/!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.7.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.

C:\Program Files (x86)\Fast!\ui\css\opensans.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1800
Entropy (8bit):	5.223532960977299
Encrypted:	false
SSDEEP:	24:L286KGb28HL/RK28Y28vm1y28tJ28pf5pG28swy9IDi:68NGK8rZt8f8SV8C8pf5n8sNOW
MD5:	EDAB2AD532D5A2E8736176A0D455B1BD
SHA1:	10C0BA9E3D9A8196A6852F9A264CA378D0961099
SHA-256:	AEAC4EF506D8ECDA071169649D3A9D46344E8EEC246BA1C716499E9FAB05F7E4
SHA-512:	3C059E4BD497C22AD7DD586ED5252C091BC63753BCE2065D566C94C5B7F2BEBE5F858D2FC812052926F69F5465AEAC9389917EDDEDF1B7D0BFE5D82808DA9158
Malicious:	false
Preview:	/* cyrillic-ext /..@font-face {.. font-family: 'Open Sans';.. font-style: normal;.. font-weight: 400;.. src: local('Open Sans'), local('OpenSans'), url(opensans1.woff2) format('woff2');.. unicode-range: U+0460-052F, U+20B4, U+2DE0-2DFF, U+A640-A69F;..}../ cyrillic /..@font-face {.. font-family: 'Open Sans';.. font-style: normal;.. font-weight: 400;.. src: local('Open Sans'), local('OpenSans'), url(opensans2.woff2) format('woff2');.. unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;..}../ greek-ext /..@font-face {.. font-family: 'Open Sans';.. font-style: normal;.. font-weight: 400;.. src: local('Open Sans'), local('OpenSans'), url(opensans3.woff2) format('woff2');.. unicode-range: U+1F00-1FFF;..}../ greek /..@font-face {.. font-family: 'Open Sans';.. font-style: normal;.. font-weight: 400;.. src: local('Open Sans'), local('OpenSans'), url(opensans4.woff2) format('woff2');.. unicode-range: U+0370-03FF;..}../ vietnamese */..@font-face {.. font-fam

C:\Program Files (x86)\Fast!\ui\css\opensans1.woff2

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 16868, version 1.6554
Category:	dropped
Size (bytes):	16868
Entropy (8bit):	7.9880541218783945
Encrypted:	false
SSDEEP:	384:AF92jnHaPlexnHnbJg3txyB4pRvbSJsLJKJFZ9n:c92bHsWJmg47D2stAvd
MD5:	4B60E71334D025BE8BD843ACC59753E1
SHA1:	E0350190D720A8FEC0557AB47B318EC4E4486448
SHA-256:	CDD6F09441727E4AC6FA370E2B8221EE3C2892265CB618AFA35643CBDD5B7617
SHA-512:	B7ED2906BEAE601AAAF9249BE565C1F6A6F29FD9D2C36F7C8338AAD97B4ADD5CD8F7023F8EB5491A660E252021BD247B8C65564F2D2C1AC17B7972D754A568AB
Malicious:	false
Preview:	wOF2......A...........A..........................".....`....."..4.....T..D.6.$..p..<.. ..2..J....:r5l......p._.h$B.820.kGE.q.(..d..9.r...<.jY........foL.%.S)tl....K..d.K.U...O3.{...2.Gs...Z.5.Db.@g..)."....T$..c.?.7.Z...M..../..c..q....'fZ...q..2..8.3.n..i..~~.3..&5.}.7.w..$....t,.......~.&.L5.{f.?.lh..37......fbb.z..g.TLT...&..q.....E?.#y...v..}o?5.L..q.d.%.j Q...:.....&uV..Zq.-.8a.E../.oF.X..4T.s..E.E.....jw..H..?.L/.!K.....).#].L....6<.}.e.[2.RW....n.e....=..W..A......yY}..TE..U%...8...:+.v.}C\|.PQG`.&..V~..].Yh..$y`...F..r..Bb.......I..t....7.FM.Q...v.-...Xc.;..D.6.{.L.\...:..._..{.HH.8X.\t....Y..[(...^......I.....dJ....9J..r...\t..K..g.....(@T.u...;..{......t..O}....B......:...s.s.(..K[.....wI.8....~9z........ .n .?I.xXv.L.`.)...2t....Ru. .t8.D.....q.....7.!.....$...F....5.5]....."...\| ..xU)......{.~..~..y......a..!.iU.H.W1.....Q.8...&...Z..d S.VjUA...&.....#....l ..,.@SB$.d@..W../...A.....la..d\........S.f.[0..u.U7...ST/...W?.]1.@..6.P..

C:\Program Files (x86)\Fast!\ui\css\opensans2.woff2

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 9676, version 1.6554
Category:	dropped
Size (bytes):	9676
Entropy (8bit):	7.974841909039616
Encrypted:	false
SSDEEP:	192:pvu6iax1W+gxgsnpb2Ds8gS78nB9fxoA3sp5XdWpQS2Jm6P8ve:o6iaLexDnYD0mOD13svtWyS+BP8ve
MD5:	85759F54539623A05BF2E5A3F6799DAF
SHA1:	BE201D32A9AA5D186723EBB3C538BE691AA8C53A
SHA-256:	CF84A7B7066A47F6973D447ABE36D8B8247A2949DC66363F2CD861767885ABC2
SHA-512:	9BEDED6DB64CB808B4E61F0ED26B26CE03A20ACF68275A5CFE7079758D6A72A791F273A6E939018B338EA414D2E3B149C92BCFD0313725F14BAA87F1B790FF51
Malicious:	false
Preview:	wOF2......%.......J...%j.........................(.....`....."..4....x.P.6.$.. ..f..... ..2..?....UA......l....$B.8@.AU............j...u..nm.........Z...,.R.U:.M....9t...T^U....d...?..0...:...Z.Y....\|...5a.>\W.j....gi......._.e0.p....&C.2y.\..lr....+..b....gZ.....CX.a...Q7..3}_....Z.....r.d.cW!.:_...M.\ ...1.K...r-...p..m...vvba...D.h.X.2"X3.....Q(F.0zel....wV.....e.....{.8=.f.....}......0.)..t..M.T.._Q.pS...f.I.u....<.......U.......$...T.....9q.!.[.h...Cy.AvR.. ..;....'F\|........I$....=t.........pT.f.c.Bq...XOB.......S......Z...a....uz..9.2\$'.\|.........$;......B.%...\|...T.MsE...uy..-..2.......,.0T....rYr..B(.......P'.J..B.....k..^nB&.!..,4"..g. .Z.sA.!!....a..^...........mz..y].JB;~F....'2. .....J.......=...%?A.n...s..n.'....O..Jxe)..!M.JBhL.cD..8.6..4?L...p....;~...x.....Pyx.......O...."...}.#.0.....T1.i...k.j..t/..?.%L83...c...!.......m.J@.......zf...(.~.u../..x'...V.X.\iP...8..q..n5...9}.MAI..%.A.s_.o.2.....%.A...~..@M..nL.....H\

C:\Program Files (x86)\Fast!\ui\css\opensans3.woff2

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 2332, version 1.6554
Category:	dropped
Size (bytes):	2332
Entropy (8bit):	7.869949868745035
Encrypted:	false
SSDEEP:	48:Ibi/lZ1jAjJ+6p1/d4vfhRblBFRGLiGxrQ0EM4Jg5QsM:fZ5AjJ+8/4hRbFRtKrQ0E60
MD5:	F736E54388BFAAD417DF1B30814B6AAE
SHA1:	2C5B039B57F62625E88226A938679EC937431AD1
SHA-256:	5CED1FBF1C36965E6A61DDCB52D7AD7CC43A8A6096A8E40AE2405BFBB3153FAD
SHA-512:	4BEC4A9EFC6FDB22F805F5CF61F765C8DEB259C72748DE6069714AF0D4287B435583F8ADA6637DF3B139AE4CF5BD3AB805088C99888C10F54E9981C34DADC991
Malicious:	false
Preview:	wOF2...................................................`.,.."..4....`.E.6.$...... ..2.G......Q.M.I.E..b.%%..XH`<-....FF..w7b(...}......5d..oq).....Z._N.L$.H..N....d.c....S...2y9o.,\..}...z]`:v..1A....y..y@..").r.#.e..a.....C..i?W'.F.-..Nf..}...#...I)C.. $J&..26..7f .H.<.....b1j.....+.[.`6....J^..&.o?@..2.... .....]._......$q...S......w`UY.8.9.$..}W....dg..p.%X.H.e..+..ZCt.....%.W...r.o...`...!........].-.......{.5 6....-....j...Y..\..G...o5..Z....'..+.Q,.s......cG..>tp......R.Vv..e.....".P0..y=...Eb...h..0.9.l...f...J6R..W.M.r..9Hm.).....:..)........@.G2.....v...<..?.7.IcnUE............=......Xa2....D,.....^.l."j_i.q. ......g..5n..U.....Y.X.B{../`...q?.....)..d......p.p.8. <../c2.;X.w<..E....+.....1...O..4.Qq.....wN.H.....J.$u...RZ..Qb.$l......2.n4.5..U^..^.........9f...R...1..V.3N...3...&....1..G..rU.....a....z.r...i.%....[.RuMu.f_.hp.^.2.....`....)71...*.+...n..E..v../....{.2.!'P....E.....(k.hq........f3XN......*......v;.A.-..a....X~c.

C:\Program Files (x86)\Fast!\ui\css\opensans4.woff2

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 8160, version 1.6554
Category:	dropped
Size (bytes):	8160
Entropy (8bit):	7.9700811821881645
Encrypted:	false
SSDEEP:	192:9+77Ihm4JmBCuXbtbyKjgBnw+3uqS8IxZrtXPyR6V:9VvmTtUnHTSXhXKi
MD5:	C09EA514A21D4A93BC0C4A96ED503A59
SHA1:	BE365ECA44760CE3FC9B377C43D4634958479C69
SHA-256:	F66947CEC51A5785E6F9CA02F45E8F0D22D43BA818ED114366D033E14458BC84
SHA-512:	19365BC788085CA00F86DC74ABCCC77B48CC9F0BFE11093B52165B049ADDA5DC16B48598BD878AE2816465CB1AD70A4F134C4619CE58C8A76FCF15380B05B285
Malicious:	false
Preview:	wOF2..............<\|.............................(.....`.\|.."..4....l.x.6.$........H.. ..2..6.....6....w.........d....r.MX...."N....0..PFNX1...i.u.......Q.n..C.1.._...N..%,5:D...T....;L..?...D.^....<...xD.u...#..>..g2=...;.&..k(%A..}....u...p \|H.W.%...@!\.........."..>/rK....W^...}..W.....@........X{@..z?.#..ga.5.LP2PuU.....\._..U.......&.... .......TK..OJ......i#.lV..z\...m.Pj]4..SqZ. W.Y.Snr9..a...c..;].@....R.5.JV..Q...b...).:.gVY7....*b...L....B%4....B.f.. w........Y.?s..%i....2a.J.Q..B.g..O........u.2.i....i\|(.l..T_.a.w.AP>,j.,a..IJ...IYO.sj9K.r.!.%.........$=...uLT......."X.y..yr....XSk..f....`....3.>A.....H...zd.q.E@.8.y3....u..7.......vv.(D.m..A..sZ%.@!...p.F1%..Y/.<H$.._!....=.'....\\y.A%\|.rXD.....3.i.e.8Q..LR....p.........GI.EC.....x..1?.D....}6....Tm^......L.".w...(.nZH..<N=n...DU.S.NY2..$...,....D...2.,.....r.H..tg..m....1.>....."..$.,...s...4tM.".O..~.Z...d.m..2..VRpF. ....Ef..a%..P.Jb4g..Il(..s..X.J.V.C9c.\...e..V...+t....

C:\Program Files (x86)\Fast!\ui\css\opensans5.woff2

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 5740, version 1.6554
Category:	dropped
Size (bytes):	5740
Entropy (8bit):	7.95831025079887
Encrypted:	false
SSDEEP:	96:UEocAnI0DGeTJqMNB6x16AIoeqOqjk/kWA812MX9GPvlreZUWxajgCsQyN:vnAI0KetnBw5IqKkxYhXwPvlr6UWKxyN
MD5:	5C02962E1F9A25F98CC3CAB0DC1EE177
SHA1:	C4248EA800BD5608344CE163F5658B57E7EF9410
SHA-256:	CA17AE084F5465C81BA80EC29C647ACD772F953738940E874CCA265ED81499FA
SHA-512:	3D903B73B3D7129083DA4A7C9458D61A17C73DD489F273D46672AD75C601F3B790F695C667361AFFE020B0CFFFDB87B370F3ED9B4A11BED8B59E529D42A92D09
Malicious:	false
Preview:	wOF2.......l....../..............................(.....`.R.."..4....,.w.6.$..`.Z..t.. ..2..o.........a.........d...8.;...p........&l....$KF..%u_...w....H......+3.....v...U.z....]7........s.....c..,.."............2....6..WD.X.........h.9.a/.q....1......]6..G........B..D....7.V^].....N.gJ...9.Z.E..V%...0e.To.......e...0....M.w.n..-.L2i2$....N..5$..@4.p...4R..aL.V...9}:g...y!O>....`{SY_....Ne`.N..J..O..J.....)7...-EHEGQ..H...ki.6....5.^..Q..b.B.I...\.R....h.hZ..Jx..~c..D..]mk....B.4.Ecb/M.#jkN..............Z3.FDDD.hF... ...P .75@ ..@f.5.\|".;y5l?..h...$7....,...h^?.0.CQ8I.&.........f.r.,.J..-......b.R@.!.]E......[...ERL+..p.-.].O.C...L.C\|[\|....\|...n...@..Zk..oO.P..i... u\.....[....=A..G.&........3/./.Y...8..7...,c#V.E.C...JZ]VZR\TX.........HOKU.$'%&..M.2y..8~.h.....#xX..#..t.8l..A...!..BFR6.\|bQ..F!.=.J.JL...Zl...Z-..%0@!..a(.Z]3..8...2..}M.z.*\|D7&.VZz......D!.y.!..E..b...;i.k...t,/.G!K.....M.P\O...^T...S.1.}.._K.%..T...QX.n.T....5.(S..k.n.mH../n.G.-.

C:\Program Files (x86)\Fast!\ui\css\opensans6.woff2

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 12288, version 1.6554
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	7.973221791058246
Encrypted:	false
SSDEEP:	192:yS4RT4Sxe82NOQXmzngpDbW6tyC3Kew1r3ZuhSZVKk4Ht7Y4kyv4VCK3c+J1aA48:/4tt2N7Wzg5NtV6/F3wcnKttU2vkCr+T
MD5:	921DD520C3FBA714997C8B941D51DBC5
SHA1:	113978181DCAC77BAECEF6115A9121D8F6E4FC3A
SHA-256:	A846F7AF6F32F2BE5CB922158882116AF42816A0FF71506920E18A3BA89456B9
SHA-512:	17CE9CD97314F7122879EC05B9A379E6ACFB6B4B5E9BC7C12A46CBB81B45B772DDC1F41471F4B6FACAC9010FA69F0420A7C538B6B9293A19551CF9593033C6CC
Malicious:	false
Preview:	wOF2......0.......r.../..........................F...l.`..n.."..4....@.(.6.$..,..b..X.. ..2..".....gw.......f...../5.L{.Dd.\.5.r2..........l. .VU...$..&.....[.......&..$..F.. ..B.$"..t..#...g. {.".9M2YJD,=..w...N.........vG;.........*........F...W.o.eY>.~..6._.!..E........-.=Q...e.C..I..._u...{w..-..D.......Y}y...!.f...8.q...".F...........5....8+......s.Gy}_.dT5.,t.t.?.X...g....p:....3.@..~.A..qrP]!.;@%..oU..........Y..a"..z3.=....T.....?.[./.("..+...`./.bH7.+[.Y.E.<.3..s.....^.....!O.....=.M..qd.>..&..5.c.!...7U=...$.)..G.........N...J/c=g...}.e.....V?...b....F....!\|<....tkc......o..{...5.^."4.H..Yk.C1........=b...z._..0......$ ..L)es2L..}.....I .@..t.\A..\|!(.G.Mv.R.@.#....VJ].)c2.c.[.f..z~....H.qC1."+...........q..o.S<y..5..3.0..!m.B.J..5...$.<....Z.......L.r..[.T......\U.cJ....O.R..%2q.&.H.S.....L.`m....... @[..C2.....u.9v.s.s.K.M..`u.....A..87>.@.P...G.>n..A....^ZC.[... x......t(`..9.3^.E.+._...8v....'.r>.@.....f.V.....1....8

C:\Program Files (x86)\Fast!\ui\css\opensans7.woff2

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15572, version 1.6554
Category:	dropped
Size (bytes):	15572
Entropy (8bit):	7.9810164149550245
Encrypted:	false
SSDEEP:	384:js8NoiTYZhWLvKuU4dX+XD3lk8M4RedEEHluh/:DoiP+4dX+T3OCRkE6I9
MD5:	E64CAB167BBDC04807429D10873901A0
SHA1:	AFC44700053C9A28F9AB26F6AEC4862AC1D0795D
SHA-256:	60F9B5203842A4FE2D52F7C96F3C57B755BBF8F347535469739BCC6F95A9C4B5
SHA-512:	9812A394D05F56B70C1DE57FF6CCD46E15C2DB99A003138A0CC2210D08303746969A269F37583A6BE14C706C645FB923136E4231B3ED1FB47FCAF6209884CEAC
Malicious:	false
Preview:	wOF2......<........8..<p.............................t.`..L.."..4.....D..B.6.$..l.....<.. ..2..(.....w..;[...C.[%[.v.(T..E.q@..g.....yI..%X."h.u..O...)nb.A1..hC.V.@CN....~.e..........el<..s.....8.9..5B./(..%.k..4Ji.:.....C".o)&.......T.......K....R...R(.......G.T..'.6...?......j.o..,..T.I.&..]..g..@.B. ....P&...m..Q.r..S..=Q.1.....2r......*D....9.._......?.6f..F.......^.r0.7..W.dY..$.......\.x...{..%.-....g.K>.>.Y. ..AtAti@..q..&y..).)..(+..aC.......d....Xy..T_.[.l}K..DN...A..Ug.....,..J5....".&.F..@.v:..pM5......}..,.AD.~..m.....#..%./B]..E-..Xv;.i..r..h.e..O..V..1P...`>.S...../.jUb....Gq.9@..x..O.v\.........A..'...5.,..A...p...".&.4...S>.-)l.Bo.'5?4S3...14J.]H.^....\|!......L....... (....R:/II..FP....@...SN.7.....D.K1Wv..M..../MO6x..2B........Q. ....^B0+&..i..xZ.GS......:.2.....d...)..x...l!.>r.............TJ.S..4....E.).sN.e. .2..p.I1..&...$....Z..0E.t..G..............vkp..h"...iH@.B..[...D.,0..e.....AN....r..w.......L

C:\Program Files (x86)\Fast!\ui\css\style.css

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	751
Entropy (8bit):	4.370458965530699
Encrypted:	false
SSDEEP:	12:U/MdHDvLu/Bheod5Qu87YR49+JFbFOh143aZOtX+r:U/OzqBheo/Quj49kLSq34AA
MD5:	EA3477E0D5A9C69C057D330A4B46645A
SHA1:	62D93C8E79C2F97D1EE6FD7CFCBC4FCD24A7FBB4
SHA-256:	DA50C47FD185F0C337A1F176F6A6285916CF478C2CBA1116A0EC9599A3DCBBBB
SHA-512:	70A9960BE1AD3942BD2868DB6FC1324A5AED999249CDE30948B9C798ED579C51DF843E31649DD6C18D51DCF7774B9595861BEAFE587ABBB960F1C4587E6A82A6
Malicious:	false
Preview:	body {... -webkit-touch-callout: none;...-webkit-user-select: none;...-khtml-user-select: none;...-moz-user-select: none;...-ms-user-select: none;...user-select: none;.....background:#333; ...color: #fff;...// text-shadow: 1px 1px #444;...font-family: 'Open Sans';...font-size: 22px;......cursor: default;.. }.. .. .. ..button {.. color: white;.. background-color: #77b577;.. width: 100%;.. height: 3.75em;.. line-height: 3.75em;.. .. border-radius: 0px;.. border: 0;.. cursor: pointer;.. display: inline-block;.. font-size: 0.8em;.. font-weight: 600; .. text-align: center;.. .. }

C:\Program Files (x86)\Fast!\ui\images\fast.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	675
Entropy (8bit):	7.606800268124855
Encrypted:	false
SSDEEP:	12:6v/7i6gX7dGD3+zoCQDrqUw2QUp9RKG3VvJN1xOJ24wLTYqp2agcmitQ9:78DOsCQ/PQoRB3VhN1k24wfYqp2avVa9
MD5:	8D1ED092B3BE364DC47574F1310D2C87
SHA1:	D5BBA623B5AFB4C5B6C0AD5ED04A10F1881DA595
SHA-256:	07B61E98466A1F851D5DCF555AD9B901684EE622275129B98C38DA3785506FF2
SHA-512:	70134A9B5B786473A56F11BA7098CA6AF568EEF97AA8704A9748A5EFDFC4F16CEE1F9C22CEA9F55660BE4FEB14D6C1B5B09A7C76076D4F813A58FECF27BB8828
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....jIDATx..VKK.Q....R."..q.....Z.\|.P....."b..'.......XiE..B6.6Z.c4.8....nf.$Nf&^. d1.w..9'...$.(.2N.V.\|.&....g...8.E.%].y.G_$8...O.H..4....%..>.N...P.....K..V9Z..4f..Y.,..T.pGi.%.?8.,@..W.'q...g...}p8....y.5r.......)......&....(.WrD_V.er.).h.....t....c~sN..u&S....Z.m\|.n..c.-_.A....(...._....X....,.hBD..<Z..Yk.V..._7V...U.........;....'....F..>;B..8.^.f../.:.. a?]..\.l......&@dD.g..y.r.p.g....fG<......M...r.....c..,...FJ,W...2G...d.9Q.4..5{4D...,._Oe.......Csbw.M~......dU.........j.0W.....r...'.s6..S......n...E...V@..e.$V....rfeN7.I...z+..`..R.,.N.]...>z..i#..~b.....N'..~0go.].*....I.e.x........[.S......IEND.B`.

C:\Program Files (x86)\Fast!\ui\images\fast_off.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	620
Entropy (8bit):	7.532871627537594
Encrypted:	false
SSDEEP:	12:6v/7iQz6urs3fgXgJX3MrE5s7j9dtn2ZA7FkmIA7:2WfgXCXkd14XmIC
MD5:	F775E05DAB18F69D2901B12299E63A16
SHA1:	B13CAB82F3B766E77589C8F99777FF27DC914FAA
SHA-256:	88D3DC2159DD31907CCD68C01102D94501476837998072B88DB6006AA459EB30
SHA-512:	9BA707E41DD3C971245BC45E97EAD1BC3FCE037FF5DEFCC4780744F1A87BE3F7B09DCC73446F952FD9B39D372431841C7355A3B16DBFF7FC05E23A94075D0B48
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....3IDATx..WKK[Q..sk........ D.Q.'...R.BE..(>VJ...."A...D.7......_..\|SO8..s...B.......I ..{<;...,..\|..:J.\|...c.9.M..n.>.c(...+}D..8.h.%.e......\.BU..<...:..ls.@...g../v.J....\Fb.....;...;.QsO?...9.G.................48...`.M..8.0.....C..C.x7..j...0...X<.sI....L%..)...b.v....o.....Z...:.........8...U@@....)....`.V-.._7V.....k.E`....[.g&z....'[z'R.8.}y.t.p,.2...........t.........s.....j.B-y.@.r..Q._dG.kM#;>u..6..W.:...9f/.b..:].l..j8..m.0.....zs.99...N..#....mu..DjB....E.+....'F>..&N.X.2@({.(..{....$;..j...Y.>..:..d..x......~.7{C..O.....:0a......Giu.....IEND.B`.

C:\Program Files (x86)\Fast!\ui\images\gears.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	GIF image data, version 89a, 256 x 256
Category:	dropped
Size (bytes):	92622
Entropy (8bit):	7.698979492898534
Encrypted:	false
SSDEEP:	1536:3WqVH70z3SdndGVSIs8h0e1S/bPnOY9P851LwU3bK/ZGOcG62Z6MMrsfPrTTdDg:3lFdpdmDs8hZ1mbPOYCnwU3Wxf6g6MMb
MD5:	2F2AD9512C7AD4EA794D3A5D6ADBD69E
SHA1:	76C48CE3DB2DCA18E28B2648EF34E7735F294772
SHA-256:	7D77AFE35414413C958C359B06DAA7DAD9C2A385D116E5870AAFB772261CDD98
SHA-512:	7568DCBFA138001DAA5D477CBC25E32DA92A5B776F0FDF0C80722CCFF9C2524B000D2868C464AF0090CBA8C3748FC28D388FAFB42A06A23B787A03BD2D4198A6
Malicious:	false
Preview:	GIF89a..........xaN............................................................................................................................................................\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..}..~................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.]...P.J.J...X.j....`..K...h.]...p..K...x..........L.....+^....#K.L....3k.....

C:\Program Files (x86)\Fast!\ui\images\grad.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	7.962335133869884
Encrypted:	false
SSDEEP:	192:sqd9LjOc71eEd9G7zIGHO3mgUD4Z2q5DO0sAmasbPbLiovYT7hE6/6co0il0:sY9Wc7d9G7zlHuUZqECma9/H/X
MD5:	DF9772D8383B587D8E0E2D78C1DECE5D
SHA1:	C7371EDD4272592A373E04A9B3A4D06C26A8DA0A
SHA-256:	F513EC17BA8716C92D362D0D892CC74ED5F5B1B45EA857D9F7D63794840696C6
SHA-512:	EC89CA890BEB39B2DD2DFC3CE91A93626F37305FCAFAED1185AD781EE5E10329AC75ACF5386F478B5627CBEDAA5F34DC6D6FAEA38A621EB589065DAF0E790C70
Malicious:	false
Preview:	.PNG........IHDR...d...d.....p.T...KiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about=""/>. </rdf:RDF>.</x:xmpmeta>.<?xpacket end="r"?> I.:.. .IDATx.}}Y.lI...O.7Te.!.-.. m.7...C;...C?..._8.A.......8..4.8..x....?e&.....;....D ..5.......F..H.5:.....vt}V_HT..rc....vw..w.Ym.......F .@d.e....@D"..H ..~......].....}n..i+...#....."..=..O5.B..(..=...$.=.P...N9...Q..R5..........P...q...zI)..{..\......C@u....7,...].wa...k...5..x..6..k....%.....N..H..#..5.h......v....#B.s..>z...f8.5.W...e._."B.sX.1.h..s7.Y.#..M...T..3gr....T.N\|.......F.}.o....B#c..<A.j....HU.'.oY....[..=..h.r.....1a.!....p..<&s.......OJf.@`h.......e.1....c..W..k.._..Sx...K...}.i...8q.H....R.7......:pK.'bN.8.b.<'q\;8....YV...'..9...SL.ZN...........GZ.N./..&Mz

C:\Program Files (x86)\Fast!\ui\images\msft.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	PNG image data, 172 x 73, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5011
Entropy (8bit):	7.9230181220317215
Encrypted:	false
SSDEEP:	96:bRci3PH/1hCVT+NCCGtcM/04yD57da+NjBYJcxKCP2:bRci31kh+NCCVM/A7da+NjBAlF
MD5:	9D3989274A9F42CE68270B6D62740980
SHA1:	257C28BABA104DCC8A15AEBE823FE944D9900FA6
SHA-256:	8CD8503A2ACB24D6B8B744A37300B71FBCD7E6EDE767F78C3747C5B4CE7F545E
SHA-512:	C6DE4375475AA556408AC8A16C7601E4934E10EF7B2675D161EB98FB5FD28A957E021D13227CC71880B6E51E53E3BA7CA2E38E4E3CAA8488A673D4536608BA81
Malicious:	false
Preview:	.PNG........IHDR.......I............KiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about=""/>. </rdf:RDF>.</x:xmpmeta>.<?xpacket end="r"?> I.:....IDATx....]Uu.?.4....ID .dB.Q.). D.....b.6Am...CEk.;.Z]..&b..6.R..t.4jQaa.J..!..$.!N..!..y.$.......=..9...&...]............{_....V`9.8r..X....b.sX.t..%h+T0.+#P.....!.1.........v....X.t..}.Y@......Fx....z.".......]..m...>..n.L.;.2.Q.xa@....h..@[+.8.+....j...K.r.....R...y7...w......-...l....TC.....\|..].h.:.G`.v....u..0ok.......`....-45T#z,E............B..v.i...{.`.;:...o.T..uH..RT`\|..c....r4=..B2G.Y,G.6.....}U8....h8.Ff...5...FT...h...mE........!..h...x.%r..V.hD..p..`.]B.....p5w....,.5Th.m.~.=..j&A.C.....Pa....R...BK!...Q.....<...D.1.=....>...p3pV..F...<........S.-...z..}.2O..I..J.8.5

C:\Program Files (x86)\Fast!\ui\images\patent.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	PNG image data, 95 x 43, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	9406
Entropy (8bit):	7.94022430872657
Encrypted:	false
SSDEEP:	192:EIIHUCD4wacvaKWaFGlENytchQA1QIEM91eBm:60wsKWaFGlEMtchQALv1im
MD5:	A325C56AC5095D3459A31023CBDDAAD8
SHA1:	77D2CE1EAA9775D901DC79A329D324C5F20F0E75
SHA-256:	2E7C88199F79F7EE899DF4333E85EA8959C6B156C1EA96DC0F0A1D3FE7D48F0E
SHA-512:	256D0826778D9B77FA79C4F6EDD482B9969276AE58EAD3514010EA937C5966F00E7FDFEA3938F8437402C76124E671DA0F902A2CFABF9DDC1A4C6EA8399D8A64
Malicious:	false
Preview:	.PNG........IHDR..._...+.....i.d....CiCCPICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m....... ......O......:..L..$R...J5e?

C:\Program Files (x86)\Fast!\ui\index.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7900
Entropy (8bit):	5.182745289197122
Encrypted:	false
SSDEEP:	96:++HHSG5zwOadswDylIbsfM3YOOOGbp/fHypKind/RDaW4pTfj+OYQhLQw72fkKmx:yG53Z6yHM3VMxWd47fj+OYQhP7OkKmx
MD5:	C3D925EF0D88E8D8372830FFA9CFAF9C
SHA1:	2577C96F15DDEA2E647FBD5AACABF9FFA6F1F984
SHA-256:	E83A36C8F39A084F1C2D118875747650CAB7F4A5D6489ACDCCE03D0D6B882910
SHA-512:	49177260DE2361DA28B3045E4A5D513B19CA58006C3E9AEBFFD8853B4257D3C0295F053782E15E57DF238EBD3F020586169CC753D80DDCFE8036122DC42E73F5
Malicious:	false
Preview:	<html>..<head>......<link href='css/opensans.css' rel='stylesheet'>..<link href='css/style.css' rel='stylesheet'>....<style>....</style>......</head>....<script src="js/jquery-2.1.4.min.js"></script>..<script src="js/circle-progress.js"></script>..<script src="js/chart.min.js"></script>....<video id=fastvid style='display:none; position: fixed; top:0; bottom:0; left:220px; right:0; z-index:0;' width='100%' height='100%' xloop nocontrols xautoplay>...<source src='vid/fast.webm' type='video/ogg'>..</video>......<body style="display:none; background:#111514;">....<div id=welcomeToFast style="position:absolute; top:150px; left:100px; font-size:42px; display:none"></div>....<div id=topHeadline style="position:absolute; top:10px; left:0px; width:100%; text-align: center;"></div>.. div id=topActivateBtn style="position:absolute; top:40px; left:0px; width:100%; text-align: center; font-size:14px; cursor:pointer; Display:none">Click Here to Activate Immediately</div-->....<div id=minimizeIc

C:\Program Files (x86)\Fast!\ui\js\chart.min.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	158750
Entropy (8bit):	5.366119866830528
Encrypted:	false
SSDEEP:	1536:OXZdEOLRr3NejQIooAIf9olnc3mfxZEtgsIC+Mc+CXxrP7eZYOcHBCF2RrUsAclj:4LetVBxpSxr6iHS2g+meI+B
MD5:	217CB5D4EA048DE6BD91DBCE1B3BC12E
SHA1:	C62B51022581122005182D235D78C19B8D53509F
SHA-256:	FEFEF4C25BBBDC09D6000B14AEFDAE1398A0A215E5402D6DF86C61052D49D408
SHA-512:	98A96C4B779E7CFD10447BD6E843AD6E97FDE08B3C1BD70FBB0C10F5533FF4D1E95ED3B965B152781BC1E198F2979E9B28E5030CAD9893ADCC0FAA012A88D445
Malicious:	false
Preview:	/!.. Chart.js.. * http://chartjs.org/.. * Version: 2.7.3.. .. Copyright 2018 Chart.js Contributors.. * Released under the MIT license.. * https://github.com/chartjs/Chart.js/blob/master/LICENSE.md.. */..!function(t){if("object"==typeof exports&&"undefined"!=typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{("undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:this).Chart=t()}}(function(){return function o(r,s,l){function u(e,t){if(!s[e]){if(!r[e]){var i="function"==typeof require&&require;if(!t&&i)return i(e,!0);if(d)return d(e,!0);var n=new Error("Cannot find module '"+e+"'");throw n.code="MODULE_NOT_FOUND",n}var a=s[e]={exports:{}};r[e][0].call(a.exports,function(t){return u(r[e][1][t]\|\|t)},a,a.exports,o,r,s,l)}return s[e].exports}for(var d="function"==typeof require&&require,t=0;t<l.length;t++)u(l[t]);return u}({1:[function(t,e,i){},{}],2:[function(t,e,i){var o=t(6);function n(t){if(t){

C:\Program Files (x86)\Fast!\ui\js\circle-progress.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15899
Entropy (8bit):	4.76323863494514
Encrypted:	false
SSDEEP:	384:wPeb21wglBqMcF14UxkPl/wxmFM2g7nR2Juv:n2W+qMGoVFM2UnR2Juv
MD5:	0912DF1CB8BC4B1D791524EC962FE932
SHA1:	ED06DCF2219A3AB5682E087D70B5177D6E182990
SHA-256:	0014E3CFD890D2C64B9AA76C610E6FCEE5800D1D23A0DCDA964BCC7F3F95EBA4
SHA-512:	D70D26073FD0C9D58B8FF0090D86BA4C2C4A1F51757603384C599B30137C2CE8440C59AE3F138B8B063A21F4F15043B5703438BC7FB92CE53B3EE9698800429A
Malicious:	false
Preview:	/*.. jquery-circle-progress - jQuery Plugin to draw animated circular progress bars:.. * {@link http://kottenator.github.io/jquery-circle-progress/}.. .. @author Rostyslav Bryzgunov <kottenator@gmail.com>.. * @version 1.2.1.. * @licence MIT.. * @preserve.. /..// UMD factory - https://github.com/umdjs/umd/blob/d31bb6ee7098715e019f52bdfe27b3e4bfd2b97e/templates/jqueryPlugin.js..// Uses AMD, CommonJS or browser globals to create a jQuery plugin...(function(factory) {.. if (typeof define === 'function' && define.amd) {.. // AMD - register as an anonymous module.. define(['jquery'], factory);.. } else if (typeof module === 'object' && module.exports) {.. // Node/CommonJS.. var $ = require('jquery');.. factory($);.. module.exports = $;.. } else {.. // Browser globals.. factory(jQuery);.. }..})(function($) {.. /.. Inner implementation of the circle progress bar... * The class is not exposed _yet_ but you can create an instance through jQuery method

C:\Program Files (x86)\Fast!\ui\js\jquery-2.1.4.min.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	84349
Entropy (8bit):	5.366942924126885
Encrypted:	false
SSDEEP:	1536:oP10iSi65U/dXXeyhzeBuG+HYE0mdDuJO1z6Oy4sh3J1x72BjmN7TwpDKba98HrA:f+41hJiz6fhdlTqya98HrA
MD5:	B0DC11D0A434AAFE88908C7F33D71095
SHA1:	1327F754FF87D26BCED46568543207E9DF190AAA
SHA-256:	DE4B3C3D1DC2506B6693F0F98884E1DC074CDA9D66CAB39B7B48A115FDFC4C0F
SHA-512:	177719EF74C4593E139FD254AACA5590B108338F1139041E24C56CA212BDC61CBFDCE9799C8A51FD7B67E587B920097294E834FDACE5127BCCA9CE2877F48EA0
Malicious:	false
Preview:	/! jQuery v2.1.4 \| (c) 2005, 2015 jQuery Foundation, Inc. \| jquery.org/license /..!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l=a.document,m="2.1.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,funct

C:\Program Files (x86)\Fast!\ui\js\ui.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	data
Category:	dropped
Size (bytes):	60800
Entropy (8bit):	5.859782781777608
Encrypted:	false
SSDEEP:	1536:7GFMP89bf37maw5co+Oluk8kpuRM+h9o2lQkf:e9ribWzkCPh9y2
MD5:	4FA7992DAE52FA80BC6CF22E640B82B7
SHA1:	C55C11458B361BDAD76832156C30E7CBC7F9E3F0
SHA-256:	BC2DC9C5B54C02DBADA76893CAB97254755837D9672963F984F534CEABEAF98F
SHA-512:	9F12619371D079D1830366D710DA53296676ABC6883381A85CB74900658B88B6D12EEB22BC01E2A3ABC8CE7C95D9A8AB6319386D5BA4A933BECF6BD3463414D9
Malicious:	false
Preview:	....v.C.T........GHL........D.....v..;..l....................T..... ...........................U...p.m.................................J.r.....gui.........a............2.......https................?.....win..............BN....bClosing............Y.X....bRunning............8....bFirstMinimize.............&.......bExpired........ ...."...bInExpiredSetting.... ............;....bEnterKey....$..........: ...bInActiveSetting.(.........~SC.....bTrial...,..........:......nTrialLeft...0.........&.k.....nMaxInterests....4.........6.Un....bShowInterests...8......... .u....fast_UUID....<............(....fast_Version.@.........R.......defaultBrowser...D.........b......bFirstError..H...... ..V."x"...bFirstStartReport....L.........\|......bTutorial....P...... .....0&...bTutorial_apps_word..T...... ...c.(...bTutorial_apps_excel.X......(..&.n.2...bTutorial_apps_powerpoint....\...... ..a.C$...bTutorial_apps_pdf...`...........}J....fast_urlPixel....d.........".2?....bSurvey..h.........g.. ...n

C:\Program Files (x86)\Fast!\ui\js\ui.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	45
Entropy (8bit):	4.461530252405225
Encrypted:	false
SSDEEP:	3:+BKSLDrbIoMLNLQJlWsren:+Dn4oRVre
MD5:	FE10063F4A895C45C6F50E4B031A7B7E
SHA1:	6B2E8F116DBDD03A7AD19C0C156C0C3824AA1AD4
SHA-256:	FE3E5FDBC7265A8463D2AB98D7066DF486717A760501CBCFB3E8EBD7478CCAA5
SHA-512:	36A8EA42F7D35192DF68246520A7F91946A8E7DCF3747112C6FB2DBB9159F2DC31AF527BC0A66772EE379E08C3036E16D6B191DC34AE0B3D324BC42F83EA32FD
Malicious:	false
Preview:	nw.Window.get().evalNWBin(null, 'js/ui.bin');

C:\Program Files (x86)\Fast!\ui\notify.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	5.339040171867944
Encrypted:	false
SSDEEP:	24:rh8rCPMcOSnqTQ0EWAGOQuNVM8VoJ7BPshFm5qL7s3sFgV7qGL1dCrH2x4GVNhOq:d8WHoTFEUD8WN8FiYtgZqmdCr5GVDUo
MD5:	EBAC1E1B46C40E3E46C4845C3EE223BE
SHA1:	86105E4884A664A898E1598E40C31250D007CB67
SHA-256:	AFD3C163BC581B1F24683CAFBD9CE2EC5C24F2C57FAB2382FEBE9194B94CB277
SHA-512:	9D74108AF0DAD9FFF67462133443AF1C832286F1B75397AAFAEDAB425DFD65BD0955637F5205F387E98202D564F6C524FD497189708EB7F7A08483B971B9879C
Malicious:	false
Preview:	<html>..<head>....<link href='css/opensans.css' rel='stylesheet'>..<link href='css/style.css' rel='stylesheet'>....</head>....<body style="background:transparent; display:none" onclick='onClk()'>..<div style='position:absolute; left:0px; top:0px; bottom:0px; right:0px; background:black; opacity:0.4'></div>..<img src='images/fast.png' style='position:absolute;left:10px;top:40px'>..<span id=notifyClose style='position:absolute; right:10px;top:10px;font-size:10px; cursor: pointer; display: none;' onclick="event.stopPropagation(); closeMe();">X</span>..<span id=notifyText style='position:absolute;left:50px;top:30px;font-size:16px'>..</span>..</body>....<script src="js/jquery-2.1.4.min.js"></script>....<script>..var gui = require('nw.gui');..var win = gui.Window.get();....win.x = screen.availWidth-win.width;..win.y = screen.availHeight-win.height;....win.setAlwaysOnTop(true);..win.show();....$('body').fadeIn("fast");....function getQueryParams(qs) {.. qs = qs.split('+').join(' ');....

C:\Program Files (x86)\Fast!\ui\package.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	334
Entropy (8bit):	4.584871869417259
Encrypted:	false
SSDEEP:	6:3HWLGbc65cCRvFNKM1G8/BoFkSH4xIr0HHvFJ8NjDIqONUVFyfV8NMukIAArVn:VQ65cCRv+8/PSYxI4HHuUTNUu9TukIA0
MD5:	04B3F58E3D1DEEEA1FB93746C618F358
SHA1:	3DF691AC206AD0A89B603DB034A760BA7CE1C98C
SHA-256:	91E700C9BDA2B8B0AD9479429B4DB598BF0DF5D0D7DD8D406BCCC214E0B4CE0D
SHA-512:	A8CC90B0DC721EBF357E4F7B07D34F603B75455191664686584639CAC7BC9F824E185398F3889E103BBDEDADB8872896F6356E995460F64EA96576AD46C1574B
Malicious:	false
Preview:	{.. "name": "FAST!",.. "main": "index.html",.. "window": {.. "title": "FAST!",..."icon": "images/fast.png",.. "toolbar": false,.. "width": 800,.. "height": 450,.. "show": false,.. "resizable": false,.. "frame": false,.. "transparent": true,.. "show_in_taskbar": false,..."always-on-top": true.. } ..}..

C:\Program Files (x86)\Fast!\ui\vid\fast.webm

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	WebM
Category:	dropped
Size (bytes):	1160514
Entropy (8bit):	7.901652490507714
Encrypted:	false
SSDEEP:	24576:3iZISjCDYvM5+1t0F/5ePRUgkzO2uk1H08sruk/+xURY7KjOslU2:FYAA0F/5ePJ2uka8sSk/qxsJ
MD5:	8A11E17C5B16557AE39C76966F355ADD
SHA1:	191AF04A6CAFC37DD4DD1C818F2EEF3EC31F65CB
SHA-256:	95746E5F06053CAEBCDA80E65EC58FABA62D07B054F1D7B3B9EC4A345DBB7B4C
SHA-512:	A99028B7D372491D3AF834D92AFFBF1C7506603DCC3CFF8662F1097AE1AC81F7B94393606D37CC074960078FD34BD687BCCB189EE57E5D7F46CE8D374BA179C6
Malicious:	false
Preview:	.E.........B...B...B..B..B..webmB...B....S.g.........M.t@-M..S...I.fS...M..S...T.kS...#M..S...S.kS........................................................................................................................................................................................I.f.......2...B@M..Lavf57.76.100WA.Lavf57.76.100D..@.X......T.k.......U........L..s....."...eng..V_VP8...#....U........ ...T.......T...UT....U..U...U....C.u...........J..........T....G...........z%.>....'e~a...'.O.E......H..................0?......+..._...............Jo.?...i?......U.;.@.....X./.x.U.m._.}D.o.o.;{P.c.......?..1<..&.....>.w.....p?....;.........7.O....v...W.7...../.......{...>..*..7....c..3.:.p.f..A......1.y..........9.I.s..\..&...Ms.4..8i5.p.k...9.I.s..\..&...Ms.4..8i5.p.k...9.I.s..\..&...Ms.4..8i5.p.k...9.I.s..\..&...Ms.4..8i5.p.k...9.I.s..\..&...Ms.4..8i5.p.k...9.I.s..\..&...Ms.4..8i5.p.k...9.I.s..\..&...Ms.4..8i5.p.k...9.I.s..\..&...Ms.4..8i5.p.k...9.I.s..\..&..

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x62b173ec, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.6429589253184702
Encrypted:	false
SSDEEP:	1536:GPBySB2nSB25SjlK/BHidB8ycYi/c9kea8K2rMPCCxYhHzecRPoKjhHzFO8w7nJB:GPYaoaflrd
MD5:	C260DDAF14C6D1D365B8B7A2BB6400D6
SHA1:	76EF166373D63F8B97175F3E160DC1B5A8D833DA
SHA-256:	892FEE8364AD9DC8C8F97C7ABAF52D59674484C4F335FB9B7F3779D1A227B60A
SHA-512:	11D36CB912D1D868BE6BA4C82E438BC8BA85CF5B7EDAFC46DE1C7D197C7C8EE2A0B55CBAE2FFDBDC9132EC0D1AA48B1ACE4B526DF9B1A9C80B7213F9DE522FE7
Malicious:	false
Preview:	b.s.... .......).........ah.....y......................^.......*....y..#1...z..h...........................n........y...........................................................................................................G......P....@...................................................................................................... ............y.........................................................................................................................................................................................................................................#1...z%[.................VU.#1...z...........................#..............................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\2d8399a4-38a9-4174-a4a0-88ac825ac791.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	106192
Entropy (8bit):	6.034511469891243
Encrypted:	false
SSDEEP:	1536:6UH2KOJiPcca2PH0SZRnpzrMwN+RV+04duSCZ23AAfhCsjUtjOjXMWG:6UW9fcNPH0EMwMRV+0fZ2P5RgyjXi
MD5:	272377B447A72D23A32F51F24BAA06BA
SHA1:	C5DCDB52866DD773940970B407C1702781F80C64
SHA-256:	9E18D9FACF5123806C6B48CF29B4CA6432FAA4283BD8CE114437019594071BB5
SHA-512:	6A2B648998C0C19711C862D82CE483459BC62CE8806DD44C21E45F8D643E5E8BC82474EEBAACC942654695F123EDA18E25A7050785E377AD66E594FCBFCF90FE
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"91.0.4472.77"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.654148987016205e+12,"network":1.654116588e+12,"ticks":179927169.0,"uncertainty":2155703.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABBQ7WxpM2gT7fMNkY5iRxkAAAAAAIAAAAAABBmAAAAAQAAIAAAALDWDwoLRYqp0NkiPsTxUN2QcOPsitaJrdacpo+ULE2PAAAAAA6AAAAAAgAAIAAAAOIeKQBWbQSCqXv1OSNS2lIZGHfAdJRwvbkapN4/FWvwMAAAAPz8I/w07KQb4Ut8ObsBGVgFwbuU88R362cCGZpNEtOEILJDMaKWOA4Y9ejBRTt5kEAAAADq8RkIezfgqGPgEaEMkhoGd9qhyBeyucXcRUPEI7mgYIxaDt8C5FJrjkEhV5EOUcUmR2SCzqYelImLnfOlbhRQ"},"policy":{"last_statistics_update":"13298622582860349"},"profile":{"info_cache":{"Default":{"active_time":1654148984.515801,"avatar_icon":"chrom

C:\Users\user\AppData\Local\Google\Chrome\User Data\33e5baec-e6dd-468a-86e0-b7f280fb1a1d.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	106173
Entropy (8bit):	6.034206870573671
Encrypted:	false
SSDEEP:	1536:6rH2KOJiPcca2PH0SZRnpzrMwN+RV+04duSCZ23AAfhCsjUtjOjXMWG:6rW9fcNPH0EMwMRV+0fZ2P5RgyjXi
MD5:	CABD668779FF920F1161F7D65389EA5B
SHA1:	E97BBA2289842AFBE0F88262A411CAEF0E6D4B4D
SHA-256:	630E689A9A2BF57AF18659933AFD76266A12F3BBDCC8E1522FACE58465793720
SHA-512:	DBF9FA85330E3EC114BAD5CEED51AF50EA138EED5207216E2D3973052AAD5BC90AA09547DF8EE05D2A3D7B38965D1CC7C8BAE7D3F61508E8F8D62C426F379310
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"91.0.4472.77"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.654148987016205e+12,"network":1.654116588e+12,"ticks":179927169.0,"uncertainty":2155703.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABBQ7WxpM2gT7fMNkY5iRxkAAAAAAIAAAAAABBmAAAAAQAAIAAAALDWDwoLRYqp0NkiPsTxUN2QcOPsitaJrdacpo+ULE2PAAAAAA6AAAAAAgAAIAAAAOIeKQBWbQSCqXv1OSNS2lIZGHfAdJRwvbkapN4/FWvwMAAAAPz8I/w07KQb4Ut8ObsBGVgFwbuU88R362cCGZpNEtOEILJDMaKWOA4Y9ejBRTt5kEAAAADq8RkIezfgqGPgEaEMkhoGd9qhyBeyucXcRUPEI7mgYIxaDt8C5FJrjkEhV5EOUcUmR2SCzqYelImLnfOlbhRQ"},"policy":{"last_statistics_update":"13298622582860349"},"profile":{"info_cache":{"Default":{"active_time":1654148984.515801,"avatar_icon":"chrom

C:\Users\user\AppData\Local\Google\Chrome\User Data\9756a547-abc4-4937-ae72-2f2117c9f629.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	97592
Entropy (8bit):	3.763239873642593
Encrypted:	false
SSDEEP:	384:2rn3M2IyM7QjCUYOSNB9YT/ggHfgluJnqOMgTspkxbvCjr2k8Q0eb8fhdBqz/g55:4GgSjbo7/AV7Al+RHKCGdQC
MD5:	2D2080E8E73F0D6E354B54BA7DC13C95
SHA1:	2E1CEAC99A2934ADCCD94D6977C0070A4D89B7AF
SHA-256:	D1EA212EE3847B05CA3AF66247C7C8A17AEE9EC0DFD0C36854576AA33B809275
SHA-512:	86D570E8CF7EA411EF010BEF7000A1E656392729B58BC44E5336E1194A9BCA2D890F70DEDCC1A4891571ED9E73D6A1087B0526528342EA6FF0EB19FECD44376B
Malicious:	false
Preview:	4}..............T...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e.\.2.1...0.8.3...0.4.2.5...0.0.0.3.\.a.m.d.6.4.\.F.i.l.e.S.y.n.c.S.h.e.l.l.6.4...d.l.l.......puA...c.:.\.p.r.o.g.r.a.m. .f.i.l.e.s. .(.x.8.6.).\.m.i.c.r.o.s.o.f.t. .o.n.e.d.r.i.v.e.\.2.1...0.8.3...0.4.2.5...0.0.0.3.\.a.m.d.6.4.\.......f.i.l.e.s.y.n.c.s.h.e.l.l.6.4...d.l.l.......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e."...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n.....2.1...0.8.3...0.4.2.5...0.0.0.3.....T...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e.\.2.1...0.8.3...0.4.2.5...0.0.0.3.\.a.m.d.6.4.\.F.i.l.e.S.y.n.c.S.h.e.l.l.6.4...d.l.l.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....]8. ...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.7.-.Z.i.p.\.7.-.z.i.p...d.l.l.......n\....%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.7.-.z.i.p.\.......7.-.z.i.p...d.l.l.......7.-.Z.i.p.......7.-.Z.i.p. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n.......1.9...0.0................]8.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.254162526001658
Encrypted:	false
SSDEEP:	3:FkXSoWA0:+g
MD5:	FA7200D6F80CD1757911C45559E59C0E
SHA1:	89C6E99BAEC4EBB3E9A97B928FB473D1498EBA88
SHA-256:	D9779EA4D6DD544A23C2A1C53146B6A4E596927F47DFA0680B0A7EE751D43BB2
SHA-512:	71D9B2DA8EAF404063D918812BA61C3EFB6A23A283B0332180A38C8137FBB21D7977C008D5A57A74469776945CD4ED42C0BCC09F923EDEC52D8F7FE90FA2D104
Malicious:	false
Preview:	sdPC.....................A.>'..M..,.,.-.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\258a3759-5ddf-4b11-a024-3efb29045e59.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2b9c3669-4403-4286-83e4-394d8eec625e.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	16306
Entropy (8bit):	5.5678752328093974
Encrypted:	false
SSDEEP:	384:4fxtFLlJXJ1kXqKf/pUZNCgVLH2HfEMrUXCK414s:ULlNJ1kXqKf/pUZNCgVLH2HfbrUXb41n
MD5:	9B23D14C90A1B4EA951C0F2655713EC0
SHA1:	690F7EEF9BB7664A7F9F4F09FBD00F86B7E93738
SHA-256:	C31D101B8728B6E939B320CFC30DC2749CBD806618CAE97AD353133B9075FF16
SHA-512:	DA101C9EE59A1B8D4602395C87210BC6EAD080D22597A53DF237CC8565D201FC96D851EC079214D271A5694BBE064029175B8751B6171827DEDAB81B866DAEF0
Malicious:	false
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13298622583288744","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3a0c0825-8cbf-4e88-ab3c-e224727a69d6.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	3488
Entropy (8bit):	4.954243832724031
Encrypted:	false
SSDEEP:	48:YcRvlHrAcqwoTw0FI8cO1TSUQ/9BhUIEyMoI3HmeSye7peVGiytqoonVuAip:n/ynnuaRWMoiVmde6tMVuAip
MD5:	D57C9E3030436B2394F36C77AC4131EB
SHA1:	6E4EF8013EDB722B1101397C40D2C7DC2E06F6A1
SHA-256:	D3B4571679F8F6DB10D61C88139642E64E16455086187840F46CD7DAA6483CAD
SHA-512:	5EC6B3F767F1D32A3370747DE4D5710C152A9BB592F3DDB76276943661589821D579A18FC8712064C324FF91A657CA03939C5652B90AB1830457E468697E958B
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13298622584850537","alternate_error_pages":{"backup":true},"autofill":{"orphan_rows_removed":true},"browser":{"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"this_week_number":2735},"default_apps_install_state":2,"domain_diversity":{"last_reporting_timestamp":"13298622584849608"},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"92.0.4515.107"},"gcm":{"product_category_for_subtypes":"com.chrome.windows"},"google":{"services":{"signin_scoped_device_id":"626983ea-122b-4740-ab2b-bebb37887cd1"}},"intl":{"selected_languages":"en-US,en"},"invalidation":{"per_sender_topics_to_handler":{"1013309121859":{},"8181035976":{}}},"media":{"device_id_salt":"2B01C0C58FD154FC9A91FE5107D8EBE0","engagement":{"schema_version":4}},

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\41ba3607-cb55-4e07-9a49-85bb1b243f5e.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	5.041412539319544
Encrypted:	false
SSDEEP:	96:npyJKInuaRWMoiVmde0kD1PlVrMVuAiZw4:nUJDWMEkDTVn
MD5:	37F4EE6916968714289196C4BFAC1EDB
SHA1:	ED3C37C78BE7EFA344ECFA3101AFA08B8C44B27B
SHA-256:	80E54BDF578294B3FF2702DE3FFB67A95865213D3EE125388FFF160C5C8288CA
SHA-512:	DD72CF75B2480EB0FC9098B900429666A51D116ACCEF2159241E94783CC299F80F48ABBBB7176C79E41E231259ACB580D531648A3910C1C45884B409D38B474D
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13298622584850537","alternate_error_pages":{"backup":true},"autocomplete":{"retention_policy_last_version":92},"autofill":{"orphan_rows_removed":true},"browser":{"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"this_week_number":2735,"this_week_services_downstream_foreground_kb":{"115188287":52,"21145003":243,"35565745":2,"5151071":2}},"default_apps_install_state":2,"domain_diversity":{"last_reporting_timestamp":"13298622584849608"},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"92.0.4515.107"},"gaia_cookie":{"changed_time":1654148987.49301,"hash":"2jmj7l5rSw0yVb/vlWAYkK/YBwk=","last_list_accounts_data":"[\"gaia.l.a.r\",[]]"},"gcm":{"product_category_for_subtypes":"com.chrome.windows"},"google":{"services":{

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\43b80ae6-3764-48c0-8a35-76eaa2919d43.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	3343
Entropy (8bit):	4.945222848960228
Encrypted:	false
SSDEEP:	48:YXsVVMHzzsmdAMHtKsyfDszmcQ/RLsOcXSsM1PzshVMH8sp1AAMHDysKGMHTFsB5:PGqGctrmKwGPTGD7GSGMphH
MD5:	CAB8BEABE7E66A4015C98A3C77B3698B
SHA1:	C960AAAEA7014E105290C7D0F09BFCA837C8E8CC
SHA-256:	75431010BFE77818B8BEF4B0C4B328C00668DC6B13C09AAB769EBF58BDA4EDF7
SHA-512:	0D1E94E84294AEA4BF400FF9D0654748BFFEB92D3A1643A6A13B541ADB1BC13EA2F649560A27C8CC3D8AEF9DA5D6B668C7E3BE696091CE882A475B91A9A4CAC8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3-29"],"expiration":"13270230891381309","port":443,"protocol_str":"quic"},{"advertised_alpns":["h3-Q050"],"expiration":"13270230891381310","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":39697},"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3-29"],"expiration":"13270230887958662","port":443,"protocol_str":"quic"},{"advertised_alpns":["h3-Q050"],"expiration":"13270230887958664","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":52163},"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3-29"],"expiration":"13270230886326794","port":443,"protocol_str":"quic"},{"advertised_alpns":["h3-Q050"],"expiration":"13270230886326795","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://clients2.google.com","supports_spdy

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5fe4f7ec-cda8-4efa-88de-51739877be04.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	18395
Entropy (8bit):	5.555345069958653
Encrypted:	false
SSDEEP:	384:4fxtFLlJXJ1kXqKf/pUZNCgVLH2HfEMrU5HG3CE414c8:ULlNJ1kXqKf/pUZNCgVLH2HfbrUdG31x
MD5:	EA6C89DE22B2196CD1FCACF36EEF02AA
SHA1:	35AF06B59911A6F2BBA2F797F6BAC261327C18CC
SHA-256:	9B1085EC7045DD842DE58A6BF7E657D0F757B75CCD614DB8A3C3AB2C5992A04E
SHA-512:	7800F32C567770552D27ABECC31F98F85783C79B1EFDA0CEA266A47582930CEEAAF8FA38BD1ED03FAEA92557468B0172EFFFAD684765953DB33E30A9F7FB3D12
Malicious:	false
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13298622583288744","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\897fab8e-53ef-4c04-9c1e-22d59f5d17ff.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	15765
Entropy (8bit):	5.57367828097689
Encrypted:	false
SSDEEP:	384:4Frt/LlJXQ1kXqKf/pUZNCgVLH2HfE8rUh+9O4142:2LlNQ1kXqKf/pUZNCgVLH2HfprUhgO4P
MD5:	8240EE8D291E63F6B4136A1BF749EB90
SHA1:	0109CEF39397A4CBDAEDCB0BAE3398549CD8B3B4
SHA-256:	C260C449C965DD407B90C70E13967A147BABDAA8FBCC13DE3DB05F594E972398
SHA-512:	8C1A08FF9F27F862BD1BBF87CBD7A5A4517F5C87112838C2C8566A94F9A192F3A319E2C963959441ABDC8F307D584586DEBC7997C853CED5FF0D230896A84B92
Malicious:	false
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13298622583288744","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9ee7fee9-7e1d-431f-9807-746968aefec0.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4329
Entropy (8bit):	5.039702145492446
Encrypted:	false
SSDEEP:	96:nGaJKInuaRWMoiVmde0kD1PlVrMVXAiZw4:nDJDWMEkDTVq
MD5:	53847795A6CAC5CF3B27809B87319E0C
SHA1:	D32BCBBB0E0E8B35E5AB38ECDEE149AF05D5EE85
SHA-256:	7383E23D04C2A92274BBBBBBB9A07283BCE5F2BCB5DD2A4440996B5C743DA3CE
SHA-512:	3D9B9B7926D545010F05A4B6D464331BF5CC0584D62466365CAEFC4F2AF045666698270EC60E10586649D5089C73308C844BF77B23A102129727855331E5BB2F
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13298622584850537","alternate_error_pages":{"backup":true},"autocomplete":{"retention_policy_last_version":92},"autofill":{"orphan_rows_removed":true},"browser":{"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"this_week_number":2735,"this_week_services_downstream_foreground_kb":{"112189210":6,"115188287":52,"21145003":243,"35565745":2,"5151071":2}},"default_apps_install_state":2,"domain_diversity":{"last_reporting_timestamp":"13298622584849608"},"download":{"directory_upgrade":true},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"92.0.4515.107"},"gaia_cookie":{"changed_time":1654148987.49301,"hash":"2jmj7l5rSw0yVb/vlWAYkK/YBwk=","last_list_accounts_data":"[\"gaia.l.a.r\",[]]"},"gcm":{"product_category_for_su

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	11336
Entropy (8bit):	6.0707244876366575
Encrypted:	false
SSDEEP:	192:AbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Ab+nldByaFx4toj8VEPT
MD5:	2E2110A99AD3AE9721A458C95C64C868
SHA1:	72AE17599EDC0B2DC61C41D946E3E296864F2CBA
SHA-256:	BB46BA705D5F6F43F66B07EA5DA4CC7CC0BF8FE635CCC4EBBA30A5D4A54158DE
SHA-512:	29D95D043F3E529DD33F73B3207A9167D479D9FC404209497B53229CF68AA634CB8A1FE3FD08512FD7F48AFB567144DB873FBBDAD8171D42968B97357F06BC1E
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["8D+nOE33nrpuAnTVcJlgMPWVo79reBkp3Z22WTJi5B8="],"block_size":4096,"path":"_locales/nb/messages.json"},{"block_hashes":["A+1PYW3V6CJbBuQ7aqrgYhyH3bT8PKyBXp3hN2slpI0=","WSOpQRkYTHjPSlG9Zif2a7TNhy43NDcG1Zg5Nv0UbH0=","jDctR8ImG5KZrQKm4kDjUB7FokSJfjo/pmvFowRVlaY=","LPxhhJiuU0lprt0T6flpS7TkaDg7MocrbmzO65xH6RI=","nZ9zLb2By96AkKXALRM+C0Eu11XUjPiMXEKjiCPdtHE=","wifibc1QfMBN2jrtUtLgsCefvuceTpAatmLvul11RJA=","dHjWlSIIdjj7MWqg3T8MG58RuuqRXk32vqi/13JqEgA=","zd3DV7dbvfNvx1hdhU01fW5ily52DLN0CFL/ADaEeTI=","DpjXcO85FFFY9KJFPkGNfFUtdQIOsGwO5jUckiUwY14=","gqid6l1+mk/6yWgUECRofI9lMipXgXh2jEN2+CxmPE0=","prDB91X2Mmfg/M/txVMITWBmEGbOGjqBTP7CMjYqdHs=","yLPAqV4gqoyS/zFkEt3Cn2j0q2v9QOSthVFfWn8EzCM=","EPQ3jzdrLkAHyvf3920B5Y3aAkO1IJdn/UtbnAmq6T0=","+oOc6ca+ChKUpTu+oa2ZRxRE+wG3QJmuYWEvYCs40NI=","3mBGNAiRlTANEQkqzU3TEi+5wJ0ubR5uwtS4/9OOM7w=","1A9NNawxuhu95H5eThvf1rewJ4QQWhhPNxJXO1C/n68=","E3vWLQxzmj+e5QxYbUscllJ5n0ITpw5JBHV1Kph3/KM=","i3I8ghdTF9c1ZXNBZmvsID+DV4gxBVN27rj9wsMtRpg=","R

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
Category:	dropped
Size (bytes):	181072
Entropy (8bit):	5.774426487043815
Encrypted:	false
SSDEEP:	1536:avbYFOZyYb37psk2SVlfN/qskVMxoZ51+XBY95/E5cCDd4QAOXxfzUBn2Y2l3P:a8Y7wqFTkVMO51+XBY96Nd4ByVuV2l3P
MD5:	1B40AC9ABB964672109D49ABFCFE2717
SHA1:	966E224F2887075825D42D2E7E0063BFAA81A99C
SHA-256:	503149B1B47F8296DEDB800251DBD9AF614856F0D7E6AB1C03DBC90EBCE53674
SHA-512:	00B50E49CAFD8246102BB460C7B96C20B50A2DDCB48A64C40D65901B517A2698DB9C5AA5EC7F143314DDB8D74624377F12A95C7F4D9FCE206473E8BBF126388B
Malicious:	false
Preview:	............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ .2v...M..(............. .................................]..X\.).H...>..Z............\..._...V...F...A...A.......^..Wb...f.)...l...v.M...B...@..Wc...[.....z...`...J.....9...E...k...R.D.......G...A.....;...E...h..XKd..KW..........D...>...=..X....GQ.JW..;M..8K..@H..=;.............JV.YKV.IT.BS.Y........................................(............. .....................................[..TZ.5.B...@..T................X...]...`...\...K...D...A...;.......3...\...e...V...h.).d.G.<...F...@...3...^..Td...X.....e....v.....:...E...=..T`...d...h.B.....?...;...O...B...A...b.!.g...Ru......9...8...P...C...C...l..U].M.5@..............6...C...@..T....EW..LX..=K..Ob..Me..5R..AX..;V..++......BL..KW..KW..DO..BL..EN..AJ..;1..................HT.UIV.FT.BQ.U..............................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	5.601545808516322
Encrypted:	false
SSDEEP:	24:5t+qpLWthpLDrgYBLWupLshFIU5U1jeeDod1d2dYnaZM34L0LBmH:X+qQHYAjEadW/Ru
MD5:	28F072C6646C0FBFE025D6DE9AA0AF94
SHA1:	FA856D13A1C4A21E3D1FFD401101E1315667B087
SHA-256:	2E2177B63E0A36D2044D1D6BAC8957EF1A683DA348B6915D9E776ACFDCC2DFD0
SHA-512:	31A7A8BAB0A471A887964886B51C1972C72F18DF492DE5B24D8F951B73C2C3EB4595F619F9BD0E859784D5D9E2DC048B6F7A57169F4BAC2636DD804588B0AA47
Malicious:	false
Preview:	............."f....11eb4d56..cd47..eb68..fb46..fb9922c35d94..guid..html..https..installing2..io..veryfast..installing........11eb4d56......cd47......eb68......fb46......fb9922c35d94......guid......html......https......installing......installing2......io......veryfast..2.........1........2.........3........4...........5.........6..........7........8........9........a..........b...........c.........d...........e..........f..........g..........h.........i...........l..........m........n.........o........p........r........s...........t............u........v........y...:x........................................................................................................................B.....r...... ........Nhttps://veryfast.io/installing2.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D942.:.................q...... ........Mhttps://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D942.:................J$.............$)27<A.......... %38=B

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1948
Entropy (8bit):	4.951313361789639
Encrypted:	false
SSDEEP:	48:Y2TtwDHXPqnyv3zs9dKDssjdRLsF85/sWlSbD:JTODHXin+xfl5lSH
MD5:	D8A12663862EE9B8EF2C147E2FA1D36A
SHA1:	B32BBADE100E1AE107816558D45E4238CE034FCD
SHA-256:	2D752C90F5BE126DEA828089BB51FB95A1E02F5E8649521B0439FABD4872EF7F
SHA-512:	48848C4CE88F6835BF9AA67E9E81FE43DFAEDFBC8081F6C97C42BA81A533E3250A90CD08765B8555BD4CD3B705A242D5FF49716A2E751BB663712BAD2D2ECD7A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://www.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://ssl.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://ogs.google.com","supports_spdy":true},{"isolation":[],"server":"https://apis.google.com","supports_spdy":true},{"isolation":[],"server":"https://update.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://www.google.com","supports_spdy":true},{"isolation":[],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"isolation":[],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3-29"],"expiration":"13301214587473849","port":443,"protocol_str":"quic"},{"advertised_alpns":["h3-Q050"],"expiration":"13301214587473853","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3-29"

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4420
Entropy (8bit):	5.048375376976625
Encrypted:	false
SSDEEP:	96:nNaJKInuaRWMoiVmde0kD1/VrMVXAiZw4:nsJDWMEkDhVq
MD5:	10BD7AD6FAAFE6957FF92F1E34F4EE07
SHA1:	B0A8B70EFA4172E4A46D12EB5E4DED8CD8F62A33
SHA-256:	E1FA9F1332F989394769515E68022934B8EF060A166667A2C28649E653665500
SHA-512:	F1FB334D7766A9913ABFE15A58B3F52E169EE4BCBCB5189D0B414123AFFBD77D82C09488993463725B40180BC2876C23E310802123DD82DE77F2F8B748FCB11D
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13298622584850537","alternate_error_pages":{"backup":true},"autocomplete":{"retention_policy_last_version":92},"autofill":{"orphan_rows_removed":true},"browser":{"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"this_week_number":2735,"this_week_services_downstream_foreground_kb":{"112189210":6,"115188287":52,"21145003":243,"35565745":2,"49601082":3,"5151071":2,"54845618":29}},"default_apps_install_state":2,"domain_diversity":{"last_reporting_timestamp":"13298622584849608"},"download":{"directory_upgrade":true},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"92.0.4515.107"},"gaia_cookie":{"changed_time":1654148987.49301,"hash":"2jmj7l5rSw0yVb/vlWAYkK/YBwk=","last_list_accounts_data":"[\"gaia.l.a.r\",[]]"},"gcm

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	18395
Entropy (8bit):	5.555345069958653
Encrypted:	false
SSDEEP:	384:4fxtFLlJXJ1kXqKf/pUZNCgVLH2HfEMrU5HG3CE414c8:ULlNJ1kXqKf/pUZNCgVLH2HfbrUdG31x
MD5:	EA6C89DE22B2196CD1FCACF36EEF02AA
SHA1:	35AF06B59911A6F2BBA2F797F6BAC261327C18CC
SHA-256:	9B1085EC7045DD842DE58A6BF7E657D0F757B75CCD614DB8A3C3AB2C5992A04E
SHA-512:	7800F32C567770552D27ABECC31F98F85783C79B1EFDA0CEA266A47582930CEEAAF8FA38BD1ED03FAEA92557468B0172EFFFAD684765953DB33E30A9F7FB3D12
Malicious:	false
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13298622583288744","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\91213544-5843-48b1-8445-c42009b45bd8.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.762700853527964
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJqjn1KKtiKnMb1KKtiVY:YHpoeS7PMVKJw1K3KnMRK3VY
MD5:	038931FF72A0C6AA0695A404960B1B22
SHA1:	90802F36B75C3CA70FC8CD1CF8BDFBAE0E8723A4
SHA-256:	BEF93811AE263E2E9145A44205340015843B1D4485D084BB642EAEB500FE564C
SHA-512:	97903821D21BB748255C29BE83BCA5BE61E0E36719050D4BB780EBC35424202A23F3ED4EE0056833E7748F1D55D82A5F38476298C5012202776BEA411DA7001E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.762700853527964
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJqjn1KKtiKnMb1KKtiVY:YHpoeS7PMVKJw1K3KnMRK3VY
MD5:	038931FF72A0C6AA0695A404960B1B22
SHA1:	90802F36B75C3CA70FC8CD1CF8BDFBAE0E8723A4
SHA-256:	BEF93811AE263E2E9145A44205340015843B1D4485D084BB642EAEB500FE564C
SHA-512:	97903821D21BB748255C29BE83BCA5BE61E0E36719050D4BB780EBC35424202A23F3ED4EE0056833E7748F1D55D82A5F38476298C5012202776BEA411DA7001E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PGP\011Secret Key -
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\f6cf3300-d328-4f28-9664-edd16cbc251d.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	139
Entropy (8bit):	4.762700853527964
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJqjn1KKtiKnMb1KKtiVY:YHpoeS7PMVKJw1K3KnMRK3VY
MD5:	038931FF72A0C6AA0695A404960B1B22
SHA1:	90802F36B75C3CA70FC8CD1CF8BDFBAE0E8723A4
SHA-256:	BEF93811AE263E2E9145A44205340015843B1D4485D084BB642EAEB500FE564C
SHA-512:	97903821D21BB748255C29BE83BCA5BE61E0E36719050D4BB780EBC35424202A23F3ED4EE0056833E7748F1D55D82A5F38476298C5012202776BEA411DA7001E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\af17c4d1-dbef-4423-98cf-49ac35381de7.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1948
Entropy (8bit):	4.951313361789639
Encrypted:	false
SSDEEP:	48:Y2TtwDHXPqnyv3zs9dKDssjdRLsF85/sWlSbD:JTODHXin+xfl5lSH
MD5:	D8A12663862EE9B8EF2C147E2FA1D36A
SHA1:	B32BBADE100E1AE107816558D45E4238CE034FCD
SHA-256:	2D752C90F5BE126DEA828089BB51FB95A1E02F5E8649521B0439FABD4872EF7F
SHA-512:	48848C4CE88F6835BF9AA67E9E81FE43DFAEDFBC8081F6C97C42BA81A533E3250A90CD08765B8555BD4CD3B705A242D5FF49716A2E751BB663712BAD2D2ECD7A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://www.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://ssl.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://ogs.google.com","supports_spdy":true},{"isolation":[],"server":"https://apis.google.com","supports_spdy":true},{"isolation":[],"server":"https://update.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://www.google.com","supports_spdy":true},{"isolation":[],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"isolation":[],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3-29"],"expiration":"13301214587473849","port":443,"protocol_str":"quic"},{"advertised_alpns":["h3-Q050"],"expiration":"13301214587473853","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3-29"

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\be9ca23e-358f-4b0a-9aec-4a48825c937e.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	16305
Entropy (8bit):	5.567714025684011
Encrypted:	false
SSDEEP:	384:4fxtyLlJXJ1kXqKf/pUZNCgVLH2HfEMrU8CK414O:ZLlNJ1kXqKf/pUZNCgVLH2HfbrU8b41N
MD5:	400849DD6153422DA1786303C939E55A
SHA1:	1DE7DC1FCF0427C93C085D4BB1F31D6C8E51BB1B
SHA-256:	67F3B113D88C3DFA9DF996C26885378ABE833D24A7BE3008EF015ECEFA3D64A8
SHA-512:	4F84A53A46D020E76B2026F13DA741B127A9B0B287002D528071F8FF77AFFC68A5E8CF13D2A939B8A55B229EEACF6CF405683D54814F57826ECB3AFA32135608
Malicious:	false
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13298622583288744","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\c86e8558-13b7-4bd7-a42b-6b059f130309.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	3488
Entropy (8bit):	4.954061694120719
Encrypted:	false
SSDEEP:	48:YcRvlHrAcqwoTw0FI8cO1TSUQ/9BhUIEyMoI3HmeSye7peVGiytqoonVuzip:n/ynnuaRWMoiVmde6tMVuzip
MD5:	62B4C450770035EBFA3BF5B37A1FD606
SHA1:	5EC3E09BA47F1C911937DFD6991D8DA19CD87D1A
SHA-256:	6708DCD566F87DEB3588FE3BC806E818645E7E698C088A2635D2D1094639A2D0
SHA-512:	F2F0929B494BC20ACCD20CB3A6712150BCC96E85174E16EDB9579091C3D5929493DD6DC89D480182DF72130E69FF7D1636FCB6BF71D09D8EE4ACB27BB7F4E512
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13298622584850537","alternate_error_pages":{"backup":true},"autofill":{"orphan_rows_removed":true},"browser":{"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"this_week_number":2735},"default_apps_install_state":2,"domain_diversity":{"last_reporting_timestamp":"13298622584849608"},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"92.0.4515.107"},"gcm":{"product_category_for_subtypes":"com.chrome.windows"},"google":{"services":{"signin_scoped_device_id":"626983ea-122b-4740-ab2b-bebb37887cd1"}},"intl":{"selected_languages":"en-US,en"},"invalidation":{"per_sender_topics_to_handler":{"1013309121859":{},"8181035976":{}}},"media":{"device_id_salt":"2B01C0C58FD154FC9A91FE5107D8EBE0","engagement":{"schema_version":4}},

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cb892a2a-8def-461d-adbf-8e4801587eb3.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
Category:	dropped
Size (bytes):	181072
Entropy (8bit):	5.774426487043815
Encrypted:	false
SSDEEP:	1536:avbYFOZyYb37psk2SVlfN/qskVMxoZ51+XBY95/E5cCDd4QAOXxfzUBn2Y2l3P:a8Y7wqFTkVMO51+XBY96Nd4ByVuV2l3P
MD5:	1B40AC9ABB964672109D49ABFCFE2717
SHA1:	966E224F2887075825D42D2E7E0063BFAA81A99C
SHA-256:	503149B1B47F8296DEDB800251DBD9AF614856F0D7E6AB1C03DBC90EBCE53674
SHA-512:	00B50E49CAFD8246102BB460C7B96C20B50A2DDCB48A64C40D65901B517A2698DB9C5AA5EC7F143314DDB8D74624377F12A95C7F4D9FCE206473E8BBF126388B
Malicious:	false
Preview:	............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ .2v...M..(............. .................................]..X\.).H...>..Z............\..._...V...F...A...A.......^..Wb...f.)...l...v.M...B...@..Wc...[.....z...`...J.....9...E...k...R.D.......G...A.....;...E...h..XKd..KW..........D...>...=..X....GQ.JW..;M..8K..@H..=;.............JV.YKV.IT.BS.Y........................................(............. .....................................[..TZ.5.B...@..T................X...]...`...\...K...D...A...;.......3...\...e...V...h.).d.G.<...F...@...3...^..Td...X.....e....v.....:...E...=..T`...d...h.B.....?...;...O...B...A...b.!.g...Ru......9...8...P...C...C...l..U].M.5@..............6...C...@..T....EW..LX..=K..Ob..Me..5R..AX..;V..++......BL..KW..KW..DO..BL..EN..AJ..;1..................HT.UIV.FT.BQ.U..............................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000006.dbtmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Tv:1qIFj
MD5:	AEFD77F47FB84FAE5EA194496B44C67A
SHA1:	DCFBB6A5B8D05662C4858664F81693BB7F803B82
SHA-256:	4166BF17B2DA789B0D0CC5C74203041D98005F5D4EF88C27E8281E00148CD611
SHA-512:	B733D502138821948267A8B27401D7C0751E590E1298FDA1428E663CCD02F55D0D2446FF4BC265BDCDC61F952D13C01524A5341BC86AFC3C2CDE1D8589B2E1C3
Malicious:	false
Preview:	MANIFEST-000006.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Tv:1qIFj
MD5:	AEFD77F47FB84FAE5EA194496B44C67A
SHA1:	DCFBB6A5B8D05662C4858664F81693BB7F803B82
SHA-256:	4166BF17B2DA789B0D0CC5C74203041D98005F5D4EF88C27E8281E00148CD611
SHA-512:	B733D502138821948267A8B27401D7C0751E590E1298FDA1428E663CCD02F55D0D2446FF4BC265BDCDC61F952D13C01524A5341BC86AFC3C2CDE1D8589B2E1C3
Malicious:	false
Preview:	MANIFEST-000006.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\e98a4c5a-f168-45c2-a609-aa35e4f0d9f0.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4420
Entropy (8bit):	5.048375376976625
Encrypted:	false
SSDEEP:	96:nNaJKInuaRWMoiVmde0kD1/VrMVXAiZw4:nsJDWMEkDhVq
MD5:	10BD7AD6FAAFE6957FF92F1E34F4EE07
SHA1:	B0A8B70EFA4172E4A46D12EB5E4DED8CD8F62A33
SHA-256:	E1FA9F1332F989394769515E68022934B8EF060A166667A2C28649E653665500
SHA-512:	F1FB334D7766A9913ABFE15A58B3F52E169EE4BCBCB5189D0B414123AFFBD77D82C09488993463725B40180BC2876C23E310802123DD82DE77F2F8B748FCB11D
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13298622584850537","alternate_error_pages":{"backup":true},"autocomplete":{"retention_policy_last_version":92},"autofill":{"orphan_rows_removed":true},"browser":{"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"this_week_number":2735,"this_week_services_downstream_foreground_kb":{"112189210":6,"115188287":52,"21145003":243,"35565745":2,"49601082":3,"5151071":2,"54845618":29}},"default_apps_install_state":2,"domain_diversity":{"last_reporting_timestamp":"13298622584849608"},"download":{"directory_upgrade":true},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"92.0.4515.107"},"gaia_cookie":{"changed_time":1654148987.49301,"hash":"2jmj7l5rSw0yVb/vlWAYkK/YBwk=","last_list_accounts_data":"[\"gaia.l.a.r\",[]]"},"gcm

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	3.138546519832722
Encrypted:	false
SSDEEP:	3:tbloIlrJ5ldQxl7aXVdJiG6R0RlAl:tbdlrnQxZaHIGi0R6l
MD5:	DE9EF0C5BCC012A3A1131988DEE272D8
SHA1:	FA9CCBDC969AC9E1474FCE773234B28D50951CD8
SHA-256:	3615498FBEF408A96BF30E01C318DAC2D5451B054998119080E7FAAC5995F590
SHA-512:	CEA946EBEADFE6BE65E33EDFF6C68953A84EC2E2410884E12F406CAC1E6C8A0793180433A7EF7CE097B24EA78A1FDBB4E3B3D9CDF1A827AB6FF5605DA3691724
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.873140679513133
Encrypted:	false
SSDEEP:	3:mB4:mu
MD5:	3A0E5D4F452CF99191634D0FFAB744A0
SHA1:	F115BBB898EEFF640D8D19AD44A86C3FCDFFC0AD
SHA-256:	B9D528D3AE283039F4700C7E4E790744C58A26353A91B536DD91CBA4F648A35F
SHA-512:	87BF9DB30598EC454A02A4A32E5458E83870524D4AA497CB167C8A92B7521204B7B75E2BE18D61F9FBE51CA7DE8E35782AA65E6F6F11E4A4926A9B6C85D6528A
Malicious:	false
Preview:	92.0.4515.107

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	110775
Entropy (8bit):	6.064310878222599
Encrypted:	false
SSDEEP:	3072:QaT7p2W9fcNPH0EMwMRV+0fZ2P5RgyjXi:QaTIPP0EyV3fZWG
MD5:	0BDE77796BBEE9ACD31046463E48CB86
SHA1:	EAFB2538CCC77233215DF94B03CA2BFEB3DE0AC1
SHA-256:	014AA895ED9E9135B8A6AE9565E70887770853F3747347ED7A26B92582A42917
SHA-512:	235362FDAB1C199D91EA38A282B22C1AE60AA7C0B5FF1825AF92B73B6E28E7F165B9CB89E5B280120661CAA02B8224C657E0CA924AF65CB8715C8C406FF8FD58
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"91.0.4472.77"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.654148987016205e+12,"network":1.654116588e+12,"ticks":179927169.0,"uncertainty":2155703.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABBQ7WxpM2gT7fMNkY5iRxkAAAAAAIAAAAAABBmAAAAAQAAIAAAALDWDwoLRYqp0NkiPsTxUN2QcOPsitaJrdacpo+ULE2PAAAAAA6AAAAAAgAAIAAAAOIeKQBWbQSCqXv1OSNS2lIZGHfAdJRwvbkapN4/FWvwMAAAAPz8I/w07KQb4Ut8ObsBGVgFwbuU88R362cCGZpNEtOEILJDMaKWOA4Y9ejBRTt5kEAAAADq8RkIezfgqGPgEaEMkhoGd9qhyBeyucXcRUPEI7mgYIxaDt8C5FJrjkEhV5EOUcUmR2SCzqYelImLnfOlbhRQ"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13288110187304843"},"plugins":{"metadata":{"adobe-flash-player":{"displ

C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	97592
Entropy (8bit):	3.763239873642593
Encrypted:	false
SSDEEP:	384:2rn3M2IyM7QjCUYOSNB9YT/ggHfgluJnqOMgTspkxbvCjr2k8Q0eb8fhdBqz/g55:4GgSjbo7/AV7Al+RHKCGdQC
MD5:	2D2080E8E73F0D6E354B54BA7DC13C95
SHA1:	2E1CEAC99A2934ADCCD94D6977C0070A4D89B7AF
SHA-256:	D1EA212EE3847B05CA3AF66247C7C8A17AEE9EC0DFD0C36854576AA33B809275
SHA-512:	86D570E8CF7EA411EF010BEF7000A1E656392729B58BC44E5336E1194A9BCA2D890F70DEDCC1A4891571ED9E73D6A1087B0526528342EA6FF0EB19FECD44376B
Malicious:	false
Preview:	4}..............T...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e.\.2.1...0.8.3...0.4.2.5...0.0.0.3.\.a.m.d.6.4.\.F.i.l.e.S.y.n.c.S.h.e.l.l.6.4...d.l.l.......puA...c.:.\.p.r.o.g.r.a.m. .f.i.l.e.s. .(.x.8.6.).\.m.i.c.r.o.s.o.f.t. .o.n.e.d.r.i.v.e.\.2.1...0.8.3...0.4.2.5...0.0.0.3.\.a.m.d.6.4.\.......f.i.l.e.s.y.n.c.s.h.e.l.l.6.4...d.l.l.......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e."...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n.....2.1...0.8.3...0.4.2.5...0.0.0.3.....T...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e.\.2.1...0.8.3...0.4.2.5...0.0.0.3.\.a.m.d.6.4.\.F.i.l.e.S.y.n.c.S.h.e.l.l.6.4...d.l.l.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....]8. ...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.7.-.Z.i.p.\.7.-.z.i.p...d.l.l.......n\....%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.7.-.z.i.p.\.......7.-.z.i.p...d.l.l.......7.-.Z.i.p.......7.-.Z.i.p. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n.......1.9...0.0................]8.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\af4a7f67-0b06-423f-96f6-6d09e5f158ef.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	110681
Entropy (8bit):	6.064014526277796
Encrypted:	false
SSDEEP:	3072:QyT7pUW9fcNPH0EMwMRV+0fZ2P5RgyjXi:QyTSPP0EyV3fZWG
MD5:	B916C7DDA7DC2E7AF30E6B2E3C51DD94
SHA1:	00B9040B13329290F50E9A931E22705BB8FF5DB2
SHA-256:	3E530BE8AE50D358CCF3F3FE84B4EBC6B09D5E9B8B0F28FEA49743A70EB664E1
SHA-512:	A91AB403F135206B95EE0AF4B5741CA3F306E76EB871A620A3AF4E43C53210C52CF3E324B79E2D6770A809C59BEEEBDD9DC557227089873A9825B7F1873A5320
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"91.0.4472.77"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.654148987016205e+12,"network":1.654116588e+12,"ticks":179927169.0,"uncertainty":2155703.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABBQ7WxpM2gT7fMNkY5iRxkAAAAAAIAAAAAABBmAAAAAQAAIAAAALDWDwoLRYqp0NkiPsTxUN2QcOPsitaJrdacpo+ULE2PAAAAAA6AAAAAAgAAIAAAAOIeKQBWbQSCqXv1OSNS2lIZGHfAdJRwvbkapN4/FWvwMAAAAPz8I/w07KQb4Ut8ObsBGVgFwbuU88R362cCGZpNEtOEILJDMaKWOA4Y9ejBRTt5kEAAAADq8RkIezfgqGPgEaEMkhoGd9qhyBeyucXcRUPEI7mgYIxaDt8C5FJrjkEhV5EOUcUmR2SCzqYelImLnfOlbhRQ"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13288110187304843"},"plugins":{"metadata":{"adobe-flash-player":{"displ

C:\Users\user\AppData\Local\Google\Chrome\User Data\b34d5208-3af4-442a-8045-ffca22c64ede.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	94804
Entropy (8bit):	3.762956587460553
Encrypted:	false
SSDEEP:	384:lrn3M2IyM7XCVNB9YT/ggHfgluJnqOMgTspkxbvCjr2k00eb8fhdBqz/g5Jt/V/s:BgSjgo7/AV7Al+RHKCGdQB
MD5:	957C2147AB8E92F8B798914F01794653
SHA1:	5769E6502CCDE7D41D2FDD5037E79D1EAB35E630
SHA-256:	5B23F8BF41726018670D5B5AD81B7C1668462180EAAC126D437931855A9F032D
SHA-512:	D099FA2B0ADB0FB774260B68CAC5B423F7503D129563F7D4F70F942FEDB5767F39A7FD0902465F44A1F5A669C8FB4A5BA4DAA6889FD3756522A0608B6123D0C9
Malicious:	false
Preview:	Pr..............T...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e.\.2.1...0.8.3...0.4.2.5...0.0.0.3.\.a.m.d.6.4.\.F.i.l.e.S.y.n.c.S.h.e.l.l.6.4...d.l.l.......puA...c.:.\.p.r.o.g.r.a.m. .f.i.l.e.s. .(.x.8.6.).\.m.i.c.r.o.s.o.f.t. .o.n.e.d.r.i.v.e.\.2.1...0.8.3...0.4.2.5...0.0.0.3.\.a.m.d.6.4.\.......f.i.l.e.s.y.n.c.s.h.e.l.l.6.4...d.l.l.......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e."...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n.....2.1...0.8.3...0.4.2.5...0.0.0.3.....T...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e.\.2.1...0.8.3...0.4.2.5...0.0.0.3.\.a.m.d.6.4.\.F.i.l.e.S.y.n.c.S.h.e.l.l.6.4...d.l.l.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....]8. ...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.7.-.Z.i.p.\.7.-.z.i.p...d.l.l.......n\....%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.7.-.z.i.p.\.......7.-.z.i.p...d.l.l.......7.-.Z.i.p.......7.-.Z.i.p. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n.......1.9...0.0................]8.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\bbd9ebf3-ffa7-40d6-9f4f-74a5653488e4.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	106285
Entropy (8bit):	6.035095064367825
Encrypted:	false
SSDEEP:	1536:OUH2KOJiPcca2PH0SZRnpzrMwN+RV+04duSCZ23AAfhCsjUtjOjXMWG:OUW9fcNPH0EMwMRV+0fZ2P5RgyjXi
MD5:	F084F5D39572210C3AB1FD29A926C75B
SHA1:	5F03A3F75299E85F0EDA8C07B7FB471080C8192B
SHA-256:	6DE56168BB31B09EA29A31FDF28AD3FEFA1784990EEF84E85BBFC515DA2F9165
SHA-512:	40EF7946D7F609DAF82ECF1207CE14F73D223A2811F966057568F53743F903E49F4779DF4A1914594F55A4D0E37EC809F0C43939FE5004D25A844BC4FB6C2F55
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"91.0.4472.77"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.654148987016205e+12,"network":1.654116588e+12,"ticks":179927169.0,"uncertainty":2155703.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABBQ7WxpM2gT7fMNkY5iRxkAAAAAAIAAAAAABBmAAAAAQAAIAAAALDWDwoLRYqp0NkiPsTxUN2QcOPsitaJrdacpo+ULE2PAAAAAA6AAAAAAgAAIAAAAOIeKQBWbQSCqXv1OSNS2lIZGHfAdJRwvbkapN4/FWvwMAAAAPz8I/w07KQb4Ut8ObsBGVgFwbuU88R362cCGZpNEtOEILJDMaKWOA4Y9ejBRTt5kEAAAADq8RkIezfgqGPgEaEMkhoGd9qhyBeyucXcRUPEI7mgYIxaDt8C5FJrjkEhV5EOUcUmR2SCzqYelImLnfOlbhRQ"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13288110187304843"},"policy":{"last_statistics_update":"132986225828603

C:\Users\user\AppData\Local\Google\Chrome\User Data\bc1c2b6d-8aa8-47cf-a358-1f194b75ea0c.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	110681
Entropy (8bit):	6.064014526277796
Encrypted:	false
SSDEEP:	3072:QyT7pUW9fcNPH0EMwMRV+0fZ2P5RgyjXi:QyTSPP0EyV3fZWG
MD5:	B916C7DDA7DC2E7AF30E6B2E3C51DD94
SHA1:	00B9040B13329290F50E9A931E22705BB8FF5DB2
SHA-256:	3E530BE8AE50D358CCF3F3FE84B4EBC6B09D5E9B8B0F28FEA49743A70EB664E1
SHA-512:	A91AB403F135206B95EE0AF4B5741CA3F306E76EB871A620A3AF4E43C53210C52CF3E324B79E2D6770A809C59BEEEBDD9DC557227089873A9825B7F1873A5320
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"91.0.4472.77"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.654148987016205e+12,"network":1.654116588e+12,"ticks":179927169.0,"uncertainty":2155703.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABBQ7WxpM2gT7fMNkY5iRxkAAAAAAIAAAAAABBmAAAAAQAAIAAAALDWDwoLRYqp0NkiPsTxUN2QcOPsitaJrdacpo+ULE2PAAAAAA6AAAAAAgAAIAAAAOIeKQBWbQSCqXv1OSNS2lIZGHfAdJRwvbkapN4/FWvwMAAAAPz8I/w07KQb4Ut8ObsBGVgFwbuU88R362cCGZpNEtOEILJDMaKWOA4Y9ejBRTt5kEAAAADq8RkIezfgqGPgEaEMkhoGd9qhyBeyucXcRUPEI7mgYIxaDt8C5FJrjkEhV5EOUcUmR2SCzqYelImLnfOlbhRQ"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13288110187304843"},"plugins":{"metadata":{"adobe-flash-player":{"displ

C:\Users\user\AppData\Local\Google\Chrome\User Data\c08fdea1-3aa7-4232-bdfc-1be8bd0680bf.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	96852
Entropy (8bit):	3.7633638252343595
Encrypted:	false
SSDEEP:	384:Ofrn3M2IyM7QjCUYOSNB9YT/ggHfgluJnqOMgTspkxbvCjr2k00eb8fhdBqz/g5l:qGgSjgo7/AV7Al+RHKCGdQa
MD5:	F7B7AB19F50B5DD7338E9C57D4986A81
SHA1:	3A641E3D708D92E8204117D626D06A073641D35C
SHA-256:	95314D8361E2D576BCF46566ADF3DE5FA435181AE321624080B7F1568F79A332
SHA-512:	393D724576BF126C77C21326AD543DCB3D68F4FE0D057DA90D81764E5D9D5029B08887FEE77DDE4E92DCDA0A5726B3C05688105AA74CC554A789E87590F269E7
Malicious:	false
Preview:	Pz..............T...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e.\.2.1...0.8.3...0.4.2.5...0.0.0.3.\.a.m.d.6.4.\.F.i.l.e.S.y.n.c.S.h.e.l.l.6.4...d.l.l.......puA...c.:.\.p.r.o.g.r.a.m. .f.i.l.e.s. .(.x.8.6.).\.m.i.c.r.o.s.o.f.t. .o.n.e.d.r.i.v.e.\.2.1...0.8.3...0.4.2.5...0.0.0.3.\.a.m.d.6.4.\.......f.i.l.e.s.y.n.c.s.h.e.l.l.6.4...d.l.l.......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e."...M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n.....2.1...0.8.3...0.4.2.5...0.0.0.3.....T...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e.\.2.1...0.8.3...0.4.2.5...0.0.0.3.\.a.m.d.6.4.\.F.i.l.e.S.y.n.c.S.h.e.l.l.6.4...d.l.l.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....]8. ...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.7.-.Z.i.p.\.7.-.z.i.p...d.l.l.......n\....%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.7.-.z.i.p.\.......7.-.z.i.p...d.l.l.......7.-.Z.i.p.......7.-.Z.i.p. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n.......1.9...0.0................]8.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\c2d8c948-40e0-499a-b500-9f70e0bb25e7.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	110775
Entropy (8bit):	6.064310878222599
Encrypted:	false
SSDEEP:	3072:QaT7p2W9fcNPH0EMwMRV+0fZ2P5RgyjXi:QaTIPP0EyV3fZWG
MD5:	0BDE77796BBEE9ACD31046463E48CB86
SHA1:	EAFB2538CCC77233215DF94B03CA2BFEB3DE0AC1
SHA-256:	014AA895ED9E9135B8A6AE9565E70887770853F3747347ED7A26B92582A42917
SHA-512:	235362FDAB1C199D91EA38A282B22C1AE60AA7C0B5FF1825AF92B73B6E28E7F165B9CB89E5B280120661CAA02B8224C657E0CA924AF65CB8715C8C406FF8FD58
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"91.0.4472.77"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.654148987016205e+12,"network":1.654116588e+12,"ticks":179927169.0,"uncertainty":2155703.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABBQ7WxpM2gT7fMNkY5iRxkAAAAAAIAAAAAABBmAAAAAQAAIAAAALDWDwoLRYqp0NkiPsTxUN2QcOPsitaJrdacpo+ULE2PAAAAAA6AAAAAAgAAIAAAAOIeKQBWbQSCqXv1OSNS2lIZGHfAdJRwvbkapN4/FWvwMAAAAPz8I/w07KQb4Ut8ObsBGVgFwbuU88R362cCGZpNEtOEILJDMaKWOA4Y9ejBRTt5kEAAAADq8RkIezfgqGPgEaEMkhoGd9qhyBeyucXcRUPEI7mgYIxaDt8C5FJrjkEhV5EOUcUmR2SCzqYelImLnfOlbhRQ"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13288110187304843"},"plugins":{"metadata":{"adobe-flash-player":{"displ

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\98S549LJ\pixel[1].gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\98S549LJ\register[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	2.4688702187432865
Encrypted:	false
SSDEEP:	3:nVUdvGt1U:Zte
MD5:	86CF4BCCD386456CA8091DEC847A0AD1
SHA1:	F6E3A73D7A1284A46E62EDCEBC7351FF6854CF65
SHA-256:	002A1BEFFB815578D1551DF0D56F2153EAFDE7DCE1902FB3328421242726C19B
SHA-512:	620FACF072B2BF312180A0A5A48BF5688F9D53AD4699B5D676E041C4840082A87F5AD7DD82C216F1B5136FA1AF89EFF7FAEAEFED0F20547355B057A3DE4C61B7
Malicious:	false
Preview:	0,0,0,1,2,64,2,5,256,1,2,64,1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BJM855OV\SetupEngine[1].exe

Download File

Process:	C:\Users\user\Desktop\Setup 2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2665608
Entropy (8bit):	7.9968054029398585
Encrypted:	true
SSDEEP:	49152:+95oSXdgCeJhhNBF7YBNDW67KYmCUqZyDyPYyaFz8AgGHDrCGtE79JS8:+kydgdDBF7YB2YSr/yaFz8TQ/kTr
MD5:	5633DE5AF2C7D8E011EFE802CEC7B83E
SHA1:	681D6BDFB53BC36FC3DE4148CCC7B926775E8BC6
SHA-256:	28A7BAAFD30B03E8493C15BD1ACEB491502CFB2D90FA13110C4E19132BFDBE4D
SHA-512:	AACA439DAC7DD2CC5A2E4DE4B3A6B0E8382CE8019D2D3ECD155525217995A11263B4615B605D8DA2938D33B2B78B0E6F7000079BEE253E41A7BBEE578F3BF043
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 5%, Browse Antivirus: ReversingLabs, Detection: 19%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3(..RF..RF..RF.]...RF..RG.pRF.]...RF.qv..RF..T@..RF.Rich.RF.........................PE..L...oy.V.................`...........1.......p....@..................................)......................................t..........x............w(..4...........................................................p...............................text...<^.......`.................. ..`.rdata..j....p.......d..............@..@.data...8]...........x..............@....ndata...................................rsrc...x........ ...~..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BJM855OV\pixel[1].gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CE8D676K\SetupResources[1].exe

Download File

Process:	C:\Users\user\Desktop\Setup 2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	55410880
Entropy (8bit):	7.998952021709674
Encrypted:	true
SSDEEP:	1572864:Yq6r2jVe6d4iw4Gf+wznzARxcky/hCkpLvsxnfVXe503I:N6KjVxd40GfhzzARxckyZCCLANXe5qI
MD5:	884E1463B4CB20B28C3A80960E02AC2D
SHA1:	E6BFBCD90FEF4918754393F02B8D9D5A30B3D260
SHA-256:	94C3E4DB939C00F36DB55C752A7E452B8B76DA4752EA01491E2DE3FED2FE9C21
SHA-512:	3332415DED6FD0C8358769A3639DA30CE1A2FC738E07222848064DBDD49834AD59E06F039D69DDAEAE732A2699EA037DA18C83C849EB64CDACA10340E1AC4492
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3(..RF..RF..RF.]...RF..RG.pRF.]...RF.qv..RF..T@..RF.Rich.RF.........................PE..L...oy.V.................`...........1.......p....@...................................N......................................t......................8lM..............................................................p...............................text...<^.......`.................. ..`.rdata..j....p.......d..............@..@.data...8]...........x..............@....ndata...................................rsrc............ ...~..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QFX1KV1T\pixel[1].gif

Download File

Process:	C:\Users\user\Desktop\Setup 2.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QFX1KV1T\pixel[2].gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

C:\Users\user\AppData\Local\Temp\3a4f9369-9f86-491b-b19f-a21f31add6a2.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\497e70dd-af5c-4ea7-b5ae-04ca2fd1a912.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	248531
Entropy (8bit):	7.963657412635355
Encrypted:	false
SSDEEP:	3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5:	541F52E24FE1EF9F8E12377A6CCAE0C0
SHA1:	189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
SHA-256:	81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
SHA-512:	D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f\|.~.c.4.E.......0..0....H............0.......).'..b.$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.\|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$\|..\|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...\|!..A..L.+.=...kP.!.1..

C:\Users\user\AppData\Local\Temp\54e1edc3-c6c0-4a4f-b055-b431df86766f.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
Category:	dropped
Size (bytes):	30948
Entropy (8bit):	7.99105089802474
Encrypted:	true
SSDEEP:	768:jElAfPryn5QzShaPuChbhFbHRu/llKGr7J9FwyIlWg+S3:jElAfzyneSMPuKbvzUllKGzFDOWgv
MD5:	7F0FCE2F184F63FED8E9929FB106C282
SHA1:	0582EB5BFC7FCCCC1C77A860F00E351E61F5DC67
SHA-256:	7C33F333216849E50AFC9550DA7DA4450D221B837340716ACCEE3766FFD4A62B
SHA-512:	AD1CD5B804C08C4C25BD6F97153D3371156848A83682DF1829B0B113B60ED0B01D67B5CD737CB414C8B825E12C7E0D6B5F9B338F4AF7FC82BE8AAF4CA8E279BA
Malicious:	false
Preview:	............y..../...D4e.sH.v.{......mv9MR...&..b.`.P."........r.....X...9s.s..w..;...>.}8...O.ep....O.]...$KO.tu...2?Yfi.'ove..T.....(.N7.R..<yr....t..})......>[......."......'7.j......#.n..e1..Fr...........j5xH.~....yvw....y.....vI......IWT..)...\|...\..<=.V.C..}.fF..T.....~.~..:).....i...2./D.}...]..<+3T..Z.Q90.......3..7.e..p.:..-.P..n.}j....U...."...\|Gm...AdQ:...gz%n..:...K.o[...".n...(V..A...U.D.~x.Q..X.tw.F..,.Q...k.9.w.......2....t......XF....E./...Hu.%..].....7.T...X.\$4.~.....`..e\....}.X...`A...J.....k...$IO..OS:...=...R...q......FE.H.)M..WX/........6.._..ry..J..`.q.'....x^..[r..Z.Y:..0...g.y....#.1.'...F7M.6...S....7.To.G.... `#.......-."...^....;..8..{.6VhL?%uU...K....O9.`Y....b.5.,zP.+\..!.1wK.j.P].....jW.!.j...i3.v.<..n.P..g....~.x..z.8...2^..U.f.bt#.+.U..N......!.[.!#.C.A.xy.....p...n.mU,.....=.......h .ME..T/....lT\h,.U..........(.U ...Tf.?Zd8.2.V........../....Oyh.j.._.I.k..u...).3.r.3...j......O....+],...

C:\Users\user\AppData\Local\Temp\552637a5-4d90-4e04-9f95-b3a3e98bd54f.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
Category:	dropped
Size (bytes):	5168
Entropy (8bit):	7.956694278195136
Encrypted:	false
SSDEEP:	96:HLCk5oNLp/f4PvzusAnSWuaGqLiWuGVaNhZMHd0NJHp9873PDqQ7:H2vUv7AnSKnaNPM+4uA
MD5:	3E5CCD9B583763AF68E28C5101373167
SHA1:	2005CDC0A8070B65E321A197D576698ECC267496
SHA-256:	41412C0863920BA95E9FDBD3AF000CBE926A73C078997A233DF55379A5C4D274
SHA-512:	04BF4F7320326B085C40527797577D8770A30A1ED24A8587A000A5AE1D8F39E0B7F187DB14603295AC7A2901A4698683CC3BED2C2611539293A1927AB31BEAE1
Malicious:	false
Preview:	...........[ks.8..._.........#..,.G..8.;.55;.%..&5$e...... )..d.._...%.....s.....+..Uv}...]rq......luK.).zJh..3.&..Uu...W...s.H. .MV..\U3Ef.\.\|...TU.9.z )I...u.+.g3U`Zs.6d...JiJ.rU.IV.".'L\|8.d..j.J..q.....O."..<,...n...~\|E.dV.u.O..'"...e.uyJ?..?]~.?.......M.,.7...j.,.fz].. >+o.gz....<^(5.Jg_.Ap.U.i............?.8....,..../.iQ..8......A.DO/....?.~..N.~a.-..g.N~.......o.^...L.mW.]:{....../........[VkTu[wki.gK...;-.<...\.".3]..}V...)9i.V.P="m?......V.i...7..S.U.d..(..\....g....bU.....}........P9$.A...N..ckV..Qz..A....7..{pd.f.7....}6on.....7J;...Y..l>W...H.Z.........j.......Wk9vj+V.W.zAm.....P.oYo..\|........}.g.^.p...Z....l%cT\|LN3..H......{...~.J.%.!k.(.)..."....q.%.V.. d..MZ.`......o..m3....1.../..jeH........Q....X...j..o..\|.o.r..nVw._...9 .......o...l....!...{....xU5..}.x.I..3.vT%z.k..o..........^.S*.t(....+r\.u<...G.`.........g...r..?...}7.=.....c~.F.e..w.v$sC/.B.p.D~..J...:....7Vl3w...s.-"......]+..KO.~....%.I..?.&.o...\?.9..

C:\Users\user\AppData\Local\Temp\7884_408606812\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	3034
Entropy (8bit):	5.876664552417901
Encrypted:	false
SSDEEP:	48:p/hEc9q0S+UTKYM43z8nqMsfWRUWEADM/W9n7lqFkakzcVTGkcYTPi6zM:RGcg5z/jjjHgUnV278+aWLy4
MD5:	8B6C3E16DFBF5FD1C9AC2267801DB38E
SHA1:	F5CADC5914DF858C96C189B092BC89C29407BBAA
SHA-256:	FD986A547D9585E98F451B87CA85DEB4B61EE540C6FAC678D7BEDABF04653095
SHA-512:	37048EF8FADF62A26CAEC6EE90AC192429AB1E99424E5C68FACA90C0DAD68642C761FDCAC03FC38FA930841F91FA145A6943EC7F168D4F2FA426F1F092C2F502
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMveDg2XzY0L3BuYWNsX3B1YmxpY19wbmFjbF9qc29uIiwicm9vdF9oYXNoIjoiVkNUSHNJVHNUSXVncWNhV2ctWHVpTU1sdWloV1FSTE1sQnpTTGprdGhETSJ9LHsicGF0aCI6Il9wbGF0Zm9ybV9zcGVjaWZpYy94ODZfNjQvcG5hY2xfcHVibGljX3g4Nl82NF9jcnRiZWdpbl9mb3JfZWhfbyIsInJvb3RfaGFzaCI6ImxINWt2a1BvSVZZczZKVHhyOHc5Q2MxXzloVEJCX3lVSlF6VDZseVVNd0kifSx7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMveDg2XzY0L3BuYWNsX3B1YmxpY194ODZfNjRfY3J0YmVnaW5fbyIsInJvb3RfaGFzaCI6IkVuLVFQTW1HUm1xbG9Ud1gzOTAzckpsMkw0R25sQmdET1FhZlNKaHJ4Nk0ifSx7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMveDg2XzY0L3BuYWNsX3B1YmxpY194ODZfNjRfY3J0ZW5kX28iLCJyb290X2hhc2giOiJkT2lJVzRmdEdGNW9FY0k1UXYyYjBmdXNrUlYyaUVtdmxhbmV6MlpFc3VvIn0seyJwYXRoIjoiX3BsYXRmb3JtX3NwZWNpZmljL3g4Nl82NC9wbmFjbF9wdWJsaWNfeDg2XzY0X2xkX25leGUiLCJyb290X2hhc2giOiIzNEU5QU9EMmpqLWNoMzZQZ0NVV0YtMUpYWVhVdlNGY1I4bks1aWppcWNjIn0seyJwYXRoIjoiX3B

C:\Users\user\AppData\Local\Temp\7884_408606812\_platform_specific\x86_64\pnacl_public_pnacl_json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	507
Entropy (8bit):	4.68252584617246
Encrypted:	false
SSDEEP:	12:TjLJ7qaVgPPd8bdzQBXefosmc5T9+n6e1Cetm1JXcAwA:TJ7jViPOd8wfHmZ6RP15
MD5:	35D5F285F255682477F4C50E93299146
SHA1:	FB58813C4D785412F05962CD379434669DE79C2B
SHA-256:	5424C7B084EC4C8BA0A9C69683E5EE88C325BA28564112CC941CD22E392D8433
SHA-512:	59DF2D5F2684FACC80C72F9C4B7E280F705776076C9D843534F772D5A3D578BEE04289AEE81320F23FB4D743F3969EDF5BA53FEBBAC8A4D27F3BC53BCF271C3E
Malicious:	false
Preview:	{. "COMMENT": [. "This file serves as a template for the resource info description used by ", . "the NaCl Chrome plugin. It is kept in the NaCl repository to prevent ", . "hard-coding of NaCl-specific information inside the Chrome repository.". ], . "abi-version": 1, . "pnacl-arch": "x86-64", . "pnacl-ld-name": "ld.nexe", . "pnacl-llc-name": "pnacl-llc.nexe", . "pnacl-sz-name": "pnacl-sz.nexe", . "pnacl-version": "5dfe030a71ca66e72c5719ef5034c2ed24706c43".}

C:\Users\user\AppData\Local\Temp\7884_408606812\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_for_eh_o

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
Category:	dropped
Size (bytes):	2712
Entropy (8bit):	3.4025803725190906
Encrypted:	false
SSDEEP:	48:b/5D5V5PK82aTS6aTTw0Do1DttoyDNsEA:b/hbVic1ZtLDNsE
MD5:	604FF8F351A88E7A1DBD7C836378AE86
SHA1:	9D8D89AE9F13D6306E619A4EAAD51EDE91A5F9F3
SHA-256:	947E64BE43E821562CE894F1AFCC3D09CD7FF614C107FC94250CD3EA5C943302
SHA-512:	85B1EDA4C473E00034EE627B7ABB894A77E521BC6A91A91A4A3744CA7511CB0AF10B9723D9ECC2CE3378DD70B659DF842D8C11875958CB77070CF01EC0A15840
Malicious:	false
Preview:	.ELF..............>.................................@.....@.......................................PH.......,$J.l=....J.$<A[..@.A...M..A..ffffff..................PH......,$J.l=....J.$<A[..D..A...M..A..ffffff..................PH..1..,$J.l=....J.$<A[.......A...M..A..ffffff..................PH..SP..h.........fff...................h.........fff.............J.$<[.,$J.l=....J.$<.....f.....................................................................................................................................................................................NaCl....x86-64...........zR..x......................@....C....C.........8.......@....C....C.........T.......@....C....C.........p.......`....C....C..B...... .......................<...............@.......X.......................t........................clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pna

C:\Users\user\AppData\Local\Temp\7884_408606812\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_o

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
Category:	dropped
Size (bytes):	2776
Entropy (8bit):	3.5335802354066246
Encrypted:	false
SSDEEP:	48:b/5D5V5ej5ej5PjDdaTS6aTTw6DV1DtFouoyDOsTy:b/hbEEVJB1ZFhLDOsT
MD5:	88C08CD63DE9EA244F70BFC53BBCADF6
SHA1:	8F38A113A66B18BAA02E2C995099CF1145A29DAA
SHA-256:	127F903CC986466AA5A13C17DFDD37AC99762F81A794180339069F48986BC7A3
SHA-512:	78D2500493A65A23D101EC2420DC5F0CE8C75EFAC425C28547121643E4FB568E9D827EF2C0F7068159E043C86B986F29BF92C6BADC675F160B63C7B3512EB95F
Malicious:	false
Preview:	.ELF..............>.....................X...........@.....@.......................................PH.......,$J.l=....J.$<A[..@.A...M..A..ffffff..................PH......,$J.l=....J.$<A[..D..A...M..A..ffffff..................PH..1..,$J.l=....J.$<A[.......A...M..A..ffffff..................PH..,$J.l=....J.$<A[f........A...M..A..ffffff..................PH..,$J.l=....J.$<A[f........A...M..A..ffffff..................PH..SP..h.........fff.............J.$<[.,$J.l=....J.$<.....f.K...............`.......P.......................z...................................NaCl....x86-64...clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f)............zR..x......................@....C....C.........8.......@....C....C.........T.......@....C....C.........p.......@....C....C.................@....C....C.................@...

C:\Users\user\AppData\Local\Temp\7884_408606812\_platform_specific\x86_64\pnacl_public_x86_64_crtend_o

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
Category:	dropped
Size (bytes):	1520
Entropy (8bit):	2.799960074375893
Encrypted:	false
SSDEEP:	12:Bvx/ekjlM/NQQmTfR9yp9396QQmTfR9C6wRqD8MTDDw7lEOkSbfuEAXwX6BX2U8b:bDjO/NbmT3296bmT3Twk8qDwh7b7CD8
MD5:	75E79F5DB777862140B04CC6861C84A7
SHA1:	4DB7BDC80206765461AC68CEC03CE28689BBEE0C
SHA-256:	74E8885B87ED185E6811C23942FD9BD1FBAC9115768849AF95A9DECF6644B2EA
SHA-512:	FE3F86E926759E71494F2060C4ED3C883EBCAF20CB129A5AD7F142766C33FAB10B5FABC3C7C938E0E895E27EA0AC03CBFE8D0EEABF5300A4AD07F67FD96CC253
Malicious:	false
Preview:	.ELF..............>.................................@.....@.........................NaCl....x86-64.......clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f)...text..comment..bss..group..note.GNU-stack..eh_frame..shstrtab..strtab..symtab..data..note.NaCl.ABI.x86-64.......................................................!................................................................................................................................................................................................../../../pnacl/support/crtend.c.__EH_FRAME_END__...............................................................................................@...............................................................H.......................................P.......................H...............................

C:\Users\user\AppData\Local\Temp\7884_408606812\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=7511538a3a6a0b862c772eace49075ed1bbe2377, stripped
Category:	dropped
Size (bytes):	2163864
Entropy (8bit):	6.07050487397106
Encrypted:	false
SSDEEP:	24576:HPHonIwYZJ0ykwVO7Owf31yJKzCtxO8RSV4lY+PbeHVxCtjFV4lBNeSAmfGqa+A7:HvSMRwf3SKmlY+PyPvnM2Gq+
MD5:	0BB967D2E99BE65C05A646BC67734833
SHA1:	220A41A326F85081A74C4BB7C5F4E115D1B4B960
SHA-256:	C6C2D0C2FC3E38A9BFA19C78066439C2F745393F1FD1C49C3C6777F697222C76
SHA-512:	8EF8689E00E4B210A30444D18ED6247F364995ABEB2FD272064C3AF671EEDB4D9B8B67CA56F72FEBF8F56896D4EA7EC4B10CB445FFA1C710C1F312E9DA0E4896
Malicious:	false
Preview:	.ELF..............>..... .......@.........!.........@.8...@......................................................................................................................................................{......W...............................................@.......@...............P.td.....h.......h.......h......4b......4b..............Q.td................................................................NaCl....x86-64..............GNU.u.S.:j..,w...u...#w.......?......Y@.......@......1@......B@......P@.....@X@.....``@......h@.....pp@.....H.@.......@.......@.......@.......@.......@....`..@.......@.......A.......A......................p................@..............?.......A.........5.....?5.5...?.5.....?......P9..............PC.......?......0@................aCoc...?..`.(..?.y.P.D.?<.s..O.u......$@.......@...............@........................................ ... ....... .......@...`...`...`...`...................`...`...`...`...`...`...`...................................`...

C:\Users\user\AppData\Local\Temp\7884_408606812\_platform_specific\x86_64\pnacl_public_x86_64_libcrt_platform_a

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	40552
Entropy (8bit):	4.127255967843258
Encrypted:	false
SSDEEP:	768:xlP+1fzyUNVU5LmKxeOnjpD5eA/eUnUUxvT:xlP+1ryYMTekpD5eAWjuvT
MD5:	0CE951B216FCF76F754C9A845700F042
SHA1:	6F99A259C0C8DAD5AD29EE983D35B6A0835D8555
SHA-256:	7A1852EA4BB14A2A623521FA53F41F02F8BA3052046CF1AA0903CFAD0D1E1A7B
SHA-512:	7C2F9BF90EB1F43C17B4E14A077759FA9DC62A7239890975B2D6FD543B31289DC3B49AE456CA73B98DE9AC372034F340C708D23D9D3AAB05CCBDABDC56A6314E
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 624 `...................,...8...Z(..e...e...t...t...y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`........................fmod.fmodf.memcmp.memcpy.memmove.memset.__nacl_read_tp.__pnacl_init_irt.longjmp.setjmp.__Sz_fptosi_f32_i64.__Sz_fptosi_f64_i64.__Sz_fptoui_f32_i32.__Sz_fptoui_f32_i64.__Sz_fptoui_f64_i32.__Sz_fptoui_f64_i64.__Sz_sitofp_i64_f32.__Sz_sitofp_i64_f64.__Sz_uitofp_i32_f32.__Sz_uitofp_i32_f64.__Sz_uitofp_i64_f32.__Sz_uitofp_i64_f64.nacl_tp_tdb_offset.nacl_tp_tls_offset.__Sz_bitcast_16xi1_i16.__Sz_bitcast_8xi1_i8.__Sz_bitcast_i16_16xi1.__Sz_bitcast_i8_8xi1.__Sz_fptoui_4xi32_f32.__Sz_uitofp_4xi32_4xf32..e_fmod.o/ 0 0 0 644 2792 `..ELF..............>.....................(...........@.....@.......................................PH..AVAUATSfI.~.M..I.. E....@.A......D..D1.......8fI.~.M.....I.. E..A......D..D..t.D....D..f....D..=....r...Y...^.[A\A]A^..@..,$J.l=....J.$<A[A...M..

C:\Users\user\AppData\Local\Temp\7884_408606812\_platform_specific\x86_64\pnacl_public_x86_64_libgcc_a

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	132784
Entropy (8bit):	3.6998481247844937
Encrypted:	false
SSDEEP:	384:Hf0mOXYmeKzQUIdedRFvT5p1Ee2HyAlL3O4:Hf7OXdmWRJT5p1R2HyAhO4
MD5:	C37CA2EB468E6F05A4E37DF6E6020D0F
SHA1:	EA787E5EADFB488632EC60D8B80B555796FA9FE9
SHA-256:	C1483ED423FEE15D86E8B5D698B2CDAB89186CE7FF9C4E3D5F3F961FD80D7C6E
SHA-512:	01281DE92B281FB29E1ACA96AA64B740B65CC3A9097307827F0D8DB9E1C164C56AFCDFA0BF138EA670A596D55CE2C8D722760744E9FC9343BB6514417BF333BA
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 942 `....;...\|.......4...x..#...-...4l..E...M...U...]...n...u...~X...4.......................L......................t...p...............`......"...*...1...:...D...K...T...\...d...r\|..\|0.......x...........L.......\...8..........................__clzti2.__compilerrt_fmax.__compilerrt_fmaxf.__compilerrt_logb.__compilerrt_logbf.__ctzti2.__divdc3.__divdi3.__divmoddi4.__divmodsi4.__divsc3.__divsi3.__divti3.__fixdfdi.__fixdfsi.__fixdfti.__fixsfdi.__fixsfsi.__fixsfti.__fixunsdfdi.__fixunsdfsi.__fixunsdfti.__fixunssfdi.__fixunssfsi.__fixunssfti.__floatdidf.__floatdisf.__floatsidf.__floatsisf.__floattidf.__floattisf.__floatundidf.__floatundisf.__floatunsidf.__floatunsisf.__floatuntidf.__floatuntisf.compilerrt_abort_impl.__moddi3.__modsi3.__modti3.__muldc3.__muloti4.__mulsc3.__multi3.__popcountdi2.__popcountsi2.__popcountti2.__powidf2.__powisf2.__udivdi3.__udivmoddi4.__udivmodsi4.__udivmodti4.__udivsi3.__udivti3.__umoddi3.__umodsi3.

C:\Users\user\AppData\Local\Temp\7884_408606812\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_a

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	13514
Entropy (8bit):	3.8217211433441904
Encrypted:	false
SSDEEP:	192:uU9v4pXizdrEuxwk3vp20tprpdSGFwDqO:P9v4palvvc0tpFdSGFwmO
MD5:	4E8BEDA73EB7BD99528BF62B7835A3FA
SHA1:	DC0F263A7B2A649D11FF7B56FE9CFAC44F946036
SHA-256:	6B835FD48DF505EB336FF6518CE7B93BB0ED854DADAA5C1EEED48D420291F62C
SHA-512:	46116B8BABC719676D68FD40D2AC82F38A3D13D8A482ADFC6FC32A99170AC3420E52CC33242CCD0FA723ABF4FA5EDBB9CE16A09C729BF04AE4AFBB2F67A1E38B
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 94 `................._pnacl_wrapper_start.__pnacl_real_irt_query_func.__pnacl_wrap_irt_query_func..shim_entry.o/ 0 0 0 644 7392 `..ELF..............>..................... ...........@.....@.........................NaCl....x86-64..................................A.L....A.L...D...........D....A.....t+.. u..t"..A.D..........A... .....A.D...........f..D..<.......................Q.......................V.......................clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f).../../ppapi/native_client/src/untrusted/pnacl_irt_shim/shim_entry.c./mnt/data/b/build/slave/sdk/build/src/out_pnacl/x64.NACL_STARTUP_FINI.NACL_STARTUP_ENVC.NACL_STARTUP_ARGC.NACL_STARTUP_ARGV.NaClStartupInfoIndex.unsigned int.size_t.char.TYPE_na

C:\Users\user\AppData\Local\Temp\7884_408606812\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_dummy_a

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	2078
Entropy (8bit):	3.21751839673526
Encrypted:	false
SSDEEP:	24:MOcpdhWE5O/bZbmT3296bmT3TwQwDnvD/+R3:MHuECdaTS6aTTwXDvD/+l
MD5:	F950F89D06C45E63CE9862BE59E937C9
SHA1:	9CFAD34139CC428CE0C07A869C15B71A9632365D
SHA-256:	945B1C8A1666CBF05E8B8941B70D9D044BAAFB59B006F728F8995072DE7C4C40
SHA-512:	F9AFBB800A875EDCC63DEA4986179E73632B3182951A99C8B3D37DB454EFD7CC7192ECA5AC87514918A858BAD6DAEAB59548CA2E90EADA9900EF5B9F08E62CFC
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 30 `........._pnacl_wrapper_start..// 20 `.dummy_shim_entry.o/./0 0 0 0 644 1840 `..ELF..............>.................................@.....@.......................................PH..,$J.l=....J.$<.....f..D......................................NaCl....x86-64...clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f)............zR..x...................... ....C....C..... .........................rela.text..comment..bss..group..note.GNU-stack..rela.eh_frame..shstrtab..strtab..symtab..data..note.NaCl.ABI.x86-64.....................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7884_408606812\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=309d6d3d463e6b1b0690f39eb226b1e4c469b2ce, stripped
Category:	dropped
Size (bytes):	14091416
Entropy (8bit):	5.928868737447095
Encrypted:	false
SSDEEP:	196608:tKVqXp3Qev4dg6ilfHM8KLM2J3jqjnkZ:uqufB
MD5:	9B159191C29E766EBBF799FA951C581B
SHA1:	D1D4BBC63AB5FC1E4A54EB7B82095A6F2CE535EE
SHA-256:	2F4A3A0730142C5EE4FA2C05D27A5DEFC18886A382D45F5DB254B61B28ED642B
SHA-512:	0B4FF60B5428F81B8B1BCF3328CF80CBD88D8CE5E8BDBC236B06D5A54E7CF26168A3ABB348D87423DA613AB3F0B4D9B37CB5180804839F1CA158EC2B315DDF00
Malicious:	false
Preview:	.ELF..............>..... .......@...................@.8...@...............$.....................................................................................................................!.......!......'......G...............................................@.......@...............P.td............................D.......D...............Q.td................................................................NaCl....x86-64..............GNU.0.m=F>k....&...i........................0C......0C..0C..0E..............0C......0E.-DT.!.?.-DT.!.........................?........-DT.!...-DT.!.?.......?......................?..............?."..."..."..."......@.......`...................... ...@...`...................... ...@...`...................... ...@...`...................... ...@...`.......................................`... ...@...`...........`...`.......@...@....... ....1..`3.. 4..`-..`-...:...:...F..@H..`H...H...F...F...G...H.. H...F..@G...I.. I..@I..@G...G...I...I...J...G..`I..

C:\Users\user\AppData\Local\Temp\7884_408606812\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=4b15de4ab227d5e46213978b8518d53c53ce1db9, stripped
Category:	dropped
Size (bytes):	1901720
Entropy (8bit):	5.955741933854651
Encrypted:	false
SSDEEP:	12288:gXqUSpBjwQO2o8k+7zjidg4euCAauOILffvCpGy4Wh3BTFmHpq82K2/KsvPyla9d:gafZwcOdNe2auOepCBTFmJq3Kf8ksr
MD5:	9DC3172630E525854B232FF71499D77C
SHA1:	0082C58EDCE3769E90DB48E7C26090CE706AD434
SHA-256:	6AA1DA6C264E0AF4E32A004F4076C7557C6AC6D9C38B0C5DE97302D83FA248C3
SHA-512:	9E9584241A39EED1463D7D4C1B26AE570B839AA315778FF3400C61341EBA43B630307DE9F1532A265CA82EA69BDEA03EC9D963E59A18569C02DA8285449870FE
Malicious:	false
Preview:	.ELF..............>..... .......@...................@.8...@.............................................................................................0.......0................................................Y......................................................@.......@...............P.td....t^......t^......t^.......W.......W..............Q.td................................................................NaCl....x86-64..............GNU.K..J.'..b......<S...`...`... ...@...@.......@.............................................Y@......................p................@.......?..............?.......A.........5.....?5.5...?.5.....?......P9..............PC.......?......0@................aCoc...?..`.(..?.y.P.D.?<.s..O.u......$@.......@...............@`...`.......@.................................................. ...`... ... .......`................... ... ...@...`.......................@... Z...[...[...e.......... ...@... ...@...`........0...0...2..`4.. 6...7...9...~...~...z...{...{..

C:\Users\user\AppData\Local\Temp\7884_408606812\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.928261499316817
Encrypted:	false
SSDEEP:	3:STDLGswXEVBcVdBiTDt3zLsW:SPLGLErcVdBiDtf3
MD5:	C00BCE97F21B1AD61EB9B8CD001795EE
SHA1:	8E0392FF3DB267D847711C3F4E0D7468060E1535
SHA-256:	59F06F04230E32E8BC839F45B984D31D611930427B631C963D09E7064A602363
SHA-512:	9930E44A6ECC62505DBADCEED5E05645909FF09816FB12AAC0414E6D2830AC09758366C3B7D4EDD7839C87EB16DFA4C66D8981AE6237D408B37135C3506F4CD2
Malicious:	false
Preview:	1.6f6bc93dcd62dc251850d2ff458fda96083ceb7fbe8eeb11248b8485ef2aea23

C:\Users\user\AppData\Local\Temp\7884_408606812\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	573
Entropy (8bit):	4.859567579783832
Encrypted:	false
SSDEEP:	12:BLqG6yDJmL4mLDlG9hQ181G46XzrXc+EFfNqpaiOc+T5NqXIOclNqXL:BkylmL4mLDlJ18116XsRNqtZeNqXIZlE
MD5:	1863B86D0863199AFDA179482032945F
SHA1:	36F56692E12F2A1EFCA7736C236A8D776B627A86
SHA-256:	F14E451CE2314D29087B8AD0309A1C8B8E81D847175EF46271E0EB49B4F84DC5
SHA-512:	836556F3D978A89D3FC1F07FCED2732A17E314ED6A021737F087E32A69BFA46FD706EBBDFD3607FF42EDCB75DC463C29B9D9D2F122504F567BB95844F579831B
Malicious:	false
Preview:	{."update_url": "https://clients2.google.com/service/update2/crx",.. "description": "Portable Native Client Translator Multi-CRX",. "name": "PNaCl Translator Multi-CRX",. "manifest_version": 2,. "minimum_chrome_version": "30.0.0.0",. "version": "0.57.44.2492",. "platforms": [. {. "nacl_arch": "x86-32",. "sub_package_path": "_platform_specific/x86_32/". },. {. "nacl_arch": "x86-64",. "sub_package_path": "_platform_specific/x86_64/". },. {. "nacl_arch": "arm",. "sub_package_path": "_platform_specific/arm/". }. ].}.

C:\Users\user\AppData\Local\Temp\9a798f0b-c91c-4001-be3e-81c712e41a98.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
Category:	dropped
Size (bytes):	3110
Entropy (8bit):	7.933903341619943
Encrypted:	false
SSDEEP:	96:0MWjN1CDThRYxENcEvyGF/8WAr6Fv9MFghzqSl:0MWjN1gRYavR8WjMFQzqSl
MD5:	A83A2746B84F1CF573B02965B72ED592
SHA1:	85CC572D6F90029EB99AAFA56297D1BCA494313A
SHA-256:	DF4B53C1C7C48E80753D4945E6EC7847084F51BF57F0ED9D341326C74651D6EC
SHA-512:	C287F479EF572A06FF191C4E9A8A718507C97A2A45CB265D7DC65DD7922B80D36CE7660EC5D7EA9F3D1F1EF71C51C3E4F3D7973754F97A89B4F14D1B1FDE70DE
Malicious:	false
Preview:	............ko.7......J...../..v....... ....zE.\+.T..f..%wW.$........p8/.....z..\|a...}.#y.`.l..7Kr..T:'.UE,.&.i..Y............h...B.....gJ....%.\.?.f]1R..@3.jHA..eHi&.Q..`....g.__?'3^...@~X..a8............UN..%...&.F..K19".Y:.).L.L..WL..xxD>.P@ ...&'..j..)%.Q\..<!.3n.<#....;.gd2.LZ....x.m&.e.`&;.KX..."...<G....8.R.jsd....g.)..?.$=UVT...#.+g.!.......R..1..#D.k...3.Bj3iT......M..L....}..S.K.....zi..n.A{......n..o.0j..q...w...3.7.N..].>...zK..sr1#.d..Tk..ckB...<....j.a.M1oe.9.jIQ.y+...6.....]....v.X.......q.....a>...2`.WV.v.'..~.3.4.'8...hkT.H..9SOIF.%...;n.6.U....i!...2v.9/.;.....R..8.(..L.b....aY2ps% ."...x.V..Y[.h.....^.........U.....p.'.&m.....6..%pWE....:..o.k...<.....5....j.I...9...f..3.....-..0..D;......S.td/...........^_.v.)y ..Uf..q>.v2...0....o....Y%5;.5fn..{.......p_......B..V.......D.Y.l....q 3...sm.b..!..E....a. &.w.-.s..>..M_...`.0..k.!<SH...9$.....V.\A$..}..8....#`...,...3.W..k...\..xH.1).~.Y.L1.O...\.....k.....s..i+.....).0

C:\Users\user\AppData\Local\Temp\SetupEngine.exe

Download File

Process:	C:\Users\user\Desktop\Setup 2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2665608
Entropy (8bit):	7.9968054029398585
Encrypted:	true
SSDEEP:	49152:+95oSXdgCeJhhNBF7YBNDW67KYmCUqZyDyPYyaFz8AgGHDrCGtE79JS8:+kydgdDBF7YB2YSr/yaFz8TQ/kTr
MD5:	5633DE5AF2C7D8E011EFE802CEC7B83E
SHA1:	681D6BDFB53BC36FC3DE4148CCC7B926775E8BC6
SHA-256:	28A7BAAFD30B03E8493C15BD1ACEB491502CFB2D90FA13110C4E19132BFDBE4D
SHA-512:	AACA439DAC7DD2CC5A2E4DE4B3A6B0E8382CE8019D2D3ECD155525217995A11263B4615B605D8DA2938D33B2B78B0E6F7000079BEE253E41A7BBEE578F3BF043
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3(..RF..RF..RF.]...RF..RG.pRF.]...RF.qv..RF..T@..RF.Rich.RF.........................PE..L...oy.V.................`...........1.......p....@..................................)......................................t..........x............w(..4...........................................................p...............................text...<^.......`.................. ..`.rdata..j....p.......d..............@..@.data...8]...........x..............@....ndata...................................rsrc...x........ ...~..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SetupResources.exe

Download File

Process:	C:\Users\user\Desktop\Setup 2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	55410880
Entropy (8bit):	7.998952021709674
Encrypted:	true
SSDEEP:	1572864:Yq6r2jVe6d4iw4Gf+wznzARxcky/hCkpLvsxnfVXe503I:N6KjVxd40GfhzzARxckyZCCLANXe5qI
MD5:	884E1463B4CB20B28C3A80960E02AC2D
SHA1:	E6BFBCD90FEF4918754393F02B8D9D5A30B3D260
SHA-256:	94C3E4DB939C00F36DB55C752A7E452B8B76DA4752EA01491E2DE3FED2FE9C21
SHA-512:	3332415DED6FD0C8358769A3639DA30CE1A2FC738E07222848064DBDD49834AD59E06F039D69DDAEAE732A2699EA037DA18C83C849EB64CDACA10340E1AC4492
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3(..RF..RF..RF.]...RF..RG.pRF.]...RF.qv..RF..T@..RF.Rich.RF.........................PE..L...oy.V.................`...........1.......p....@...................................N......................................t......................8lM..............................................................p...............................text...<^.......`.................. ..`.rdata..j....p.......d..............@..@.data...8]...........x..............@....ndata...................................rsrc............ ...~..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ce831cd1-acac-4aa5-944e-eeb6fde20abe.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
Category:	dropped
Size (bytes):	28748
Entropy (8bit):	7.9918576871001425
Encrypted:	true
SSDEEP:	384:SU7ZPeF1W3JgUrqaO/8dOcbwy59NjS5BMYGYycIfPhrVx2NtsEeSeFzVXe/rxd:H7peFkZL9RZSz3gnhhGcpXetd
MD5:	2A37AD0EC191D53104BB46953AC6C43C
SHA1:	FD23FFC5B7E4A6B45FBD88A486D15FAA51DC07AE
SHA-256:	51F075EB69486CB23B32A0776782B4A1B2AF204429AB94510469E02B115E56CC
SHA-512:	AEB91CB7902A800D7B0C43627EC2B52121BC41BA29A1B6ABEDBFCFA4802254A0594ED239EA7A3F8D40241E43D436428D1E4AC117BD97269D78460F82F9BDCF68
Malicious:	false
Preview:	...........Zms.6..._..p..[.(.b[...M....N{..t ...S.......v...H.q.g:....]...p..6I8_d...C.\p.X$.2.p.g.8I}8.".D)$<..O...}.J9.3..a.i.'...x.....5O...x......I.M.!.'\.l.2.0.cN.fq....\......7..,......>.p...w&.KS.......(O.V>......O.r..V~J.`....U(..Y..MIy..w..g0e......D.,L..y..N.+..._....O.h.]...V....r................O.\|.:....Li..>COy......N.h.......R....Q%.,Xr.y...G8=.A....!8(..L....c....sA....t.Vl:...v...G;...^.l...#.t.>...k..d..kr...B......Pb.0..!..;9.....:~....j;....j.O..!B......?....^.]....;...[.g.B...%..'.7;.9.>..gP. p8...:.5l.Y.....Jp..R,.?..b..8O......h.X(..G.).Cz.C..%....x.ET.....AEi.../..0.. ....k.t...wl..e...H.i.F.....?.....z...?..........(../.O..R.?.4..7...j ..Q.....l..ob!..A..j...@..!).....K...MW.U.N.......W..Bh'8.'.y....Y.[o...PI..W....i...r.e..=.k^.WC..Uy.j..687^.z.#u5.4O...........-j.j3..L.1..F...8.......@l.9.c.aGC.R.&..j.Q-av?...[4.E..T8....u..+9.<.n.Qw.D..N..S..3.D...... .%C.j.7.Y.s(.0wq.ZI.#''#..[K.GJ ....4.....?

C:\Users\user\AppData\Local\Temp\chrome_BITS_7884_1637944473\0.57.44.2492_hnimpnehoodheedghdeeijklkeaacbdc.crx (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	6760942
Entropy (8bit):	7.967022493507665
Encrypted:	false
SSDEEP:	196608:t9+jC/EDtY24xYzXBXqn+uPo7NKP0XSGagLKhzi0:tkjCQm1xOXBGSK8iGaOKhz3
MD5:	B92BBCFD3C31F799C5863D78154DB555
SHA1:	86B1B058E1E7D2F1F35E830DB446B59E15670E5E
SHA-256:	6F6BC93DCD62DC251850D2FF458FDA96083CEB7FBE8EEB11248B8485EF2AEA23
SHA-512:	38BE0C179619C045A321D1FA2C67DDA8419A33075A87F548FEED9A858F5BA19B5B980C53D4A3BB5B745C7CE566B53773785AA1F7677E37DD5793CCAE76E83787
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b..........>l...j.`...........H1._.."..0.!.........S....Shg..J..k.R..u.7..l...C8...T...`...C..M.c....i.kd..6..[...y...,.e.....(.b...\tZ.........&.#.......C.._I>....BX...4.H....=..d.......^2..?.Q.5.4(.4..F?..,1gI...n......l...W.b.1L.e..I..%q..@......0..0....H............0........9...$.~...d1.....K.~.....#xs#%a...X..G..!y..C....D.x1.YL..)N.....\|<...F.PM.u.`...\|.K..c....M_....; r......s..A ..ov..Q...........l..J..:.b.nW. .1.`.c$.a.....\|I..].[.I....`NI.Y5...0l..}l.......>.O2.....).....w..I...w.....t...o.0...@........Z...~......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. nP..-...>..h...U...1C...

C:\Users\user\AppData\Local\Temp\chrome_BITS_7884_1637944473\BIT5B5C.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	6760942
Entropy (8bit):	7.967022493507665
Encrypted:	false
SSDEEP:	196608:t9+jC/EDtY24xYzXBXqn+uPo7NKP0XSGagLKhzi0:tkjCQm1xOXBGSK8iGaOKhz3
MD5:	B92BBCFD3C31F799C5863D78154DB555
SHA1:	86B1B058E1E7D2F1F35E830DB446B59E15670E5E
SHA-256:	6F6BC93DCD62DC251850D2FF458FDA96083CEB7FBE8EEB11248B8485EF2AEA23
SHA-512:	38BE0C179619C045A321D1FA2C67DDA8419A33075A87F548FEED9A858F5BA19B5B980C53D4A3BB5B745C7CE566B53773785AA1F7677E37DD5793CCAE76E83787
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b..........>l...j.`...........H1._.."..0.!.........S....Shg..J..k.R..u.7..l...C8...T...`...C..M.c....i.kd..6..[...y...,.e.....(.b...\tZ.........&.#.......C.._I>....BX...4.H....=..d.......^2..?.Q.5.4(.4..F?..,1gI...n......l...W.b.1L.e..I..%q..@......0..0....H............0........9...$.~...d1.....K.~.....#xs#%a...X..G..!y..C....D.x1.YL..)N.....\|<...F.PM.u.`...\|.K..c....M_....; r......s..A ..ov..Q...........l..J..:.b.nW. .1.`.c$.a.....\|I..].[.I....`NI.Y5...0l..}l.......>.O2.....).....w..I...w.....t...o.0...@........Z...~......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. nP..-...>..h...U...1C...

C:\Users\user\AppData\Local\Temp\diskspd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144688
Entropy (8bit):	6.667845757025275
Encrypted:	false
SSDEEP:	1536:4YRHFhhMmofU98VLVFqZ3/FnKk2vlQBOJ2LcjNal+laLMQ03hc3J2tjF6+hjIEKT:NRlhhMmh33NnaE6O0vF6wBYqW2popg4
MD5:	FC41CABDD3C18079985AC5F648F58A90
SHA1:	51A619DDCB3661AA8675C2D7483840AC4F991746
SHA-256:	FA159F50E67FB5829F0F2511E25111C719411E6B6152FEA97F3A296264C7D7A4
SHA-512:	691090B54CE52D7E8BCFFF2711ADE7A6A8BB21B409358D7BFFC2053A53C116C7C22896F21BA36945A54F094D963CD9361A132D2E165365FE287C02F3C60356ED
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...s..s..s.....z.....f.....{.....x..s........x......r......r..Richs..........PE..L...O.*W..........................................@..........................`............@...... ...........................!..x....0.. ............&..0....@..........8...............................@............ ...............................text...8........................... ..`.data...h...........................@....idata..j.... ......................@..@.rsrc... ....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dskres.xml

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	2622
Entropy (8bit):	5.1670376940837714
Encrypted:	false
SSDEEP:	48:l5tXK//6zXledsGZqdfb+6z3kELe9XwMZM6TPMCWmZQ6WGO7:LoWGZCkELezy64pGAGc
MD5:	A9B08A6074B16F612B20E4DB63EDEFE8
SHA1:	6A3FD106655061F3856B10EF1DEDBD20AC8EDFE3
SHA-256:	4DA3A867805472FBCA88E4BC5BCA881A41B1CF39C39833F5FDAF7FB4B47257BE
SHA-512:	86F00EC0AA62A528BEE3B5083FF10EB297A06EBA656495173365882F914ABCBF404448ADA16960E6510687E1BC2DD240D3F4B0BDCB1CA2B78E9AA88F894BF83C
Malicious:	false
Preview:	<Results>..<System>..<ComputerName>066656</ComputerName>..<Tool>..<Version>2.0.17a</Version>..<VersionDate>2016/5/01</VersionDate>..</Tool>..<RunTime>2022/06/02 05:50:42 GMT</RunTime>..<ProcessorTopology>..<Group Group="0" MaximumProcessors="2" ActiveProcessors="2" ActiveProcessorMask="0x3"/>..</ProcessorTopology>..</System>..<Profile>..<Progress>0</Progress>..<ResultFormat>xml</ResultFormat>..<Verbose>false</Verbose>..<TimeSpans>..<TimeSpan>..<CompletionRoutines>false</CompletionRoutines>..<MeasureLatency>false</MeasureLatency>..<CalculateIopsStdDev>false</CalculateIopsStdDev>..<DisableAffinity>false</DisableAffinity>..<Duration>10</Duration>..<Warmup>5</Warmup>..<Cooldown>0</Cooldown>..<ThreadCount>0</ThreadCount>..<IoBucketDuration>1000</IoBucketDuration>..<RandSeed>0</RandSeed>..<Targets>..<Target>..<Path>C:\Users\user\AppData\Local\Temp\testfile.temp</Path>..<BlockSize>4096</BlockSize>..<BaseFileOffset>0</BaseFileOffset>..<SequentialScan>false</SequentialScan>..<RandomAccess>fa

C:\Users\user\AppData\Local\Temp\nsr5A0A.tmp\INetC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.668346578219837
Encrypted:	false
SSDEEP:	384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
MD5:	92EC4DD8C0DDD8C4305AE1684AB65FB0
SHA1:	D850013D582A62E502942F0DD282CC0C29C4310E
SHA-256:	5520208A33E6409C129B4EA1270771F741D95AFE5B048C2A1E6A2CC2AD829934
SHA-512:	581351AEF694F2489E1A0977EBCA55C4D7268CA167127CEFB217ED0D2098136C7EB433058469449F75BE82B8E5D484C9E7B6CF0B32535063709272D7810EC651
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9<.EXR.EXR.EXR.b.).LXR.EXS..XR.b. .FXR.b.(.DXR.b...DXR.b.*.DXR.RichEXR.................PE..L....I6V...........!.....8...P......Q?.......P...................................................................... G..l....?..d.......(...............................................................................P............................text....7.......8.................. ..`.data...<<...P.......<..............@....rsrc...(............D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsr5A0A.tmp\KillProc.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	7.591489461851231
Encrypted:	false
SSDEEP:	384:DqIKV2NkzYqElRYhENOwN3uCyolsTMY29Goaz+QshqTPZHoErRZGAqcywHTswk4A:D3KexROO3uCyow2/RA9VRZtBzLk5
MD5:	6C2B245E89428FB917A5805815A4054E
SHA1:	5BCD987700DD761F02D2D1D024B8F20077985051
SHA-256:	0558BBDFE61EEFB680E8560A7D4B174447A9516098F9CD8B4C84BF1552CEE5C5
SHA-512:	ECB3FB77532D6FFA1CA08DF05A6A86B18138356E63CB40EDF68F97FC7FDF2E781A4EBEB1EFDB9F13F947304312DD19EF5C4A78DDC60843F5F726CDE69B2C57D4
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................`...........$.......0....@..........................@.......................................6..h...\5..<....0..\....................7......................................................................................UPX0....................................UPX1.....`.......V..................@....rsrc........0.......Z..............@..............................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

C:\Users\user\AppData\Local\Temp\nsr5A0A.tmp\SimpleSC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	62976
Entropy (8bit):	6.324320451317714
Encrypted:	false
SSDEEP:	1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
MD5:	D63975CE28F801F236C4ACA5AF726961
SHA1:	3D93AD9816D3B3DBA1E63DFCBFA3BD05F787A8C9
SHA-256:	E0C580BBE48A483075C21277C6E0F23F3CBD6CE3EB2CCD3BF48CF68F05628F43
SHA-512:	8357E1955560BF0C42A8F4091550C87C19B4939BF1E6A53A54173D1C163B133B9C517014AF6F7614EDDC0C9BBF93B3B987C4977B024B10B05B3DC4EB20141810
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................4......`.............@..........................0..................................................R.... ..............................................................................................................CODE....x........................... ..`DATA....@...........................@...BSS.....y................................idata..R...........................@....edata..............................@..P.reloc..............................@..P.rsrc........ ......................@..P.............0......................@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsr5A0A.tmp\WmiInspector.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	6.425120053243541
Encrypted:	false
SSDEEP:	1536:1Gg42gDj3f6+qSunYP4rayTba/KgCNgKONMjv1c4EotCsWjcdofV/D8DE:JTgn3dwra0iK6YjvFEojofV/IDE
MD5:	74C44D664457CEC263E2E2BC1C59CD7A
SHA1:	3C30917C961042933911D796A18CE338C5960BF3
SHA-256:	C2E0A3F3540E05FB36F1A17B0228FF4BA2C6BCEC89D9F806CD281C4D8D42161B
SHA-512:	9C0483ACF134F6FD727E2F8BA536953A3515EC7C3518DFF58F50D92573F033D9E2FE9DA65A62B6B32ABE393F2F79F32F611F4AFA947FF4A37C08C07E00814497
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$p.-`..~`..~`..~&@.~u..~&@:~...~...~a..~&@;~S..~...~i..~`..~...~mC?~a..~mC.~a..~mC.~a..~mC.~a..~Rich`..~........................PE..L....^UV...........!................Sp.......@............................... ............@.........................p...2.......P...............................p....A..8...............................@............@..<............................text...L-.......................... ..`.rdata..Nn...@...p...2..............@..@.data....:..........................@....rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsr5A0A.tmp\nsExec.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.036421331647997
Encrypted:	false
SSDEEP:	96:A7GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNw32E:qGgrwgcrEzylQBHkZwd0qJVgN7
MD5:	F9BE9E9ED447E7650434A7E46431BAEA
SHA1:	574080E6BD862099BDDBB4330D513CE0E2E9C506
SHA-256:	5797BA15A18B8C713DF62D4A630DDD81FEFEEB01A87D65D486D829991A1EDC83
SHA-512:	C939476C27A49B1D7EAC2657453FD3E1027AF5125FD750897E9315B36A48851D43196022E48F0D2DD5DE20BE94D3F6ECE09190ED6009C60D7FE35A8649499C1F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........PE..L...\y.V...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text...H........................... ..`.rdata..,.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\INetC.dll

Download File

Process:	C:\Users\user\Desktop\Setup 2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.668346578219837
Encrypted:	false
SSDEEP:	384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
MD5:	92EC4DD8C0DDD8C4305AE1684AB65FB0
SHA1:	D850013D582A62E502942F0DD282CC0C29C4310E
SHA-256:	5520208A33E6409C129B4EA1270771F741D95AFE5B048C2A1E6A2CC2AD829934
SHA-512:	581351AEF694F2489E1A0977EBCA55C4D7268CA167127CEFB217ED0D2098136C7EB433058469449F75BE82B8E5D484C9E7B6CF0B32535063709272D7810EC651
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9<.EXR.EXR.EXR.b.).LXR.EXS..XR.b. .FXR.b.(.DXR.b...DXR.b.*.DXR.RichEXR.................PE..L....I6V...........!.....8...P......Q?.......P...................................................................... G..l....?..d.......(...............................................................................P............................text....7.......8.................. ..`.data...<<...P.......<..............@....rsrc...(............D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Setup 2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	5.7433628862644
Encrypted:	false
SSDEEP:	192:Xv+cJZE61KRWJQO6tFiUdK7ckD4k7l1XRBm0w+NiHi1nSJ:Xf6rtFRdbQ1W+fn8
MD5:	0FF5120F1AFD0F295C2BAA0F7192D3F8
SHA1:	BDE842D5D11005DCB4FF1D4EA97DA31865477697
SHA-256:	4CA5BF1BEB4B802914C4D3E2F37861F6BA5ECF969CFEADF5855EDF58F647A721
SHA-512:	E049FFD7AACE8D136EEE007EE4F8DBC2AE8F3DCE79D1C633D9654392240F8215787DF8A6D08085257DB51F28FF2A8023A13333DDA3EA7F9BDC8B9C57B605F0A0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j....l.9..i....l.Richm.........................PE..L...^y.V...........!.................).......0...............................`......................................p2......t0..P............................P.......................................................0..X............................text............................... ..`.rdata.......0......."..............@..@.data...d....@.......&..............@....reloc.......P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\WmiInspector.dll

Download File

Process:	C:\Users\user\Desktop\Setup 2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	6.425120053243541
Encrypted:	false
SSDEEP:	1536:1Gg42gDj3f6+qSunYP4rayTba/KgCNgKONMjv1c4EotCsWjcdofV/D8DE:JTgn3dwra0iK6YjvFEojofV/IDE
MD5:	74C44D664457CEC263E2E2BC1C59CD7A
SHA1:	3C30917C961042933911D796A18CE338C5960BF3
SHA-256:	C2E0A3F3540E05FB36F1A17B0228FF4BA2C6BCEC89D9F806CD281C4D8D42161B
SHA-512:	9C0483ACF134F6FD727E2F8BA536953A3515EC7C3518DFF58F50D92573F033D9E2FE9DA65A62B6B32ABE393F2F79F32F611F4AFA947FF4A37C08C07E00814497
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$p.-`..~`..~`..~&@.~u..~&@:~...~...~a..~&@;~S..~...~i..~`..~...~mC?~a..~mC.~a..~mC.~a..~mC.~a..~Rich`..~........................PE..L....^UV...........!................Sp.......@............................... ............@.........................p...2.......P...............................p....A..8...............................@............@..<............................text...L-.......................... ..`.rdata..Nn...@...p...2..............@..@.data....:..........................@....rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\Desktop\Setup 2.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 4
Category:	dropped
Size (bytes):	26494
Entropy (8bit):	1.9568109962493656
Encrypted:	false
SSDEEP:	24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5:	CBE40FD2B1EC96DAEDC65DA172D90022
SHA1:	366C216220AA4329DFF6C485FD0E9B0F4F0A7944
SHA-256:	3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
SHA-512:	62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
Malicious:	false
Preview:	BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\nsDialogs.dll

Download File

Process:	C:\Users\user\Desktop\Setup 2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.052729239776183
Encrypted:	false
SSDEEP:	96:FtJ6tC4jcY5rKhkfL9SYdKkcxM2DjDf3GEfKvBKav+Yx4BndY7ndS27gA:Fyj6QS8HREf+BYYxAdqn420
MD5:	C4BE29CD82D2D02FABADB153C8A54846
SHA1:	8E7DC6B67ECAB045C735715C2D4E524CA6E774A4
SHA-256:	1D85D2A1216909905B095284894BFC54840C15E949B1BC8711734EEEA795A60F
SHA-512:	7ED721125672765B3774FE512DFF2B6AB7017D75409E2218C54809FD91FC37FF9356C0C2E11F8F05AED0F3FC515B90299A8B98EF611AD575B080AF0A4716F237
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.cXN`0XN`0XN`0XNa0mN`0.A=0UN`0.mP0]N`0.Hf0YN`0.nd0YN`0RichXN`0........................PE..L...\y.V...........!......... ...............0.......................................................................6..k....0.......`.......................p.......................................................0...............................text...G........................... ..`.rdata..k....0......................@..@.data........@......................@....rsrc........`....... ..............@..@.reloc..<....p......."..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\497e70dd-af5c-4ea7-b5ae-04ca2fd1a912.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	248531
Entropy (8bit):	7.963657412635355
Encrypted:	false
SSDEEP:	3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5:	541F52E24FE1EF9F8E12377A6CCAE0C0
SHA1:	189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
SHA-256:	81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
SHA-512:	D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f\|.~.c.4.E.......0..0....H............0.......).'..b.$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.\|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$\|..\|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...\|!..A..L.+.=...kP.!.1..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	796
Entropy (8bit):	4.864931792423268
Encrypted:	false
SSDEEP:	12:1HEJMLkSlwZGGMLkSlwZ+WYpU34f145Gb+dgoxTyO8ZpU34f1L0frhmJ03OyZnLt:1HE7n4gn8WYpYrbhz8ZpotHOGAOf6aD
MD5:	6F8E288A9AD5B1ED8633B430E2B4D4CA
SHA1:	F671D3D4BEFA431D1946D706F4192D44E29B6F08
SHA-256:	A114E2783D0E9B12155017323BA70838F0F82A71C7EE8DC1F115AE36991241F8
SHA-512:	0F87F3F0D115B872288949E59ACD3CD41B1FBC64A622D8FDA6D71FAFC5A900D92ADFBB0E7EB926F2A8759BBAA0896D48728FB719BBF5EF54AC21027328F7700C
Malicious:	false
Preview:	{.. "app_description": {.. "message": "........ . ... ........ .. Chrome".. },.. "app_name": {.. "message": "........ . ... ........ .. Chrome".. },.. "craw_app_unavailable": {.. "message": "........... .... ...... .. .............".. },.. "craw_connect_to_network": {.. "message": "...., ........ .. . ......".. },.. "iap_unavailable": {.. "message": "........... .... ...... .. .......... ....... .. .........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "...., ...... . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	675
Entropy (8bit):	4.536753193530313
Encrypted:	false
SSDEEP:	12:1HEJ0gbbGG0gbb+WYpU34g3YbiLO+dgyGFoO8ZpU34+puiPmb03OyZnLAOfTYABk:1HE5baib6WYpm31Lt0Z8Zp8pxOGAOfKD
MD5:	1FDAFC926391BD580B655FBAF46ED260
SHA1:	C95743C3F43B2B099FEBEBC5BD850F0C20E820AC
SHA-256:	C67898B67F9C9209EAFDA6532B62D5789863CFB855998DD6A70E7775316CEC20
SHA-512:	39D95D45C5746DA3BAA7AE6A3344EA17D7A7C3569C2A56959FF119261DA08C747A320FCF701AC72B8DBDBF8BF06FD8B239017A282CDDA444F3826D4EC672CBB4
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Sistema de pagaments de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagaments de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Ara mateix aquesta aplicaci. no est. disponible.".. },.. "craw_connect_to_network": {.. "message": "Connecteu-vos a una xarxa.".. },.. "iap_unavailable": {.. "message": "La funci. Pagaments a l'aplicaci. no est. disponible actualment.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicieu la sessi. a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	641
Entropy (8bit):	4.698608127109193
Encrypted:	false
SSDEEP:	12:1HEJfZGGfZ+WYpU34OBh+dgN/O8ZpU34j05U03OyZnLAOfTYWc:1HEl4G8WYpdt8Zpq5TOGAOfW
MD5:	76DEC64ED1556180B452A13C83171883
SHA1:	CFB1E56FD587BCDC459C1D9A683B71F9849058F9
SHA-256:	32290D69A90E6BAAC428B10382C99221B12773BB9A184F3B93DFB48A4F6D7A40
SHA-512:	5230A217968D5DC463E2E92D704544311A721E5CEF65C3125CBD8DEB9C0293D3BFB5C820A6011ABF77095FDEE7DAF67D541DC202B0C9CDB0908CBB85D84885CB
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "app_name": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikace v sou.asn. dob. nen. dostupn..".. },.. "craw_connect_to_network": {.. "message": "P.ipojte se pros.m k s.ti.".. },.. "iap_unavailable": {.. "message": "Platby v aplikaci aktu.ln. nejsou k dispozici.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "P.ihlaste se do Chromu.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.5289746475384565
Encrypted:	false
SSDEEP:	12:1HEJJMKKFZGGJMKKFZ+WYpU34OHu+dgxlCZO8ZpU34J4Wu03OyZnLAOfTYzD:1HErMKfqMKVWYpM6lL8ZpDNOGAOfiD
MD5:	238B97A36E411E42FF37CEFAF2927ED1
SHA1:	4E47AC90BA24C8F4724D9293FA40CFD4ADA66FE0
SHA-256:	4977D4A053542FF66967FAED6B06585DD70E68E20BFEB533B66FE3287F9655D9
SHA-512:	FD0742D47B5F5AB9AAD9B4C3D57F63CB693E060EECE123A72036C6E92156D099495C7E9E9CC6DC83EEBCDDCC4B4C81FB47E4C9559DA3EBA024780FFF10C53E0A
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Betalinger i Chrome Webshop".. },.. "app_name": {.. "message": "Betalinger i Chrome Webshop".. },.. "craw_app_unavailable": {.. "message": "Appen er ikke tilg.ngelig i .jeblikket.".. },.. "craw_connect_to_network": {.. "message": "Opret forbindelse til et netv.rk.".. },.. "iap_unavailable": {.. "message": "Betaling i appen er ikke tilg.ngelig i .jeblikket.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Log ind p. Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	651
Entropy (8bit):	4.583694000020627
Encrypted:	false
SSDEEP:	12:1HEJQ1ZGGQ1Z+WYpU34pCEMT+dgJMlCTO8ZpU34p6FK603OyZnLAOfTYJ6K:1HEzWWYp3Bewv8Zp7k4OGAOfQj
MD5:	6B3E916E8C1991AA0453CBA00FEDCAAA
SHA1:	D6366D15912E40CA107FD42BFE9579C3336A51F9
SHA-256:	A62FFAB910E31531758EEE48B2CC71A8857BEC3021DEAD50B668CBA3C8667053
SHA-512:	87EA4311B61F29543B13F3E17DFA919D0C320B4FE370CC152E0B1514BCA79B0ABB526DDCF08621D6EBFA48923EE8FB4C667EFB120A72BD9583EEBEE7BFB80552
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome Web Store-Zahlungen".. },.. "app_name": {.. "message": "Chrome Web Store-Zahlungen".. },.. "craw_app_unavailable": {.. "message": "Die App ist momentan nicht verf.gbar.".. },.. "craw_connect_to_network": {.. "message": "Bitte stellen Sie eine Verbindung zu einem Netzwerk her.".. },.. "iap_unavailable": {.. "message": "In-App-Zahlungen sind momentan nicht m.glich.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Bitte melden Sie sich in Chrome an.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.973349962793468
Encrypted:	false
SSDEEP:	24:1HEw+aZ+6WYpbWZe80A08ZpCGyDVWlOGAOf+XD:WguYpCZnpEZbGoD
MD5:	05C437A322C1148B5F78B2F341339147
SHA1:	AB53003A678E44A170E73711FBD9949833BBF3AA
SHA-256:	A052C32B4FCAC61152EB0ADB2C260FB6A8256AD104AA0013DB93E9798D41A070
SHA-512:	C36CB9202A34356DD06D377E2A088F428D0B8EBE7D2E54F8380485E9D94A0598D7F651C1E7A2FD55BE481D49C02B0812F2BA335E08611EC85EE0BD60784A6B40
Malicious:	false
Preview:	{.. "app_description": {.. "message": "........ ... Chrome Web Store".. },.. "app_name": {.. "message": "........ ... Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": ". ........ .... .. ..... ... ..... ..........".. },.. "craw_connect_to_network": {.. "message": ".......... .. ... .......".. },.. "iap_unavailable": {.. "message": ".. ........ ..... ......... ... ..... ..... .. ...... ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": ".......... ... Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.483686991119526
Encrypted:	false
SSDEEP:	12:1HEJ6GG6+WYpU34OuFpR+dgGfFZO8ZpU34aEGFpR03OyZnLAOfTYdD:1HEVSWYpVp0JS8Zp5KpaOGAOfuD
MD5:	91F5BC87FD478A007EC68C4E8ADF11AC
SHA1:	D07DD49E4EF3B36DAD7D038B7E999AE850C5BEF6
SHA-256:	92F1246C21DD5FD7266EBFD65798C61E403D01A816CC3CF780DB5C8AA2E3D9C9
SHA-512:	FDC2A29B04E67DDBBD8FB6E8D2443E46BADCB2B2FB3A850BBD6198CDCCC32EE0BD8A9769D929FEEFE84D1015145E6664AB5FEA114DF5A864CF963BF98A65FFD9
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome Web Store Payments".. },.. "app_name": {.. "message": "Chrome Web Store Payments".. },.. "craw_app_unavailable": {.. "message": "App currently unavailable.".. },.. "craw_connect_to_network": {.. "message": "Please connect to a network.".. },.. "iap_unavailable": {.. "message": "In-App Payments is currently unavailable.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Please sign into Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.483686991119526
Encrypted:	false
SSDEEP:	12:1HEJ6GG6+WYpU34OuFpR+dgGfFZO8ZpU34aEGFpR03OyZnLAOfTYdD:1HEVSWYpVp0JS8Zp5KpaOGAOfuD
MD5:	91F5BC87FD478A007EC68C4E8ADF11AC
SHA1:	D07DD49E4EF3B36DAD7D038B7E999AE850C5BEF6
SHA-256:	92F1246C21DD5FD7266EBFD65798C61E403D01A816CC3CF780DB5C8AA2E3D9C9
SHA-512:	FDC2A29B04E67DDBBD8FB6E8D2443E46BADCB2B2FB3A850BBD6198CDCCC32EE0BD8A9769D929FEEFE84D1015145E6664AB5FEA114DF5A864CF963BF98A65FFD9
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome Web Store Payments".. },.. "app_name": {.. "message": "Chrome Web Store Payments".. },.. "craw_app_unavailable": {.. "message": "App currently unavailable.".. },.. "craw_connect_to_network": {.. "message": "Please connect to a network.".. },.. "iap_unavailable": {.. "message": "In-App Payments is currently unavailable.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Please sign into Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	661
Entropy (8bit):	4.450938335136508
Encrypted:	false
SSDEEP:	12:1HEJHlbGGHlb+WYpU34ubdDH+dgxbFxTO8ZpU34lPbdlVo03OyZnLAOfTY6xjD:1HEvaC6WYpcDeEFxq8ZpNl5OGAOffD
MD5:	82719BD3999AD66193A9B0BB525F97CD
SHA1:	41194D511F1ACC16C1CA828AC81C18C8C6B47287
SHA-256:	4DB9B2721E625C18B9E05C04B31AF5D9694712F1CAAF6219ABE34BB08E5DB1C7
SHA-512:	D4C49B43427799B6292CEED11CACB1D76F7CE43EBF402B43B638A6EB2B414ED0981E386CB8CDF0B51D1BD9552934FE25B2F6392266BB73D8C9A691F65BCE0128
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Esta aplicaci.n no est. disponible en este momento.".. },.. "craw_connect_to_network": {.. "message": "Con.ctate a una red.".. },.. "iap_unavailable": {.. "message": "Los pagos en la aplicaci.n no est.n disponibles en este momento.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicia sesi.n en Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	637
Entropy (8bit):	4.47253983486615
Encrypted:	false
SSDEEP:	12:1HEJHlbGGHlb+WYpU34ubdDH+dgxbFxTO8ZpU34GLO03OyZnLAOfTYiJD:1HEvaC6WYpcDeEFxq8Zp4LlOGAOfvD
MD5:	6B2583D8D1C147E36A69A88009CBEBC7
SHA1:	4D4DEEB4BE6AA0181825F3371A761ABC5B4D5937
SHA-256:	6659BC3705311D7641A73995DCFEA80C7734F2F4EBBC3787B3892A240348324F
SHA-512:	37F0DBFCC1B5A2B8E4C92C49D2D9DEEF25616421350324F57E0149A45A6CCB437F5E3CBE97412C4B5DBBF2593783C7DF71E9C25A851AEAE6E4764C545723FA53
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Esta aplicaci.n no est. disponible en este momento.".. },.. "craw_connect_to_network": {.. "message": "Con.ctate a una red.".. },.. "iap_unavailable": {.. "message": "En este momento, Pagos En-Apps no est. disponible.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Accede a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	595
Entropy (8bit):	4.467205425399467
Encrypted:	false
SSDEEP:	12:1HEJfPGGGfPG+WYpU34Ze7z+dgrW9O8ZpU34ZwZz03OyZnLAOfTYgoLIR:1HEdvqlWYpTeObk8ZpT/OGAOfuLIR
MD5:	CFF6CB76EC724B17C1BC920726CB35A7
SHA1:	14ED068251D65A840F00C05409D705259D329FFC
SHA-256:	C85800BF45942FCC7FD6B1DF929C25F9CC2A977A6678966BD03D4B6B69889AFD
SHA-512:	53D7D01BB30C0306DE65A79FD9551D2E8C1F71F4F45F71906B009071CB3E0F231E6A50FDD78773E9B4DE94085BC7B97F829842FA21A89A2080D33458B745C46F
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome'i veebipoe maksed".. },.. "app_name": {.. "message": "Chrome'i veebipoe maksed".. },.. "craw_app_unavailable": {.. "message": "Rakendus pole praegu saadaval.".. },.. "craw_connect_to_network": {.. "message": "Looge .hendus v.rguga.".. },.. "iap_unavailable": {.. "message": "Rakendusesisesed maksed ei ole praegu saadaval.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Logige Chrome'i sisse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	4.595421267152647
Encrypted:	false
SSDEEP:	12:1HEJRuzGGRuz+WYpU34ujSBu+dgYO8ZpU34J+Bu03OyZnLAOfTY5HN:1HEFcWYpPNa8ZpD+FOGAOfEHN
MD5:	3A01FEE829445C482D1721FF63153D16
SHA1:	F3EAAADDC03F943FC88B30B67F534AA13E3336DD
SHA-256:	0BDE54B20845124113383B6EB81E43A0F05E4EB0C44BEE3C1DFAC4CC5FEC2836
SHA-512:	3B92B6C86D30FD36AA3CEFF8773BA60C3FC5CC19C693540137044C5838A5503895C770C0336A4D0A3DB5E42F3FB36274D8D3F85B9DCA2F3EC0E974FDDB0BEAD8
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome Web Storen maksut".. },.. "app_name": {.. "message": "Chrome Web Storen maksut".. },.. "craw_app_unavailable": {.. "message": "Sovellus ei ole t.ll. hetkell. k.ytett.viss..".. },.. "craw_connect_to_network": {.. "message": "Muodosta verkkoyhteys.".. },.. "iap_unavailable": {.. "message": "Sovelluksen sis.iset maksut eiv.t ole t.ll. hetkell. k.ytett.viss..".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Kirjaudu sis..n Chromeen.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	658
Entropy (8bit):	4.5231229502550745
Encrypted:	false
SSDEEP:	12:1HEJADlbGGADlb+WYpU34hTUT+dgHfZAFFZO8ZpU34hTjzeT03OyZnLAOfTYHfvF:1HEYah6WYp7TUSoxOS8Zp7TOsOGAOfqV
MD5:	57AF5B654270A945BDA8053A83353A06
SHA1:	EEEF7A4F869F97CF471A05D345E74F982D15E167
SHA-256:	EC002ED92359F67818B49455DFC579E140368E6A004080AF022FD4F57F6B03F2
SHA-512:	5F0AE839FCF3F4EA48FF41A76655AE0F3821564AFD5D42FBB9FBB9A38E8D8F7BB5E9B6F71064588CD441261F644095A44A755C134CE546D506D9A21E488BAF52
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Mga Pagbabayad sa Chrome Web Store".. },.. "app_name": {.. "message": "Mga Pagbabayad sa Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Kasalukuyang hindi available ang app.".. },.. "craw_connect_to_network": {.. "message": "Mangyaring kumonekta sa isang network.".. },.. "iap_unavailable": {.. "message": "Kasalukuyang hindi available ang Mga Pagbabayad na In-App.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Mangyaring mag-sign in sa Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	677
Entropy (8bit):	4.552569602149629
Encrypted:	false
SSDEEP:	12:1HEJALf/nbGGALf/nb+WYpU34Owdgbyb+dgdQjO8ZpU34ITQpGnbyb03OyZnLAO8:1HE4Hna1Hn6WYpNdgpY8ZpSTQwnBOGAh
MD5:	8D11C90F44A6585B57B933AB38D1FFF8
SHA1:	3F9D44EA8807069A32AACA2AAAD02FD892E6CC90
SHA-256:	599491F8C52B945C16C441ADF45BFD45AFAE046DA07757D97C56AF4DE75ED3B5
SHA-512:	D7EF7F5AD7EF1A1595825D79B69E2B1E988AD3CF1F3881496FCCD30F241E4E9C6E457F9F5D0F855DE3536DB7A40C3E1C55946B50D3F556F4A35285066A0CD6F7
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Paiements via le Chrome.Web.Store".. },.. "app_name": {.. "message": "Paiements via le Chrome.Web.Store".. },.. "craw_app_unavailable": {.. "message": "Application indisponible pour le moment.".. },.. "craw_connect_to_network": {.. "message": "Veuillez vous connecter . un r.seau.".. },.. "iap_unavailable": {.. "message": "Les paiements via l'application ne sont pas disponibles pour le moment.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Veuillez vous connecter . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	835
Entropy (8bit):	4.791154467711985
Encrypted:	false
SSDEEP:	24:1HEs07J0JWYp9vnCSVLP8Zp6CsOGAOf8SLm:Wh7qgYp1CMLUph1GiSLm
MD5:	E376D757C8FD66AC70A7D2D49760B94E
SHA1:	1525C5B1312D409604F097768503298EC440CC4D
SHA-256:	8106D98C4F8DA16DB698444409558E29CC96735E188BFA303C333A5D99231C1D
SHA-512:	673F3F259AF2946E4F49BBED14A2A70D44BF9FDA9D7A71DC9172BA9B7B3C7F7062B16D29682B638D485B0520ED6F99E7A735F28C7C719B539559005B69FA7555
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome ... ..... ......".. },.. "app_name": {.. "message": "Chrome ... ..... ......".. },.. "craw_app_unavailable": {.. "message": "......... .. ... ...... .... ...".. },.. "craw_connect_to_network": {.. "message": "..... ....... .. ...... .....".. },.. "iap_unavailable": {.. "message": "..-.. ...... ... ...... .... ...".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "..... Chrome ... .... .. .....".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.56999230891419
Encrypted:	false
SSDEEP:	12:1HEJGiimxmbZGGGiimxmbZ+WYpU34OBOEuhopIO+dgcapZO8ZpU34GiiZrMrQphK:1HE4H4TH8WYpNjTta28ZpQVLP0SOGAOK
MD5:	8185D0490C86363602A137F9A261CC50
SHA1:	5BD933B874441CEACB9201CCC941FF67BAED6DC0
SHA-256:	A2B2EC359A9DD9DCCCE02859CE1E738BD30FAA4A05F1DC522893FFDF722BBC15
SHA-512:	D7629978FC031EA5F716F9C1065FB2FEAB48C15F10CD68830DC966FA1002C03DDC7ACDE314C7D075F9F3A0A68552A6ACBCCDEE24CF20B6C3DD1BCE6562D0396E
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pla.anja u web-trgovini Chrome".. },.. "app_name": {.. "message": "Pla.anja u web-trgovini Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikacija trenuta.no nije dostupna.".. },.. "craw_connect_to_network": {.. "message": "Pove.ite se s mre.om.".. },.. "iap_unavailable": {.. "message": "Pla.anje u aplikaciji trenuta.no nije dostupno.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prijavite se na Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	683
Entropy (8bit):	4.675370843321512
Encrypted:	false
SSDEEP:	12:1HEJVJiGGVJi+WYpU34Hpo9O+dgMmfgijO8ZpU34Huo9O03OyZnLAOfTYBIAYm:1HEVrk5WYpQzTUg/8ZpwoXOGAOfYIAd
MD5:	85609CF8623582A8376C206556ED2131
SHA1:	1E16EB70DB5E59BB684866FF3E3925C2DEF25A12
SHA-256:	32A249749F12ADB6A220BF9ADC272C7E5D9AD5497A38B0086D961E3ABA17FBC6
SHA-512:	27883430865D3CFA6EDFE8C6CE1442BD96150B5CE520CCF7D556A330CAA6392C712B47BD86F7350E174876BC681F6DEC94D1312402655B0AF90883A2899EC78B
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome Internetes .ruh.z Fizet.si rendszere".. },.. "app_name": {.. "message": "Chrome Internetes .ruh.z Fizet.si rendszere".. },.. "craw_app_unavailable": {.. "message": "Az alkalmaz.s jelenleg nem .rhet. el.".. },.. "craw_connect_to_network": {.. "message": "K.rj.k, csatlakozzon egy h.l.zathoz.".. },.. "iap_unavailable": {.. "message": "Az alkalmaz.son bel.li fizet.s jelenleg nem .rhet. el.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Jelentkezzen be a Chrome-ba.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	604
Entropy (8bit):	4.465685261172395
Encrypted:	false
SSDEEP:	12:1HEJs25bGGs25b+WYpU34ORBHAeSJ+dgkmO8ZpU34s22C/SzFAs03OyZnLAOfTYR:1HEBaA6WYpaHFH8ZptOYOGAOf2D
MD5:	EAB2B946D1232AB98137E760954003AA
SHA1:	60BDC2937905B311D2C9844DF2D639D7AC9F7F67
SHA-256:	C6E8800450602DE0F39FE9F6854472383813FB454B08ABAE7E25A9167CE004C3
SHA-512:	970FEC9A9EF0BAF7F693C4C5977F3B47914579C5B5414FCE9DBB5E4574659A5BB9AD2DE0CC886B368F49C019785AF7D2D7FE82F71341F039EADC399ED776CA12
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pembayaran Chrome Webstore".. },.. "app_name": {.. "message": "Pembayaran Chrome Webstore".. },.. "craw_app_unavailable": {.. "message": "Aplikasi tidak tersedia saat ini.".. },.. "craw_connect_to_network": {.. "message": "Sambungkan ke jaringan.".. },.. "iap_unavailable": {.. "message": "Pembayaran Dalam Aplikasi saat ini tidak tersedia.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Harap masuk ke Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	603
Entropy (8bit):	4.479418964635223
Encrypted:	false
SSDEEP:	12:1HEJsqd/bGGsqd/b+WYpU34OcX4+dgUvIO8ZpU34vq703OyZnLAOfTYsD:1HEXd/aKd/6WYpZrv58ZpskOGAOfzD
MD5:	A328EEF5E841E0C72D3CD7366899C5C8
SHA1:	2851ED658385804E87911643F5A4200B1FB26E13
SHA-256:	CD891C45F7586FB4A2514205A11F260E4A6D4482FA03D901909DD9F57BE0536D
SHA-512:	E47297896E981774EC3B59D41B89D6BA9333F6B4435EB9727D8645A46B10C7D408ADE06844871FA757382FBE7E645276449DB7B1B23BC59C9A71A5CB5A5ECC57
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pagamenti Chrome Web Store".. },.. "app_name": {.. "message": "Pagamenti Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "App al momento non disponibile.".. },.. "craw_connect_to_network": {.. "message": "Collegati a una rete.".. },.. "iap_unavailable": {.. "message": "La funzione Pagamenti In-App non . al momento disponibile.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Accedi a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	697
Entropy (8bit):	5.20469020877498
Encrypted:	false
SSDEEP:	12:1HEJ07uGG07u+WYpU34DB+dgnsVztO8ZpU34MwiB03OyZnLAOfTYmSH:1HEcnDNWYp1kxU8Zp2wiqOGAOfpSH
MD5:	9B3A5D473C3F2BBFAEECE94A07A940B8
SHA1:	61BACA342CF766BBA15C7B4D892A0E7DAC9405AA
SHA-256:	706312A4A2AEF3317223F141EB2B82685345B7EED444F16BB4DF3A272716DA1F
SHA-512:	94F6FEE9A11BD890AB8211C98D1CC142348961EBCF756F66477A3E3A76519804B70BE0AE4E551739F8AFE32D7ADE6EDE04EF6B9B9EED03E3A857E6058EEDD4C6
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome ........".. },.. "app_name": {.. "message": "Chrome ........".. },.. "craw_app_unavailable": {.. "message": ".................".. },.. "craw_connect_to_network": {.. "message": "................".. },.. "iap_unavailable": {.. "message": ".......................".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Chrome ............".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	631
Entropy (8bit):	5.160315577642469
Encrypted:	false
SSDEEP:	12:1HEJ1GG1+WYpU34K3aT+dgh8d0HTO8ZpU34KaNkaT03OyZnLAOfTY/YeHx:1HEajWYpc3aSl0Hq8Zpc6kasOGAOfyYA
MD5:	9F6B4D82A70C74CA751E2EAE70FAB5CF
SHA1:	0534F125FFCE8222277CF2BE3401C59DAF9217F8
SHA-256:	D1467B8D037114403E8F4EFC52E88C4A7FEB96126BE4CFF883FEFF1084EF7E68
SHA-512:	ED9319830314385D09C06F62EE34186E8CA576C857981205E4468A28B3ACD2AB03384E77B866032C324ABDD97A56EFD08E2D6E0C79D563578B3EC52517819BD8
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome . ... ..".. },.. "app_name": {.. "message": "Chrome . ... ..".. },.. "craw_app_unavailable": {.. "message": ".. .. ... . .....".. },.. "craw_connect_to_network": {.. "message": "..... ......".. },.. "iap_unavailable": {.. "message": ".. .. ... ... . .....".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Chrome. .......".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	665
Entropy (8bit):	4.66839186029557
Encrypted:	false
SSDEEP:	12:1HEJpqHnkGGpqHnk+WYpU346M+dgV6O8ZpU34WzSWz03OyZnLAOfTYx:1HELqHtKqHPWYpM3A8ZpwGzOGAOfg
MD5:	4CA644F875606986A9898D04BDAE3EA5
SHA1:	722A10569E93975129D67FBDB75B537D9D622AD1
SHA-256:	7C311AB751D840D750C11553C083785813E079C1D464FE568A98C9E3EF3DB96C
SHA-512:	E575E3D0622F5BD4B6C0EE79128A1B1F1882195670139D1983F4377D847141B8FB8EBB8BCED82AF3A220ED07D3577AFBE085BADC0E9C7678292B80E3EC5D3444
Malicious:	false
Preview:	{.. "app_description": {.. "message": ".Chrome. internetin.s parduotuv.s mok.jimo sistema".. },.. "app_name": {.. "message": ".Chrome. internetin.s parduotuv.s mok.jimo sistema".. },.. "craw_app_unavailable": {.. "message": "Programa .iuo metu negalima.".. },.. "craw_connect_to_network": {.. "message": "Prisijunkite prie tinklo.".. },.. "iap_unavailable": {.. "message": "Mok.jimai programoje .iuo metu negalimi.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prisijunkite prie .Chrome..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	671
Entropy (8bit):	4.631774066483956
Encrypted:	false
SSDEEP:	12:1HEJFhVbGGFhVb+WYpU34wDoz+dgGedBO8ZpU34wF03OyZnLAOfTYGYID:1HENQKkWYp2Doy/em8Zp2WOGAOfRYID
MD5:	C5CE2C51391EAFD3DA9E4C71549A3C28
SHA1:	1F67FF6EF6E90C0CE3AAF56ED543A3EFD381574D
SHA-256:	1FA1DF2CA8516DEF490FB8484E9AA498ACFF80EEF5C9258FFE42D3678E6C7DED
SHA-512:	C85F6281E682F52BC2147DEA7E2F3BB4DC48D98BADA8687B05C6C7271C78EA7F5431CD51671A4184C9AE004FC53C016E3C594697F483195CCBA08A93821EEF70
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome interneta veikala maks.jumu sist.ma".. },.. "app_name": {.. "message": "Chrome interneta veikala maks.jumu sist.ma".. },.. "craw_app_unavailable": {.. "message": "Lietotne pagaid.m nav pieejama.".. },.. "craw_connect_to_network": {.. "message": "L.dzu, izveidojiet savienojumu ar t.klu.".. },.. "iap_unavailable": {.. "message": "Maks.jumi lietotn.s pa.laik nav pieejami.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "L.dzu, pierakstieties p.rl.k. Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\nb\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	501
Entropy (8bit):	4.804937629013952
Encrypted:	false
SSDEEP:	12:YGGYpB928UZjdyE9iDCiop8682fURHWO/NrnLAOK:YHYpXK/iOiop8NFHWOFvAOK
MD5:	8F0168B9A546D5A99FD8A262C975C80E
SHA1:	B0718071BD0B7251D4459E9C87DF50C14622FBD6
SHA-256:	F03FA7384DF79EBA6E0274D570996030F595A3BF6B781929DD9DB6593262E41F
SHA-512:	A1191CDC496DDD7470BDCFAF186BB9488767159E0CA6A6242D195FA3351704DC8F8BBD03DBEE57D37BBD897C9E8D14B7325FB37D58AC80DEC0F972FF893758B8
Malicious:	false
Preview:	{"craw_app_unavailable":{"message":"Appen er utilgjengelig for \u00f8yeblikket."},"craw_connect_to_network":{"message":"Du m\u00e5 koble til et nettverk."},"app_name":{"message":"Chrome Nettmarked-betalinger"},"app_description":{"message":"Chrome Nettmarked-betalinger"},"iap_unavailable":{"message":"Betaling i app er ikke tilgjengelig for \u00f8yeblikket."},"please_sign_in":{"message":"Du m\u00e5 logge p\u00e5 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	615
Entropy (8bit):	4.4715318546237315
Encrypted:	false
SSDEEP:	12:1HEJJQGkbGGJQGkb+WYpU34OQKJT+dgiXUmvFZO8ZpU34g7JT03OyZnLAOfTYMD:1HErxkaqxk6WYptndXI8ZpTOGAOfbD
MD5:	7A8F9D0249C680F64DEC7650A432BD57
SHA1:	53477198AEE389F6580921B4876719B400A23CA1
SHA-256:	92BE7C2DC9CFBE5A65E9CE6488D364C8D7EC19E7B67A31E4D43C1CB2B169671C
SHA-512:	969AB979546A741C0F3EDBEEB21BABA375FA8870D4FB9248CDD4C305736E332E10CAB7B64C5C078E60EC0CD73848101B390BE8F44B89C310058AF4C1CA3C8AA7
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Betalingen via Chrome Web Store".. },.. "app_name": {.. "message": "Betalingen via Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "App momenteel niet beschikbaar.".. },.. "craw_connect_to_network": {.. "message": "Maak verbinding met een netwerk.".. },.. "iap_unavailable": {.. "message": "In-app-betalingen is momenteel niet beschikbaar.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Log in bij Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	636
Entropy (8bit):	4.646901997539488
Encrypted:	false
SSDEEP:	12:1HEJbiVbGGbiVb+WYpU34OBHlBi9+dgQUg6O8ZpU34bdbfiIu03OyZnLAOfTYR5k:1HE5iVauiV6WYpIAYr8ZpxFiaOGAOfIC
MD5:	0E6194126AFCCD1E3098D276A7400175
SHA1:	E8127B905A640B1C46362FA6E1127BE172F4A40F
SHA-256:	E2699F98C511B18A2AFB82EAE9A4804B646C4FF1077D80E77C17A3943A6373C2
SHA-512:	A71F7C7BFBBF1E37E699601AF2E095C56CBA91F90CB7556477DF31D01B83ADFB1271E1775C9BA299FF6875BBFC2B6AB47488CC88E33DEF2F6F2E0E5AC687B777
Malicious:	false
Preview:	{.. "app_description": {.. "message": "P.atno.ci w sklepie Chrome Web Store".. },.. "app_name": {.. "message": "P.atno.ci w sklepie Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Aplikacja jest obecnie niedost.pna.".. },.. "craw_connect_to_network": {.. "message": "Po..cz si. z sieci..".. },.. "iap_unavailable": {.. "message": "P.atno.ci w ramach aplikacji s. teraz niedost.pne.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Zaloguj si. w Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	636
Entropy (8bit):	4.515158874306633
Encrypted:	false
SSDEEP:	12:1HEJsc/bGGsc/b+WYpU34OLw+dgn/KzO8ZpU34FjIBMwGRO03OyZnLAOfTYN+KcY:1HEb/a8/6WYp4mZ8Zp7cKlOGAOf2tD
MD5:	86A2B91FA18B867209024C522ED665D5
SHA1:	63DEC245637818C76655E01FCB6D59784BC7184E
SHA-256:	6374880FDD1F8AF1EE8AEA6A06B73BE0AB265AFCEB4FE6F08BDE3B3989264B21
SHA-512:	DA6DBDE5028756421C2904F605632EE98831A25A1247E6238A931629B94CE8A00FD76F4235F118D2167304BD60F2C06B2AD78E54FF6CE53F8C38DF8C7B5AFCE4
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pagamentos da Chrome Web Store".. },.. "app_name": {.. "message": "Pagamentos da Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Aplicativo indispon.vel no momento.".. },.. "craw_connect_to_network": {.. "message": "Conecte-se a uma rede.".. },.. "iap_unavailable": {.. "message": "No momento, os Pagamentos no aplicativo n.o est.o dispon.veis.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Fa.a login no Google Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	622
Entropy (8bit):	4.526171498622949
Encrypted:	false
SSDEEP:	12:1HEJsZUkbGGsZUkb+WYpU34OAE+dgqxKzO8ZpU34rEpBfvPO03OyZnLAOfTYLD:1HEmUka5Uk6WYpFvdxZ8ZpSTnPlOGAOS
MD5:	750A4800EDB93FBE56495963F9FB3B94
SHA1:	8BFB915488A4EB3CB33D68E2E59F1F8447DB7D61
SHA-256:	C1C94F65FABAF17DEF98A8587711A56D61B1E5607500E9B01F2824DB109F9E83
SHA-512:	2AEDEF5793406221BE76AF22031CE8C30AB5FAEAED09BB394C153E2EBE990C89C1A2A73B40D8A92842641AFCA8C77FFD808A2058602D3646FD8DAE2844406F24
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pagamentos via Chrome Web Store".. },.. "app_name": {.. "message": "Pagamentos via Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Aplica..o atualmente indispon.vel.".. },.. "craw_connect_to_network": {.. "message": "Ligue-se a uma rede.".. },.. "iap_unavailable": {.. "message": "Os Pagamentos na app est.o atualmente indispon.veis.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicie sess.o no Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	641
Entropy (8bit):	4.61125938671415
Encrypted:	false
SSDEEP:	12:1HEJqJrJZGGqJrJZ+WYpU344HIx2Z+dgrVPlZO8ZpU34qT7hI3O03OyZnLAOfTYU:1HEC4D8WYpKow8WV68ZpKhoOGAOfoVGD
MD5:	98D43E4B1054A65DF3FA3CC40AB6FB6D
SHA1:	46E0A21C4DA2BB5D4D8F837AE211C1B6FA26E7E2
SHA-256:	113A13900CBA62FE8AED06751971C23A80A99B47F9BE219CF884D57DB19611D9
SHA-512:	A76DC53912A4F46714926B9EA2B22E909540E447F61F6DD72607AB7B3BB5D4A9B39E525B04C33AEC53BA813D14AC1FB5827275B2524E52B693E83171E1CD1466
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pl..i prin Magazinul web Chrome".. },.. "app_name": {.. "message": "Pl..i prin Magazinul web Chrome".. },.. "craw_app_unavailable": {.. "message": ".n prezent, aplica.ia nu este disponibil..".. },.. "craw_connect_to_network": {.. "message": "Conecteaz.-te la o re.ea.".. },.. "iap_unavailable": {.. "message": "Pl..ile .n aplica.ie nu sunt disponibile momentan.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Conecteaz.-te la Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	744
Entropy (8bit):	4.918620852166656
Encrypted:	false
SSDEEP:	12:1HEJ7OJHZMSl3ZGG7OJHZMSl3Z+WYpU34zWJ2F+dgVtLSv/TO8ZpU347NWjT03On:1HElOJHZMq4uOJHZMq8WYpdWJ/YGHq8m
MD5:	DB2EDF1465946C06BD95C71A1E13AE64
SHA1:	FB4F3ECE9ECECEBBC6CA2A592A15FB9C1FDFB811
SHA-256:	FBAF22CE6E16DE174CED8CB5EA3098CCA1C3426A2111FF33BD3E64DA64ED67AB
SHA-512:	4E0CF00BAEF1757548DEB17BBE1AF55770A0A0F7351779EF55C7DEFA6D112D0227B8865C2C22E0EC62E6E2F1C8E1632A2D0CE6828D25C5ABBF143C990116F632
Malicious:	false
Preview:	{.. "app_description": {.. "message": "......... ....... ........-........ Chrome".. },.. "app_name": {.. "message": "......... ....... ........-........ Chrome".. },.. "craw_app_unavailable": {.. "message": ".......... ...........".. },.. "craw_connect_to_network": {.. "message": "............ . .....".. },.. "iap_unavailable": {.. "message": "....... ..... .......... ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "....... . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	4.640777810668463
Encrypted:	false
SSDEEP:	12:1HEJfZGGfZ+WYpU34ORO+dgmmCO8ZpU34yH7u2Z03OyZnLAOfTYCUAi0D:1HEl4G8WYpetPmD8ZpcH7aOGAOfzUeD
MD5:	8DF215D1EFBDABB175CCDD68ED8DCB0A
SHA1:	2B374462137A38589A73FDD00A84CBDC7E50F9F4
SHA-256:	7FA16AF97E6CFC52EC6008EB679D3F30E7E0C24F9EF2D18A9228EAF4DED9D63B
SHA-512:	C0E623343BDAEB4731800D183B59F2FCFE285F0C7153EC99641FD84F2F2DCFE47D21E73F3D28B1240340453C5668EB0AFFBE087AAB62F1C88CD2A40CC44E599D
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "app_name": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplik.cia moment.lne nie je dostupn..".. },.. "craw_connect_to_network": {.. "message": "Pripojte sa k sieti.".. },.. "iap_unavailable": {.. "message": "Platby v aplik.cii moment.lne nie s. k dispoz.cii.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prihl.ste sa do prehliada.a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	4.5101656584816885
Encrypted:	false
SSDEEP:	12:1HEJGcyvmbZGGGcyvmbZ+WYpU34OBOEtf+dgca1ZO8ZpU34GcQArERff03OyZnLh:1HE4cyY4TcyY8WYpNoWa1w8ZpQcQ6AfK
MD5:	3943FA2A647AECEDFD685408B27139EE
SHA1:	0129DD19D28373359530B3B477FE8A9279DABB7D
SHA-256:	18AFF072EE0DF7C3495045435C752A805606E6D5D462EF2321C443F1773F4B3A
SHA-512:	42E62B3855611FF2E1D39C11404CB1A09825EE4CA6A8ACB3FF538B4574388F549E3BD79137DD4DC128A8DC44DD270D7D878E4AAD20DA8250A5C25297B0DEC09D
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pla.ila v spletni trgovini Chrome".. },.. "app_name": {.. "message": "Pla.ila v spletni trgovini Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikacija trenutno ni na voljo.".. },.. "craw_connect_to_network": {.. "message": "Pove.ite se z omre.jem.".. },.. "iap_unavailable": {.. "message": "Pla.ila v aplikacijah trenutno niso na voljo.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prijavite se v Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	743
Entropy (8bit):	4.913927107235852
Encrypted:	false
SSDEEP:	12:1HEJssbdOGGssbdO+WYpU347xBP+dgcucO8ZpU34s1muP03OyZnLAOfTYzDYD:1HEKsb59sbTWYplx4Xud8Zpy1mNOGAOv
MD5:	D485DF17F085B6A37125694F85646FD0
SHA1:	24D51D8642CDC6EFD5D8D7A4430232D8CDE25108
SHA-256:	7FFDE34C58E7C376C042DE64DEF6481DAE32BE8B70F0B18EDF536290CBE0C818
SHA-512:	0DDECFD860E99290B6C3AAA04F510272AE081CF2D93ED5832D9D6378EC9D36177FFBE213471247FB94721EA34A83E7665669200047091D0FDE134E3D763217E7
Malicious:	false
Preview:	{.. "app_description": {.. "message": "....... . Chrome ...-..........".. },.. "app_name": {.. "message": "....... . Chrome ...-..........".. },.. "craw_app_unavailable": {.. "message": ".......... .. ........ ...........".. },.. "craw_connect_to_network": {.. "message": "........ .. .......".. },.. "iap_unavailable": {.. "message": "....... . .......... .. ........ ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "......... .. . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	630
Entropy (8bit):	4.52964089437422
Encrypted:	false
SSDEEP:	12:1HEJJMkbGGJMkb+WYpU34OACwz+dgNPGFZO8ZpU34JgpXLSb03OyZnLAOfTYLdID:1HErMkaqMk6WYpTOcb8ZpDgdZOGAOf8Y
MD5:	D372B8204EB743E16F45C7CBD3CAAF37
SHA1:	C96C57219D292B01016B37DCF82E7C79AD0DD1E8
SHA-256:	B8BA77E0089B0676545EC16D32468B727812B444F90B33A7A5B748E6C36C4388
SHA-512:	33640529E0D5DCC5CA4BDB0615A2818E8D26C6FCB7B3474C08AC3EB67B9DB40E1F0A79954ED20728CD47A686D2533DCBC76ABCBDB917F8530C8DE8BBA687352E
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Betalning via Chrome Web Store".. },.. "app_name": {.. "message": "Betalning via Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Appen .r inte tillg.nglig f.r tillf.llet.".. },.. "craw_connect_to_network": {.. "message": "Anslut till ett n.tverk.".. },.. "iap_unavailable": {.. "message": "Betalning i appen .r inte tillg.ngligt f.r n.rvarande.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Logga in i Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	945
Entropy (8bit):	4.801079428724355
Encrypted:	false
SSDEEP:	24:1HEKa1dDa1/WYp6UFi72SmlG8ZpyactrW2SAOGAOfvSLD:WK2DNYp6U4y3bpyLxwGFW
MD5:	83E2D1E97791A4B2C5C69926EFB629C9
SHA1:	429600425CB0F196DDD717F940E94DBD8BFF2837
SHA-256:	2FECA577F43D97BAEEA464741D585892103585208FD0A935B810A03BDCE83C88
SHA-512:	60A5928DAA8CB4341487F477C56B5A98B83EDE50E5F4F55A802E01FDDAB86F3E795D391953D3D9214552D14D3F58C5A183693C613720FC12FC387D7B8F9B9AB6
Malicious:	false
Preview:	{.. "app_description": {.. "message": "............... Chrome .........".. },.. "app_name": {.. "message": "............... Chrome .........".. },.. "craw_app_unavailable": {.. "message": ".............................".. },.. "craw_connect_to_network": {.. "message": ".........................".. },.. "iap_unavailable": {.. "message": "...............................................".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "................. Chrome".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	631
Entropy (8bit):	4.710869622361971
Encrypted:	false
SSDEEP:	12:1HEJ9Y8GG9Y8+WYpU34wWT+dgGb0GO8ZpU34wryd7T03OyZnLAOfTYGbPKG:1HE0jWYpyRnG8Zpyr/OGAOfFPn
MD5:	2CEAE0567B6BB1D240BBAD690A98CA3B
SHA1:	5944346FBD4A0797B13223895995CAB58E9ECD23
SHA-256:	A7CB86F30C9C31FE5540282C308BA96ADB4EC16EF98C87129EB88105E5BEF5FC
SHA-512:	108A07C6D03D7178E8D0FFEF5349E0249A898D864964FED8757BD8A08BC1C6D9613F2A6C01AA34A6606127D1C6CE14C229FA02586677DBB060B85E3E845950E1
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome Web Ma.azas. .demeleri".. },.. "app_name": {.. "message": "Chrome Web Ma.azas. .demeleri".. },.. "craw_app_unavailable": {.. "message": "Uygulama .u anda kullan.lam.yor.".. },.. "craw_connect_to_network": {.. "message": "L.tfen bir a.a ba.lan.n.".. },.. "iap_unavailable": {.. "message": "Uygulama ..i .demeler .u anda kullan.lamaz.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "L.tfen Chrome'da oturum a..n.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	720
Entropy (8bit):	4.977397623063544
Encrypted:	false
SSDEEP:	12:1HEJ7wILkSlXZGG7wILkSlXZ+WYpU34zb1Oy2P+dgSV1EjiTO8ZpU347qtfP2CTW:1HElwEkK4uwEkK8WYpd/dTV1e8Zptq5S
MD5:	AB0B56120E6B38C42CC3612BE948EF50
SHA1:	8B3F520E5713D9F116D68E71DAEED1F6E8D74629
SHA-256:	68ABA284751EB9C856032062EF9B1651E2A1E5CE5FDA0977FFC97D63BA7BED9E
SHA-512:	CD852A58217F739C1CD58567FF432D31A7AD3F68C884ABBA1DA95799BCD1545C6A5D3B06F319681C12B78AD0A709828DE4B22736316F148D21F5DB76A5BCCBEF
Malicious:	false
Preview:	{.. "app_description": {.. "message": "....... ...-........ Chrome".. },.. "app_name": {.. "message": "....... ...-........ Chrome".. },.. "craw_app_unavailable": {.. "message": "........ ......... ...........".. },.. "craw_connect_to_network": {.. "message": "............. .. .......".. },.. "iap_unavailable": {.. "message": "....... ..... ........ ..... .. .........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "........ . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	695
Entropy (8bit):	4.855375139026009
Encrypted:	false
SSDEEP:	12:1HEJMAZrSFZGGMAZrSFZ+WYpU34WFHoz+dgdklzoO8ZpU34NFHoz03OyZnLAOfTU:1HEI4B8WYpAKytFZ8ZpXKMOGAOfd6D
MD5:	7EBB677FEAD8557D3676505225A7249A
SHA1:	F161B4B6001AEAEAB246FF8987F4D992B48D47BE
SHA-256:	051F96ED874C11C4A13589B5F68964E4F5B03B52DDA223D56524F2CA23760C04
SHA-512:	74FD267CF7E299FB8E7054605C3F651F057F676FF865082FA24F4916755456768DB0DA62DBC515D829B48AB1F9CFC8AD3E841DCBF1F194D5CB14C5335A192A0D
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Thanh to.n tr.n c.a h.ng Chrome tr.c tuy.n".. },.. "app_name": {.. "message": "Thanh to.n tr.n c.a h.ng Chrome tr.c tuy.n".. },.. "craw_app_unavailable": {.. "message": ".ng d.ng hi.n kh.ng kh. d.ng.".. },.. "craw_connect_to_network": {.. "message": "Vui l.ng k.t n.i v.i m.ng.".. },.. "iap_unavailable": {.. "message": "Thanh to.n trong .ng d.ng hi.n kh.ng kh. d.ng.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Vui l.ng ..ng nh.p v.o Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	595
Entropy (8bit):	5.210259193489374
Encrypted:	false
SSDEEP:	12:1HEJ01GG01+WYpU34zeHz+dgfO8ZpU34YKiO03OyZnLAOfTYB6U:1HEpIWYpISv8Zp+JOGAOfa6U
MD5:	BB73BF561BB79F89D9BF7C67C5AE5C65
SHA1:	2FADD3A1959B29C44830033A35C637D0311A8C9C
SHA-256:	D804F2A040D21D7511EFD5213D8E1721D64964A1A0DBB48E21622CEEDC9D967E
SHA-512:	627D44CEF1FE5C5ABD598BD47FF5E22B9EFC1CF98DDE3868FA9E5896C134A0C9C055AC34EDDADAE56B6690E51AEA89965D38F770552A85C732CC796795DC68D2
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome .........".. },.. "app_name": {.. "message": "Chrome .........".. },.. "craw_app_unavailable": {.. "message": ".........".. },.. "craw_connect_to_network": {.. "message": ".......".. },.. "iap_unavailable": {.. "message": "............".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "... Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	634
Entropy (8bit):	5.386215984611281
Encrypted:	false
SSDEEP:	12:1HEJ2j62GG2j62+WYpU34m7T+dgc8nOO8ZpU34mvIO03OyZnLAOfTYAuH:1HEuSZCWYpsStwP8ZpROGAOfCH
MD5:	5FF50C673CC0C661D615F0CFD0E6DCA0
SHA1:	60DFF98DEAB9C4746B288BDD9C94B3BCAE5EAA85
SHA-256:	C6F8C640F3353A7B9B1432A0C139C1AEEC40133800E6C9B467B63991AD660308
SHA-512:	361D62D91F4931C5F34092C9F2C6A5323D5EEB82A24E7ABE11F7817D8D66341C0ECAD4DCB4B10873920C8D6A3CC9F5704889E178EB2549001A9F62BEDF6C8019
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome ............".. },.. "app_name": {.. "message": "Chrome ............".. },.. "craw_app_unavailable": {.. "message": ".............".. },.. "craw_connect_to_network": {.. "message": "......".. },.. "iap_unavailable": {.. "message": "................".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "... Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	7780
Entropy (8bit):	5.791315351651491
Encrypted:	false
SSDEEP:	192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
MD5:	0834821960CB5C6E9D477AEF649CB2E4
SHA1:	7D25F027D7CEE9E94E9CBDEE1F9220C8D20A1588
SHA-256:	52A24FA2FB3BCB18D9D8571AE385C4A830FF98CE4C18384D40A84EA7F6BA7F69
SHA-512:	9AEAFC3ECE295678242D81D71804E370900A6D4C6A618C5A81CACD869B84346FEAC92189E01718A7BB5C8226E9BE88B063D2ECE7CB0C84F17BB1AF3C5B1A3FC4
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiZHUtdGRPdUNWcmxDY254Q0poRkg2NXpLU05vb1RiUE56bDNHbzdRMGJ3SSJ9LHsicGF0aCI6Il9sb2NhbGVzL2NhL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJ6ZGtWaF9XdkxJWlhkck5xWHBvSHNRMGh1ZGtSM2d1QlMzb2VsTEZLNklVIn0seyJwYXRoIjoiX2xvY2FsZXMvY3MvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6Ik9nUkNIZlVoam9xOU93NHFfaEhvTTQxNzNMelJyYkVpUVdsRXNRSzhscFkifSx7InBhdGgiOiJfbG9jYWxlcy9kYS9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiN2JVWW1LYkhQUUNRMXBGcmUzTHJySEhwWk9xN1c2Zk5hT0laWmdKUERTTSJ9LHsicGF0aCI6Il9sb2NhbGVzL2RlL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJOV3FkU3Rfc1NFMm9KT2VuSUZtM0pMRm9iOGtBZ3ZTa3RtZGpCRGJWazdBIn0seyJwYXRoIjoiX2xvY2FsZXMvZWwvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6ImgyaEZ0YUJoLXJQUEtoUm00QkFWM0VEZmhFbnh5MElGOVhYT3Z0aHhlNjAifSx7InBhdGgiOiJfbG9jYWxlcy9lbi9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoid0pSZDFmM3NxMERFVTJHLXd

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\craw_background.js

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	544643
Entropy (8bit):	5.385396177420207
Encrypted:	false
SSDEEP:	6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
MD5:	6EEBED29E6A6301E92A9B8B347807F5F
SHA1:	65DFB69B650560551110B33DCBA50B25E5B876DE
SHA-256:	04CD9494B0ED83924DAD12202630B20D053D9E2819C8E826A386C814CC0A1697
SHA-512:	FEDE6DB31F2AD242E7BC7B52A8859BA7F466A0B920A8DADCB32DCFB5B2A2742E98B767FF22E0C5BC5C11FEC021240AA9E458486C9039EB4EBE5CF6AF7BE97BF2
Malicious:	false
Preview:	/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var d,e=e\|\|{};e.scope={};e.arrayIteratorImpl=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};e.arrayIterator=function(a){return{next:e.arrayIteratorImpl(a)}};e.ASSUME_ES5=!1;e.ASSUME_NO_NATIVE_MAP=!1;e.ASSUME_NO_NATIVE_SET=!1;e.SIMPLE_FROUND_POLYFILL=!1;e.ISOLATE_POLYFILLS=!1;e.FORCE_POLYFILL_PROMISE=!1;e.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION=!1;.e.defineProperty=e.ASSUME_ES5\|\|"function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};e.getGlobal=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");};e.global=e.getGlobal(this);.e.IS_SYMBOL_NATIVE="func

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\craw_window.js

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	261316
Entropy (8bit):	5.444466092380538
Encrypted:	false
SSDEEP:	3072:I5vU7I6s2M9duIWFCbmYJ4tnFWdqpMad2vywhIp81QFv9F9nNsZgiDdOFlV/mZmc:I5vqFCb2p8Gx9FNNsZ9Dd/ceR
MD5:	1709B6F00A136241185161AA3DF46A06
SHA1:	33DA7D262FFED1A5C2D85B7390E9DBC830CBE494
SHA-256:	5721A4B3F8E09C869A629EFFD350B51C9D46F0AC136717D4DB6265C0EE6F9AC8
SHA-512:	26835B4C050F53AD2DDB84469DF9A84BBB2786A655AB52DFC20B54BEDCB81D1ECD789198D5B7D8B940242E5CEAC818A177444D402397AE82C203438C4B1D19CB
Malicious:	false
Preview:	/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var b,k=k\|\|{};k.scope={};k.createTemplateTagFirstArg=function(a){return a.raw=a};k.createTemplateTagFirstArgWithRaw=function(a,c){a.raw=c;return a};k.arrayIteratorImpl=function(a){var c=0;return function(){return c<a.length?{done:!1,value:a[c++]}:{done:!0}}};k.arrayIterator=function(a){return{next:k.arrayIteratorImpl(a)}};k.makeIterator=function(a){var c="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];return c?c.call(a):k.arrayIterator(a)};.k.arrayFromIterator=function(a){for(var c,d=[];!(c=a.next()).done;)d.push(c.value);return d};k.arrayFromIterable=function(a){return a instanceof Array?a:k.arrayFromIterator(k.makeIterator(a))};k.ASSUME_ES5=!1;k.ASSUME_NO_NATIVE_MAP=!1;k.ASSUME_NO_NATIVE_SET=!1;k.SIMPLE_FROUND_POLYFILL=!1;k.ISOLATE_POLYFILLS=!1;k.FORCE_POLYFILL_PROMISE=!1;k.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION=!1;.k.objectCreate=k.ASSUME_ES5\|\|"function"==typeof Object.cre

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\css\craw_window.css

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	4.912380256743454
Encrypted:	false
SSDEEP:	24:LalZ74H+rMwJHwIodHRmxt3jiu1iu1RDpfeWlMl548wJHwDwCapt/VMYXj8Eq27K:Z+rMm71le88S1tWYXmrVZFH
MD5:	67BF9AABE17541852F9DDFF8245096CD
SHA1:	A4AC74DD258E8E0689034FAA1B15A5C7C56DC3BB
SHA-256:	10DFBD2D98950B79EE12F6B8E3885AABE31543048DE56AD4FC0A5E34D0D9D4EC
SHA-512:	298FA132C6F122798FDB9BC6DE8024915147ADC20355B56A92F0ED9ACCE4549BE6E7F42212E07DCA166E31624D4E66E299565845D4BA1C51CA935050641B61FE
Malicious:	false
Preview:	html, body {. margin: 0;. overflow: hidden;.}..webview {. width: 100%;. height: 100%;. min-height: 100%;. position: absolute;.}...craw_overlay {. position: absolute;.. left: 0;. top: 0;. right: 0;. bottom: 0;.. background-color: white;.. -webkit-transition: opacity 250ms linear;.. display: -webkit-flex;. -webkit-flex-direction: column;. -webkit-flex: 1 0%;. -webkit-align-items: center;. -webkit-justify-content: center;.. -webkit-app-region: drag;.}...craw_overlay img {. margin: 16px;.}..#loading_overlay {. opacity: 1;.}..#offline_overlay {. opacity: 0;. display: none;.}..#offline_overlay > img {. -webkit-filter: saturate(0%);.}..#offline_overlay > span {. font-family: 'Open Sans', 'Deja Vu Sans', Arial, sans-serif;. font-size: 15px;. line-height: 21px;. color: #8d8d8d;. display: block;.}..#loading_splash {. width: 128px;. height: 128px;.}..#drag_overlay {. position: absolute;. left: 0;. top: 0;. right: 0;. bottom: 0;. pointer-events: none;. -webkit

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\html\craw_window.html

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	810
Entropy (8bit):	4.723481385335562
Encrypted:	false
SSDEEP:	12:hYenuEJIig5fRpvV4AEdN2sAAuzg/7RwQuLYpUH9KfRnQBGgZKy3QGgjPSWZDQL:hYeLJKTVNEuLAuzg/twQucpS9bj3
MD5:	34A839BC40DEBC746BBD181D9EF9310C
SHA1:	8B4EAA74D31EED5B0BABA3CA5460201F6B10DA46
SHA-256:	BB8742615E4CD996AE5D0200E443AE6A6F0B473255F03AFFDB8FB4660DE4554D
SHA-512:	EE81E5509CBC2CB2B6C834224688C1E1B1AA9AA3866C52F8EAED040D5C390653C52D8D681E2E2CF62906643962ABAC823D5B622385B983B21E0DCCAFDF281EFF
Malicious:	false
Preview:	<!DOCTYPE html>.<html>. <head>. <link href="/css/craw_window.css" rel="stylesheet">. <script src="/craw_window.js"></script>. </head>. <body>. <webview></webview>. <div class="craw_overlay" id="loading_overlay">. <img src="/images/icon_128.png" />. <img src="/images/flapper.gif" />. </div>. <div class="craw_overlay" id="offline_overlay">. <img src="/images/icon_128.png" />. <span id="app_unavailable"></span>. <span id="connect_to_network"></span>. </div>. <div id="drag_overlay"></div>. <div id="top_bar">. <div id='close_button'>. <img src='/images/topbar_floating_button_close.png'/>. </div>. <div id='maximize_button'>. <img src='/images/topbar_floating_button_maximize.png'/>. </div>. </div>. </body>.</html>.

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\images\flapper.gif

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 30 x 30
Category:	dropped
Size (bytes):	70364
Entropy (8bit):	7.119902236613185
Encrypted:	false
SSDEEP:	768:g5TXOSBAqNIPmA8NcjCWdM0VFMJEwavTeElfWupav5TXg7wV+irIPny9MTVQHydi:g5KSmiIPmAhZWiMsDfWug7DmqM6HybkF
MD5:	398ABB308EEBC355DA70BCE907B22E29
SHA1:	CFFB77B8A1724B8F81D98C6D6AD0071D10162252
SHA-256:	2B73533F47A99FFEA9CC405FFAFA9C4C53623F62487AEBFBA415945120B22040
SHA-512:	FC7A56FC8A61A582161874B54ADBAD30A84840190008EDB0B6FBF84F91393CA58E988E3FE446F11A0C3C691C18249B93AEC2904B3D0C4F0857D79034F662385A
Malicious:	false
Preview:	GIF89a.......................................................!.......!..NETSCAPE2.0.....,.............9.:.h0.bT(6.!l.&..("gk..JL1.[....o. .(:..B(.6."...Z.CUyh0.....j.C.z8..S....2.T'...Q..4 g\|]$ueW.NyQ.IoL!AoF#9h>7.0t..%..,.@.m4..7..!.......,.............9.:.h0.bT(6.!l.&..("gk..JL1.[....o. .(:..B(.6."...Z.CUyh0.....j.C.z8..S....2.T'...Q..4 g\|]$ueW.NyQ.IoL!AoF#9h>7.0t..%..,.@.m4..7..!.......,............................................................................................................'..w=.....\.)._6.k..OF...n.#\~"....2b3..I.)..eu.Q.`.e......gr.?>.s.I0.....@.~.Tr.[8.+.,.;..EE....S.*f.....,.....B8/D..;.9.q......ukC...r.I.....j......BGY...o2J....+O4....X4.....cH%7....I.....0H!.!.....!.,.............................................................................................................................................................................................................p8.a$....hh@.4....X,A.0L..(....JX.j...,..........z.X.Q....jB.d....B..

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\images\icon_128.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4364
Entropy (8bit):	7.915848007375225
Encrypted:	false
SSDEEP:	96:YjlLDJjTvXUtNvX8dgb9HT6y8nviyHG5iCRYtIP:YtNTfUzvX8KM+MGRsIP
MD5:	4DBC9F9E6F5A08D299BAC9E54DF07694
SHA1:	BB38F5DE34B1E0BE1109220BA55271087A4D9EA5
SHA-256:	91C2718DD23B4356D71F88F6146868369033291086DF327534546DFA459BEB0E
SHA-512:	A5F2B1F47502836130D8083F757B7773C1E1CB36B76AD298CC29AB2B428C8002D2F15BD839838FC326DAC3681C2F48AB25A3E7631D33726C4B25E8EC14170912
Malicious:	false
Preview:	.PNG........IHDR..............>a.....IDATx..yp.....gF#.:,[H.l.l..8...`/.k....,!a7Km...E...Te..T.....J...p....%.(....+...3....eY.e...L.o...5....h4...\....{?....~.u.`0.....`0.....`0.....`.Y......[(.......).4....ai..w38.+....Bf././..]...{......8...3.....3W~OJ.. /...u6V.C..U.0.+._=.c..9.X.?....L....S@.L...m.0..>.C...L\|TF.p5..f4M.,.V....8..a.<...RP..@)E,..E"...h.....!...-....,I..T..........m..._[[{w{{....{.^......M.x..h4.h.....\.R.E....j).7.....h4.A.E....,. ...iii.Vj?2...=/.B.FK9P..@)=Rj..D".Y...2.B..x.}0...&J...2.......f.O..e.H.....!.J)'I..R....B............QJ;K..L...L.l".L~mhh.R.@).FFF~.L&...~.B.......u.........}.....~.....f..yUU...........^M...6......].,w.e..~.!$.C.R.....E(%e9.,....k..@...W8.........@...........O..@%.~..@.S..P.....`Tp...."...?ME..c......s...`..S1...7.b..aNE..k...3.yP.}.Ch.}......B..........IPE..C.<....T....k......Z..o_......g........P..A=y.J.)h..@.q.-.].AU.4...F.M.....y%B]+ .\.~..9......:..=...r.....E].o...F..P........i...\|....

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\images\icon_16.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	558
Entropy (8bit):	7.505638146035601
Encrypted:	false
SSDEEP:	12:6v/7vyVgSKYsfFzXxXsrPfA+b0YX+5IOUWCQKznuow7:6yVnKYsfFzhXsrIq0YXmgQGn6
MD5:	FB9C46EA81AD3E456D90D58697C12C06
SHA1:	5FC450F7D73CCFAC8F0D818CB3392BA4D91B69DE
SHA-256:	016CA659BA080E194FBFC0929602B16506ED60AA6019FAA51410C4FD93B583E8
SHA-512:	ADD810EE9EB7CAEC505B5FD90A1F184CE39D8F8C689DCC240F188FE353B9575489492E07D572A3B1C11A1555CE66AFCA5134903E4C1AA3D54BC7C5ED3E65B50C
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8...Mk.Q...;... .....F..QW.....F....J.?.w..7~......'.Q..B]... .QS...M&_w..b&.\|`......p...f.?.D$.y^..........y...\..Z..t6..oRj.@&.u..G.qN).t.-V.>(.N.Ep]wFk.60o.]0.`Y..cT..Y.Tb.`DF.d..s.Z..E..9.4._C.._...%..*.^....4.l...Y..X..R..../...Wj+w0[.].._B.k.${.\.>.%...........lz .w.ALxo.2;..a...".p..S..&..uXS...<..6..[..zD.._.N+w.WbM7ye6X<...'(,=.r}........$f..5..P....k..."..8.s.<zgSm@.....).Y.....:e..\|.....F...I..A$.....T?.....m....8.........N...z.....V..vd.h'....C.?.....H.;]..C.M.....9.b......IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\images\topbar_floating_button.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.475799237015411
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZtnAkx/RPJDmV7bScsP4a9zln94FptVp:6v/lhPKM4nDspnAkZJNmgPdln2TTp
MD5:	8803665A6328D23CC1014A7B0E9BE295
SHA1:	9DA6EE729D5A6E9F30658B8EC954710F107A641F
SHA-256:	D5F9234DC36E7FFA85F35B2359A4F82276F8395EFA76E4553507EA990B27FC6C
SHA-512:	ECD9E71B8BA1ED8BD4CA5A0936CB66A83611C4ABCBDA76C250F4CDF4AD80320212E8F5EEB79A38910718F8346ECC1AD580A3FA835EC2B22BE497F36899FB5930
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...Q..0......2...(p...~Z.}'.>I%O...V!s..................../...`.<..`.....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\images\topbar_floating_button_close.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.512071394066515
Encrypted:	false
SSDEEP:	6:6v/lhPKM4nDsp7q1hKVlomsj9rxKNgtmN0VZ+GFYep:6v/7iMXVq1ylxemNgtmKVnYM
MD5:	0599DFD9107C7647F27E69331B0A7D75
SHA1:	3198C0A5F34DB67F91A0035DBC297354CBC95525
SHA-256:	131817CD9311C03DF22D769DD2AD7FA2E6E9558863A89F7E5E1657424031A937
SHA-512:	0076ACB9D6A886BD987876E49495038F9388B292A9EFE5C9093CCA64CA3692E3A5D24E35172C7697F6AAE34B86CA217EE59C003423E46D9499BD27EC7D77A649
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...... ..Pp.X....H...b@...\|.^LC_.E.BP+......X.P..........q..~..p/. ..s.....%D^...$......@.!...<...).?.4{.k.G3...4..[cH..0..l.8.!r..m.R..{..........`.f...#.x.....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\images\topbar_floating_button_hover.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.423186859407619
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZtnAkx/9lVtEHxrPLyN+ltNPhv/l2up:6v/lhPKM4nDspnAkZHVtERrPLygltNPn
MD5:	7CB6B9DC1A30F63B8BD976924B75AD96
SHA1:	0C40B0C496D2F2B5F2021C117EC8610AC03AB469
SHA-256:	721B7AAA9A42A54A349881615A12E3A26983ACA48E173FD2F66E66AA0D725735
SHA-512:	4764937364E355956B242B84010AC56102536D2AACBE4227F0E88E4DE7AB468571957EA6C33012539156E5349AE4F777115615AE3361F60ADDF9CD227424F76A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...A..0...+B.z.s...*.....$.<u..[...................h.......C.CA).....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\images\topbar_floating_button_maximize.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	166
Entropy (8bit):	5.8155898293424775
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZttd//HmnFz1P/ZjXlUTqyCIc30ItK1p:6v/lhPKM4nDsptF/HOP/ZjXlUeyCo/p
MD5:	232CE72808B60CBE0F4FA788A76523DF
SHA1:	721A9C98C835D2CD734153BBE07833C6637ECD68
SHA-256:	AFA4EA944CBDEC8543242E627EF46D5BFD3766DCAC664E7E50CDEEF2B352740C
SHA-512:	4048EEA5A78DD569521C488C4CE4F7B77AC0454C92EE9107A81A1B3AF91A4EE036039AC1A0A6B8DD26B12E7F1595DB80B7FAA7B6A25D9032BF385528A81A8654
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...HIDATx......0.CQS.......~..."..........m.v+Sq....<!...M8m...'...@$..0....E........IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\images\topbar_floating_button_pressed.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.46068685940762
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZtnAkx/9lVtEXIyN+ltN1/lsg1p:6v/lhPKM4nDspnAkZHVtEZgltN1eup
MD5:	E0862317407F2D54C85E12945799413B
SHA1:	FA557F8F761A04C41C9A4BA81994E43C6C275DBB
SHA-256:	5C10CE0589EB115600F77381130B70AE0B7B3752614D86D4C89E857658AA222B
SHA-512:	07CB69327961FD0019BEF8EF7590B5524905AC373A815F73F6D9E0B26840929F919A96CAA977D4B5656704DACD0F352D568FB3997F80EE6BB94C95B58839DBFE
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...A..0...+B..@wu...*.....$.<u..[...................h.........M..x(....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir7884_36615702\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1322
Entropy (8bit):	5.449026004350873
Encrypted:	false
SSDEEP:	24:1HEis7ViC/yox/fiqeUoLFlmF1s80FKrGfd0d3NZNZx1Fq7eY7nfj1B:WL7V2opiV1mvs8rxTZRczhB
MD5:	01334FB9D092AF2AA46C4185E405C627
SHA1:	47AD3C0E82362FFE5B881DF8D71D6F79AB7F5796
SHA-256:	F52714812D68C577A445169D11E84DF6751C2D6886BC429643072BB5D61C6C27
SHA-512:	888D96ADB7A847ABE472145258C8C46950EB2FA3BA7D596C2E90A17C8FB06FD0155C56CC8ABA5D076D89368417464BCB2D236F9E40E53241950A01F9F8ED548F
Malicious:	false
Preview:	{.. "app": {.. "background": {.. "scripts": [ "craw_background.js" ].. }.. },.. "default_locale": "en",.. "description": "__MSG_APP_DESCRIPTION__",.. "display_in_launcher": false,.. "display_in_new_tab_page": false,.. "icons": {.. "128": "images/icon_128.png",.. "16": "images/icon_16.png".. },.. "key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrKfMnLqViEyokd1wk57FxJtW2XXpGXzIHBzv9vQI/01UsuP0IV5/lj0wx7zJ/xcibUgDeIxobvv9XD+zO1MdjMWuqJFcKuSS4Suqkje6u+pMrTSGOSHq1bmBVh0kpToN8YoJs/P/yrRd7FEtAXTaFTGxQL4C385MeXSjaQfiRiQIDAQAB",.. "manifest_version": 2,.. "minimum_chrome_version": "29",.. "name": "__MSG_APP_NAME__",.. "oauth2": {.. "auto_approve": true,.. "client_id": "203784468217.apps.googleusercontent.com",.. "scopes": [ "https://www.googleapis.com/auth/sierra", "https://www.googleapis.com/auth/sierrasandbox", "https://www.googleapis.com/auth/chromewebstore", "https://www.googleapis.com/auth/chromewebstore.readonly" ].. },.

C:\Users\user\AppData\Local\Temp\temp_event

Download File

Process:	C:\Users\user\Desktop\Setup 2.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Preview:	GIF89a.............!.......,...........D.;

C:\Users\user\AppData\Local\Temp\temp_settings

Download File

Process:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	2.4688702187432865
Encrypted:	false
SSDEEP:	3:nVUdvGt1U:Zte
MD5:	86CF4BCCD386456CA8091DEC847A0AD1
SHA1:	F6E3A73D7A1284A46E62EDCEBC7351FF6854CF65
SHA-256:	002A1BEFFB815578D1551DF0D56F2153EAFDE7DCE1902FB3328421242726C19B
SHA-512:	620FACF072B2BF312180A0A5A48BF5688F9D53AD4699B5D676E041C4840082A87F5AD7DD82C216F1B5136FA1AF89EFF7FAEAEFED0F20547355B057A3DE4C61B7
Malicious:	false
Preview:	0,0,0,1,2,64,2,5,256,1,2,64,1

C:\Users\user\AppData\Local\Temp\testfile.temp

Download File

Process:	C:\Users\user\AppData\Local\Temp\diskspd.exe
File Type:	data
Category:	dropped
Size (bytes):	104857600
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	2F282B84E7E608D5852449ED940BFC51
SHA1:	2C2CECCB5EC5574F791D45B63C940CFF20550F9A
SHA-256:	20492A4D0D84F8BEB1767F6616229F85D44C2827B64BDBFB260EE12FA1109E0E
SHA-512:	2798503C2C7B718799324122137BF30A562AAD1BC04BBF343DAAD225A5FD0D1FD5D269843A01AB00D4F8D8C5AB34F8956065F9831EF7459E9C487E895099E956
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-US\default.acl

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Little-endian UTF-16 Unicode text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Little-endian UTF-16 Unicode text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-US\default.exc

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Little-endian UTF-16 Unicode text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	UTF-8 Unicode (with BOM) text
Category:	dropped
Size (bytes):	2583
Entropy (8bit):	4.9697986369741445
Encrypted:	false
SSDEEP:
MD5:	B85E9A4702D1EEE70CA0B91AB0BD8110
SHA1:	9BE136BF0625D12E69B5F440892C67DD76ED2363
SHA-256:	4C365648A2AF6EA1B81DF89BD9BA18082D9475218CF609C0E72EAB72157C4F9C
SHA-512:	66931D4BD97531B12609E11A78F81BEA25215C0CFC83DDC42290B27E6A808D7702DE6585D826788763BC9823C038BCB904109FCAD10731D28E58EC10BEFE3026
Malicious:	false
Preview:	.{. "AFSEnvironment" : 0,. "AFSUrl" : "https://activity.windows.com",. "AccountSettings" : [],. "AfcDefaultUser" : "",. "AfcPrivacySettings" : {. "ActivityFeed" : 0,. "CloudSync" : 0,. "PublishUserActivity" : 0,. "UploadUserActivity" : 1. },. "AfsConnectivityEnabled" : true,. "AfsPostInitializeSyncWaitMs" : 10000,. "AfsSyncFrequencyMs" : 86400000,. "Authentication.Environment" : 0,. "BluetoothTransportEnabled" : true,. "BluetoothTransportHostingAllowed" : true,. "CcsApiVersion" : "/api/v1",. "CcsDefaultServerName" : "romeccs.microsoft.com",. "CcsPollingEnabled" : false,. "CcsPollingInterval" : 0,. "CcsSeenRequestIds" : [],. "CcsSeenRequestIdsLastUpdatedTime" : "0000-00-00T00:00:00.000",. "Cloud.SessionIdleTimeoutIntervalSecs" : 3600,. "CloudDataGroupPolicyActivitiyPolicies" : [],. "CloudDataMDMActivitiyPolicies" : [],. "CloudTransportEnabled" : true,. "CloudTransportHostingAllowed" : true,. "CustomAuthClsid" : "",.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\L.user.cdp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	UTF-8 Unicode (with BOM) text
Category:	modified
Size (bytes):	945
Entropy (8bit):	4.87407035063695
Encrypted:	false
SSDEEP:
MD5:	81D1E9428FCCBFACC9AD145A326DFB32
SHA1:	F44457BD8C3B9C8943B5A3260660EB750042B4B8
SHA-256:	CFB4CBED3EFB57B78814497F9A3E954028B8663253A84AB6AD4EC7DCD7D6E964
SHA-512:	E61D972C104E92742407DECAB0B430658EE015BC5631347B6A7B02FA57F6D5E14C81F0F69F7EF271465914852D2FA92A30270037AD00B6B335F27CF73EC8BFFF
Malicious:	false
Preview:	.{. "AfcDatabaseSettings" : {. "DatabaseInstanceId" : 0,. "LastUpdated" : "2022-06-01T22:49:39.544". },. "AfsActivityTypes" : [],. "AfsChannelUri" : "",. "AfsEnvironment" : "",. "AfsSubscriptionId" : "",. "AfsSubscriptionUpdateTime" : "0000-00-00T00:00:00.000",. "BaseRegisteredInfoHash" : "",. "CNCNotificationUri" : "",. "CNCNotificationUriExpirationTime" : "0000-00-00T00:00:00.000",. "CNCNotificationUriLastSynced" : "0000-00-00T00:00:00.000",. "DdsRegistrationExpiryTickCount" : 2435245389664,. "Devices" : [],. "FormatVersion" : 12,. "LastRegisteredNotificationUri" : "",. "LastRegisteredNotificationUriExpirationTime" : "0000-00-00T00:00:00.000",. "LastSyncedTime" : "0000-00-00T00:00:00.000",. "LogicalDeviceId" : "",. "NextDataEncryptionKeyRolloverTime" : "0000-00-00T00:00:00.000",. "RegisteredInfoHash" : "",. "RegisteredWithStrongAuth" : false,. "StableUserId" : "L.user".}.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SoftwareDistribution\DataStore\DataStore.edb

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe60deb47, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	24117248
Entropy (8bit):	4.160833409816978
Encrypted:	false
SSDEEP:
MD5:	24A423039D7A43680842063008948ADF
SHA1:	B92E224654D9654923DE08B25B0CD4FA45A506CB
SHA-256:	496E81D77763258861B62F2153766865FE66515B3EC15F5F916A0C6FFC8005A8
SHA-512:	ACB26F12F4970E1B7CD60A043304B15B0EEC391DE4B82CFC1E0DA9A8F47BCD864A080A9954891890D2C930AA8E2E7E4D150F482E9E273B803697DCFB8DEE39D9
Malicious:	false
Preview:	...G... .......L................y5..................................y...3...z..h....................................y..............................................................................................H............G......P....@...................................................................................................... ............yc.......................................................................................................................................................................................................................................bs.3...z.[................f)..3...z...........................#..............................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3746146480340311
Encrypted:	false
SSDEEP:
MD5:	39E615ADFF925D502BD4D32DCCEBFC77
SHA1:	E20B27B6356D60A985EA22ABA4C86BD4F7959C5D
SHA-256:	0EC5A7867B772092A8D7807282AEF4AF833CC9739EA30A54582C381DEA3F77A9
SHA-512:	31700163FD6589908074DBC05AF850D8C60008BED214F51D4058A49986D5D8C80C93774EBC3DC76D2C8CBF86B27C5590491F9A5912CE0C61A3B9B9810D47E18F
Malicious:	false
Preview:	.._..........................y..................C:\Windows\SoftwareDistribution\DataStore\Logs\......................................................................................................................................................................................................................C:\Windows\SoftwareDistribution\DataStore\Logs\.......................................................................................................................................................................................................................0u..................@...@....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\TMP1FB5.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Microsoft Cabinet archive data, 327 bytes, 1 file
Category:	dropped
Size (bytes):	16991
Entropy (8bit):	7.293385559012834
Encrypted:	false
SSDEEP:
MD5:	D410319561B5559E46F2D12A94A463F5
SHA1:	6C5AED5986ECB1ACDA7C6B80CFD3D41CFF7FAF29
SHA-256:	7D33DCEDB1AEF041EAA4C7B1C6139843A3DA71128382C93E9C516D625922D4B9
SHA-512:	6AE16B3A6A79A0F0FE308A49C8CAE9603743343CA0C3AFC635129C92F51958593F49A06DF148CB5376CDE403CF7DDC3FB29DFB1774182969C0D994DD2A29D725
Malicious:	false
Preview:	MSCF....G.......D................7..........G....A..........d.......m...............environment.xml.\.....m.CKm....0.E..}.T[;.F.U..qh...5.h.&.E..}2NA.n.=.rxty.T....$.......G.S.Z.p....0.^...&.}..r...rYwZ..tm.E..}.....c..Q.Y..<W%..SE.".I.."ZDs..$w...?..?. ...7...i..~Z......WYZ.{...p`t2...qeU.o...w...o.A..............0.A....H........A.0.@....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". .U..[=p.A.}..cv,..8e.X.'\:W...010...`.H.e....... ....>.p..=...3.s.o...=..H4.R......0...0..........3....}V]..N........0....H........0~1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1(0&..U....Microsoft Update Signing CA 2.30...180712202305Z..190808202305Z0o1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft Update0.."0...*.H.............0.........^Vo.w......r.?..-..o6.u%.~I..[....E/..^LO{. @>x..+.p,-/c^5.....W...J,/].. ....e...6/s.......g.kb.~...R

C:\Windows\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\sls.cab

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Microsoft Cabinet archive data, 7680 bytes, 1 file
Category:	dropped
Size (bytes):	24344
Entropy (8bit):	7.631461561360458
Encrypted:	false
SSDEEP:
MD5:	DF05AC827E0D5EF261A0103DB3D6B086
SHA1:	AB26C67C4F72E4DFFAD5686E7F912773D6797CC9
SHA-256:	4156412F0ED20B33707572E12603468FD1844C89F66AAA9509F55B2DCE540C72
SHA-512:	84255D98A249AB635F9B2EEE382BBFE945EDC09C3A63BEF6DFB686061B20642861D6C26BA11E8A67EB1A9A956A2E2EC26DBD7EA93A9D34475F04F9A250FE6C90
Malicious:	false
Preview:	MSCF............D...............)................A..........d......._B..............environment.cab...,.._BCK.Z.8T}.?...Zv.R.zf.kv.%{.,.1..d.)K.EB.H.B.y,I.EdiG....J...-.......z...._..............}.`..G{..@.`..@......Z..C.....}.p0`.'.p.....}qn...P..`..C....2..5&...t...#.X.)..&Z...=kX.e.=.t..aZ...k...T...%..S..H8!...4..qs.m._rfr.H.gbf~K..F..>xKr.M....1..M...J....k..].6.4V....u....9).m.....!U.......B...$O.T..o..M.Z..3aec{:..o...AV..w....o....s.....^c.c..Hz]....kq.p...BI#..#......O.@.$..8..f..(i..v...H8.......b.0$.$..!.) 1.......$...WN...Q..?Kqz..Ac@.[/..Z..b.d..S..e..Y.4.5X<.....u.....}Y.....H.?Oi..}..@.n9^zS.#\|WB;.j...2.f.U..$.~.D.......p.....+k.n.+4.....J...rat...t .%..I...4G.....5+..s.'....E3...T.Tfn{qx.h>..\C.........PZ..?\|.3.....BnG...k....LpC.c=\|.qQZ.(..4...V........em.."..\|....e~. ....~..H....#h..$.#....I.r.....B..96q..j@.......^.+hs{R.~4`..r}\G....$.....J...#?q.).=..w...V...w.K9<K.C=...w{1].<FNp`.,/g......(jIZ...[F>.^.}..7.j..v..y.V.kN.

C:\Windows\WindowsUpdate.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.850098938673388
Encrypted:	false
SSDEEP:
MD5:	2CC83D93DD1DDE691158CF5E9882420B
SHA1:	49BFDC6E1E73E09A0DEC345CA15B72D167ADD3B6
SHA-256:	455EC4F5B15557762B893388B591CA9F3E822675AB94FC6664AA4EC8C41CB295
SHA-512:	E67F883A016B7A410F4461492BCE124421BDDCCF4544322B9A460A56DF469170B2323FD0325E2CF928193FB6A1323C31CB0D464097F25D2F9B11AF3BF9CA1B4D
Malicious:	false
Preview:	Windows Update logs are now generated using ETW (Event Tracing for Windows)...Please run the Get-WindowsUpdateLog PowerShell command to convert ETW traces into a readable WindowsUpdate.log.......For more information, please visit https://go.microsoft.com/fwlink/?LinkId=518345

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.693469005681391
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup 2.exe
File size:	142536
MD5:	ec427b1bf867dc6fdfdfc2b5219f44de
SHA1:	d23dfcbd02089bc6f13db8dd4cf1f9c5a085d275
SHA256:	9b1d8b1bafd4f496de3e996dc6778ff0c75f37f2e5eaa5a60049d7c8338e7ef5
SHA512:	46b8c187ce0ad0a1e8f99703444b7c0494aaab1d2b275de5d655f01e237a5af7b35399ca70f21dc51db875066ddc7f347dfa3864a8f2bc1970ff56ce8ff3840c
SSDEEP:	3072:tqRaMrUwmuvDWLcKKDiH699VrvaaabJb1TYwC6+5WulEG1Uu:tnx13KeH69nrvaa6TYo+5WoEKU
TLSH:	19D3DF86279845B3FA8175F03967DF2BFA764E4374610A8387727DA36971283CD0A21F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3(..RF..RF..RF.]...RF..RG.pRF.]...RF..qv..RF..T@..RF.Rich.RF.........................PE..L...oy.V.................`.........

File Icon


Icon Hash:	60d81b192413490d

Static PE Info

General

Entrypoint:	0x40310d
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x567F796F [Sun Dec 27 05:38:55 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	29b61e5a552b3a9bc00953de1c93be41

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	3/21/2020 2:24:45 PM 5/20/2021 8:51:43 AM
Subject Chain	CN=Fast Corporate LTD, O=Fast Corporate LTD, L=Kfar Saba, C=IL
Version:	3
Thumbprint MD5:	609182DDEB26105E8E32FEBE91ED5B11
Thumbprint SHA-1:	930C9C4D910DB2B8522BC4E18CF70C7C1A5B3927
Thumbprint SHA-256:	26A9AD0DA011EFDFFD745BA4644737331414260B452AF58EE8F4BB7AE5342E8A
Serial:	00D6A5C821A6FB7C3C

Entrypoint Preview

Instruction
sub esp, 00000180h
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+14h], 00409188h
xor esi, esi
mov byte ptr [esp+18h], 00000020h
call dword ptr [004070B4h]
call dword ptr [004070B0h]
cmp ax, 00000006h
je 00007F1BE4D6AE93h
push ebx
call 00007F1BE4D6DC69h
cmp eax, ebx
je 00007F1BE4D6AE89h
push 00000C00h
call eax
push 0040917Ch
call 00007F1BE4D6DBEAh
push 00409174h
call 00007F1BE4D6DBE0h
push 00409168h
call 00007F1BE4D6DBD6h
push 0000000Dh
call 00007F1BE4D6DC39h
push 0000000Bh
call 00007F1BE4D6DC32h
mov dword ptr [0042EC44h], eax
call dword ptr [00407034h]
push ebx
call dword ptr [00407270h]
mov dword ptr [0042ECF8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 00000160h
push eax
push ebx
push 00429078h
call dword ptr [00407160h]
push 0040915Ch
push 0042E440h
call 00007F1BE4D6D869h
call dword ptr [004070ACh]
mov ebp, 00434000h
push eax
push ebp
call 00007F1BE4D6D857h
push ebx
call dword ptr [00407144h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x74d8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3f000	0x1f78	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1f610	0x36b8	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x280	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e3c	0x6000	False	0.668619791667	data	6.43229528851	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x126a	0x1400	False	0.43359375	data	5.00588726545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x25d38	0x600	False	0.474609375	data	4.29175604973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x2f000	0x10000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3f000	0x1f78	0x2000	False	0.271606445312	data	4.37989116735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x3f1f0	0x10a8	data	English	United States
RT_ICON	0x40298	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_DIALOG	0x40700	0x202	data	English	United States
RT_DIALOG	0x40908	0xf8	data	English	United States
RT_DIALOG	0x40a00	0xa0	data	English	United States
RT_DIALOG	0x40aa0	0xee	data	English	United States
RT_GROUP_ICON	0x40b90	0x22	data	English	United States
RT_MANIFEST	0x40bb8	0x3be	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	SetFileAttributesA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CompareFileTime, SearchPathA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, CreateDirectoryA, lstrcmpiA, GetCommandLineA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, LoadLibraryA, SetFileTime, CloseHandle, GlobalFree, lstrcmpA, ExpandEnvironmentStringsA, GetExitCodeProcess, GlobalAlloc, WaitForSingleObject, GetWindowsDirectoryA, GetTempPathA, GetProcAddress, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, ReadFile, FindClose, GetPrivateProfileStringA, WritePrivateProfileStringA, WriteFile, MulDiv, LoadLibraryExA, GetModuleHandleA, MultiByteToWideChar, FreeLibrary
USER32.dll	GetWindowRect, EnableMenuItem, GetSystemMenu, ScreenToClient, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetForegroundWindow, PostQuitMessage, RegisterClassA, EndDialog, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, OpenClipboard, TrackPopupMenu, SendMessageTimeoutA, GetDC, LoadImageA, GetDlgItem, FindWindowExA, IsWindow, SetClipboardData, SetWindowLongA, EmptyClipboard, SetTimer, CreateDialogParamA, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteValueA, SetFileSecurityA, RegOpenKeyExA, RegDeleteKeyA, RegEnumValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2022 22:49:36.691153049 CEST	49779	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:36.691224098 CEST	443	49779	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:36.691355944 CEST	49779	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:36.725323915 CEST	49779	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:36.725383043 CEST	443	49779	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:37.021333933 CEST	443	49779	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:37.021495104 CEST	49779	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:37.387073040 CEST	49779	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:37.387135029 CEST	443	49779	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:37.387562990 CEST	443	49779	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:37.387662888 CEST	49779	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:37.391535997 CEST	49779	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:37.437942982 CEST	443	49779	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:37.530810118 CEST	443	49779	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:37.530879974 CEST	443	49779	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:37.530944109 CEST	49779	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:37.530987978 CEST	49779	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:37.548369884 CEST	49779	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:37.548420906 CEST	443	49779	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:45.437005997 CEST	49786	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:45.437094927 CEST	443	49786	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:45.437489033 CEST	49786	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:45.531244040 CEST	49786	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:45.531312943 CEST	443	49786	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:45.814023018 CEST	443	49786	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:45.814136982 CEST	49786	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:45.938635111 CEST	49786	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:45.938661098 CEST	443	49786	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:45.938962936 CEST	49786	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:45.938977957 CEST	443	49786	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:46.252804995 CEST	443	49786	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:46.252924919 CEST	49786	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:46.252969027 CEST	443	49786	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:46.253000975 CEST	443	49786	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:46.253058910 CEST	49786	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:46.255161047 CEST	49786	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:46.624819040 CEST	49786	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:46.624867916 CEST	443	49786	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:46.699706078 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:46.699778080 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:46.699883938 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:46.700586081 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:46.700613976 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.127886057 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.128036022 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.141196966 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.141211033 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.141482115 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.141566992 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.142086029 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.189897060 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.371943951 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.372095108 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.372174025 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.372212887 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.372263908 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.372318983 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.372335911 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.372469902 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.372478962 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.372545958 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.510715961 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.510770082 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.510833979 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.510850906 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.510910034 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.510934114 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.510938883 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.510982037 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.510991096 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.511009932 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.511043072 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.511061907 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.511074066 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.511115074 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.511143923 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.511156082 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.511208057 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.650074959 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.650129080 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.650218010 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.650296926 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.650341988 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.650373936 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.650420904 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.650441885 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.650464058 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.650510073 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.650527954 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.650551081 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.650604963 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.650621891 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.650641918 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.650655985 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.650708914 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.650844097 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.650886059 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.650953054 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.650954008 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.650974035 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.651024103 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.651041985 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.651048899 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.651293993 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.651338100 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.651400089 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.651428938 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.651452065 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.651530981 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.652985096 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.745363951 CEST	60815	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:47.745430946 CEST	443	60815	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:47.745548964 CEST	60815	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:47.746184111 CEST	62701	443	192.168.2.3	142.250.181.237
Jun 1, 2022 22:49:47.746238947 CEST	443	62701	142.250.181.237	192.168.2.3
Jun 1, 2022 22:49:47.746340036 CEST	62701	443	192.168.2.3	142.250.181.237
Jun 1, 2022 22:49:47.746879101 CEST	50127	443	192.168.2.3	142.250.184.206
Jun 1, 2022 22:49:47.746944904 CEST	443	50127	142.250.184.206	192.168.2.3
Jun 1, 2022 22:49:47.747044086 CEST	50127	443	192.168.2.3	142.250.184.206
Jun 1, 2022 22:49:47.752476931 CEST	60815	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:47.752505064 CEST	443	60815	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:47.754213095 CEST	62701	443	192.168.2.3	142.250.181.237
Jun 1, 2022 22:49:47.754264116 CEST	443	62701	142.250.181.237	192.168.2.3
Jun 1, 2022 22:49:47.754692078 CEST	50127	443	192.168.2.3	142.250.184.206
Jun 1, 2022 22:49:47.754748106 CEST	443	50127	142.250.184.206	192.168.2.3
Jun 1, 2022 22:49:47.790381908 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.790452957 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.790510893 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.790529966 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.790585041 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.790594101 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.790642977 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.790777922 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.790836096 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.790877104 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.790888071 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.790921926 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.790936947 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.790944099 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.790992022 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.791132927 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.791191101 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.791213036 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.791225910 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.791271925 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.791364908 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.791429043 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.791533947 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.791589975 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.791632891 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.791642904 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.791678905 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.791703939 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.791757107 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.791811943 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.791912079 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.791966915 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792006969 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.792016983 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792073011 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.792114019 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792166948 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.792211056 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792248964 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792295933 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.792308092 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792352915 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.792378902 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.792388916 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792423010 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792459011 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792525053 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.792538881 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792548895 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.792598963 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.792608976 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792634964 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792670965 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792680025 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.792695999 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792726040 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.792766094 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.792776108 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.792828083 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.805905104 CEST	443	50127	142.250.184.206	192.168.2.3
Jun 1, 2022 22:49:47.809007883 CEST	443	62701	142.250.181.237	192.168.2.3
Jun 1, 2022 22:49:47.809845924 CEST	50127	443	192.168.2.3	142.250.184.206
Jun 1, 2022 22:49:47.809916973 CEST	443	50127	142.250.184.206	192.168.2.3
Jun 1, 2022 22:49:47.810290098 CEST	443	50127	142.250.184.206	192.168.2.3
Jun 1, 2022 22:49:47.810374022 CEST	50127	443	192.168.2.3	142.250.184.206
Jun 1, 2022 22:49:47.810487032 CEST	62701	443	192.168.2.3	142.250.181.237
Jun 1, 2022 22:49:47.810501099 CEST	443	62701	142.250.181.237	192.168.2.3
Jun 1, 2022 22:49:47.811089993 CEST	443	50127	142.250.184.206	192.168.2.3
Jun 1, 2022 22:49:47.811160088 CEST	50127	443	192.168.2.3	142.250.184.206
Jun 1, 2022 22:49:47.811527967 CEST	443	62701	142.250.181.237	192.168.2.3
Jun 1, 2022 22:49:47.811598063 CEST	62701	443	192.168.2.3	142.250.181.237
Jun 1, 2022 22:49:47.930885077 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.930944920 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.930999994 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931015015 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931055069 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931073904 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931082964 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931129932 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931144953 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931169987 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931220055 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931226969 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931241035 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931271076 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931293011 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931298018 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931313992 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931334972 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931375980 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931385040 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931411028 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931431055 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931436062 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931448936 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931469917 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931510925 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931519985 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931533098 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931539059 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931571960 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931585073 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931596041 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931610107 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931648970 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931663036 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931679010 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931720018 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931772947 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931797028 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931838036 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931869030 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931875944 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.931910038 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.931937933 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.932037115 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932060003 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932101965 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932183027 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.932192087 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932215929 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.932233095 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.932302952 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932327032 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932364941 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932391882 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.932400942 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932434082 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.932472944 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.932580948 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932602882 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932646036 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932658911 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.932668924 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932698965 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.932718992 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.932818890 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932842970 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932879925 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932907104 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.932915926 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.932950020 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.932969093 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933089018 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933114052 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933151007 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933171034 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933178902 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933221102 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933257103 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933334112 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933357954 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933393955 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933413982 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933422089 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933471918 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933497906 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933516979 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933538914 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933598995 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933602095 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933613062 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933643103 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933665991 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933685064 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933708906 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933773041 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933774948 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933788061 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933824062 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933839083 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933849096 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933860064 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933873892 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933911085 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933919907 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.933958054 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933981895 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.933988094 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.934003115 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.934024096 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.934027910 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.934039116 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.934067011 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.934129000 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.934139013 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.934151888 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.934174061 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.934176922 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.934189081 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.934225082 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.934278965 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.934289932 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.934330940 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.973045111 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.973072052 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.973186970 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:47.973207951 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:47.973253965 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.032865047 CEST	443	60815	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.033411026 CEST	60815	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.033425093 CEST	443	60815	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.034478903 CEST	443	60815	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.034562111 CEST	60815	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.072905064 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.073000908 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.073355913 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.073393106 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.073468924 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.073472023 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.073491096 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.073550940 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.073992968 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.074026108 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.074085951 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.074090004 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.074103117 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.074126959 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.074143887 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.074170113 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.074642897 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.074678898 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.074734926 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.074739933 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.074753046 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.074811935 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.075290918 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.075329065 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.075376987 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.075391054 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.075407982 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.075449944 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.075459003 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.075512886 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.075879097 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.075912952 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.075963974 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.075973988 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.076018095 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.076045036 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.076051950 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.076103926 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.076432943 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.076467991 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.076524973 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.076527119 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.076541901 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.076585054 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.076617002 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.076834917 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.076869965 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.076924086 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.076936960 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.076953888 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.076997995 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.077008963 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.077069044 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.077208996 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.077243090 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.077301979 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.077331066 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.077346087 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.077387094 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.077404976 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.077604055 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.077636003 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.077692986 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.077697039 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.077712059 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.077752113 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.077776909 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.105752945 CEST	50127	443	192.168.2.3	142.250.184.206
Jun 1, 2022 22:49:48.106081009 CEST	62701	443	192.168.2.3	142.250.181.237
Jun 1, 2022 22:49:48.106086969 CEST	443	50127	142.250.184.206	192.168.2.3
Jun 1, 2022 22:49:48.106230974 CEST	50127	443	192.168.2.3	142.250.184.206
Jun 1, 2022 22:49:48.106259108 CEST	443	50127	142.250.184.206	192.168.2.3
Jun 1, 2022 22:49:48.106348991 CEST	443	62701	142.250.181.237	192.168.2.3
Jun 1, 2022 22:49:48.106535912 CEST	60815	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.106756926 CEST	443	60815	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.107330084 CEST	62701	443	192.168.2.3	142.250.181.237
Jun 1, 2022 22:49:48.107356071 CEST	443	62701	142.250.181.237	192.168.2.3
Jun 1, 2022 22:49:48.107578039 CEST	60815	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.107604027 CEST	443	60815	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.137326956 CEST	443	50127	142.250.184.206	192.168.2.3
Jun 1, 2022 22:49:48.137506962 CEST	443	50127	142.250.184.206	192.168.2.3
Jun 1, 2022 22:49:48.137523890 CEST	50127	443	192.168.2.3	142.250.184.206
Jun 1, 2022 22:49:48.137597084 CEST	50127	443	192.168.2.3	142.250.184.206
Jun 1, 2022 22:49:48.143455029 CEST	50127	443	192.168.2.3	142.250.184.206
Jun 1, 2022 22:49:48.143516064 CEST	443	50127	142.250.184.206	192.168.2.3
Jun 1, 2022 22:49:48.156435013 CEST	443	62701	142.250.181.237	192.168.2.3
Jun 1, 2022 22:49:48.156582117 CEST	62701	443	192.168.2.3	142.250.181.237
Jun 1, 2022 22:49:48.156594992 CEST	443	62701	142.250.181.237	192.168.2.3
Jun 1, 2022 22:49:48.156646967 CEST	443	62701	142.250.181.237	192.168.2.3
Jun 1, 2022 22:49:48.156728029 CEST	62701	443	192.168.2.3	142.250.181.237
Jun 1, 2022 22:49:48.160542965 CEST	62701	443	192.168.2.3	142.250.181.237
Jun 1, 2022 22:49:48.160564899 CEST	443	62701	142.250.181.237	192.168.2.3
Jun 1, 2022 22:49:48.223988056 CEST	60815	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.253649950 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.253680944 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.253721952 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.253783941 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.253801107 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.253835917 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.253853083 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.253858089 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.253868103 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.253911018 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.253940105 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.253953934 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.253979921 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.254008055 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.254117012 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254136086 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254165888 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254204035 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.254213095 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254250050 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.254401922 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254422903 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254451036 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254519939 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.254528046 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254556894 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.254590988 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.254668951 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254688978 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254734993 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254756927 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.254765987 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254806042 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.254817009 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254836082 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254878998 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254903078 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.254911900 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254926920 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254940033 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.254945993 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.254986048 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.254993916 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.255028009 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.255043983 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.255064011 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.255074024 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.255108118 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.255131960 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.255156040 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.255166054 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.255208969 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.255222082 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.255258083 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.255269051 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.255300045 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.255356073 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.310789108 CEST	443	60815	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.310869932 CEST	443	60815	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.310916901 CEST	60815	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.354651928 CEST	60815	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.354676008 CEST	443	60815	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.359107971 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359137058 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359169960 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359229088 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359244108 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359291077 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359342098 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359364033 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359406948 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359421015 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359428883 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359453917 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359472036 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359472990 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359487057 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359546900 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359555960 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359580994 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359596968 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359599113 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359611988 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359642029 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359689951 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359690905 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359703064 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359735966 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359755993 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359771013 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359791040 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359791994 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359812021 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359817028 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359827042 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359853029 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359884977 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359893084 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359911919 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359930038 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359930992 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.359942913 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.359971046 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360014915 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360023975 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360035896 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360054970 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360063076 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360074997 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360120058 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360157013 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360198021 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360202074 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360213041 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360236883 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360265970 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360270023 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360280037 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360307932 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360325098 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360333920 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360346079 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360363007 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360393047 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360404015 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360428095 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360451937 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360452890 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360466003 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360488892 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360537052 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360548973 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360584974 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360594034 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360625982 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360626936 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360640049 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360652924 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360671043 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360677958 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360738039 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360747099 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360761881 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360780954 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360793114 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360804081 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360852957 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360857010 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360891104 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360893011 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360905886 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360939026 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360953093 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360982895 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.360989094 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.360999107 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361027956 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361046076 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361083031 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361092091 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361141920 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361176014 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361185074 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361237049 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361247063 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361308098 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361318111 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361365080 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361371994 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361416101 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361423016 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361438990 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361457109 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361464977 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361486912 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361537933 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361546993 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361582041 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361594915 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361605883 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361654997 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361663103 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361694098 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361705065 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361715078 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361741066 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361763954 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361773968 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361809015 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361829042 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361860037 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361866951 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361876965 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361926079 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361948013 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.361964941 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.361978054 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.362013102 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.362051010 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.362052917 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.362065077 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.362093925 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.362124920 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.362128973 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.362139940 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.362154007 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.362169981 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.362171888 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.362229109 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.362237930 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.362272024 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.362309933 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.395982981 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.396043062 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.396141052 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.396155119 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.396199942 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.396300077 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.396368980 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.396378994 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.396399975 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.396411896 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.396467924 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.396495104 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.396559000 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.396606922 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.396656036 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.396708012 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.396716118 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.396748066 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.396891117 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.396958113 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.396960974 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.396971941 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.397000074 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397063017 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397070885 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.397124052 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397150993 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.397196054 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.397242069 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397248983 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.397269964 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397296906 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397336006 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.397391081 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397437096 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.397480965 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.397572994 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397581100 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.397629976 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397650957 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397655964 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.397702932 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397725105 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.397768021 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.397826910 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397835016 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.397871017 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397891045 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.397952080 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.398019075 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.398049116 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.398091078 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.398145914 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.398154020 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.398199081 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.398235083 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.398241043 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.398283005 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.434241056 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.434705973 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.444864988 CEST	54422	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.444902897 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.444991112 CEST	54422	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.445275068 CEST	54422	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.445283890 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.540484905 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.540543079 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.540625095 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.540653944 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.540680885 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.540762901 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.540792942 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.540812969 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.540874958 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.540919065 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.540930033 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.540993929 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.541151047 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.541188002 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.541254044 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.541255951 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.541279078 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.541296005 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.541313887 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.541332960 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.541434050 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.541471958 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.541560888 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.541564941 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.541585922 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.541632891 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.541655064 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.541682005 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.541723967 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.541773081 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.541789055 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.541815042 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.541857004 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.541871071 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.541933060 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.541941881 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.541963100 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542023897 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542026043 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542058945 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542121887 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542140007 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542151928 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542174101 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542220116 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542236090 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542269945 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542275906 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542295933 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542324066 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542345047 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542357922 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542387009 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542423964 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542475939 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542490959 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542536974 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542553902 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542571068 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542594910 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542633057 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542643070 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542665005 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542685986 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542736053 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542762041 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542778015 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542804956 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542839050 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542849064 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542870045 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.542891026 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542943001 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542969942 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.542987108 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543039083 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543055058 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543076038 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543107033 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543132067 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543158054 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543174028 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543220043 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543251038 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543267012 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543303013 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543334007 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543353081 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543380976 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543404102 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543422937 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543437004 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543477058 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543530941 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543550014 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543612957 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543612957 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543646097 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543695927 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543708086 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543730974 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543790102 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543807030 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543838024 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.543904066 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.543967009 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544019938 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544064045 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544080973 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544101954 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544142962 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544162035 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544226885 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544285059 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544336081 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544393063 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544409037 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544426918 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544475079 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544490099 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544553995 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544570923 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544600010 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544647932 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544677019 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544727087 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544748068 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544761896 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544812918 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544837952 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544862032 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544898987 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544907093 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544928074 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.544959068 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.544992924 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545042038 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545054913 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545078039 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545134068 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545192957 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545196056 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545221090 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545238972 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545248985 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545255899 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545259953 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545280933 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545300007 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545324087 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545325994 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545381069 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545397997 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545418978 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545455933 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545465946 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545500994 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545531034 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545538902 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545562029 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545594931 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545638084 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545671940 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545685053 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545727968 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545754910 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545775890 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545813084 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545886993 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545901060 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545926094 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545964003 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.545974970 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.545994043 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546014071 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546086073 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546103001 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546137094 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546169043 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546186924 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546206951 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546227932 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546288013 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546303034 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546329021 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546363115 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546375036 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546392918 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546415091 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546475887 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546490908 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546513081 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546545029 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546566963 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546586990 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546608925 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546660900 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546679974 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546753883 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546761990 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546781063 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546823978 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546849966 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546886921 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546901941 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.546921015 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546961069 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.546974897 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547032118 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547045946 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547065020 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547122002 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547132015 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547188044 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547195911 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547225952 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547244072 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547255039 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547270060 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547303915 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547321081 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547353983 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547364950 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547415018 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547454119 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547476053 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547554016 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547584057 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547631025 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547683001 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547698975 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547746897 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547760963 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547770977 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547825098 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547843933 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547866106 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547889948 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547919035 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.547956944 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.547977924 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.548000097 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.548016071 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.548024893 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.548053026 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.726057053 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.728919029 CEST	54422	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.728966951 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.729604006 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.730237961 CEST	54422	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.730284929 CEST	54422	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.730300903 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.730436087 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:48.777942896 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.777971029 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778070927 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778093100 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778121948 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778143883 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778207064 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778214931 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778239965 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778273106 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778292894 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778306961 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778351068 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778366089 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778418064 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778465033 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778505087 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778562069 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778574944 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778599977 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778623104 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778628111 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778667927 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778671026 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778691053 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778723955 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778736115 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778748035 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778778076 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778800011 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778815985 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778862000 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.778944016 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.778996944 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.779032946 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.779043913 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.779084921 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.779114008 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.779146910 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.779196978 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.779284954 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.779335976 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.779370070 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.779380083 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.779416084 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.779438972 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.779494047 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.779551029 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.779629946 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.779680967 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.779700994 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.779716015 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.779757023 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.779844046 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.779896021 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.779983044 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.780035973 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.780057907 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.780069113 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.780105114 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.780127048 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.780180931 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.780230045 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.780319929 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.780378103 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.780402899 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.780416012 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.780448914 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.780492067 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.780525923 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.780581951 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.780659914 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.780713081 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.780741930 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.780751944 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.780951977 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781008005 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781019926 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781033993 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781042099 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781048059 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781086922 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781106949 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781174898 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781232119 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781286955 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781311035 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781323910 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781364918 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781385899 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781426907 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781481028 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781531096 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781569004 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781606913 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781615973 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781652927 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781683922 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781689882 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781739950 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781760931 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781796932 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781832933 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781840086 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781893969 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781903982 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.781934977 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.781974077 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782015085 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.782021999 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782092094 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782095909 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.782114983 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782151937 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782161951 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.782188892 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.782192945 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782241106 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.782269001 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782306910 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782342911 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.782350063 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782382965 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.782406092 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.782526016 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782563925 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782598972 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.782607079 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782651901 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.782671928 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782746077 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.782867908 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.782938004 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.782980919 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.783018112 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.783050060 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.783057928 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.783090115 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.783113956 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.788615942 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.822782040 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.822824001 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.822879076 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.822901011 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.822930098 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.822951078 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.824274063 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.824342966 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.824371099 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.824383974 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.824414968 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.824431896 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.824472904 CEST	54422	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:48.824687958 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.824742079 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.824769974 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.824780941 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.824820042 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.824841022 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.825143099 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.825203896 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.825232029 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.825243950 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.825278044 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.825304031 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.825486898 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.825542927 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.825570107 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.825579882 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.825617075 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.825638056 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.825829983 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.825915098 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.825922966 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.825956106 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.825992107 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.826014996 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.826221943 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.826261997 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.826303959 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.826318026 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.826358080 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.826386929 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.917218924 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.917263985 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.917342901 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.917366028 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.917403936 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.917432070 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.917613029 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.917666912 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.917726040 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.917742968 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.917777061 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.917797089 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.917988062 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.918045998 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.918098927 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.918118954 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.918138981 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.918195009 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.920080900 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.920142889 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.920229912 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.920245886 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.920263052 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.920311928 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.920358896 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.920416117 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.920461893 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.920478106 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.920495987 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.920545101 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.920778990 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.920831919 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.920885086 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.920900106 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.920936108 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.920953035 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.921107054 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.921159029 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.921207905 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.921222925 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.921241999 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.921286106 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.921451092 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.921506882 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.921580076 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.921598911 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.921619892 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.921679020 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.921778917 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.921894073 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.921911001 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.921961069 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:48.921983004 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.922039986 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.927933931 CEST	49787	443	192.168.2.3	52.217.197.24
Jun 1, 2022 22:49:48.927968979 CEST	443	49787	52.217.197.24	192.168.2.3
Jun 1, 2022 22:49:49.003309011 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.003360987 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.003379107 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.003464937 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.003473043 CEST	54422	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.003494978 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.003520966 CEST	54422	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.003525972 CEST	54422	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.003526926 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.003608942 CEST	54422	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.025743008 CEST	54422	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.025794983 CEST	443	54422	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.047967911 CEST	56320	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.048043013 CEST	443	56320	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.048155069 CEST	56320	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.048698902 CEST	56320	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.048728943 CEST	443	56320	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.087418079 CEST	52740	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.087471008 CEST	443	52740	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.087584019 CEST	52740	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.088005066 CEST	56863	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.088057041 CEST	443	56863	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.088146925 CEST	56863	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.088316917 CEST	52740	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.088344097 CEST	443	52740	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.088572025 CEST	56863	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.088599920 CEST	443	56863	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.213831902 CEST	55949	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.213912964 CEST	443	55949	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.214009047 CEST	55949	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.218561888 CEST	55949	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.218599081 CEST	443	55949	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.330435038 CEST	443	56320	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.369316101 CEST	443	56863	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.371079922 CEST	443	52740	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.440658092 CEST	56320	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.499893904 CEST	443	55949	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.528678894 CEST	56863	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.528897047 CEST	52740	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.640646935 CEST	55949	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.690985918 CEST	56320	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.691031933 CEST	443	56320	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.691854954 CEST	443	56320	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.692430019 CEST	55949	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.692452908 CEST	443	55949	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.692852020 CEST	52740	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.692886114 CEST	443	52740	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.693731070 CEST	443	52740	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.694150925 CEST	56863	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.694191933 CEST	443	56863	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.694597960 CEST	56320	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.694796085 CEST	443	56320	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.695415974 CEST	443	55949	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.695492983 CEST	443	55949	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.695524931 CEST	55949	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.696290016 CEST	52740	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.696583033 CEST	443	52740	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.697000027 CEST	443	56863	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.697078943 CEST	443	56863	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.697097063 CEST	56863	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.755476952 CEST	55949	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.755845070 CEST	443	55949	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.757267952 CEST	56320	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.759151936 CEST	56863	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.759471893 CEST	443	56863	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.767030954 CEST	52740	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.767719030 CEST	55949	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.767762899 CEST	443	55949	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.769180059 CEST	56863	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.769212008 CEST	443	56863	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.801945925 CEST	443	56320	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.809900045 CEST	443	52740	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.839695930 CEST	55949	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.906907082 CEST	443	55949	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.907038927 CEST	443	55949	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.907156944 CEST	55949	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.908672094 CEST	443	56863	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:49.908771038 CEST	56863	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.985146046 CEST	55949	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:49.985178947 CEST	443	55949	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:50.045665026 CEST	443	56320	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:50.045738935 CEST	443	56320	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:50.045876026 CEST	56320	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:50.150274038 CEST	443	52740	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:50.150410891 CEST	443	52740	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:50.150543928 CEST	52740	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:50.896686077 CEST	56863	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:50.896723032 CEST	443	56863	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:51.741353989 CEST	56320	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:51.741380930 CEST	443	56320	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:51.741945982 CEST	52740	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:51.741970062 CEST	443	52740	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:51.785368919 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:51.785415888 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:51.785506010 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:51.785888910 CEST	57495	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:51.785918951 CEST	443	57495	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:51.785985947 CEST	57495	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:51.786338091 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:51.786356926 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:51.786616087 CEST	57495	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:51.786624908 CEST	443	57495	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:52.066454887 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:52.067553043 CEST	443	57495	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:52.127537012 CEST	57495	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:52.139902115 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:56.567243099 CEST	57495	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:56.567279100 CEST	443	57495	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:56.567333937 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:56.567389011 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:56.568238020 CEST	443	57495	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:56.568546057 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:56.569102049 CEST	57495	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:56.569298029 CEST	443	57495	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:56.569608927 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:56.569822073 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:56.624223948 CEST	57495	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:56.741379023 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:56.934446096 CEST	57495	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:56.977931976 CEST	443	57495	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.013565063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.013616085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.013716936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.014286995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.014312029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.070569038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.070674896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.074316978 CEST	443	57495	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.074362993 CEST	443	57495	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.074444056 CEST	57495	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.074461937 CEST	443	57495	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.074525118 CEST	443	57495	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.074598074 CEST	57495	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.078455925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.078468084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.078663111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.078728914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.079252005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.079684973 CEST	57495	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.079709053 CEST	443	57495	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.104409933 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.121901035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.145956039 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.252448082 CEST	52582	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.252506018 CEST	443	52582	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.252624035 CEST	52582	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.252832890 CEST	52582	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.252862930 CEST	443	52582	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.286454916 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.286504030 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.286753893 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.286828995 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.286844015 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.345525980 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.347115040 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.347170115 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.348647118 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.348747015 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.372773886 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.373032093 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.383300066 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.383362055 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.383383989 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.383436918 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.383447886 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.383457899 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.383479118 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.383481026 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.383496046 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.383510113 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.383529902 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.383549929 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.383595943 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.383744001 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.383764982 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.383805990 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.383826971 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.383876085 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.383896112 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.383912086 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.383936882 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.383944035 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.383975983 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.383980989 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.440310955 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.440346003 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.523781061 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.523842096 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.523901939 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.523926973 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.523977995 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.523988962 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.524048090 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.524054050 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.524111986 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.524116993 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.524184942 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.524409056 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.524493933 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.524507999 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.524543047 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.524564981 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.524574995 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.524663925 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.524682999 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.524846077 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.524880886 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.524930954 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.524954081 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.524966002 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.525015116 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.534460068 CEST	443	52582	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.541441917 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.564116955 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.564276934 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.564337969 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.567348957 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.574048042 CEST	52582	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.574084044 CEST	443	52582	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.574500084 CEST	443	52582	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.574984074 CEST	52582	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.575067043 CEST	443	52582	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.575455904 CEST	52582	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.579248905 CEST	57975	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.579297066 CEST	443	57975	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.607044935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.607084990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.607152939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.607176065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.607191086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.607249975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.617919922 CEST	443	52582	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.694473028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.694607973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.697154045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.697175980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.697304964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.697377920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.697405100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.697422981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.697468042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.700252056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.700316906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.700349092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.700364113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.700388908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.700417995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.700443983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.714967966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.715055943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.715126038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.715142012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.715186119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.715204954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.784614086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.784734011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.786534071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.786647081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.786657095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.786725998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.789072990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.789097071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.789171934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.789180994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.789222002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.789259911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.791829109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.791851997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.791925907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.791949034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.791964054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.792011976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.804145098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.804167986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.804295063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.804339886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.804352045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.804402113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.804445028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.812000990 CEST	443	52582	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.812143087 CEST	443	52582	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.812300920 CEST	52582	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.819680929 CEST	52582	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.819717884 CEST	443	52582	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.877280951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.877418995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.878387928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.878468037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.878482103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.878504038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.878546953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.878576040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.882905006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.882946968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.883013010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.883027077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.883059978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.883085012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.883799076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.883871078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.883894920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.883908033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.883935928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.883958101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.885528088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.885567904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.885634899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.885646105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.885684967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.885710955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.886122942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.886198044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.887868881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.887907028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.887973070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.887983084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.888025045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.888045073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.888931036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.889008045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.889039040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.889049053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.889106989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.889770031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.889842987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.889929056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.890000105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.890312910 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.891355991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.891427040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.891463041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.891474962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.891503096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.891524076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.893022060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.893059969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.893134117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.893148899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.893177986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.893197060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.893980980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.894047022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.894088984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.894095898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.894126892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.894155979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.897072077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.897156954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.897459984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.897531033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.897562027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.897569895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.897591114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.897619009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.898375988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.898468018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.911103010 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.911235094 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.911295891 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.911345959 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.911391973 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.911467075 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.911473036 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.911494970 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.911564112 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.912117004 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.913425922 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.913477898 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.913513899 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.913532972 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.913595915 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.914855003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.914920092 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.914973021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.915146112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.915222883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.915870905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.915971994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.915981054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.916038036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.916122913 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.916182995 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.916203022 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.916223049 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.916285992 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.917491913 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.917615891 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.917702913 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.917785883 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.917818069 CEST	443	49273	142.250.186.99	192.168.2.3
Jun 1, 2022 22:49:57.917829990 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.917896032 CEST	49273	443	192.168.2.3	142.250.186.99
Jun 1, 2022 22:49:57.970998049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.971056938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.971151114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.971177101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.971204042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.971246958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.971497059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.971538067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.971595049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.971607924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.971657038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.971678972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.972312927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.972352028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.972428083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.972440004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.972479105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.972500086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.972851992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.972898960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.972956896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.972969055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.973006964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.973027945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.973481894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.973521948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.973587036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.973592997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.973642111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.974148035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.974169016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.974239111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.974246025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.974304914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.974975109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.975035906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.975059032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.975070000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.975106955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.975132942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.975800991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.975824118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.975898027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.975907087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.975945950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.975982904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.976044893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.976854086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.976871967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.976934910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.976942062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.976983070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.977545023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.977564096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.977633953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.977642059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.977678061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.977771044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.977788925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.977838993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.977845907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.977886915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.978673935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.978693008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.978751898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.978759050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.978792906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.978813887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.979614019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.979633093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.979707003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.979713917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.979756117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.980483055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.980501890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.980546951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.980572939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.980585098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.980644941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.981555939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.981575966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.981648922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.981657028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.981695890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.993335009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.993367910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.993419886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.993452072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.993468046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:57.993494034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.993530989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:57.994374990 CEST	63065	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.994432926 CEST	443	63065	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:57.994525909 CEST	63065	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.994725943 CEST	63065	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:57.994754076 CEST	443	63065	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:58.004651070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.004694939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.004853964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.004890919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.004914045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.004955053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.005589008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.005630016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.005680084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.005718946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.005733013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.005765915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.005784035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.054486036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.054620981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.055234909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.055275917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.055373907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.055396080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.055457115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.055870056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.055907011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.055955887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.055969000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.055984974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.056022882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.056032896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.056091070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.056389093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.056468964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.056479931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.056503057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.056535959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.056565046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.056664944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.056744099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.056998014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.057075024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.057106018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.057120085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.057147026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.057189941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.057231903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.057351112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.057651043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.057737112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.057832003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.057934046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.058001041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.058075905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.058279991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.058360100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.058644056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.058701992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.058731079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.058732033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.058751106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.058752060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.058783054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.058801889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.058886051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.058957100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.059252024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.059308052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.059348106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.059360027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.059375048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.059416056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.060060978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.060098886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.060154915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.060167074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.060210943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.060237885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.060694933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.060733080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.060787916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.060800076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.060841084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.060852051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.061248064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.061284065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.061345100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.061357021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.061395884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.061417103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.062026978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.062064886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.062133074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.062144041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.062206984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.062215090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.062391043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.062405109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.062465906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.063051939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.063138008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.063163042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.063177109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.063213110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.063220978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.063246012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.063256979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.063278913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.063343048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.063488960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.063513994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.063580036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.063591003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.063607931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.063615084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.063653946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.063666105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.063684940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.063730001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.064050913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.064111948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.064142942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.064157009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.064173937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.064203978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.064238071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.064327955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.064635992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.064690113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.064721107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.064733982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.064754963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.064788103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.064914942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.064992905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.109167099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109337091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.109338999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109364033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109428883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109440088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.109471083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109499931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109523058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.109533072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109539032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.109553099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109590054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.109632015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.109668970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109723091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.109752893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109785080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109834909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.109848022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109874010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.109910965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.109922886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109966040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.109983921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.109993935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110044956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110073090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110097885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110200882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110214949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110234022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110271931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110282898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110323906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110359907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110373020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110435009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110459089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110471010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110486984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110496998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110522032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110533953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110553026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110572100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110610962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110621929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110637903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110677004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110677958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110697985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110739946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110774040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110852957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110919952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.110939980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.110977888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111012936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111020088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111036062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111044884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111068010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111069918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111116886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111124992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111149073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111164093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111193895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111206055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111275911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111288071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111345053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111367941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111428022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111450911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111463070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111488104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111506939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111529112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111562967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111605883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111618042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111649036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111664057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111666918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111685038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111718893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111746073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111757994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111778975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111809015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111829042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111892939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.111912966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.111958027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112003088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112015009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112027884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112031937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112067938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112087965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112102032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112181902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112205982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112281084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112289906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112308025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112355947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112375975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112404108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112442970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112447977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112469912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112481117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112504959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112507105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112538099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112550020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112576962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112607956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112622976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112636089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112679005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112699032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112704039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112720966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112762928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112781048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112795115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112852097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112874985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.112941027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.112968922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113039017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113065004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113136053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113157988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113214970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113238096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113250971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113267899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113276005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113322973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113333941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113348961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113363981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113406897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113418102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113432884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113461971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113476992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113488913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113531113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113547087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113562107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113573074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113626957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113639116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113693953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113706112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113734961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113765001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113776922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113807917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113842010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113847971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113867044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113919020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113919020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.113936901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.113979101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114000082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114020109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114078045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114145041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114214897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114236116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114290953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114321947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114331961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114345074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114358902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114375114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114404917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114428997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114502907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114520073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114572048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114603043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114604950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114623070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114629984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114725113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114768982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114787102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114799976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114810944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114852905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114864111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114880085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114933014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.114945889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.114995956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.115348101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.144129038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.144263983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.144270897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.144294024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.144349098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.144365072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.144382000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.144443989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.145009041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.145046949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.145106077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.145112991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.145127058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.145169020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.145205021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.145910978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.145948887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.146012068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.146024942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.146059990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.146078110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.146173954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.146253109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.146826029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.146872044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.146936893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.146949053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.146964073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.147001982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.147533894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.147614002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.147619009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.147644997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.147696018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.147713900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.147723913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.147742033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.147780895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.147790909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.147806883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.147852898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.147927999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.147985935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.148015022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.148030996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.148046970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.148085117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.148746967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.148787975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.148852110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.148864031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.148880959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.148904085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.148922920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.148932934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.148961067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.149005890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.149451017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.149513006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.149557114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.149561882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.149571896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.149584055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.149635077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.149736881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.149795055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.149817944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.149831057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.149851084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.149852037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.149884939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.149897099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.149909973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.149950027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.150122881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.150182009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.150206089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.150218010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.150254965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.150270939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.150525093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.150608063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.150809050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.150866985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.150891066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.150904894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.150928974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.150948048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.151206970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.151289940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.151335955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.151346922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.151371002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.151400089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.151444912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.151460886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.151473999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.151519060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.182599068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.182698965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.182758093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.182840109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.182857990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.182929039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.182936907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.182974100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.182995081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.183002949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.183032990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.183047056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.183062077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.183090925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.183101892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.183114052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.183135033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.183165073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.183207035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.183219910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.183271885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.201070070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.201184034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.201205015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.201263905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.201297998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.201313019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.201337099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.201342106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.201370001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.201380014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.201404095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.201441050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.201715946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.201760054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.201805115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.201819897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.201838970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.201863050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.201874971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.201921940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.201967955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.202003956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.202055931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.202137947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.202150106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.202195883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.202208042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.202228069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.202253103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.202291965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.202305079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.202342987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.202348948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.202368021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.202378988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.202405930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.202420950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.202455997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.202466965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.202483892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.202522039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.202785969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.202862024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.202934027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203027010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203039885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203061104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203085899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203118086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203135014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203145981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203164101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203185081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203197002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203214884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203250885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203283072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203341961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203414917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203480005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203509092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203555107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203586102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203598976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203613997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203650951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203736067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203809977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203850031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203890085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203923941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203937054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203949928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203963995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.203984976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.203998089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204014063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204052925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204066038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204085112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204109907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204153061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204164982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204185963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204204082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204217911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204289913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204302073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204322100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204346895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204379082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204390049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204402924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204428911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204443932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204456091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204497099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204524994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204554081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204617023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204668045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204713106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204750061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204766989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204780102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204787016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204819918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204826117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204842091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204858065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204900026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204910994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.204963923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.204981089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.205053091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.205070972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.205113888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.205148935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.205159903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.205173969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.205219030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.206228971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.206464052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.206629038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.206681013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.206711054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.206722975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.206734896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.206774950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.206793070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207055092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207089901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207143068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207153082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207181931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207207918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207210064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207227945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207258940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207295895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207308054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207359076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207374096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207395077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207437992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207474947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207488060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207503080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207509041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207536936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207545996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207564116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207577944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207614899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207626104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207640886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207679033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207680941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207696915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207736969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207751989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207840919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207885027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207920074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207931995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.207957983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207983971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.207989931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208009005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208041906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208064079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208076000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208101988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208132029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208184958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208224058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208268881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208281040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208326101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208342075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208347082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208365917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208395958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208431959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208444118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208468914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208496094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208502054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208522081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208554983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208581924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208611012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208621025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208636045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208667040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208677053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208688974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208741903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208754063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208781004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208811998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208818913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208838940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.208846092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208888054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208910942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.208957911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209032059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209038019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209055901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209085941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209119081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209135056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209144115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209180117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209214926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209225893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209276915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209292889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209362030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209383011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209429026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209462881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209477901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209490061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209502935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209530115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209542990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209558010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209611893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209615946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209630966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209661961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209683895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209695101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209719896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209753036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209760904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209778070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209801912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209839106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209851980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.209866047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209898949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.209933043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210012913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210047007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210124969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210135937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210158110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210190058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210213900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210226059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210252047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210278034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210287094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210342884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210351944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210370064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210418940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210454941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210544109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210556030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210583925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210612059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210622072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210637093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210674047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210681915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210700989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210725069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210757017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210769892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210783958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210823059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210839033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210906029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.210951090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.210987091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211031914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.211047888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211060047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.211081028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211095095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.211107016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211127043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211154938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.211189985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.211199045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211239100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211256027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.211267948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211344957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211354017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.211364985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211391926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211422920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.211441040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211453915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.211461067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211494923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.211505890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.211522102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.211560965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228053093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228128910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228188992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228199005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228219032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228243113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228260994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228281021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228332996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228379965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228416920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228435993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228457928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228463888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228499889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228507996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228527069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228544950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228559971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228588104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228600025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228615999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228640079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228653908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228665113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228696108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228728056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228853941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228902102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228936911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228938103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228955030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.228966951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.228986979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.229012012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.229312897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.229361057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.229391098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.229406118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.229418039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.229454041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.229476929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.229851961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.229902983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.229939938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.229953051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.229976892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.229993105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.230015039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.230026007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.230041981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.230076075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.230154037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.230200052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.230235100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.230242968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.230261087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.230263948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.230334044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.230458021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.230504036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.230541945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.230555058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.230570078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.230629921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.230813980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.230856895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.230902910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.230916023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.230954885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.230961084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.231193066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.231223106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.231286049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.231297970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.231321096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.231362104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.231379032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.231389999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.231415033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.231429100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.231440067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.231470108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.231499910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.231513977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.231528044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.231537104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.231570959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.231586933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.231604099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.231609106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.231646061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.231656075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.231682062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.231699944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.232002020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.232033014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.232167006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.232178926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.232193947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.232243061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.232253075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.232270956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.232346058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.232357979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.232412100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.232526064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.232585907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.232620001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.232630968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.232686043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.232858896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.232892036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.232945919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.232954979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.232991934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.233007908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.233283043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.233313084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.233372927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.233383894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.233423948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.233441114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.233539104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.233571053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.233618975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.233628988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.233644009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.233656883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.233678102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.233705044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.233793020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.233869076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.234105110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.234159946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.234203100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.234220028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.234231949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.234272957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.234329939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.234376907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.234412909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.234425068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.234441996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.234482050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.234483004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.234497070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.234525919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.234556913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.234570980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.234586000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.234630108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.234869003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.234911919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.234929085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.234965086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.234977007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.235007048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.235023975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.235321999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.235346079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.235392094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.235507011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.235519886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.235621929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.235790014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.235831022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.236008883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.236022949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.236078024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.236102104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.236145973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.236155987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.236179113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.236198902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.236466885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.236490965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.236545086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.236572027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.236584902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.236608028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.236623049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.236804962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.236852884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.236888885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.236890078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.236903906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.236938953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.236958981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.237030029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.237102985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.237173080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.237262011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.237274885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.237338066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.237375975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.237416983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.237452984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.237452984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.237468004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.237490892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.237519026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.237822056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.237865925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.237903118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.237912893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.237925053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.237932920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.237974882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.237988949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.238106966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.238149881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.238188028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.238200903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.238231897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.238249063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.238534927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.238629103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.238641024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.238698959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.238864899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.238907099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.238940001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.238946915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.238960028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239008904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.239029884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.239309072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239334106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239413023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.239424944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239443064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239480019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.239490986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239506960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.239515066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239545107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.239554882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239574909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239581108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.239614010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.239615917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239629984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239645958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.239650965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239680052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.239698887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.239707947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239758968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.239803076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.239903927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.240098000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.240129948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.240180016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.240191936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.240212917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.240228891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.240242004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.240251064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.240286112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.240293980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.240346909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.240371943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.240386009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.240427971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.240844011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.240890026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.240925074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.240936995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.240952969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.240956068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.240991116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.240998030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.241014004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.241030931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.241034985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.241065025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.241086006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.241095066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.241112947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.241158962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.241172075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.241251945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.241499901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.241524935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.241595984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.241607904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.241646051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.241657019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.241708994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.241733074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.241799116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.241811991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.241833925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.241863012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.242336988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.242360115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.242432117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.242444038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.242517948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.242718935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.242743969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.242795944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.242805958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.242845058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.242863894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.243007898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.243031979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.243089914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.243103027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.243127108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.243159056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.243216991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.243242025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.243299961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.243311882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.243355036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.243372917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.243835926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.243860960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.243932962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.243944883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.243962049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.243968010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.244002104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.244013071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.244028091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.244065046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.244301081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.244348049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.244378090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.244389057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.244405031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.244441032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.244512081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.244554043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.244585991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.244591951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.244604111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.244613886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.244630098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.244658947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.244674921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.244712114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.244744062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.244786978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.244800091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.244823933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.244857073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.245383024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.245428085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.245440006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.245481014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.245491982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.245527983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.245543003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.245804071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.245848894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.246036053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.246048927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.246061087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.246078014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.246105909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.246189117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.246202946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.246346951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.246733904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.246752024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.246794939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.246820927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.246835947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.246851921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.246886969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.246897936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.246939898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.246969938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.246983051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.246999025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.247037888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.247379065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.247395039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.247471094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.247482061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.247515917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.247534990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.247553110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.247595072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.247632980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.247643948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.247659922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.247670889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.247684002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.247690916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.247728109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.247759104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.248286009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.248322964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.248368025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.248372078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.248385906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.248418093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.248450041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.248460054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.248534918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.248887062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.248934031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.248948097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.248970032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.248979092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.248987913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.249003887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.249034882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.249053001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.249218941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.249253988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.249294996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.249306917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.249368906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.249406099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.249764919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.249780893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.249811888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.249841928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.249855042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.249893904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.249914885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250082016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250116110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250143051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250160933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250174046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250181913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250193119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250216007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250233889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250302076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250351906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250370979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250382900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250401974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250403881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250436068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250444889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250458956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250464916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250497103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250508070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250520945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250561953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250803947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250822067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250874043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250888109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.250900984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.250968933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.251678944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.251728058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.251770020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.251771927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.251786947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.251796007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.251820087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.251856089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.251929998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.251976013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.252005100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.252017975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.252032995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.252069950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.252290964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.252307892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.252379894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.252391100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.252413034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.252439022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.252490997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.252506971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.252537012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.252568960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.252580881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.252610922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.252646923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.253318071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.253334999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.253422022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.253433943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.253489971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.253498077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.253508091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.253546000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.253571033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.253591061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.253599882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.253633022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.253642082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.253676891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.253686905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.253706932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.253746033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.253866911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.253914118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.253957987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.253968954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.253998041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.254002094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.254039049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.254050970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.254090071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.254122972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.254415989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.254462957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.254513025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.254527092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.254551888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.254581928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.254587889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.254597902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.254636049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.254673958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.254688025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.254703999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.254736900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.256860018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.256903887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.256962061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.256972075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.257023096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.257066011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.259066105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.259165049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.259179115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.259241104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.259881020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.259896040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.259947062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.259989977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260001898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260037899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260056019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260073900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260155916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260168076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260193110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260226965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260240078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260262966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260281086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260317087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260324955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260344028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260360003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260385990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260411978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260502100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260552883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260581970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260593891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260616064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260653973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260746002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260797024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260824919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260838032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260864019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260864973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260896921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260909081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.260946035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.260981083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.261437893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.261456013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.261540890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.261553049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.261605978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.261754990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.261771917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.261811972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.261847019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.261857986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.261899948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.261939049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.262036085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.262089968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.262126923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.262141943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.262175083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.262182951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.262218952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.262228966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.262290001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.262295961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.262372017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.262382984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.262439013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.262847900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.262890100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.262931108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.262943029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.262963057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.262986898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.263017893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.263076067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.263098955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.263113022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.263145924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.263183117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.263308048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.263386965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.263402939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.263467073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.263704062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.263725996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.263792992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.263807058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.263837099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.263864994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.263890982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.263906956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.263968945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.263979912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.264014959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.264033079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.264398098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.264414072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.264498949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.264509916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.264535904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.264659882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.264673948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.264686108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.264744997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.264789104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.264799118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.264806986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.264825106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.264882088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.264961958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.265028954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.265039921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.265054941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.265067101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.265109062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.265139103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.265280962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.265297890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.265369892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.265381098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.265409946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.265448093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.265563011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.265616894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.265645027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.265657902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.265691042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.265711069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.265948057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.265964031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266015053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266031981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.266047955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266088963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.266102076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.266278028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266294003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266336918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266382933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.266393900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266443014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.266450882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.266478062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266531944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266552925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.266566038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266583920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.266613960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.266774893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266791105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266841888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266860008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.266872883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.266910076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.266921997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.267154932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.267205954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.267230988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.267244101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.267260075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.267302036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.267435074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.267467022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.267483950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.267551899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.267565012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.267587900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.267615080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.267685890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.267703056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.267750978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.267767906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.267780066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.267822981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.267858982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.268074036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.268122911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.268153906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.268171072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.268182993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.268223047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.268347979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.268389940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.268429041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.268440962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.268479109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.268502951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.268652916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.268702984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.268728971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.268743038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.268764019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.268794060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.268857956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.268903017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.268934011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.268944979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.268980026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.269006014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.269015074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.269026995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.269074917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.269108057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.269428968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.269444942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.269511938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.269522905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.269537926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.269581079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.269731998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.269747972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.269809008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.269819975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.269834042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.269875050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.269943953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.269959927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.270041943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.270051956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.270107031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.270117044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.270134926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.270199060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.270210981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.270231009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.270265102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.270558119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.270574093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.270639896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.270651102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.270678043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.270703077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.270826101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.270843029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.270906925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.270916939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.270937920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.270973921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.271106005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.271125078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.271186113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.271198034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.271217108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.271249056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.271404028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.271421909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.271481991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.271492958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.271529913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.271542072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.271641016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.271658897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.271717072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.271727085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.271745920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.271786928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.271915913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.271933079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.271992922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272005081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272025108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272062063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272156954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272173882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272233963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272244930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272268057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272295952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272356987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272377968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272437096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272448063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272468090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272511005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272602081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272618055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272684097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272695065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272713900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272748947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272784948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272799969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272850037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272864103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272877932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.272897959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.272929907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273055077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273071051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273128986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273139954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273154020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273191929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273277044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273293018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273375988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273386955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273438931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273514032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273530006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273588896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273597956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273610115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273628950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273657084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273658991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273699045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273709059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273724079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273763895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273763895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273772955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273823977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273835897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273850918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.273889065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.273906946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.274013042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.274029016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.274090052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.274101019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.274146080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.274158955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.274171114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.274188042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.274245024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.274255991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.274281025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.274300098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.276648998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.277225018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.361861944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.361941099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.361974955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.361990929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362025023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362046957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362157106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362219095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362250090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362262011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362310886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362348080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362374067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362411022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362459898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362469912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362504959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362529039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362540960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362562895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362595081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362620115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362632990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362658978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362679005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362688065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362741947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362746954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362766981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362808943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362838030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362891912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362927914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.362977028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.362988949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363003016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363044024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363110065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363121033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363161087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363174915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363187075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363207102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363234997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363277912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363291025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363311052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363347054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363388062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363398075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363411903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363423109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363456964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363467932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363483906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363521099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363532066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363578081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363646984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363655090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363676071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363697052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363718033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363733053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363744020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363763094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363800049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363800049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363818884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363872051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.363926888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.363984108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364002943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364016056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364054918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364061117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364064932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364082098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364111900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364135027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364146948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364181995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364188910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364206076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364243984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364285946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364298105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364315987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364336014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364366055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364373922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364429951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364440918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364502907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364557981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364577055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364592075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364607096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364639044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364646912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364666939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364698887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364725113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364738941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364756107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364795923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364810944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364846945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364890099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364902020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.364917040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364945889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.364969969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365025997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365046978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365061045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365076065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365098000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365115881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365128040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365148067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365170956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365211964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365222931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365288973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365324020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365367889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365377903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365391016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365427971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365433931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365452051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365484953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365504980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365524054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365534067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365557909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365592957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365602970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365689993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365725040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365767956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365782022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.365797997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.365838051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.382597923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.382658005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.382752895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.382783890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.382821083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.382843018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.382850885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.382882118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.383445024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.383482933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.383578062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.383591890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.383821964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.383857012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.383915901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.383929014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.383955002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.383974075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.384025097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.384038925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.384111881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.384149075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.384224892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.384236097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.384255886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.384293079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.384294033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.384318113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.384354115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.384361982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.384434938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.384448051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.384582043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.384617090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.384670019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.384681940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.384696960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.384742022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.384752989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.384818077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.384952068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.384988070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.385046005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.385059118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.385072947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.385301113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.386317015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.386353970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.386404037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.386418104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.386444092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.386464119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.387362957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.387397051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.387471914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.387485027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.387531042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.387559891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.388212919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.388248920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.388298988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.388310909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.388361931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.388381958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.388539076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.388622999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.388633966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.388652086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.388711929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.388720036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.388727903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.388768911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.388844013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.388858080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.388911963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.388923883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.388943911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.388998985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389055014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389090061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389147043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389157057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389177084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389211893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389215946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389230013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389286041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389347076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389405966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389432907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389446020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389461994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389481068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389520884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389533043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389554024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389594078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389599085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389614105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389647007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389667988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389678955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389719963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389733076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389743090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389796019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.389868975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.389935970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390007973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390043020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390089035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390100956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390115976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390155077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390157938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390178919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390218019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390253067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390291929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390356064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390374899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390387058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390408039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390431881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390444994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390454054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390486002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390522003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390527010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390543938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390597105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390616894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390626907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390650034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390687943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390727997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390741110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390764952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390795946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390805960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390853882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390888929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390930891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390944958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390958071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.390966892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.390994072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.391004086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.391032934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.391052008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.431288958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.431402922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.431406975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.431441069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.431466103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.431488037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.431503057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.431521893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.431535006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.431545019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.431579113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.431608915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.486696959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.486746073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.486836910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.486852884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.486890078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.486911058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.486922026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487000942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487005949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487039089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487060070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487083912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487090111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487103939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487114906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487138033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487143040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487184048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487215042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487226963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487248898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487281084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487310886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487349987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487407923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487420082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487436056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487462044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487483025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487493038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487557888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487579107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487615108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487652063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487658024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487679958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487699986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487776041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487816095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487910032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487968922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.487982035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.487989902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488023043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488042116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488048077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488080978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488084078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488111973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488117933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488141060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488147974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488176107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488183022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488209963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488230944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488262892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488351107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488358021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488373995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488439083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488445044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488488913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488495111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488512993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488559961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488598108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488603115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488620996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488645077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488650084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488677979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488687038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488712072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488718033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488751888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488755941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488794088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488800049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488843918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488853931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488861084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488874912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488914967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488923073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488950014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.488955021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.488987923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489025116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489029884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489051104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489082098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489088058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489108086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489145994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489175081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489229918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489242077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489255905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489285946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489309072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489315033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489348888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489376068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489383936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489411116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489413977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489448071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489454031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489483118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489517927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489526033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489543915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489579916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489588976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489619017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489624977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489650011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489658117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489676952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489681959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489717007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489721060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489753962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489759922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489790916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489799023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489824057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489830971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489912033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489917994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.489922047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489953995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.489989042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490035057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490041971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490082026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490109921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490114927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490181923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490185976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490206003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490250111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490257978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490303040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490303993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490324974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490356922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490375996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490381956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490420103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490439892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490454912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490461111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490494967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490516901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490526915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490531921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490564108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490597963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490621090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490674973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490704060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490761995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490775108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490787983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490827084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490852118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490879059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.490922928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.490974903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491045952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491053104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491095066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491162062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491168022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491204977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491261005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491274118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491285086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491322041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491344929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491365910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491370916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491404057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491435051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491440058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491480112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491486073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491503954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491550922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491555929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491579056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491617918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491621017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491641045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491651058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491671085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491676092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491722107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491750956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491755962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491833925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491838932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491857052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491862059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.491893053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491925001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.491971016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.492041111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.492047071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.492069960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.492103100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.492136955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.492142916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.492178917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.492209911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.492214918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.492275000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.492351055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.492357016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.493640900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.493674040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.539741039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.539844036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.539904118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.539931059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.539947987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.539988041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.589297056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.589344025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.589411974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.589428902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.589473009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.589560032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.589608908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.589616060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.589639902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.589688063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.589977026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.590040922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.590065956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.590091944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.590104103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.590136051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.590140104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.590172052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.590189934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.590198040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.590246916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.590306044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.590380907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.590434074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.590470076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.590511084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.590517998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.590550900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.590552092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.590585947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.590589046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.590609074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.590634108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.590682983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.665638924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.665966034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.666229010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.666276932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.666384935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.666392088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.666418076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.666434050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.666449070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.666496992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.666517019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.666538000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.666565895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.666646957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.666656017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.666676998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.666745901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.666754961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.666783094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.666821957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.666851997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.666888952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.666970015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667022943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667110920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667135000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667156935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667171955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667190075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667196035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667247057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667260885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667285919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667290926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667325974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667337894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667386055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667404890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667428017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667439938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667455912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667503119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667512894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667525053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667567015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667582989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667598963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667618990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667634010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667653084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667661905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667701960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667746067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667759895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667843103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667855978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667880058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667913914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.667959929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.667973042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668015957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668021917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668061018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668071032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668111086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668116093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668148041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668160915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668184042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668217897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668231010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668242931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668287039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668306112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668438911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668476105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668536901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668546915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668579102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668586016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668617964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668628931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668668032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668687105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668725014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668735981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668752909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668776035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668802977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668816090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668853998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668885946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668893099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668911934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.668962955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.668996096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669053078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669087887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669101000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669126987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669157028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669167042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669181108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669220924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669235945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669275045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669333935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669385910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669398069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669416904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669439077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669457912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669467926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669506073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669514894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669548988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669563055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669579983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669646978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669653893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669672012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669717073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669735909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669765949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669801950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669851065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669863939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.669895887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669924974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.669941902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670011997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.670057058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670146942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.670159101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670192957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670295000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670355082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.670367956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670416117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670464039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670475960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.670489073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670521975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670573950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.670589924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670646906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670691013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.670701981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670768023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.670785904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670840979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670886040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.670898914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670937061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670942068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.670974970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.670990944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671005011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671056032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671097994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671104908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671124935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671164989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671191931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671205044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671250105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671258926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671298027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671309948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671338081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671350956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671366930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671420097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671422005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671442032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671458960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671468019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671493053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671529055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671541929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671556950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671576977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671595097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671603918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671637058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671669960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671674013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671694040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671720028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671750069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671787024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671797991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671822071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671884060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.671895027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671916008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671950102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.671998024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672012091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672050953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672058105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672099113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672110081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672133923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672157049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672183990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672195911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672215939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672255993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672311068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672312975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672334909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672396898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672439098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672441006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672456980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672525883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672539949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672558069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672600985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672612906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672650099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672694921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672705889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672750950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672811985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672841072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672854900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672871113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672878981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672914028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.672918081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672938108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.672960043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673011065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673031092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673063993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673110008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673120975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673157930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673167944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673180103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673193932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673228979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673266888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673291922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673326969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673408985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673419952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673438072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673501015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673522949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673583984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673603058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673615932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673635960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673676014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673688889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673705101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673748970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673764944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673820972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673845053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673858881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673877954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673890114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673932076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673937082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673959017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.673969984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.673993111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674030066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674041033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674096107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674118042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674190044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674232006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674267054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674312115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674323082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674362898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674371958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674395084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674406052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674441099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674464941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674488068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674498081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674515009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674536943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674563885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674590111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674598932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674679041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674743891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674755096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674773932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674823999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674853086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674866915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674886942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674895048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674931049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674942970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.674963951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.674983978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675033092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675059080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675075054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675096035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675107002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675138950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675147057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675177097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675190926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675240993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675271988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675287008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675307989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675327063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675358057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675403118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675404072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675427914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675436974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675455093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675477028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675514936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675527096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675544977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675642967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675651073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675662994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675674915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675708055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675721884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675726891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675741911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675785065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675796032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675811052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.675843954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.675860882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.676189899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.743148088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743272066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.743287086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743313074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743345022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743381977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.743403912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743424892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.743433952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743469954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743499994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.743514061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743529081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.743535042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743561029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.743573904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743591070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.743621111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.743630886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743675947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.743729115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743787050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.743866920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743941069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.743942022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743973017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.743994951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744009018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744030952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744033098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744052887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744074106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744118929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744143009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744201899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744256020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744316101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744335890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744350910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744371891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744378090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744395971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744406939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744473934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744501114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744520903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744535923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744544983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744569063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744584084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744595051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744606972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744659901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744669914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744695902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744752884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744791985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744808912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744821072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744828939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744864941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744877100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744899988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744939089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744949102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.744960070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.744997978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745011091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745027065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745048046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745070934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745079041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745086908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745106936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745146990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745150089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745171070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745208025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745243073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745300055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745368004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745390892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745393991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745415926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745419979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745460987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745471954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745486021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745537043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745548964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745600939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745675087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745683908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745734930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745790005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745810032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745825052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745846987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745847940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745925903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.745929003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745935917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.745944977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746006012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.746037960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.746058941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746109962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.746161938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746201038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746248007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.746263027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746279955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.746294022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746381044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.746393919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746411085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746473074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.746484041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746548891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746582031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746625900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.746639967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746654987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.746668100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746702909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746740103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.746751070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746789932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.746814013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.746824026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746882915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.746947050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.746958971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747003078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747037888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747078896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747092009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747122049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747159958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747169971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747235060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747287035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747311115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747324944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747369051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747384071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747396946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747452974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747472048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747484922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747504950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747507095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747529984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747538090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747555017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747575045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747596979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747606039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747644901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747672081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747682095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747734070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747745037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747765064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747806072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747833014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747868061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747904062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747944117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.747956991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.747972012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748003960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748059034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748066902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748147011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748198986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748217106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748229980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748243093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748272896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748289108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748320103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748383045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748394012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748411894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748450041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748460054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748477936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748490095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748533964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748541117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748585939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748636007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748645067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748707056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748758078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748773098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748790979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748806953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748821020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748838902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748852968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748861074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748879910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748914957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.748929977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.748985052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749011040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749067068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749084949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749094009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749129057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749135971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749144077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749149084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749182940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749188900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749203920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749252081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749258041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749294043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749325037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749330997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749372005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749392986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749401093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749411106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749448061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749470949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749506950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749540091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749577045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749583006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749610901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749618053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749638081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749644995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749676943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749717951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749722958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749759912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749826908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749835014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749859095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749923944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.749932051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.749988079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750052929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750061035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750080109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750112057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750125885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750133991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750164986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750180960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750205040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750211954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750235081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750252962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750282049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750341892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750368118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750401974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750447035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750453949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750475883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750478029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750502110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750509024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750535965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750556946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750566006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750572920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750627041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750633955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750663042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750724077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750730991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750770092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750838041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750848055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750864983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.750909090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.750941038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751013994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751017094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751020908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751038074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751074076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751091957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751152992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751188993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751224041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751231909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751266003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751270056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751293898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751301050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751358986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751369953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751384974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751430035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751450062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751490116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751559019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751578093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751631021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751651049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751660109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751671076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751677990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751702070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751709938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751719952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751755953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751785040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751842022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751858950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751868010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751898050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751909018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751915932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751959085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.751965046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.751980066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752017975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752028942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752037048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752093077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752101898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752116919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752149105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752201080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752207994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752222061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752253056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752288103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752291918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752305031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752374887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752402067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752468109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752491951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752523899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752571106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752577066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752592087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752604961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752630949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752638102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752680063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752691031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752736092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752742052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752783060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752813101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752868891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752876997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752892971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752907991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752938986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752944946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.752989054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.752993107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753010035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753079891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.753089905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753108978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753139019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753143072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.753165960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.753173113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753197908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.753217936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.753223896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753285885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753367901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753371000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.753386021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753429890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753448963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.753458977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753478050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753531933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.753540039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753591061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753648996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753675938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753676891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.753698111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753706932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.753726959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753739119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.753786087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.753793001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753869057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.753875971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753933907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.753967047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754013062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754021883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754050970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754062891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754097939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754101992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754121065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754132032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754136086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754168987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754177094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754209995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754231930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754235029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754251957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754287958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754317999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754319906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754337072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754390955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754424095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754538059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754570007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754615068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754622936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754650116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754667997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754683018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754689932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754720926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754724979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754741907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754749060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754795074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754796028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754812956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754853964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754863024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754873991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754884958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754918098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.754925966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754944086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754985094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.754995108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755009890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755055904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755063057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755083084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755117893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755134106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755145073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755173922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755198002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755211115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755247116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755285025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755290985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755314112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755350113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755362988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755371094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755403042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755419016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755428076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755454063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755469084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755479097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755486012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755520105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755536079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755547047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755575895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755588055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755594969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755665064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755681038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755780935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755830050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755866051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755868912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755887032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755912066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755919933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755948067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.755954981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.755985975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.756001949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.756009102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.757926941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.757970095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.796514988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.796624899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.796638966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.796660900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.796725988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.796734095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.796767950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.796782017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.796787024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.796803951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.796840906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.796853065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797029972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797091961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797116995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797116995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.797132015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797162056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.797193050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797203064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.797213078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797255039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797271013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.797295094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797307968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797339916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.797384024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.797386885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797400951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797461033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.797463894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797477961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797528028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797540903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.797558069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.797617912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.798119068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.798154116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.798253059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.798268080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.798280954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.798820972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.798854113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.798923969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.798935890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.798955917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.798960924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.798995972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799000025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799011946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799041986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799076080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799093008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799123049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799171925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799182892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799197912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799242973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799316883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799329042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799370050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799408913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799428940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799453020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799465895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799472094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799485922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799493074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799509048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799520969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799541950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799554110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799583912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799593925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799608946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799616098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799638033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799649954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799658060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799669027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799706936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799719095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799746990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799758911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799773932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799815893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799818039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799833059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799876928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799911976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.799916029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799931049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799968004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.799987078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800002098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800043106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800060987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800060987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800076962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800121069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800157070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800209999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800272942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800296068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800304890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800318003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800350904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800359011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800404072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800416946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800441027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800451040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800483942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800494909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800512075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800543070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800554037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800565004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800604105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800617933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800632000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800662041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800668955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800677061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800688028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800731897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800760031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800767899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800784111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800826073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800839901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800862074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800915956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800916910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.800935030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800964117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.800987959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801001072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801011086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801023006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801038027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801067114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801080942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801093102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801110983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801136971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801183939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801194906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801213026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801244020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801268101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801285982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801297903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801315069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801337957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801368952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801376104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801388025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801418066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801446915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801464081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801527023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801580906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801613092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801657915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801670074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801696062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801713943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801714897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801729918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801775932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801786900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801800966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801841021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801853895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801872969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801872969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801877975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801913977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.801917076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801955938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.801990032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802026987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802056074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802100897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802113056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802128077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802144051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802167892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802176952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802197933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802237034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802248001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802264929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802311897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802330971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802346945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802360058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802387953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802409887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802416086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802426100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802436113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802472115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802525043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802540064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802571058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802620888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802633047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802649021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802690029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802692890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802706003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802751064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802766085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802779913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802829027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802839994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802845955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802858114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802901030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802920103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802933931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802972078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.802979946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.802992105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803002119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803019047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803031921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803073883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803085089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803111076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803118944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803149939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803199053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803210020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803224087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803232908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803265095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803267956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803280115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803312063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803347111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803379059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803385019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803467035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803497076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803528070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803570986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803582907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803597927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803612947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803634882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803642988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803658962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803689957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803733110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803764105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803828955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803860903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803891897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803935051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803946972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803961039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.803966999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.803999901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804040909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804054022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804069042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804115057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804126978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804146051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804177046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804219961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804231882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804245949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804313898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804383993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804409027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804420948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804451942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804480076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804497004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804626942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804677963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804689884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804706097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804749966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804774046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804779053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804794073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804828882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804862976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804892063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804923058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804969072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.804980993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.804994106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805031061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805058956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805099964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805113077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805133104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805157900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805167913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805179119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805221081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805227995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805241108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805249929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805290937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805294991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805310011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805311918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805329084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805351019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805418015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805443048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805506945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805530071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805541992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805563927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805567980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805589914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805596113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805614948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805634975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805675983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805712938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805721998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805737972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805783987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805794954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805810928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805830956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805834055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805867910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805880070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.805896997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805927992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.805977106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806041956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806046963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806047916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806061983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806112051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806123972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806149960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806225061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806241035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806322098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806327105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806344032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806390047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806404114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806417942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806437016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806447029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806466103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806476116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806505919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806508064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806536913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806549072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806562901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806596994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806602001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806612968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806655884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806683064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806689024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806704998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806744099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806763887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806777954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806797028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806814909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806828022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806835890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.806857109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806896925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.806969881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807039022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807079077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807107925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807147980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807159901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807176113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807183027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807214975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807218075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807233095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807252884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807295084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807338953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807399988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807425976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807459116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807502985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807513952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807528973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807564974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807576895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807600975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807629108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807668924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807682037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807702065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807733059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807744980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807771921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807792902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807801962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807818890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807857990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807874918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807912111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807957888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.807976961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.807990074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808005095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808057070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808087111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808096886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808113098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808120012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808166027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808175087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808192015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808223963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808244944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808254004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808264971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808304071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808305979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808329105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808336020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808343887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808366060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808394909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808427095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808429003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808438063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808485031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808491945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808506966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808512926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808535099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808551073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808568954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808589935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808598995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808609962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808619976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808628082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808648109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808655024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808691978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808701992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808716059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808731079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808739901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808753014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808763027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808785915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808808088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808835030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808842897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808859110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808873892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808902979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808921099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808929920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808952093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.808959961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808984995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.808993101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809009075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809024096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809039116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809057951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809063911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809077024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809079885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809119940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809129000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809143066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809146881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809165001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809178114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809185028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809216976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809223890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809267998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809273958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809294939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809305906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809309006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809340000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809357882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809387922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809401989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809411049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809413910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809452057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809461117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809474945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809484005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809492111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809513092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809523106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809535980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809555054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809587002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809600115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809607029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809645891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809657097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809667110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809689045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809698105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809720039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809726000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809745073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809751034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809783936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809783936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809819937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809828043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809848070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809864044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809868097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809900045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809907913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809927940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809946060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809954882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.809966087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809984922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.809993029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810004950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810022116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.810038090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810055017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.810059071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810072899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810077906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.810101986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.810110092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810132027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810138941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.810148001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810163975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.810194016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.810224056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.810261011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810312033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810331106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810331106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.810342073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810376883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810388088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.810419083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.810427904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.810440063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.810496092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.811316013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.811367035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.811383009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.811422110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.811424017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.811434984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.811449051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.811475992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.811502934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.811681986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.812150002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.812225103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.812259912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.812269926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.812302113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.812320948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.813034058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.813051939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.813216925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.813267946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.813278913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.813457012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.814043999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.814110994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.814143896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.814155102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.814176083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.814213037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.814877987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.814896107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.814941883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.814989090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.814997911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.815031052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.815058947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.815881968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.815900087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.815952063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.815988064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.815995932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.816041946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.816046000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.816066980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.816075087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.816116095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.816160917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.816946030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.816962957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.816998005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.817032099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.817039967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.817075014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.817102909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.817861080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.817889929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.817939043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.817948103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.817980051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.818001032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.818627119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.818681002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.818700075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.818706989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.818716049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.818753004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.818778038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.818794012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.819452047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.819469929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.819549084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.819559097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.819590092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.819614887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.819674015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.819689989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.819751978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.819761038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.819789886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.819809914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.820559978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.820575953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.820677996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.820687056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.821398020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.821414948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.821486950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.821496010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.821527958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.821552992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.822135925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.822153091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.822249889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.822258949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.822362900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.822380066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.822438955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.822447062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.822469950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.822504044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.823246956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.823262930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.823344946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.823354006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.823409081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.824043036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.824059963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.824141979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.824148893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.824804068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.824820995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.824908018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.824918032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.824980021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.824999094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.825066090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.825077057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.825107098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.825123072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.825921059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.825936079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.826006889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.826016903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.826057911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.826076984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.826735020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.826751947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.826839924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.826848030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.827492952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.827511072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.827598095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.827608109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.827702045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.827718973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.827786922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.827795982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.827842951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.827872992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.828552961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.828572035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.828650951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.828663111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.828685045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.828715086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.829386950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.829411983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.829504967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.829518080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.830197096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.830215931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.830322981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.830333948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.830351114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.830369949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.830439091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.830452919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.830466986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.830503941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.831250906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.831270933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.831343889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.831356049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.831418037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.832145929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.832165003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.832247019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.832256079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.832798958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.832817078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.832895041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.832907915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.832942009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.832953930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.832990885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.833009958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.833067894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.833079100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.833111048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.833127975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.833704948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.833722115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.833805084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.833817005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.833853006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.833869934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.833926916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.833940029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.833956003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.833991051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.834820032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.834839106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.834927082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.834939003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.835005045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.835021973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.835093021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.835105896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.835120916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.835886002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.835905075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.835988045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.835994959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.836008072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.836064100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.836069107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.836090088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.836100101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.836119890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.836165905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.836972952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.836991072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.837080002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.837091923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.837182045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.837184906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.837194920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.837239981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.837268114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.837280989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.837316990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.837341070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.838077068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.838099003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.838176966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.838188887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.838238955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.838246107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.838247061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.838258028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.838305950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.838361025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.838376045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.838386059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.838407040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.838445902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.839066982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.839085102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.839170933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.839183092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.839238882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.839283943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.839302063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.839345932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.839354992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.839371920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.839473009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.840100050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.840116978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.840243101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.840255976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.840271950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.840301991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.840334892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.840348005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.840389967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.840445042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.841217041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.841233969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.841345072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.841356993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.841425896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.841443062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.841516018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.841527939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.841543913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.841578960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.842294931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.842312098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.842422009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.842427015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.842437029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.842482090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.842521906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.842536926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.842552900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.842588902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.843377113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.843395948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.843540907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.843552113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.843575954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.843592882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.843810081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.843831062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.844434977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.844453096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.844551086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.844568014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.844583035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.844619989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.845132113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.845149040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.845235109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.845247030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.845587969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.845606089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.845696926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.845707893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.845737934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.845782042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.845834017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.845854998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.845873117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.845889091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.846618891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.846640110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.846740961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.846756935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.846772909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.846817017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.847285032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.847307920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.847400904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.847413063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.847461939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.847480059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.847677946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.847697020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.847793102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.847804070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.847870111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.847940922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.847960949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.848036051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.848047972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.848068953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.848099947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.848711014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.848728895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.848825932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.848835945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.849423885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.849442005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.849534035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.849546909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.849580050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.849608898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.849828005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.849844933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.849932909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.849942923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.850567102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.850584984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.850684881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.850711107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.850806952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.850824118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.850910902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.850929976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.850951910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.850979090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.851563931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.851582050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.851669073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.851686001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.851988077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.852005959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.852009058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.852020979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.852076054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.852130890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.852684021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.852700949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.852832079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.852858067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.852950096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.852967024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.853044033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.853049994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.853090048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.853105068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.853159904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.853909016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.853929996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.854031086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.854057074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.854145050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.854173899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.854255915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.854269028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.854315042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.854335070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.854947090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.854964972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.855079889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.855092049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.855173111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.855186939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.855190039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.855201006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.855253935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.855289936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.855808973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.856014967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.856034040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.856116056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.856129885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.856153011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.856185913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.856302977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.856319904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.856416941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.856429100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.856595039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.857044935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.857062101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.857146025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.857158899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.857198000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.857207060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.857222080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.857297897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.857314110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.857327938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.857403040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.858087063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.858103991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.858201027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.858212948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.858319044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.858335972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.858433008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.858445883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.859097004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.859114885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.859184980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.859195948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.859240055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.859268904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.859292984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.859308958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.859411001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.859421015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.859447956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.859479904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.860080957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.860097885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.860173941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.860183954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.860204935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.860234976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.860326052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.860342026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.860397100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.860420942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.860430956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.860469103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.860498905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.861257076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.861274958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.861413002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.861424923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.861500978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.861517906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.861588001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.861598969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.861629963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.861665010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.862214088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.862232924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.862282991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.862329960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.862343073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.862359047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.862416029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.862488985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.862507105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.862581968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.862591982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.862612009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.862641096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.863171101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.863188028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.863250017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.863276958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.863286972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.863327026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.863341093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.863985062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.864002943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.864085913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.864094019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.864131927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.864157915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.864216089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.864309072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.864320993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.864454985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.864470959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.864526033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.864552021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.864564896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.864581108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.864619970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.865134954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.865150928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.865223885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.865247011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.865257025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.865272045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.865325928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.865422010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.865432024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.866144896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.866163015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.866256952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.866282940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.866302967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.866329908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.866394997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.867089987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.867105961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.867198944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.867208958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.867224932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.867269993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.867316008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.867326975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.867358923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.867399931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.867964983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.867980957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.868033886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.868073940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.868083954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.868120909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.868135929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.868165970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.868200064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.868261099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.868283987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.868304014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.868340969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.868940115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.869002104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.869025946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.869039059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.869051933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.869066954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.869088888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.869105101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.869124889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.869136095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.869188070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.869229078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.869663000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.869741917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.869844913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.869920969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.869951010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.869983912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.870003939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.870018005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.870021105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.870021105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.870064974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.870064974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.870090961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.870106936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.870165110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.870183945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.870551109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.870641947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.870776892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.870824099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.870863914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.870876074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.870892048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.870934963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.870944977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.870955944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.870996952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.871041059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.871423960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.871495962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.871701002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.871754885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.871773005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.871776104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.871787071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.871809959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.871844053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.871846914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.871857882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.871921062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.871932030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.872153044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.872381926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.872447968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.872592926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.872643948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.872673988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.872685909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.872705936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.873248100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.873264074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.873315096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.873338938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.873353004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.873399019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.873429060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.873498917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.873516083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.873584986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.873598099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.873619080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.873651028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.874270916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.874288082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.874362946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.874368906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.874380112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.874437094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.874475956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.874486923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.874562979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.874583960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.874635935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.874645948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.874666929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.874710083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.875235081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.875252008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.875303984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.875320911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.875324011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.875328064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.875334024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.875361919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.875399113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.875408888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.875421047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.875462055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.875469923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.875509024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.875519991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.875536919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.876096964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.876137972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.876178980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.876190901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.876205921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.876209974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.876246929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.876257896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.876280069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.876327991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.876657963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.876723051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.876858950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.876905918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.876930952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.876940966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.876961946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.876995087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.877055883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.877073050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.877129078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.877140999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.877156973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.877785921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.877801895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.877866030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.877878904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.877918005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.877959013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.878417015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.878432989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.878501892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.878514051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.878551960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.878562927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.878689051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.878705978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.878767014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.878778934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.878798962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.878830910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.878842115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.878859043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.878926992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.878937960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.878973961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.879015923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.879563093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.879580021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.879636049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.879636049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.879645109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.879699945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.879736900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.879748106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.879826069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.880112886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.880131006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.880193949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.880206108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.880228043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.880256891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.880323887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.880341053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.880414009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.880426884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.880441904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.880477905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.881032944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.881048918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.881124020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.881134033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.881150007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.881354094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.881371021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.881436110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.881448030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.881464958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.881504059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.881776094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.881853104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.881864071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.882050037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.882071018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.882129908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.882144928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.882158995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.882193089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.882201910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.882213116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.882262945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.882266998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.882297039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.882306099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.882337093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.882395029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.882882118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.882900000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.882982016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.882997036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.883008957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.883400917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.883416891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.883474112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.883486032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.883501053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.883541107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.883615017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.883630991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.883687973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.883699894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.883718967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.883750916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.883799076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.883815050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.883878946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.883891106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.883914948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.883934021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.884509087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.884525061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.884588003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.884598970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.884639025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.884650946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.885051966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.885068893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.885128021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.885137081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.885165930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.885181904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.885201931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.885229111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.885394096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.885411024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.885473967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.885484934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.885500908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.885539055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.886013985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.886030912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.886090040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.886101007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.886120081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.886142015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.886270046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.886287928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.886343956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.886354923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.886399031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.886409998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.886693954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.886766911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.886964083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.886979103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.887041092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.887053013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.887067080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.887104034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.887157917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.887175083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.887231112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.887240887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.887279034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.887299061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.887883902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.887901068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.887986898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.888003111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.888082981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.888091087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.888309002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.888330936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.888428926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.888442039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.888587952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.888605118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.888664007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.888680935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.888691902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.888699055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.888740063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.888765097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.888783932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.888842106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.888854027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.888891935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.888909101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.889528036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.889544010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.889605999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.889622927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.889635086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.889652967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.889691114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.889702082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.890124083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.890144110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.890206099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.890218019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.890238047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.890261889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.890428066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.890444994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.890506983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.890518904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.890551090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.890557051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.890568972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.890572071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.890582085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.890614033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.890666962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.891140938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.891159058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.891210079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.891231060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.891244888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.891263008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.891304016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.891690016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.891707897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.891784906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.891796112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.891833067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.891844034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.891886950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.891942024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.891967058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.891979933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.892002106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.892025948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.892043114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.892338991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.892357111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.892430067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.892441034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.892482042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.892493963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.892621040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.892690897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.892829895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.892848015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.892910004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.892920017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.892941952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.892976046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.893485069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.893501043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.893551111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.893583059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.893595934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.893627882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.893646002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.893743038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.893762112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.893827915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.893837929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.893878937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.893891096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.894251108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.894268036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.894345999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.894357920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.894397020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.894416094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.894432068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.894449949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.894507885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.894519091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.894555092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.894567013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.894967079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.895008087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.895049095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.895059109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.895092010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.895107985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.895253897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.895272017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.895337105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.895348072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.895392895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.895409107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.895884991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.895900965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.895987988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.895999908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.896044016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.896060944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.896141052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.896152973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.896294117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.896538973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.896558046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.896621943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.896632910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.896651030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.896682024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.896732092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.896749020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.896819115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.896831036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.896852016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.896887064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.897356033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.897373915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.897468090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.897480965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.897608042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.897624969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.897684097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.897696018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.897735119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.897754908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.898148060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.898164988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.898258924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.898271084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.898313999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.898332119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.898438931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.898451090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.898941040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.898958921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.899027109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.899040937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.899075985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.899110079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.899379015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.899398088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.899471045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.899482012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.899492979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.899543047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.899620056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.899637938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.899713993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.899724960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.899739027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.899826050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.899844885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.899899960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.899912119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.899928093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.899970055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.900466919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.900495052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.900566101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.900576115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.900588989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.900895119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.900912046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.900981903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.900994062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.901015043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.901048899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.901113987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.901166916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.901190042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.901201963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.901223898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.901252985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.901345968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.901365995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.901432991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.901443005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.901458025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.901482105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.901946068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.901964903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.902028084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.902039051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.902055025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.902097940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.902126074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.902142048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.902215958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.902228117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.902244091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.902283907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.902605057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.902623892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.902693033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.902703047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.902725935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.902750969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.902826071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.902843952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.902904987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.902915955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.902945995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.902964115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.903388023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.903404951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.903489113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.903498888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.903534889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.903546095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.903572083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.903589964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.903651953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.903662920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.903685093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.903707027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.904078960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.904095888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.904165983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.904177904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.904201031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.904237032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.904324055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.904340029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.904417992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.904428959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.904858112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.904875040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.904948950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.904964924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.904997110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.905034065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.905266047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.905283928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.905360937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.905373096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.905427933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.905443907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.905544043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.905560970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.905631065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.905642033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.905656099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.905751944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.905770063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.905827999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.905841112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.905883074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.905904055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.906351089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.906369925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.906445026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.906455994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.906493902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.906507015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.906686068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.906704903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.906771898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.906783104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.906804085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.906824112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.906933069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.906949043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.907016993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.907027960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.907046080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.907078028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.907113075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.907129049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.907191992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.907202959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.907226086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.907263041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.907737017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.907753944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.907823086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.907833099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.907870054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.907885075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.908099890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.908118010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.908183098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.908206940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.908220053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.908245087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.908299923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.908303976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.908324957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.908339024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.908344030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.908390999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.908480883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.908499002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.908550024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.908557892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.908570051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.908591032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.908627987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.909051895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.909069061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.909137011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.909147978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.909162998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.909203053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.909248114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.909265995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.909328938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.909339905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.909384966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.909395933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.909521103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.909580946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.909858942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.909877062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.909924984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.909948111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.909960985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.909976959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.909996033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.910013914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.910064936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.910080910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.910144091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.910156012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.910180092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.910218000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.910537004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.910553932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.910625935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.910628080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.910636902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.910671949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.910686016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.910716057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.910727024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.910762072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.910773039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.911319971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.911338091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.911391020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.911428928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.911442041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.911474943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.911511898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.911647081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.911664963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.911724091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.911736012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.911756992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.911784887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.911899090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.911951065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.911977053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.911990881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.912013054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.912050962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.912260056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.912277937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.912358046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.912369967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.912430048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.912484884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.912513971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.912556887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.912570953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.912581921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.912600994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.912622929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.912647963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.912694931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.912710905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.912775993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.912787914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.912862062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.912868977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.913326979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.913345098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.913443089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.913455963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.913537025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.913677931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.913695097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.913804054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.913816929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.913846016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.913896084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.913903952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.913927078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.913940907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.913945913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.913997889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.914113045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.914129972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.914199114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.914218903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.914231062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.914249897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.914274931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.914321899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.914330959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.914401054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.914774895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.914839983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.914856911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.914875984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.914886951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.914901972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.914944887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.914987087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.914997101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915092945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915122032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.915133953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915150881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.915195942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.915283918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915338993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915354013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915400982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.915411949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915450096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.915482044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.915486097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915494919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915538073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915565968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.915577888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915600061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.915636063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.915642023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915652037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915693045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915720940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.915735006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.915776014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.915800095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.916165113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.916197062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.916276932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.916286945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.916330099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.916347980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.916651964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.916670084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.916748047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.916759968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.916790962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.916807890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.916861057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.916877031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.916960001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.916971922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.917001009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.917020082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.917083025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.917093992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.917124033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.917157888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.917546988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.917563915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.917659998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.917671919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.917870998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.917897940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.917953968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.917965889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.918004990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.918039083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.918261051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.918282986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.918323994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.918365002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.918379068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.918452024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.918493032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.918788910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.918807030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.918883085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.918894053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.918919086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.918950081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.919290066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.919307947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.919390917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.919400930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.919423103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.919456959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.919478893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.919497967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.919564962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.919575930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.919599056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.919606924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.919624090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.919629097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.919640064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.919667006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.919714928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.919749022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.920274019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.920293093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.920361996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.920372963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.920412064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.920423031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.920624018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.920640945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.920710087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.920722008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.920747042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.920778036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.920804977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.920857906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.920883894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.920897961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.920917988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.920922995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.920962095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.920967102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.920981884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.921021938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.921047926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.921060085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.921101093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.921119928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.921614885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.921636105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.921852112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.921864033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.921905041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.921922922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.921966076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.921984911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.922061920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.922074080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.922096968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.922146082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.922235012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.922252893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.922338009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.922349930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.922383070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.922413111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.922426939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.922430992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.922440052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.922502995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.922548056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.922967911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.922983885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.923058033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.923069954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.923084021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.923124075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.923284054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.923338890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.923388004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.923398972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.923433065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.923460960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.923547029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.923563957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.923638105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.923649073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.923670053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.923680067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.923696041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.923700094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.923707962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.923748016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.923796892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.924204111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.924222946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.924305916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.924319029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.924438000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.924454927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.924525976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.924536943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.924571991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.924602985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.924751043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.924768925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.924839020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.924849987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.924890041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.924901009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.924941063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.924958944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.925020933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.925031900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.925065041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.925080061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.925734043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.925753117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.925839901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.925852060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.925946951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.925961971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.926039934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.926050901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.926074028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.926090002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.926109076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.926120043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.926167011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.926207066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.926259995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.926278114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.926342010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.926352024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.926398039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.926414967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.926546097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.926562071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.926631927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.926641941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.926681995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.926693916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.927010059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.927028894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.927122116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.927134991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.927258968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.927275896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.927356005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.927366018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.927409887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.927418947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.927428007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.927437067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.927489042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.927500963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.927521944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.927531958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.927561998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.927596092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.927902937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.927920103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.928005934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.928019047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.928240061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.928256989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.928282022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.928291082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.928353071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.928406000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.928536892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.928553104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.928605080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.928627014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.928637981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.928689957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.928723097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.928997040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.929013968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.929102898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.929115057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.929574966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.929590940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.929667950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.929677963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.929712057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.929728985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.929845095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.929861069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.929908991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.929929972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.929940939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.929991961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.930010080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.930059910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.930077076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.930151939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.930164099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.930181980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.930226088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.930367947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.930425882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.930464029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.930480957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.930507898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.930592060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.930619001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.930645943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.930658102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.930677891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.930690050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.930727005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.930738926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.930753946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.930798054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.930969000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.930986881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.931060076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.931071043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.931087971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.931107998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.931123972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.931138039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.931144953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.931152105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.931164980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.931216955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.931495905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.931514978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.931579113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.931581974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.931600094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.931616068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.931659937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.931837082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.931853056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.931926012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.931937933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.931957960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.931993961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.932044029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.932064056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.932157993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.932171106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.932291985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.932301044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.932311058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.932351112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.932395935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.932447910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.932459116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.932730913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.932750940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.932816029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.932826996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.932857037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.932889938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.933026075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.933079004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.933109999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.933123112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.933147907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.933181047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.933301926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.933321953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.933422089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.933434010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.933449984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.933465958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.933533907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.933545113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.933576107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.933608055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.933969021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.933989048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.934063911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.934076071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.934091091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.934123993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.934309006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.934365034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.934422970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.934436083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.934458971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.934490919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.934602022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.934619904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.934691906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.934701920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.934729099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.934745073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.934752941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.934762955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.934796095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.934818983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.934832096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.934856892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.934894085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.935143948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935163021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935250044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.935261965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935385942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.935386896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935398102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935441971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935465097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.935477018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935492039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.935504913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935530901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.935545921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935558081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.935564995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935585022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.935628891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.935641050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935661077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935726881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.935739040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935755968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.935795069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.935858965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935877085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935939074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.935950994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.935975075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.936011076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.936531067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.936547995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.936638117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.936649084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.936799049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.936816931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.936857939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.936888933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.936899900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.936947107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.936971903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.937020063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.937036037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.937100887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.937112093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.937128067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.937316895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.937334061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.937438011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.937450886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.937710047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.937727928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.937773943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.937804937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.937818050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.937859058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.937875032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.938086033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.938103914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.938169956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.938179970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.938205004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.938237906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.938237906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.938247919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.938290119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.938313007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.938324928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.938348055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.938383102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.938394070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.938405991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.938437939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.938463926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.938477039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.938510895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.938678980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.938756943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.938834906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.939040899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939059019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939114094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939153910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.939167023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939210892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.939263105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.939358950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939377069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939420938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939466000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.939481020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939508915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.939615965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939666033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939703941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.939722061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939734936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.939742088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.939769983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.939811945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939862013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939896107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.939902067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939913034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.939933062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.939971924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.940187931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.940205097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.940295935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.940308094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.940324068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.940366030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.940393925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.940412998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.940494061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.940505028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.940520048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.940560102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.940774918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.940792084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.940870047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.940881014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.940920115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.941011906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.941029072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.941046000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.941126108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.941138029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.941159964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.941221952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.941272974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.941293955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.941375017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.941385984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.941436052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.941452980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.941502094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.941521883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.941613913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.941618919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.941628933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.941672087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.941678047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.941694975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.941739082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.941750050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.941766024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.941807985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.942147970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.942167997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.942267895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.942280054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.942347050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.942519903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.942538023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.942634106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.942646980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.942661047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.942707062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.942739964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.942759037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.942838907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.942850113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.942863941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.942905903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.943012953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.943030119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.943125010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.943136930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.943152905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.943192959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.943254948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.943273067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.943342924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.943353891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.943427086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.943427086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.943432093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.943439007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.943485022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.943519115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.943530083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.943557978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.943591118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.943608046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.943732023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.943751097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.943835020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.943845987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.943880081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.943900108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.944135904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.944154024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.944288015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.944300890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.944313049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.944350958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.944400072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.944402933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.944417953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.944446087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.944498062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.944587946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.944607019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.944688082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.944698095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.944713116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.944746017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.944916964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.944933891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.945039034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.945050955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.945065975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.945082903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.945115089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.945125103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.945195913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.945233107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.945482969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.945498943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.945596933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.945609093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.945676088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.945730925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.945748091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.945816994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.945827961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.945847034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.945885897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.945940971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.945957899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.946041107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.946053982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.946069002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.946110964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.946136951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.946156979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.946225882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.946235895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.946269989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.946289062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.946616888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.946635962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.946727037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.946738958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.946753979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.946791887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.946881056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.946897984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.946976900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.946989059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.947011948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.947037935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.947052002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.947071075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.947149992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.947161913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.947182894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.947238922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.947359085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.947376966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.947482109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.947494030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.947511911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.947555065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.947638035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.947655916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.947757006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.947770119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.947863102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.947917938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.947941065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.948020935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.948033094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.948072910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.948088884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.948101044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.948120117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.948211908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.948224068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.948282957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.948461056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.948477983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.948563099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.948575020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.948599100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.948626041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.948779106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.948796988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.948878050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.948890924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.948911905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.948949099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.949059963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.949079037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.949165106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.949181080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.949210882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.949251890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.949289083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.949306965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.949400902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.949415922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.949428082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.949430943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.949449062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.949512959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.949525118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.949543953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.949584961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.949872971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.949901104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.949991941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.950004101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.950172901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.950190067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.950190067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.950206041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.950227022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.950269938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.950329065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.950345993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.950426102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.950438023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.950474977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.950490952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.950556993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.950568914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.950598001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.950615883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.950962067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.950980902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.951138973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.951158047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.951219082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.951235056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.951325893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.951340914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.951450109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.951467991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.951545000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.951555967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.951592922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.951611042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.951662064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.951673985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.951703072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.951734066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.951967001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.952033043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.952061892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.952080011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.952100992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.952124119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.952306032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.952325106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.952419996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.952436924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.952533960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.952552080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.952625036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.952640057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.952661991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.952682972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.952692986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.952702999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.952718973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.952722073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.952769995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.952780008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.952805996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.952828884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.953062057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.953078985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.953155041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.953170061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.953193903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.953213930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.953330994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.953349113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.953429937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.953444958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.953515053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.953531981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.953609943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.953623056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.953659058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.953676939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.953748941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.953763962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954024076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954078913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954117060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.954133987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954149008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.954180956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.954303980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954322100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954420090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.954437971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954539061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954556942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954634905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.954648018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954674006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.954694986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954704046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.954710960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954749107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954768896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.954782963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.954824924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.954847097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.955082893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.955101967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.955193043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.955210924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.955338955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.955357075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.955446005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.955449104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.955465078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.955488920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.955530882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.955679893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.955698013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.955781937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.955796957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.955842018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.955866098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.955925941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.955938101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.955977917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.956010103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.956120968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956139088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956181049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956228018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.956244946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956280947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.956317902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.956382036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956399918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956444979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956475973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.956490040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956516027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.956538916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956538916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.956548929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956604004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.956614971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956775904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956795931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956855059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956861019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.956878901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.956902027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.956954002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.957067966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.957149029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.957284927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.957303047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.957346916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.957416058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.957429886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.957473993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.957498074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.957544088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.957598925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.957637072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.957648993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.957669020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.957704067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.957766056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.957782984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.957825899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.957858086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.957870007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.957911015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.957952023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.958009958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.958081961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.958225965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.958307981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.958308935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.958379984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.958432913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.958444118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.958456039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.958511114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.958523989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.958594084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.958702087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.958718061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.958765984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.958780050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.958790064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.958806038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.958822012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.958857059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.958889961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959119081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959137917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959209919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959220886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959254026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959270000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959274054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959284067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959347963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959358931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959443092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959465027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959511042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959525108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959544897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959556103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959573984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959613085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959714890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959768057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959780931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959795952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959801912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959820032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959837914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959851027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959856987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959884882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959902048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959903002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959929943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.959937096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.959975004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960009098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960166931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.960242033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960336924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.960378885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.960416079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960422993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.960447073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960468054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960541010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.960585117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.960613966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960621119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.960658073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960665941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.960675001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960680962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.960706949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960741043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960761070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.960803986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.960818052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.960829973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960834980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.960850954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960881948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.960906029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.961098909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961143017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961174965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.961182117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961213112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.961230040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.961262941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961307049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961354971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.961360931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961419106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.961545944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961590052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961604118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961621046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.961626053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961653948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.961677074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.961808920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961827040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961891890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961893082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.961905003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.961921930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.961950064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.961977959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.962110996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.962157011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.962188005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.962196112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.962224960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.962245941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.962374926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.962393045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.962451935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.962457895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.962497950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.962515116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.962553024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.962598085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.962622881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.962631941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.962657928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.962677956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.962774038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.962791920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.962836027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.962853909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.962861061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.962901115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.962934971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963083029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963135958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963166952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963174105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963186026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963191986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963239908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963248968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963361025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963409901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963433981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963439941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963445902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963471889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963500977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963587999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963634014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963648081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963660002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963665009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963684082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963712931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963772058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963818073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963830948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963843107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963849068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963861942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963896990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963912010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.963989019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.963998079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.964380980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.964399099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.964472055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.964483976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.964519024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.964548111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.964606047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.964622021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.964683056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.964689016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.964720964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.964737892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.964764118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.964778900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.964843035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.964849949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.964876890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.964896917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.965042114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.965059996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.965143919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.965150118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.965224981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.965241909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.965257883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.965325117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.965329885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.965379000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.965411901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.965461016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.965478897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.965537071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.965543032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.965548992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.965600014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.965629101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.965643883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.965686083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.965718985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.965723991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.965754986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.965779066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.966061115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966109991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966140032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966156006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.966161966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966214895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.966325045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966368914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966382027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966423988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.966429949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966470957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.966507912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.966531992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966573954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966604948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.966613054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966625929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.966655970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.966737032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966756105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966825962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.966833115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.966890097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.967039108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.967061996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.967242956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.967288017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.967297077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.967329025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.967407942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.967459917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.967477083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.967535973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.967547894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.967554092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.967597008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.967628002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.967644930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.967695951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.967715025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.967724085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.967753887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.967775106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.968051910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.968096018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.968137026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.968144894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.968179941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.968199968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.968364954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.968383074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.968452930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.968457937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.968492985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.968516111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.968585014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.968601942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.968668938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.968676090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.968708038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.968724012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.968750000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.968769073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.968831062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.968838930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.968868017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.968888998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.968923092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.968940020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969002008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.969008923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969037056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.969058037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.969230890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969247103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969291925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969321012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.969327927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969393969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.969434023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.969460011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969500065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969532013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.969537020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969566107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.969587088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.969619989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969672918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969685078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969706059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.969712973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969754934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.969778061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.969904900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969955921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.969997883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.970005989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.970037937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.970065117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.970238924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.970283031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.970316887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.970324993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.970360041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.970403910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.970474005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.970490932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.970545053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.970570087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.970577955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.970621109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.970649958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.970729113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.970746994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.970803976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.970803976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.970819950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.970843077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.970875978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.970961094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971007109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971035957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.971045971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971055031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.971087933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.971242905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971287966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971312046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.971354961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.971363068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971574068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971590996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971671104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.971679926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971754074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971810102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971817017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.971823931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971857071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.971862078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971894026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.971904039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971920013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971930027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.971946955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.971952915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.971987009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.972022057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.972080946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972100019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972170115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.972177982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972315073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972331047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972440958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.972449064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972503901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.972521067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972538948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972595930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.972603083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972628117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.972635984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972645998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.972652912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972682953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.972735882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.972807884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972851038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972883940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.972893953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.972923040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.972948074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.973021984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973041058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973107100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.973114967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973150969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.973176003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.973268032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973287106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973345995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973366022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.973371983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973462105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.973469973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973511934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973547935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973599911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.973608971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973643064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.973706961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.973804951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973874092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973896980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.973906040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.973963022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.973985910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.974162102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974215031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974235058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974248886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.974256992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974284887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.974287987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974323034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.974330902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974356890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.974399090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974402905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.974410057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974442959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.974476099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974497080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.974503994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974534988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.974558115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.974689960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974709034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974766970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.974775076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974828005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.974961042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.974977016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975053072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.975060940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975111008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.975225925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975275993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975300074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.975306988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975344896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.975389957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.975538015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975554943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975626945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.975634098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975755930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975774050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975842953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.975851059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975862980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975882053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.975897074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975925922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.975935936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.975959063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.975980997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.976013899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976031065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976094961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.976102114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976135969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.976157904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.976270914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976288080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976362944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.976371050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976382971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976414919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976450920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.976459026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976481915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.976505995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.976650953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976669073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976737976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.976744890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976824999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976841927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976902962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.976910114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.976943970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.976974964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.977415085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.977431059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.977510929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.977516890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.977564096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.977683067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.977699995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.977757931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.977765083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.977799892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.977818966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.978137970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.978157043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.978233099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.978240013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.978286028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.978404045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.978426933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.978492022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.978498936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.978528976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.978533983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.978548050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.978566885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.978571892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.978610039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.978663921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.979351997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.979368925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.979441881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.979449034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.979495049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.979724884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.979743004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.979809999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.979815006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.979856014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.979919910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.979935884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.979991913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.979996920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.980021954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.980042934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.980083942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.980101109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.980154037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.980159044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.980190992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.980232000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.980772972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.980789900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.980865955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.980871916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.980920076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.981235027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.981251955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.981358051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.981363058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.981465101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.981501102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.981517076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.981594086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.981599092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.981642962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.981647968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.981652975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.981693029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.981712103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.981719971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.981780052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.982450962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.982470036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.982563019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.982568979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.982620955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.982837915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.982853889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.982939959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.982944965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.982985973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.983117104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.983133078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.983194113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.983200073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.983232021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.983248949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.983666897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.983685970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.983769894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.983776093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.983863115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.983923912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.983942986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.984009981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.984015942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.984440088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.984462976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.984483004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.984488964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.984533072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.984579086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.984663963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.984679937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.984740973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.984745979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.984774113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.984805107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.985246897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.985264063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.985358953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.985363960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.985433102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.985483885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.985501051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.985554934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.985559940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.985590935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.985611916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.986031055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.986048937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.986129999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.986135960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.986176968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.986216068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.986233950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.986289978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.986294985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.986329079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.986349106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.986870050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.986888885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.986968040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.986974001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.987014055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.987083912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.987102985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.987153053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.987158060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.987210035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.987524033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.987540960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.987605095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.987608910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.987652063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.987757921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.987773895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.987824917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.987829924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.987840891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.987854958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.987885952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.987919092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.987921953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.988362074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.988440990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.988446951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.988621950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.988640070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.988699913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.988707066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.988746881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.988759995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.989136934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.989154100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.989232063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.989237070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.989280939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.989394903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.989413977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.989469051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.989474058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.989490986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.989502907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.989526987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.989531040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.989548922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.989567041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.990258932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.990323067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.990343094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.990350962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.990416050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.990457058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.990482092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.990534067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.990539074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.990566015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.990592003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.990726948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.990745068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.990864992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.990869999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.990875959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.990947008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.990950108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.990957022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.991008043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.991018057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.991043091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.991092920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.991107941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.991554976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.991575003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.991635084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.991640091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.991703987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.991765022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.991816044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.991841078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.991847038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.991888046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.991906881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.992291927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.992311001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.992326975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.992362022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.992388010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.992393970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.992405891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.992465973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.992470980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.992477894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.992528915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.992530107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.992547989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.992578030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.992595911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.992599964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.992638111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.993164062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.993184090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.993228912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.993247032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.993252039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.993350029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.993405104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.993796110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.993946075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.994132042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.994149923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.994157076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.994167089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.994231939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.994256973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.994263887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.994285107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.994316101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.994709015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.994762897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.994785070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.994791985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.994828939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.994848013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.994924068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.994975090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.994988918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.994996071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.995029926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.995049000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.995153904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.995213985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.995316029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.995372057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.995418072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.995424986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.995449066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.995476961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.995501995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.995554924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.995569944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.995577097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.995605946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.995624065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.995630980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.995687962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.995701075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.995704889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.995742083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.995762110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.996176004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.996211052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.996308088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.996313095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.996356010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.996532917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.996551991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.996609926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.996614933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.996650934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.996673107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.996733904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.996751070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.996831894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.996836901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.996875048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.996963024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.996978998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.997049093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.997055054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.997473955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.997490883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.997581959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.997587919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.997631073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.997812986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.997828007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.997891903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.997896910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.997921944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.997944117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.998023033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.998039007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.998095036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.998099089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.998131990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.998150110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.998188972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.998225927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.998254061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.998259068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.998291969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.998313904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.998625994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.998642921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.998720884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.998727083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.998766899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.998909950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.998927116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.998987913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.998992920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.999034882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.999057055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.999245882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.999262094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.999397039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.999403000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.999459028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.999474049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.999475002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.999485016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.999515057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.999562979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.999835014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.999851942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.999913931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.999918938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:58.999953032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:58.999974012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.000045061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.000062943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.000111103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.000134945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.000139952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.000184059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.000226021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.000297070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.000303030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.000513077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.000530005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.000586033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.000592947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.000633001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.000662088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.000828028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.000847101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.000936985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.000941992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.000991106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.001080990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.001137018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.001152992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.001158953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.001190901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.001219988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.001272917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.001291037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.001379013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.001391888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.001399040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.001430035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.001465082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.001538992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.001557112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.001614094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.001619101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.001646042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.001667976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.001754999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.001770973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.001822948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.001827002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.001868963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.001890898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.002099037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.002115965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.002175093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.002180099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.002224922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.002341986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.002360106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.002437115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.002441883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.002470970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.002502918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.002559900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.002577066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.002635956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.002641916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.002676964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.002700090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.002770901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.002789021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.002837896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.002854109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.002861023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.002902985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.002923965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003165007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003182888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003231049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003259897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003267050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003303051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003324986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003334045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003371954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003418922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003422976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003463984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003498077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003535986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003587008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003607988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003613949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003642082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003659964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003664017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003673077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003716946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003735065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003763914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003767967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003869057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003904104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003910065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003923893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003930092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003947973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.003952026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.003998995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.004128933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.004168987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.004219055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.004225016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.004249096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.004273891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.004364967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.004406929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.004434109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.004439116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.004486084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.004508018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.004671097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.004718065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.004745007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.004750967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.004805088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.004928112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.004968882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.005009890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.005016088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.005040884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.005065918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.005160093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.005214930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.005234957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.005240917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.005265951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.005292892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.005495071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.005534887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.005578041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.005583048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.005621910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.005660057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.005711079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.005763054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.005779028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.005784988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.005815029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.005841017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.006048918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.006067991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.006136894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.006141901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.006170034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.006170988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.006190062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.006194115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.006198883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.006244898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.006288052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.006362915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.006402016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.006436110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.006441116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.006472111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.006498098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.006567955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.006618977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.006633043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.006639004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.006690979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.006715059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.007083893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007102966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007193089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.007198095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007350922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.007354975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007365942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007411003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007433891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.007441044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007500887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.007533073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.007580996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007622957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007658005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.007662058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007671118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007698059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.007724047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.007728100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007766962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007818937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007839918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.007848024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.007936954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.007941008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.008032084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.008074045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.008116961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.008124113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.008160114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.008187056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.008436918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.008455038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.008536100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.008543015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.008586884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.008657932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.008676052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.008760929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.008765936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.008821011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.008848906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.008866072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.008929014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.008934021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.008985043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.009048939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009068012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009119987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.009124994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009135008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009160042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.009188890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.009193897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009269953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009331942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009340048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.009352922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009411097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.009582996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009637117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009675026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.009681940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009711981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.009737968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.009787083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009803057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009852886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009872913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.009886980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.009926081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.009946108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.010169029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.010188103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.010271072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.010277033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.010338068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.010370016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.010387897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.010442019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.010459900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.010466099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.010505915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.010543108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.010595083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.010613918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.010653019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.010670900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.010679960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.010709047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.010726929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.010752916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.010756969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.010792017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.010816097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.011070013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011086941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011166096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.011171103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011210918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.011281967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011301041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011364937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011403084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.011409044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011466026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.011535883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011595011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011610031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.011616945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011653900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.011676073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.011720896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011780977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011799097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.011800051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011811018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011846066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.011877060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.011883020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011909962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.011971951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.011977911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012195110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012212992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012290001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.012295961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012447119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012465000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012522936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012536049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.012548923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012582064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.012605906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.012648106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012665987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012731075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.012736082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012780905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.012840033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012856960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012926102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.012931108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012938976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.012943029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.012998104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.013003111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.013169050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.013186932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.013242006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.013254881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.013259888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.013289928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.013314962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.013323069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.013350010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.013384104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.013464928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.013483047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.013549089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.013555050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.013586044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.013606071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.013911963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.013928890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.013978958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.014014959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.014023066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.014060020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.014077902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.014130116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.014147997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.014209032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.014214039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.014245987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.014271021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.014395952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.014413118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.014472008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.014477015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.014484882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.014513969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.014523029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.014544964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.014549971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.014575958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.014595985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.014925957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.014941931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015013933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.015018940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015053988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.015078068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.015158892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015188932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015260935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.015265942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015307903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.015331030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015357971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.015362978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015436888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.015445948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015501022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.015605927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015624046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015698910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.015706062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015805960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.015857935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015876055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015940905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.015945911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.015976906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.015999079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.016067982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016084909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016159058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.016164064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016288996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.016325951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016387939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016419888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.016427040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016469955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.016488075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016489029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.016499043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016551018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016561031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.016572952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016639948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.016679049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.016766071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016784906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016849041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.016855955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016897917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.016921997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.016966105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.016984940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.017072916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.017077923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.017191887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.017193079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.017204046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.017242908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.017268896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.017276049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.017309904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.017334938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.017394066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.017411947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.017465115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.017469883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.017498970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.017544985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.017692089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.017710924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.017769098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.017774105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.017817974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.018104076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.018121958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.018183947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.018188953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.018250942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.018331051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.018349886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.018542051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.018629074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.018636942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.018644094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.018682957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.018728018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.018733025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.018774033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.018807888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.018935919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.018954992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019025087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.019030094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019067049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.019090891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.019171953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019191027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019243002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019252062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.019258022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019318104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.019463062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019479990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019540071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.019546032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019582987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.019609928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.019706011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019757986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019777060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.019783020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019809961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.019834042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.019927979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019944906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.019999981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.020005941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.020051003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.020072937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.020176888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.020195007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.020245075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.020250082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.020286083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.020303965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.020320892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.020337105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.020418882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.020423889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.020663977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.020684958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.020701885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.020754099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.020759106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.020801067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.020823002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.020888090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.020905018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.020960093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.020965099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.021002054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.021028042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.021049976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.021066904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.021120071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.021125078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.021163940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.021187067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.021311045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.021342993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.021418095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.021424055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.021668911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.021684885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.021735907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.021739960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.021766901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.021799088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.022082090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.022099018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.022147894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.022161961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.022170067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.022231102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.022267103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.022452116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.022473097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.022531033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.022536039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.022569895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.022593975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.022628069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.022646904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.022711039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.022716045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.022754908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.022777081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.022850037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.022907019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.022926092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.022932053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.022969007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.022990942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.023052931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023070097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023129940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.023137093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023170948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.023194075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.023303986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023320913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023411036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.023416042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023452044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.023472071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.023505926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023523092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023578882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.023583889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023622990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.023631096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023685932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023701906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.023709059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023756027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.023858070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023874998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.023946047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.023951054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.024120092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.024137020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.024200916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.024205923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.024250984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.024271011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.024286985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.024348021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.024353027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.024403095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.024905920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.024924040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.025002003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.025006056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.025064945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.025095940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.025111914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.025181055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.025186062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.025233984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.025321960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.025337934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.025393963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.025438070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.025443077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.025481939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.025507927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.025523901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.025573969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.025578022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.025613070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.025633097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.025918007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.025935888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026000977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.026005983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026042938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.026065111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.026132107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026149035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026211977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.026216030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026267052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.026396990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026412964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026463032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026464939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.026473045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026501894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.026540995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.026669979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026694059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026751995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.026757956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026786089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.026804924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.026859999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026878119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026926994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.026932001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.026973009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.026995897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.027120113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.027137041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.027199984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.027205944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.027237892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.027255058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.027261019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.027266026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.027295113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.027301073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.027338982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.027343988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.027394056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.027412891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.027492046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.027508020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.027569056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.027574062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.027609110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.027626991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.027792931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.027808905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.027859926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.027863979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.027906895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.028049946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028101921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028114080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.028122902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028173923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.028306007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028322935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028373003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028398037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.028403044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028439045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.028464079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028471947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.028476000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028502941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.028533936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.028713942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028732061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028774977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028785944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.028790951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028820038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.028850079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.028961897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.028980017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029033899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.029038906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029066086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.029084921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029089928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.029095888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029150963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.029156923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029298067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029316902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029367924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029382944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.029391050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029431105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.029459000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.029689074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029707909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029781103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.029788017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029830933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.029898882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029916048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.029970884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.029975891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.030000925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.030024052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.030112028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.030128002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.030184031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.030189037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.030244112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.030294895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.030313969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.030359030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.030365944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.030380011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.030421972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.030463934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.030823946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.030843019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.030926943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.030931950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.030972958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.031017065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031070948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031090975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.031096935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031125069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.031147957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.031236887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031255007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031312943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031316996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.031322002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031356096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.031408072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.031435966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031452894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031505108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.031510115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031533957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.031557083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.031845093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031862974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031909943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031941891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.031949043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.031991959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.032038927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.032056093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.032110929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.032114983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.032143116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.032164097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.032227039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.032282114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.032294989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.032301903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.032334089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.032356977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.032378912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.032396078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.032435894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.032442093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.032455921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.032478094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.032509089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.032901049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.032918930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.032996893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.033001900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.033042908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.033126116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.033163071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.033205986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.033212900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.033248901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.033276081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.033349991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.033368111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.033453941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.033456087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.033466101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.033509970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.033534050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.033586979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.033592939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.033655882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.033711910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.033727884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.033797026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.033802986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.033842087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.033890009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.033983946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034001112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034039974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034075975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.034081936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034091949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034121037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.034133911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034149885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.034156084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034178972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.034198999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.034231901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034276009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034295082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.034300089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034324884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.034347057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.034543037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034590960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034626007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.034631968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034693003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.034775019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034811974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034861088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.034866095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034909010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.034915924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034935951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.034939051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.034981966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.035015106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.035172939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.035190105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.035227060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.035262108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.035267115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.035305977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.035306931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.035326958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.035330057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.035335064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.035386086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.035432100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.035913944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.035929918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.036010027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.036015987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.036032915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.036063910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.036068916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.036099911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.036130905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.036333084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.036350012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.036390066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.036447048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.036453009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.036492109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.036528111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.036549091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.036565065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.036628008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.036633968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.036673069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.036695004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.037038088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037055969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037136078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.037142038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037190914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.037262917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037296057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037364960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.037369967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037379026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037416935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037436962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037447929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.037455082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037501097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.037533045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.037679911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037698030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037781954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.037787914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037830114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.037944078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.037961960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.038043976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.038050890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.038080931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.038110971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.038146019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.038163900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.038223028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.038228989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.038266897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.038285971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.038305044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.038322926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.038400888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.038405895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.038434029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.038448095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.038450956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.038467884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.038472891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.038525105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.038559914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.038897038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.038913965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.038995981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.039002895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.039046049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.039141893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.039159060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.039238930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.039243937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.039288044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.039365053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.039382935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.039449930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.039454937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.039483070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.039503098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.039637089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.039653063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.039760113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.039766073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.039875031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.039891005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.039958954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.039964914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.040005922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.040038109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.040137053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.040153027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.040215969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.040220976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.040261984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.040281057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.040316105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.040332079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.040414095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.040420055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.040626049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.040642977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.040725946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.040731907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.040776014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.040864944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.040916920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.040944099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.040951014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.040987015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.041008949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.041115046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.041132927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.041197062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.041203022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.041239023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.041260004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.041332960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.041351080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.041438103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.041444063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.041486979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.041718006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.041734934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.041809082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.041815042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.041861057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.041987896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.042006016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.042083979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.042089939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.042232990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.042249918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.042252064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.042263031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.042354107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.042469978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.042489052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.042562962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.042568922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.042618990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.042742968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.042761087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.042829990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.042834997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.042877913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.042915106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.043024063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.043040991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.043118954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.043123960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.043158054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.043180943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.043273926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.043291092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.043339968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.043349981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.043355942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.043422937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.043505907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.043564081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.043590069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.043597937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.043631077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.043658018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.043963909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.043982983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044028997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044043064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.044050932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044094086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.044123888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.044207096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044259071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044276953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.044285059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044306040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.044327021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.044331074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044342041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044419050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.044426918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044554949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044594049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044616938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.044621944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044646978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.044667959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.044725895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044797897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.044848919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044894934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044922113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.044926882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.044954062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.044975996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.045073986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045125008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045141935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045150995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.045155048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045207024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.045334101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045351982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045416117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045437098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.045442104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045500040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.045505047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045671940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045695066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045758963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.045766115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045810938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.045861959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045890093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045934916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045939922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.045944929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.045973063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.046010971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.046080112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.046129942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.046154022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.046161890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.046180964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.046199083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.046266079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.046282053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.046340942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.046345949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.046401978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.046420097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.046436071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.046492100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.046497107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.046528101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.046554089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.046725035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.046741962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.046813965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.046818972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.046855927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.046878099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.047005892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.047023058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.047092915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.047097921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.047133923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.047157049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.047167063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.047182083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.047241926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.047246933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.047285080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.047302008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.047385931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.047404051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.047462940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.047466993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.047518015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.047770977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.047786951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.047863007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.047868013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.047905922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.047935009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.048043966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.048063993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.048114061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.048130035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.048137903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.048177958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.048197031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.048363924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.048382044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.048446894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.048451900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.048492908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.048513889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.048530102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.048548937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.048607111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.048610926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.048654079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.048676968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.048815966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.048831940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.048899889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.048904896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.048944950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.048966885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.048983097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.049024105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.049053907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.049058914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.049109936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.049242020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.049263954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.049326897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.049331903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.049360037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.049393892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.049438000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.049453974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.049513102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.049518108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.049561977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.049573898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.049797058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.049849987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.049877882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.049895048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.049922943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.049938917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.050105095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050123930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050173044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050188065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.050198078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050235987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.050268888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.050340891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050359011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050407887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050435066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.050446033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050470114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.050489902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.050563097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050580978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050637960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050704002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.050712109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050755978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.050791025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.050899029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050915956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.050986052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.050993919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.051017046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.051026106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.051033974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.051054955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.051062107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.051112890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.051142931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.051203012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.051218987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.051280975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.051289082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.051323891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.051341057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.051387072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.051403999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.051457882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.051465034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.051517010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.051542044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.051843882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.051861048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.051966906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.051979065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.052078962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.052097082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.052176952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.052186012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.052217960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.052246094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.052314043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.052330971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.052429914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.052437067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.052464008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.052480936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.052490950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.052496910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.052537918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.052591085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.052746058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.052808046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.052841902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.052850962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.052886009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.052912951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.053016901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.053034067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.053131104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.053138971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.053172112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.053191900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.053256989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.053276062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.053340912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.053348064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.053405046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.053410053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.053421021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.053461075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.053482056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.053489923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.053514004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.053563118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.053606987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.053677082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.053834915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.053853035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.053937912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.053946018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054089069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054105043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054177046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.054183960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054223061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.054239035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.054275036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054291964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054349899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.054356098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054419994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.054526091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054542065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054610968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.054616928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054656982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.054685116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054692030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.054704905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054754972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054769039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.054776907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.054838896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.054995060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.055012941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.055088043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.055094957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.055150986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.055244923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.055260897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.055299997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.055319071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.055325031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.055361032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.055413961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.055672884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.055690050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.055780888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.055788040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.055934906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.055952072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056029081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.056036949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056056023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056075096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.056081057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056092978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.056097984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056135893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.056164026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.056245089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056261063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056325912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.056333065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056343079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.056407928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.056413889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056425095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056473017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056485891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.056494951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056540966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.056731939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056756020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056824923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056838989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.056845903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.056905985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.057060003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.057077885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.057117939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.057192087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.057302952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.057311058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.057423115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.057748079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.057765961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.057938099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.057945967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.058024883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.058041096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.058113098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.058124065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.058155060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.058177948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.058223963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.058276892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.058299065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.058307886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.058347940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.058387041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.058444977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.058509111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.152595997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.152621984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.152648926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.152784109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.152796984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.152815104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.152849913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.152887106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.152899027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.152955055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.152968884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153014898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153024912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153044939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153064966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153076887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153096914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153112888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153153896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153167963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153203011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153213024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153229952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153234959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153301001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153332949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153354883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153367043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153387070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153485060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153498888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153531075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153542042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153572083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153657913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153670073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153687000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153754950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153767109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153801918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153837919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153879881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.153892040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.153978109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.154042006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.154083967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.154123068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.154726982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.154803991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.154865980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.154881954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.154910088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155059099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155072927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155105114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155114889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155172110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155220032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155270100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155284882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155308008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155324936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155342102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155352116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155371904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155416012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155456066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155457973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155478001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155522108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155539989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155594110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155673027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155709028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155745983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155793905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155806065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155821085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155843019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155877113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155926943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155939102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155953884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.155987978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.155996084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.156008005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.156063080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.156090975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.156127930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.156172991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.156184912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.156205893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.156219959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.156312943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.156399965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.156460047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.156532049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.156641006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.156693935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.157147884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.157205105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.157279968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.157298088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.157319069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.157341957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.157354116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.157459021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.157471895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.157542944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.157623053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.157649040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.157674074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.157686949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.157726049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.157744884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.157759905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.157772064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.157808065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.157828093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.157854080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.157936096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.157949924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158004999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158041000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158087015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158101082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158116102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158153057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158154011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158174038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158209085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158230066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158243895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158294916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158302069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158317089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158348083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158380985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158392906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158432961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158449888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158463001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158499956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158552885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158565998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158601999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158611059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158612013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158632994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158664942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158691883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158704042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158737898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158755064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158776999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158833981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158858061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158869982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158890009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158890963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158922911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.158927917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158948898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.158957958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159002066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159034014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159049988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159120083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159137011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159172058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159218073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159229040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159245014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159277916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159284115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159296036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159342051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159369946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159401894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159437895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159483910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159495115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159528017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159548044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159548998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159567118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159601927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159626007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159638882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159663916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159681082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159693956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159702063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159724951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159737110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159792900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159806013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159879923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159955025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.159966946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.159997940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160100937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160115004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160135984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160168886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160218000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160229921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160271883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160280943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160300016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160310030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160352945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160363913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160399914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160434961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160487890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160499096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160515070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160518885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160543919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160594940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160604000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160624027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160644054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160662889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160674095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160713911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160727978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160732985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160744905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160783052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160804987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160819054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160835981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160840988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160860062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160867929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160892963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160903931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160937071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160950899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160972118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.160975933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.160984993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161022902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161062002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161062956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161076069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161113977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161134958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161148071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161166906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161189079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161192894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161202908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161214113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161266088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161273003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161298037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161299944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161309004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161351919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161389112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161389112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161402941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161442041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161468029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161482096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161498070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161503077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161521912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161529064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161545992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161556005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161587000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161598921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161619902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161626101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161639929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161654949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161686897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161691904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161720991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161734104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161750078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161771059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161792994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161844969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161859035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161875010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161886930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161916971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161920071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.161936998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.161955118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162003994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162056923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162080050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162134886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162146091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162158966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162163973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162189007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162200928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162211895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162235975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162267923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162286043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162291050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162302971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162338018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162369013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162369967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162381887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162426949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162441015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162451029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162465096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162501097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162533045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162545919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162573099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162631989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162652969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162657022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162671089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162703991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162724972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162751913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162764072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162776947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162795067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162806988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162813902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162849903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162866116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162874937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162892103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162915945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162934065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162945986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162962914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.162971973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.162997961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163017988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163034916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163079023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163104057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163135052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163145065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163171053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163177013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163203955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163214922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163239956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163252115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163276911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163294077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163305044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163315058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163335085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163352013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163408995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163410902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163424015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163466930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163502932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163506031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163516998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163542986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163556099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163578033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163589001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163614988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163635969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163652897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163672924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163676977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163676977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163691044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163712978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163731098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163763046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163820028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163826942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163837910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163877964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163892031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163912058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163958073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.163961887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.163990974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164005995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164017916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164052963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164062023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164077997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164130926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164150000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164150953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164164066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164200068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164220095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164232016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164287090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164298058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164307117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164354086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164357901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164412022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164417028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164428949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164465904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164478064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164489985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164534092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164541006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164551020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164560080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164613008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164628029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164644003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164700031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164753914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164757967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164777040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164789915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164798975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164809942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164815903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164840937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164851904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164869070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164872885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164901972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164911985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164935112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164937973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.164982080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.164985895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165002108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165007114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165054083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165066004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165081024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165091038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165123940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165126085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165134907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165144920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165173054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165194035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165206909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165215969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165245056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165277958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165280104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165292025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165344000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165352106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165364027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165400982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165422916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165436029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165452003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165467978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165488958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165498972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165513039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165524960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165553093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165569067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165581942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165589094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165592909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165630102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165643930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165656090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165668964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165690899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165743113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165749073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165761948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165780067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165791988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165822983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165828943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165842056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165857077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165904999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165918112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165934086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.165977955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.165987968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166004896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166049957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166052103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166065931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166070938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166085958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166110039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166148901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166152954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166167021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166205883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166222095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166225910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166238070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166281939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166300058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166313887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166347027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166364908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166376114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166380882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166395903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166436911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166440010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166477919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166491032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166506052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166511059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166557074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166573048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166580915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166594028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166610956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166639090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166640043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166656971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166666985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166698933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166702986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166729927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166742086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166773081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166785002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166800976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166806936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166822910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166838884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166850090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166870117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166879892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166898966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166944027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.166955948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.166971922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167017937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167036057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167041063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167053938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167071104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167110920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167120934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167141914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167175055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167186975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167205095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167208910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167238951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167251110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167273045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167284966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167319059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167329073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167342901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167347908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167381048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167399883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167424917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167442083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167454004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167462111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167499065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167509079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167526007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167529106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167571068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167571068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167588949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167601109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167607069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167645931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167654037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167661905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167673111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167717934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167722940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167746067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167756081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167777061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167793036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167814016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167825937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167857885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167861938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167891026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167901993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167917967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167922974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.167984962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.167985916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168000937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168046951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168061018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168068886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168086052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168138027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168159008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168221951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168222904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168234110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168273926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168294907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168307066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168319941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168334961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168345928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168356895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168390036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168402910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168414116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168452978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168457985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168486118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168498039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168519020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168519020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168560028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168571949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168586016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168591022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168637037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168653965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168665886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168677092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168726921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168740988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168792963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168812990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168824911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168836117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168852091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168863058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168875933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168906927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168936968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.168948889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168970108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.168987989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169003963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169018984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169028997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169044971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169049978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169095039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169106960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169121027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169126034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169172049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169192076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169203043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169214964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169231892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169235945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169281006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169295073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169310093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169326067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169365883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169373989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169387102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169445038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169464111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169514894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169543028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169554949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169568062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169569016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169614077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169636011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169650078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169668913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169692039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169692993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169711113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169720888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169748068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169770002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169771910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169836044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169837952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169851065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169863939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169892073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169909000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.169935942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.169960022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170016050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170017958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170030117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170068026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170074940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170094013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170098066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170109034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170129061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170171976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170175076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170187950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170245886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170247078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170258999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170300961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170320988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170334101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170377970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170383930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170430899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170433998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170443058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170478106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170500040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170507908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170531988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170536995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170567036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170576096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170587063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170603991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170609951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170634031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170639038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170669079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170670033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170690060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170700073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170706034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170730114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170754910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170762062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170768976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170797110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170823097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170830011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170840979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170854092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170882940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170891047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170906067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.170908928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170917034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170969963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.170978069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171009064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171021938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171029091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171047926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171055079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171075106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171087027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171094894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171122074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171143055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171166897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171175003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171185970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171189070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171217918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171220064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171238899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171255112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171289921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171298027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171304941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171338081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171350002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171356916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171385050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171421051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171437979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171446085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171458006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171504974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171541929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171550035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171569109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171575069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171591043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171597004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171606064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171619892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171634912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171641111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171664000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171672106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171674967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171724081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171731949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171742916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171756983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171765089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171775103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171782017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171806097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171823978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171832085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171868086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171889067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171895981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171910048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171917915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171942949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171952963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.171972036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.171978951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172008038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172018051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172024965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172055960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172066927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172075033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172102928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172107935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172128916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172136068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172149897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172164917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172171116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172195911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172202110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172218084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172223091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172261000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172269106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172298908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172307014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172318935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172336102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172360897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172369957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172377110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172408104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172426939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172435999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172449112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172463894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172473907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172503948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172511101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172521114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172525883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172558069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172570944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172580004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172596931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172602892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172616959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172629118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172636986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172648907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172683954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172684908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172704935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172730923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172736883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172744989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172766924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172789097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172794104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172802925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172847033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172847986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172854900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172887087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172908068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172909021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172919035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172934055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172965050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.172966003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172988892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.172996998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173010111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173022985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173051119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173055887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173079014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173086882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173100948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173111916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173129082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173135042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173154116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173166990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173175097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173208952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173218966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173238993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173248053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173252106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173286915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173295021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173310041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173315048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173335075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173341036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173377991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173381090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173398018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173438072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173441887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173448086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173475981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173481941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173516035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173523903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173536062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173557043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173564911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173584938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173595905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173604012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173625946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173636913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173645020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173679113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173680067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173688889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173707962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173731089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173732042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173748970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173754930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173780918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173789978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173821926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173834085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173841000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173871994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173896074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173902988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173917055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173927069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173947096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173953056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.173985958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.173991919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174011946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174012899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174024105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174043894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174052000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174081087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174088955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174099922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174103022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174130917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174138069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174149036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174171925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174176931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174199104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174211025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174216986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174256086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174257994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174283028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174290895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174323082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174329042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174345016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174360037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174366951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174392939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174405098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174410105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174438000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174444914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174455881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174485922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174499989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174527884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174535990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174546957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174561024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174570084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174592018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174597979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174612045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174624920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174664974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174665928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174674988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174704075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174715042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174753904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174761057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174776077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174808979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174854994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174859047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174869061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174897909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174906969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174921036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174921989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174930096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.174969912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.174998999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175007105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175013065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175041914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175045967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175066948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175074100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175105095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175132036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175137997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175146103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175173044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175184965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175192118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175220013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175223112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175240040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175246000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175275087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175280094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175309896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175317049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175328016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175340891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175348997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175378084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175381899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175391912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175426006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175441980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175461054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175467968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175502062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175509930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175527096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175530910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175539970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175568104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175575972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175587893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175600052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175606966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175620079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175636053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175645113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175663948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175669909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175698042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175698042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175729990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175736904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175755024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175764084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175781012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175782919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175808907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175817013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175827026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175843954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175852060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175874949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175901890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175909042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175919056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175939083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175962925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.175966978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.175976038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176012993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176028967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176034927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.176042080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176058054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.176064968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176084995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176088095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.176124096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.176131964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176151991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176161051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.176184893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.176192045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176203966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176218987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.176225901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176259995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176270008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.176276922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176305056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176310062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.176342964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.176342964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176357031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176379919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.176384926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176400900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176440954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.176440954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176459074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.176471949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.176512957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.193861961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.194008112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.194705009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.194726944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.194840908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.194854975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.194983006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.195369005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.195436001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.195460081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.195471048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.195494890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.195521116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.195883036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.195903063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.195966959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.195976019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.196006060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.196024895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.196342945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.196362972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.196458101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.196466923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.196507931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.196536064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.196815014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.196837902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.196886063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.196903944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.196913004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.196943045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.196980000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.197388887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.197412014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.197508097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.197520018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.197699070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.197849989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.197870970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.197923899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.197968006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.197979927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.197989941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.198026896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.198029041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.198041916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.198092937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.198120117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.198331118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.198381901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.198429108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.198438883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.198471069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.198496103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.247061968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.254828930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.292804003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.292850971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.292929888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.292956114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.292970896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293018103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293030977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293123960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293159962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293231010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293242931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293278933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293291092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293301105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293322086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293410063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293415070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293431044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293508053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293520927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293596029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293622017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293632030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293648005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293690920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293695927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293715000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293785095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293801069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293817997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293842077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293876886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293889999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.293905020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293939114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293947935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.293979883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294075966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294084072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294095993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294167042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294173956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294195890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294225931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294279099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294291973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294307947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294318914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294369936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294384003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294395924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294410944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294435978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294447899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294470072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294490099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294513941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294526100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294538975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294584036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294603109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294615030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294631004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294667959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294670105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294688940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294735909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294764996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294779062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294810057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294837952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294851065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294871092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294928074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294941902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.294954062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.294960976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295013905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295038939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295047998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295069933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295082092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295113087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295130968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295145035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295207024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295248985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295317888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295339108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295408010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295450926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295454025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295480013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295494080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295510054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295536041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295547009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295589924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295602083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295614958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295650959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295680046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295695066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295754910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295782089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295794964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295811892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295819044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295861006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295872927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295902967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295932055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295937061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.295952082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.295986891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296010971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296022892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296047926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296072960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296082020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296092987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296138048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296154976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296168089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296216965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296230078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296237946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296292067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296303034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296320915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296361923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296395063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296458960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296515942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296540976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296555042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296567917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296577930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296582937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296612978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296612978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296638966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296649933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296664953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296704054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296717882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296844006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296914101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.296926975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.296957016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297012091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297034979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297049046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297069073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297076941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297106981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297120094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297137976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297188997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297204018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297281981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297291994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297312021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297344923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297374964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297388077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297429085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297434092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297451019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297461987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297473907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297517061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297561884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297597885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297646046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297657967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297688961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297705889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297710896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297729969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297761917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297787905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297799110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297837973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297848940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.297873974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.297943115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298012018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298027992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298038960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298046112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298083067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298122883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298134089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298150063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298192024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298192978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298213005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298268080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298332930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298369884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298451900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298464060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298484087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298494101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298526049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298531055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298548937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298568010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298613071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298625946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298645973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298691988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298702955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298717976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298774958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298785925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298840046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298847914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298866034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298897982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298924923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298938036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.298964024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.298998117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299011946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299050093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299094915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299107075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299144030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299154997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299163103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299180984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299212933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299241066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299252987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299278021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299300909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299310923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299320936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299359083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299381018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299393892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299439907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299453020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299463034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299496889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299573898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299585104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299604893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299657106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299685955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299696922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299719095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.299722910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299758911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.299777031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.326522112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.333620071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.333717108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.333758116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.333762884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.333785057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.333791971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.333832026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.333857059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.333868980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.333921909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.333945990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.333961964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.334012985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334132910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334186077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334223986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.334227085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334252119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334259033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.334300995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.334388018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334461927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.334517956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334573984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334640026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.334652901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334673882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334723949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334769011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.334780931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334786892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.334804058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334841013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334863901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.334876060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.334892035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.334913015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.334932089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.334971905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335036993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.335058928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335094929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335135937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.335148096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335161924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.335191965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.335201979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335278034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335345030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.335355997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335385084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335437059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335468054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.335481882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335498095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.335506916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335536957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.335549116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335592031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.335621119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335627079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.335639000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335696936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.335767031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335833073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.335865021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335917950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335941076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.335953951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.335988045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336009979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.336021900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336080074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.336114883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336169958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336203098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.336215973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336232901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.336240053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336270094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.336282969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336304903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.336335897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336357117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.336373091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.336381912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336435080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.336446047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336464882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336534023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.336558104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336616993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336637974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.336647987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336667061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.336668015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.336702108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.336714029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.337126970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337203026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.337241888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337280989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337323904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.337336063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337358952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.337398052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337479115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.337491035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337538958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337574005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337613106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.337624073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337647915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.337675095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337682962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.337694883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337757111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337775946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.337790012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.337800026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337878942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.337888002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.337897062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337929964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.337991953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338032961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.338037968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338061094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338100910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.338109016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.338130951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.338176012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338244915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.338308096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338361025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338387012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.338397980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338422060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338424921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.338460922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338510990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.338522911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338536978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.338578939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.338581085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338599920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338654995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.338700056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338758945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338778019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.338792086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338812113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338886976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.338898897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338949919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.338999987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339025021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339040041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339060068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339095116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339098930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339119911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339152098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339174032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339186907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339209080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339241028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339257956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339293003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339303017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339355946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339368105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339385986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339418888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339428902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339499950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339534998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339577913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339591026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339616060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339627981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339652061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339663982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339680910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339741945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339795113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339817047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339829922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339847088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339864969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339889050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339900970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339940071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339958906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.339975119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.339986086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340019941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340034962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.340048075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.340059042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340090036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.340106010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340131998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.340145111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340162039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.340194941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340250015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.340260029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340298891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340353966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340374947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.340389967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340414047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340496063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.340502977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340523005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340553045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340578079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.340591908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340615988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.340650082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.340660095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340698957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340781927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.340790987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340811968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340856075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340869904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.340884924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340917110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.340992928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341008902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341031075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341083050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341105938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341119051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341147900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341159105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341186047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341197014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341214895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341249943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341260910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341273069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341301918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341322899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341341019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341367006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341392040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341464996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341475964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341494083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341553926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341567039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341609001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341660976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341684103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341697931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341715097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341722965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341734886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341763020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341766119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341784000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341803074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341847897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.341875076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.341964960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342016935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342081070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342099905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342109919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342124939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342173100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342192888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342206001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342248917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342252016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342273951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342283964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342309952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342317104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342369080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342387915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342391014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342401028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342439890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342459917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342461109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342474937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342494965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342529058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342539072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342551947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342612028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342622995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342634916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342680931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342680931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342720032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342726946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342740059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342751980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342756033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342809916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342827082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342830896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342844009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342865944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342905045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.342919111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.342933893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343003988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343008995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343019962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343065977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343087912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343089104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343102932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343126059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343147993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343189001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343189955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343220949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343238115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343241930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343244076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343276978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343288898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343306065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343311071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343333960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343353987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343364954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343380928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343394995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343450069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343451023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343463898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343482018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343492985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343529940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343532085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343540907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343547106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343595028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343595982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343607903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343646049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343663931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343674898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343688011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343736887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343739986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343769073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343780041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343806028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343808889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343847990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343857050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343871117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343873978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343930006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343949080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.343961954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.343974113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344007969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344017982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344031096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344048977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344055891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344079018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344080925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344120979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344126940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344140053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344146013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344183922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344202995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344216108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344257116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344273090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344285011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344310045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344316959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344364882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344387054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344388962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344402075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344451904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344456911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344484091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344496012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344512939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344525099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344552994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344563007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344578028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344582081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344630957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344650984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344659090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344671011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344685078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344707012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344733000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344749928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344762087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344774008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344774961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344814062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344829082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344840050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344845057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344897032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344916105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344918013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344932079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344960928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344974041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.344990969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.344990969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345005035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345036983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345046043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345072031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345088005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345099926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345103025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345155954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345169067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345185995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345236063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345256090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345264912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345278025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345328093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345344067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345357895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345380068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345385075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345443964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345464945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345474005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345488071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345532894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345562935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345572948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345635891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345658064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345743895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345755100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345799923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345820904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345885992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345900059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345916033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345923901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345937967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345957994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.345968008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.345999002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346018076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346036911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346038103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346051931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346091032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346112967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346133947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346136093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346144915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346177101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346200943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346213102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346256971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346268892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346282959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346287012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346344948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346365929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346369982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346379042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346417904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346473932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346482992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346493959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346512079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346512079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346553087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346564054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346580029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346589088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346626043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346635103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346652031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346656084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346697092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346714020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346731901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346787930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346802950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346858978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346883059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346898079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346906900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.346913099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346955061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.346982002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347002029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347002983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347014904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347045898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347079992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347088099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347100019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347141027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347157955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347167015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347181082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347215891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347227097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347245932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347253084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347266912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347270966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347301960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347318888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347333908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347346067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347384930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347387075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347429037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347435951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347446918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347450018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347492933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347510099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347527981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347538948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347558022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347562075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347599030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347609997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347625971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347630024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347666979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347675085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347693920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347707987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347718000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347732067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347754002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347755909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347769022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347794056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347805977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347830057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347836018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347848892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347865105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347898960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347901106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347915888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347924948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.347950935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.347966909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348005056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348021030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348032951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348037958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348081112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348104954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348107100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348118067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348148108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348185062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348192930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348206997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348243952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348263025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348268986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348289013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348313093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348326921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348344088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348375082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348392963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348397970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348413944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348447084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348455906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348475933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348481894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348495960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348499060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348524094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348546982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348548889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348561049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348603964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348620892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348628998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348642111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348671913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348683119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348695040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348712921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348725080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348740101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348766088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348788023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348797083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348819017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348828077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348875046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348891973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348901033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348911047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348942995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348984957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.348984957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.348999023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349054098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349066973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349087954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349143982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349157095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349174023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349178076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349201918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349250078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349253893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349267006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349286079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349302053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349318027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349324942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349333048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349356890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349364042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349399090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349402905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349414110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349440098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349451065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349473953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349478960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349489927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349539995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349545956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349569082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349579096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349623919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349623919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349642038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349651098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349668026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349682093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349697113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349710941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349720001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349730015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349740028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349761009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349776983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349792004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349802971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349812984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349817991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349860907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349864006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349889994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349901915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349910975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349947929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349956036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349963903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.349977016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.349981070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350023031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350027084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350050926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350064039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350069046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350090981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350095034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350121021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350131989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350142956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350174904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350197077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350197077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350214005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350239038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350266933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350286961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350317001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350326061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350338936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350349903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350353956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350364923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350404978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350421906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350434065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350470066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350513935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350513935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350527048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350586891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350590944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350603104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350663900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350677013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350693941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350714922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350764036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350774050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350789070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350809097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350810051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350841999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350855112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350869894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350883007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350903988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350914001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350924969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350949049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350975037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.350986004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.350997925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351013899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351043940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351075888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351088047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351103067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351124048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351176977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351188898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351205111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351224899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351226091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351264954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351277113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351290941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351306915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351330996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351336002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351347923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351373911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351385117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351396084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351413012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351447105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351459026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351473093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351517916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351530075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351553917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351583004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351634026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351645947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351661921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351670027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351684093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351705074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351713896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351757050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351764917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351788998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351799965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351840973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351855040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351876020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351878881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351887941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351922035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351948977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.351955891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.351969004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352003098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352021933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352035046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352051020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352076054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352097988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352107048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352119923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352132082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352164030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352220058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352220058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352231979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352260113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352261066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352297068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352302074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352309942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352338076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352346897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352375984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352380991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352386951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352416039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352437973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352468014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352478027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352487087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352509022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352509975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352536917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352545977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352566957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352572918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352585077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352596045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352602959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352648973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352674961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352679968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352686882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352719069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352739096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352747917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352760077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352777004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352777958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352798939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352806091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352839947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352849960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352859020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352891922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352899075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352919102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352921009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352936029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352953911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.352961063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.352994919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353007078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353010893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353053093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353060961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353071928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353086948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353091955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353140116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353146076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353154898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353179932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353204012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353226900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353251934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353296995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353305101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353327990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353328943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353346109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353348970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353355885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353387117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353409052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353425980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353444099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353450060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353473902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353486061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353502035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353506088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353513956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353523970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353560925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353560925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353579044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353599072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353606939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353636980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353650093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353652000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353688955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353697062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353710890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353729010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353734970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353775978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353785038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353796005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353811979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353816032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353861094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353868961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353892088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353897095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353920937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353929043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353956938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353960037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.353975058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.353996992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354003906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354032040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354034901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354049921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354067087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354074001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354120016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354120970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354137897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354204893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354223013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354283094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354439974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354448080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354506969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354523897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354572058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354581118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354615927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354629040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354636908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354671955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354681969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354697943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354728937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354739904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354770899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354785919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354805946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354815006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354824066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354831934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354847908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354862928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354917049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354926109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354937077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354953051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.354979038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.354986906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.355012894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.355046034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.356033087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.356050014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.356128931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.356137991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.356173038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.356190920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.356372118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.356389046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.356466055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.356472969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.356594086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.356609106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.356673956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.356682062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.356816053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.356832027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.356885910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.356894970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.356923103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.356946945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.357120991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.357136965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.357191086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.357198954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.357213020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.357248068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.357350111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.357366085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.357434034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.357443094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.357450008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.357486963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.357522964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.357603073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.357620955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.357677937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.357686996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.357712984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.357743025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.358169079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.358192921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.358261108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.358268976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.358464003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.358479977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.358557940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.358566046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.358588934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.358618975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.358619928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.358629942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.358665943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.358689070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.358699083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.358731031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.358752012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.358886957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.358903885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.358961105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.358968973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.358995914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.359020948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.359045029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.359061956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.359111071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.359114885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.359131098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.359148026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.359179974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.361991882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362010002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362059116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362097979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362106085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362131119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362150908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362231016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362273932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362303019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362312078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362338066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362355947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362375021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362437010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362456083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362463951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362488985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362488985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362509966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362518072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362543106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362570047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362648010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362688065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362715960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362725973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362740040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362771988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.362929106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362946987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.362997055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.363009930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.363017082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.363056898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.363075018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.363420010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.363437891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.363516092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.363518953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.363528967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.363558054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.363585949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.363596916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.363625050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.363653898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.363702059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.363718987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.363789082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.363796949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.363826036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.363840103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.363853931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.363862038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.363913059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.364128113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.364144087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.364198923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.364216089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.364223957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.364253044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.364254951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.364284039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.364293098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.364326000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.364360094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.364371061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.364412069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.364442110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.364450932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.364470005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.364667892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.364684105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.364721060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.364749908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.364758015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.364782095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.364806890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.365008116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365024090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365084887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365084887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.365096092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365132093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.365134954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365153074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365156889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.365164995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365187883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.365217924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.365283966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365300894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365370989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.365379095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365423918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.365458965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.365526915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365570068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365596056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.365605116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365628958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.365652084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.365827084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365844965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365906000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.365917921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.365959883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.366008043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366025925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366045952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.366053104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366069078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.366094112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366122007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.366128922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366144896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.366183996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.366328001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366396904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.366405964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366580963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366617918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366632938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366650105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.366658926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366686106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.366719007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.366888046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366905928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366962910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.366971016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366981983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.366986036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367005110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367013931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367023945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367053986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367089033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367240906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367259026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367316961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367326021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367356062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367381096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367387056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367394924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367429018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367451906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367461920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367480993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367578030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367620945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367645025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367655993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367675066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367707968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367791891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367815971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367857933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367870092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367877960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367914915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367949963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.367957115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.367966890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368011951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368017912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.368024111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368056059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.368062019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368078947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.368088007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368117094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.368133068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.368443966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368462086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368510008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368534088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.368542910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368587017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.368607044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.368802071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368818045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368872881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.368880987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368916988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.368917942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368938923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.368946075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.368978024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.369014978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.369263887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.369281054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.369338989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.369345903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.369374990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.369398117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.369564056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.369580030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.369625092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.369640112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.369647026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.369682074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.369704962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.369815111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.369832039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.369888067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.369895935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.369923115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.369936943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.370031118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.370047092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.370102882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.370110989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.370141983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.370156050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.370651960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.370671034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.370712042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.370744944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.370753050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.370781898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.370805979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.370920897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.370939016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.370995998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.371002913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.371030092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.371058941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.371193886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.371212006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.371268034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.371275902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.371304035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.371328115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.371516943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.371534109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.371593952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.371602058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.371623039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.371650934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.371818066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.371836901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.371918917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.371927023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.371973991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.371982098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.371984005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372005939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372054100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372106075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372119904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372131109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372136116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372143030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372163057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372173071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372183084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372206926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372267962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372391939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372411013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372473955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372483969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372500896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372529030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372689009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372709036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372769117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372777939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372809887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372828007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372836113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372854948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372910976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372920036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372937918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372952938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372962952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372976065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.372982979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.372996092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373013020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373049974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373059988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373075962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373121023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373143911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373157024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373183012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373189926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373223066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373229027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373246908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373260975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373296022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373308897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373493910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373513937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373601913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373611927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373626947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373703003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373720884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373785973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373796940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373833895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373847961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373858929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373867035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373905897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373925924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373939037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.373975992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.373990059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.374011040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.374027967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.374089956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.374099016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.374123096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.374150991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.374403954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.374422073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.374491930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.374500990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.374536991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.374552965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.374675035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.374691010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.374767065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.374778032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.374809027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.374825001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.374861002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.374877930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.374936104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.374946117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.374974966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.374993086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.374999046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375010014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375050068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375067949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.375081062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375133038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.375283957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375299931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375375032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.375385046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375437021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.375550032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375566959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375633955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.375647068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375658035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.375680923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.375715971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.375732899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375751972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375807047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.375817060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375849009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.375865936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.375873089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375889063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375942945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.375952959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.375986099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.376002073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.376333952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.376352072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.376441956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.376451969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.376485109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.376501083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.376605034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.376626015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.376682043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.376691103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.376722097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.376739025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.376769066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.376786947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.376838923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.376848936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.376857996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.376880884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.376893997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.376903057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.376946926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.376956940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.376986980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.376996040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.377010107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.377022028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.377052069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.377440929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.377504110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.377523899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.377535105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.377576113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.377589941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.377636909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.377686977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.377707005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.377718925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.377737999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.377764940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.377780914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.377835035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.377855062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.377856016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.377866030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.377891064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.377923012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.377928019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.377938032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.377947092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.377984047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.378000021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.378083944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378102064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378151894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378166914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.378177881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378201008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.378211021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378231049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.378238916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378269911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.378304958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.378314972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378443956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378490925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378509045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378519058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.378529072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378544092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.378580093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.378757000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378773928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378844976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.378855944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378868103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.378921032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378937006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.378993034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.379003048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.379040003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.379069090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.379326105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.379343987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.379420042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.379430056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.379466057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.379478931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.379637957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.379657030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.379714966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.379725933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.379756927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.379774094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.379842997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.379862070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.379920959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.379930973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.379957914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.379973888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.379997969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380047083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380072117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.380084038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380114079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.380129099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.380341053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380357981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380404949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380455017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.380465984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380546093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.380552053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.380609989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380626917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380695105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.380705118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380738020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.380778074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.380812883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380831003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380892992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.380903959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380934954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.380975008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.380991936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.381046057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.381057024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.381077051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.381113052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.381318092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.381377935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.381398916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.381411076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.381443977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.381462097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.381834030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.381853104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.381926060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.381936073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.381956100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.381985903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.382129908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382147074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382224083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.382235050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382266998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.382419109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382435083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382493973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.382503033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382541895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.382570982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.382671118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382688046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382744074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382747889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.382757902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382787943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.382818937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.382827044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382842064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382863998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382910013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382915020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.382925034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.382937908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.382977009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.383071899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383125067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383146048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.383157015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383169889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.383194923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383263111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.383274078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383477926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383527040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383552074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.383563995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383579969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.383594990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.383605957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383621931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383622885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.383632898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383667946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.383708000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.383764029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383783102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383827925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383842945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.383846998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383857012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.383877039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.383903980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.383917093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.384016037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384031057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384078979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384090900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.384102106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384141922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.384171963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.384208918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384259939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384284973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.384299040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384313107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.384495974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384511948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384552002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384627104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.384639025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384752989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384769917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384833097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.384835958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384848118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384871960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.384881020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384903908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.384913921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.384947062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.384974003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.385006905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.385025024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.385072947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.385117054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.385129929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.385143042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.386971951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.391608000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.395659924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.452913046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.453051090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.453073978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.453099012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.453180075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.453193903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.453216076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.453290939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.453304052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.453387022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.453466892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.453474998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.453499079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.454025030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.454108953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.454116106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.454130888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.454390049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.454446077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.454457998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.454474926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.455221891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.455259085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.455312967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.455324888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.455373049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.455405951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.456032038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.456094980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.456127882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.456141949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.456177950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.456193924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.456542015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.456613064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.456638098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.456653118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.456669092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.456898928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.456973076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.456984043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.457236052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.457288980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.457331896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.457345963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.457371950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.457408905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.457520008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.457596064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.458486080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.458520889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.458606005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.458616972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.458632946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.458704948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.458795071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.458877087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.458888054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.459512949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.459547997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.459635019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.459647894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.459692001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.459709883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.459944010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.459981918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.460061073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.460073948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.460112095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.460258007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.460702896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.460740089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.460815907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.460928917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.460935116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.460952044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.461057901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.461059093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.461078882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.461237907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.519444942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.519572973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.519594908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.520072937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.520113945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.520190954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.520196915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.520217896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.520268917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.520332098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.520730019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.520768881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.520844936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.520860910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.520896912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.520925045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.520948887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521024942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521029949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.521056890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521145105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.521189928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521260023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.521342993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521378040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521441936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.521454096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521469116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.521476030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521516085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521552086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.521564960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521579027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.521620035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.521636963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521708012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.521743059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521779060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521823883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.521836042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.521852016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.521991014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.522115946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.522178888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.522291899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.522304058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.522319078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.522412062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.542700052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.542762995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.542843103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.542865992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.542886972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.542907953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.542979002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.542993069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.543440104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.543530941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.543569088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.543622971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.543636084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.543684959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.543704033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.544049025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.544137001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.544146061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.544173002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.544198990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.544229984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.544264078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.544279099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.544301033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.544323921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.544344902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.544435024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.544500113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.544517994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.544538975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.544553995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.544594049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.545352936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.545388937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.545418978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.545459032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.545506001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.545519114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.545561075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.545577049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.545974970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.546014071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.546078920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.546092033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.546116114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.546139002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.546143055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.546164036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.546195030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.546221972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.546233892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.546269894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.546283007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.546287060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.546304941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.546336889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.546359062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.546372890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.546387911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.546433926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.546511889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.621469975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.621511936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.621625900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.621653080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.621665955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.622103930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622134924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622217894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.622227907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622483969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622577906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.622586966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622617006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622653008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622719049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.622726917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622754097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.622760057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622787952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.622792959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622807980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622828007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.622879982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622908115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622921944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.622931957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622942924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.622977972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.622997999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623003006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623025894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623049021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623064995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623142958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623152018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623177052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623238087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623246908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623281002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623298883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623306036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623359919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623395920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623400927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623424053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623445034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623451948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623486996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623509884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623522043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623528957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623565912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623580933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623589039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623614073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623631954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623635054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623647928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623692036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623698950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623723030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623752117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623805046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623815060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623821974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623845100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623846054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623863935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623871088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623898983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623933077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.623940945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.623955011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624003887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624010086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.624027014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624073982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624095917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.624104977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624154091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.624197006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624232054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624243975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.624253988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624265909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.624310017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.624325037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624342918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624380112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624401093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.624411106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624443054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624464989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.624473095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624502897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.624516010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.624852896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624892950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.624947071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.624955893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.625003099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.625019073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.625025988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.625202894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.625356913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.625464916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.625468016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.625483990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.625539064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.625608921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.625685930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.625694990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.625713110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.625749111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.625792980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.625801086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.625829935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.625864029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.625870943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.625930071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.626003027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.626013041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.627638102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.649328947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.649378061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.649487019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.649506092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.649539948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.649574995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.649588108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.649602890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.649640083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.649681091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.649689913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.649724960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.649765015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.650002003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.650094032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.650379896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.650485992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.650536060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.650605917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.650621891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.650636911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.650657892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.650691032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.650736094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.650749922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.650783062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.650820017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.652117968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.652157068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.652261972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.652275085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.652312994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.652333975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.652667046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.652729988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.652762890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.652775049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.652796984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.652801037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.652837038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.652873039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.652885914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.652918100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.652945995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.652950048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.652971029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653014898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653022051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653053045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653063059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653079987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653105021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653115988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653126001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653177023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653209925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653214931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653230906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653264999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653285980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653296947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653346062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653357029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653400898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653481007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653492928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653543949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653577089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653620005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653630972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653645039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653682947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653687000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653702974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653734922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653758049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653770924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653834105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653868914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.653951883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.653964043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654035091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654069901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654112101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.654124975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654139996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.654181957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.654221058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654258966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654306889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.654319048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654335022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.654391050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654426098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654469967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.654481888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654498100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.654537916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654540062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.654558897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654616117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.654629946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654676914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654746056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.654757023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654777050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654825926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654850006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.654864073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654885054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.654901981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654921055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.654934883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.654975891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655011892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655028105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655066967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655108929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655122042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655136108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655155897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655215025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655225992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655256033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655333996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655347109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655375957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655452967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655464888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655512094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655564070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655587912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655601025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655617952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655631065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655656099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655668974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655688047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655725002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655741930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655766010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655838013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655873060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655929089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655951977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.655966043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655986071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.655988932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.656047106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.656060934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656137943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656202078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.656213999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656243086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656286001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656322002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.656335115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656382084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656383991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.656414032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.656425953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656470060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.656486034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656496048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.656505108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656563997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.656577110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656609058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656682014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.656692028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656711102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656774998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.656788111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656815052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656883955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.656897068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656919003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656966925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.656994104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657008886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657023907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657040119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657058954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657072067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657088041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657130957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657145977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657202005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657243967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657255888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657269001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657313108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657361031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657370090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657392025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657416105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657423019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657464981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657479048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657495975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657546043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657577038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657588005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657601118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657613039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657648087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657685041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657696962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657715082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657757044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657773018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657830000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657852888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657865047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657881975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657915115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657919884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.657938004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657973051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.657993078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658006907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658045053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658066034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658082008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658154964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658171892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658226967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658252954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658266068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658297062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658329010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658343077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658354998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658402920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658454895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658484936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658499956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658521891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658529043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658560991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658574104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658591032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658631086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658646107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658725977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658787966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658824921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658869982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658880949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658906937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658916950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658934116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.658942938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658962965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.658998013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.659039021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.659050941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.659183025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.659260988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.659275055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.659296036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.659348011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.659375906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.659389019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.659470081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.659491062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.659567118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.659661055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.659720898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.659744978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.659759998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.659782887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.659853935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.659864902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.659888983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.659899950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.659950972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.659970045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.659979105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660000086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660037994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660084963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660098076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660118103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660139084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660156012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660167933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660235882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660253048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660316944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660341978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660352945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660379887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660384893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660423040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660470963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660485029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660501003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660526037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660563946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660608053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660623074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660644054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660665035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660681963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660693884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660739899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660774946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660788059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660808086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660851002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660867929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.660883904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660907984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660944939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.660991907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661005974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661020041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661051989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661058903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661072016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661119938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661132097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661149979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661185026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661230087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661242008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661259890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661286116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661300898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661313057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661367893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661396027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661397934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661415100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661468029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661498070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661509037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661529064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661600113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661613941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661633968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661684990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661711931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661725998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661746979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661756992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661799908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661812067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.661871910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.661983013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662002087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662039042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662089109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662101984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662116051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662139893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662154913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662168026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662214994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662249088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662271023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662352085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662363052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662405968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662441969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662486076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662498951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662522078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662554026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662564993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662585020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662616968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662642956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662655115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662687063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662703037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662740946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662776947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662821054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662832975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662856102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662883043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662899971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662935972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.662980080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.662991047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663022995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663039923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663058996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663094044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663144112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663156033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663171053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663212061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663218975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663243055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663279057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663295031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663317919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663326025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663366079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663372040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663398027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663408995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663429022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663459063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663500071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663516998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663619041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663692951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663706064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663736105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663785934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663806915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663820982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663836956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663844109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663876057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663881063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663899899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.663909912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663949013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663958073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.663981915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664036989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.664086103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664150953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.664180040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664249897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664274931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664283991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.664293051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664304972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.664328098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664336920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.664344072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664359093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.664366961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664395094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664402962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.664448023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664454937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.664462090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664499044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664515972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664518118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.664529085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664576054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.664578915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664596081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664630890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664650917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.664660931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.664697886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.664722919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.665075064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.679599047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.679725885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.679754972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.679796934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.679822922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.679847956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.679945946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680006981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680023909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.680038929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680145025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680214882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.680229902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680257082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680306911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680325985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.680339098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680360079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680366039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.680391073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680402040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.680413961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680459023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680461884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.680485964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680507898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.680524111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.680537939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.680542946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.680579901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.707870007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.708030939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.708036900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.708081961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.708116055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.708178043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.708998919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.709038973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.709094048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.709108114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.709145069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.709161043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.709176064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.709184885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.709258080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.710814953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.710947990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.710962057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.711042881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.712352991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.712425947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.712477922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.712491035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.712505102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.713061094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.713083982 CEST	54146	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:59.713145971 CEST	443	54146	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:59.713505983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.713609934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.713660955 CEST	54146	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:59.713666916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.713680983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.713709116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.713725090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.713747978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.713757992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.713788986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.713802099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.713820934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.713890076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.713907003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.713921070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.713948965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.713977098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.713989973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.714021921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.714039087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.714050055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.714060068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.714112997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.714303017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.714384079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.714396000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.715111971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.715209961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.715221882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.715452909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.716438055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.716474056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.716542959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.716552019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.716571093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.716599941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.716613054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.716623068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.716644049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.716665983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.716684103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.716694117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.716741085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.716748953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.716770887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.716780901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.716820002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.716864109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.716893911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.717000961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.717065096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.717082024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.717096090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.717156887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.717375994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.717479944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.717959881 CEST	54146	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:49:59.717995882 CEST	443	54146	34.195.48.210	192.168.2.3
Jun 1, 2022 22:49:59.719029903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.719069004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.719146967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.719160080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.719177961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.719201088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.719238997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.720505953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.720594883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.727664948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.727799892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.727858067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.727931023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.727957010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.727973938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.727996111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728063107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728080988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728105068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728112936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728167057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728219032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728243113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728257895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728262901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728266001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728308916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728326082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728343010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728405952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728461027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728487968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728506088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728524923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728533030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728570938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728573084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728593111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728611946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728658915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728678942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728714943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728765965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728780031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728799105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728812933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728874922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.728888988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728908062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728949070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.728990078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.729005098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.729023933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.729044914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.729069948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.729082108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.729125977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.729129076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.729139090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.729152918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.729212046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.729581118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.729665041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.729700089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.729716063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.729738951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.729796886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.730226040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.730321884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.730335951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.730555058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.730644941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.730659962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.731148005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.731206894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.731250048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.731252909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.731277943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.731295109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.731339931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.732084990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.732162952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.732208014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.732229948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.732245922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.732323885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.732409000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.732422113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.733217955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.733293056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.733340025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.733355999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.733376980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.733385086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.733423948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.733448982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.733480930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.733508110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.733618021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.733727932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.733735085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.733756065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.733813047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.733827114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.733860970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.733872890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.733905077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.735263109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.736279011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.736310005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.736371994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.736387968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.736403942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.736435890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.736488104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.737287045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.737318039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.737420082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.737437010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.737495899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.737510920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.737870932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.737974882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.738323927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.738396883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.738457918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.738482952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.738497019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.739058971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.739398956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.739428043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.739500999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.739522934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.739538908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.739571095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.739609957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.739653111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.741255045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.741350889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.741401911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.741417885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.741470098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.741491079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.742238045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.742326021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.742361069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.742377043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.742402077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.742415905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.742489100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.743494987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.743525028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.743621111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.743650913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.743669033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.743872881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.744482040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.744510889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.744566917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.744640112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.744652033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.744801998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.745584011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.745616913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.745691061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.745693922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.745709896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.745738983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.745744944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.745769024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.745781898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.745810032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.745810986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.745872974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.745887041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.745913029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.745945930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.745992899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.746025085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.746040106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.746087074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.748591900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.748667002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.748714924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.748718977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.748742104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.748752117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.748792887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.748810053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.748825073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.748888016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.749473095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.749536037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.749583006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.749603033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.749636889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.749659061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.749669075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.749680042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.749696970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.749727011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.750313044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.750418901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.750528097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.750575066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.750622988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.750646114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.750659943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.751436949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.751487970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.751534939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.751552105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.751557112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.751576900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.751619101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.751631021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.751646996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.751667976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.751698971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.751712084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.751727104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.751761913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.751776934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.751811028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.751879930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.751924992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.752012968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.752027988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.752072096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.752151012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.752163887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.752298117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.752391100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.752460957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.752485037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.752501011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.752521992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.752545118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.753499985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.753597021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.753607035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.753628969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.753662109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.753698111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.753721952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.753736019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.753745079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.753792048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.753824949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.753832102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.753839970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.753854036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.753896952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.753914118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.753948927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.754023075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.754394054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.754431963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.754493952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.754508972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.754530907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.754534006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.754579067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.755655050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.755707026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.755748987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.755757093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.755776882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.755798101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.755810976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.755835056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.755845070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.755903959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.755918980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.755961895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756026030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756041050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756069899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756114960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756149054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756165028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756186962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756196022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756216049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756232977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756254911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756309032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756314039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756336927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756364107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756386995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756405115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756413937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756462097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756469011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756490946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756505013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756531954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756567001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756582022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756603003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756660938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756678104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756710052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756787062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756803036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756824970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756917000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.756932020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.756968021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757035971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757050991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757076025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757117987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757148981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757164001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757184982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757195950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757230043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757252932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757268906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757317066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757334948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757384062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757412910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757427931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757460117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757462025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757508993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757539034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757561922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757575989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757600069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757666111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757680893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757710934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757745981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757786036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757805109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757823944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757864952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.757903099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.757977962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.758044958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758081913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758122921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.758141041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758158922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.758167028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758229017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.758244038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758302927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758385897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.758399963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758461952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758501053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758543015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.758562088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758579969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.758619070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.758644104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758683920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758724928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.758740902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758761883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.758838892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758874893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758915901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.758934975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.758951902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759038925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759074926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759114981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759133101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759169102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759171009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759193897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759205103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759227991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759228945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759258986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759273052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759298086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759329081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759341002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759419918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759454012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759502888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759531975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759548903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759556055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759623051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759639025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759659052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759701967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759736061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759740114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759762049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759785891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759831905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759848118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759895086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759972095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.759973049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.759991884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760041952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760052919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760070086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760118961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760135889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760144949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760174036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760241985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760258913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760283947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760315895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760360956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760375977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760397911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760397911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760435104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760449886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760469913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760490894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760510921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760521889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760549068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760565042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760591984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760613918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760627985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760634899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760689020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760710001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760727882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760746956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760776043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760839939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760844946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760859966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760896921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760924101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.760936975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760957956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.760998964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761022091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761037111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761044025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761087894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761092901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761111021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761173010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761179924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761188030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761204004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761231899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761262894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761277914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761296988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761326075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761343956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761379004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761430979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761445045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761476040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761495113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761504889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761524916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761552095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761599064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761615992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761636972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761643887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761672020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761693001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761709929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761715889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761729002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761740923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761758089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761771917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761794090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761822939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761833906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761852980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761919975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.761934042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761954069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.761996984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762025118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762027025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762039900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762063980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762096882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762116909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762165070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762191057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762195110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762209892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762233019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762259960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762273073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762298107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762315035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762367010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762368917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762387037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762422085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762465954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762468100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762485027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762509108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762551069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762551069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762573957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762598991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762630939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762656927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762671947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762677908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762738943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762753010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762773037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762809992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762856007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762881994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762897015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762902975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762967110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.762973070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.762989044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763039112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763044119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.763057947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763109922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.763123989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.763124943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763128996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.763144970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763166904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763195992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.763231993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763232946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.763251066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763277054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763314009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.763336897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763350964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.763397932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763449907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763483047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.763506889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763520002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.763917923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763963938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.763997078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.764023066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.764040947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.764050961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.764056921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.764081001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.764081955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.764097929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.764146090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.764178038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.765192032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.765263081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.765422106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.765450954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.765496969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.765507936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.765530109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.765615940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.765633106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.766232014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.766319990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.767127991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.767182112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.767220020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.767246008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.767262936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.768063068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.768090963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.768151999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.768173933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.768193007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.768218994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.769331932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.769361973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.769422054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.769442081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.769469976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.769526005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.770245075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.770268917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.770344019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.770369053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.770384073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.770464897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.771121025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.771168947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.771205902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.771234989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.771254063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.771305084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.772177935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.772201061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.772291899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.772310019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.772330999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.772774935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.773099899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.773123026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.773195028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.773209095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.773248911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.773309946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.773322105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.773376942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.773458958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.773468971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.773518085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.773580074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.773598909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.773617029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.773633003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.773663998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.774385929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.774437904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.774497986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.774517059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.774538040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.774558067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.775346041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.775369883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.775435925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.775470018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.775485039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.775520086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.776071072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.776635885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.776659012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.776706934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.776726007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.776737928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.776781082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.776812077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.777447939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.777501106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.777544975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.777559042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.777574062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.777671099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.777714968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.777733088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.777740955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.777757883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.777786016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.778655052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.778678894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.778753996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.778770924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.778839111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.778841972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.779314041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.779408932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.779416084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.779429913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.779476881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.779550076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.779606104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.780133009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.780190945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.780217886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.780229092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.780265093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.780287027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.780875921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.780900955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.780937910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.780973911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.780985117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.781018972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.781039000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.781860113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.781900883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.781948090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.781950951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.781971931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.782027006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.782623053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.782676935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.782815933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.782829046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.783143997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.783224106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.783226967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.783257961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.783288956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.783323050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.783329964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.783963919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.784043074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.784055948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.784183979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.784233093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.784264088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.784276009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.784307957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.784338951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.785187006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.785214901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.785295963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.785305977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.785320997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.785370111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.785980940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.786062002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.786518097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.786597013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.786628008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.786642075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.786662102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.786683083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.786710024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.786715984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.786730051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.786767006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.786773920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.786787033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.786796093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.786829948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.786859035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.786864042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.787075043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.787262917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.787324905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.787414074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.787472010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.787487030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.787496090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.787516117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.787542105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.788177967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.788227081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.788266897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.788276911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.788294077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.788326025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.788333893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.788348913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.788350105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.788373947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.788379908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.788393974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.788412094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.788463116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.788469076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.789248943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.789307117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.789340973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.789352894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.789370060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.789752960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.789793968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.789839029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.789854050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.789871931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.789906025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.790632963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.790735006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.790746927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.791327000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.791420937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.791482925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.791505098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.791513920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.791548014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.791572094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.791696072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.791757107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.791785002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.791795015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.791826963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.791846037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.793004990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.793029070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.793071985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.793143988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.793155909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.793184996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.793210030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.793864012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.793924093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.793942928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.793951988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.793962002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.794008970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.794039011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.794043064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.794384956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.794713974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.794766903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.794799089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.794807911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.794845104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.794867992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.794872999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.794888020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.794938087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.794953108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.794961929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.794992924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.795006037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.795721054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.795758009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.795814991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.795825005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.795877934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.796108961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.796155930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.796173096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.796181917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.796202898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.796205044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.796227932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.796233892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.796262026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.796297073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.797061920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.797115088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.797149897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.797159910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.797202110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.797261953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.797333002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.797339916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.797996998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.798151016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.798176050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.798229933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.798238993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.798290014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.798947096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.799031019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.799487114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.799514055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.799586058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.799597025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.799635887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.800502062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.800530910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.800579071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.800606966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.800620079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.800663948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.800707102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.801510096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.801537037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.801611900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.801623106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.802663088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.802692890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.802762032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.802772045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.802787066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.802814960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.802860022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.803725958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.803751945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.803847075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.803864956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.804610968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.804636002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.804708004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.804723978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.804750919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.804780960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.805461884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.805531979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.805556059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.805574894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.805608988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.805629969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.806081057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.806147099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.806185007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.806197882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.806215048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.806219101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.806252956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.806261063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.806281090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.806305885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.806313992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.806322098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.806381941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.806390047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.806405067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.806476116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.806998968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.807075977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.807121992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.807188034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.807193995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.807204008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.807246923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.807270050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.807933092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.807991982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.808024883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.808037996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.808060884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.808085918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.808934927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.808963060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.809037924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.809048891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.809163094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.809319973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.809346914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.809407949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.809421062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.809431076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.809514046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.810189009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.810254097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.810262918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.810275078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.810313940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.810323000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.810331106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.810367107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.810374975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.810383081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.810446024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.811165094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.811235905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.811261892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.811274052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.811316013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.812051058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.812107086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.812135935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.812148094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.812164068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.812201977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.812699080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.812762022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.812779903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.812803984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.812815905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.812865019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.813524961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.813625097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.813637018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.813777924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.814435005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.814461946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.814522982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.814533949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.814548969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.814583063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.814611912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.815362930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.815390110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.815428019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.815536022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.815551996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.815582037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.815601110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.815915108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.815968990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.815992117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.816000938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.816035986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.816051960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.816833019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.816890001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.816926003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.816939116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.816956043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.816972017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.816992044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.816997051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.817028046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.817056894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.817814112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.817840099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.817905903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.817918062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.817931890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.817960978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.817980051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.818595886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.818656921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.818691969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.818703890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.818731070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.818749905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.819003105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.819067001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.819112062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.819192886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.819201946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.820139885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.820236921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.820233107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.820255995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.820317984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.820915937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.820946932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.821053028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.821053028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.821068048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.821098089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.821134090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.821142912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.821243048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.821810007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.821898937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.822350979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.822381020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.822467089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.822479010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.822499037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.822534084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.823272943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.823301077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.823381901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.823398113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.823465109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.824112892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.824142933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.824209929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.824222088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.824245930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.824266911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.824999094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.825026035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.825090885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.825104952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.825133085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.825155973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.825539112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.825566053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.825625896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.825639963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.825670958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.825690031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.826407909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.826518059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.826530933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.826586008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.826662064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.826674938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.827455997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.827482939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.827560902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.827574968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.827588081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.827611923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.828268051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.828296900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.828380108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.828392982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.828422070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.828459978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.828788042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.828816891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.828875065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.828885078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.828924894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.828944921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.829674006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.829703093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.829765081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.829775095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.829824924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.830421925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.830523968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.830534935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.831214905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.831290960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.831317902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.831382036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.831392050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.831417084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.831451893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.831926107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.831954002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.832015991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.832027912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.832061052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.832078934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.832726955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.832753897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.832830906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.832840919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.833666086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.833690882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.833764076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.833776951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.833808899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.833838940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.834511042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.834539890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.834588051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.834624052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.834640980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.834666967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.834677935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.834691048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.834709883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.835170984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.835196972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.835266113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.835277081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.835313082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.835331917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.836042881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.836069107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.836152077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.836164951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.836957932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.836983919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.837054968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.837066889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.837086916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.837120056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.837919950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.837948084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.838038921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.838054895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.838156939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.838339090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.838469028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.838538885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.838547945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.838551998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.839255095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.839282036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.839350939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.839395046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.839407921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.839411974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.839745998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.840126991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.840208054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.840260029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.840275049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.840280056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.840284109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.841353893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.841386080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.841531992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.841547966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.841551065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.841595888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.841624022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.841711998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.841723919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.841727018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.842479944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.842515945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.842597961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.842611074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.842622995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.842638016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.842669010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.843238115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.843318939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.843375921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.843391895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.843405008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.843408108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.843513012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.844086885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.844099045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.844712019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.844741106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.844810963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.844856024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.844871044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.844901085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.844904900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.844937086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.844943047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.845499992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.845643997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.845679998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.845740080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.845791101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.845803022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.846508026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.846575022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.846684933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.846694946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.846836090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.847465992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.847630978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.847640038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.847671986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.847729921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.847754002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.847764015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.847830057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.847845078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.848470926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.848510981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.848618031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.848629951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.848634005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.848644972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.848707914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.848752022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.848762035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.848764896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.849419117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.849455118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.849529982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.849539995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.849571943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.849592924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.850121021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.850162983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.850256920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.850275993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.850287914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.850291967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.850414991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.850481987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.850509882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.850518942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.850560904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.850986958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.850997925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.851275921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.851316929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.851399899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.851413965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.851417065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.852051973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.852092981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.852102995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.852118015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.852124929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.852173090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.852175951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.852708101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.852747917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.852819920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.852829933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.852911949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.852967024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.853004932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.853046894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.853056908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.853106022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.853108883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.853564978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.853677034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.853846073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.853909969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.853938103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.853950977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.853990078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.854614019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.854773045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.854788065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.854872942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.855288029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.855415106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.855424881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.855448961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.855499983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.855532885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.855541945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.855545998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.855552912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.855587959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.855726004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.856131077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.856266022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.856288910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.856302023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.856373072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.857196093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.857249022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.857299089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.857307911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.857779980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.857845068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.857889891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.857902050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.857916117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.857919931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.857985973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.857992887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.857996941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.858697891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.858737946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.858815908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.858830929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.858834028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.858870983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.858908892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.858947992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.858956099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.859002113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.859529018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.859669924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.859709024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.859801054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.859812021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.859814882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.860390902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.860426903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.860498905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.860512018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.860515118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.861213923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.861248016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.861329079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.861346960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.861351013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.861377954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.861411095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.861515999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.861526012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.861572981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.861576080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.862256050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.862296104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.862392902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.862406969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.862411022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.862926960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.862998962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.863043070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.863053083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.863056898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.863095045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.863558054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.863748074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.863782883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.863842964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.863852978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.863929987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.863995075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.864003897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.864018917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.864023924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.864052057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.864069939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.864734888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.864770889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.864831924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.864841938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.864893913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.864897013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.865438938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.865473986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.865539074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.865549088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.865583897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.865602970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.866334915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.866370916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.866491079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.866503000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.866507053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.866565943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.866610050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.866648912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.866713047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.866727114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.866898060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.867376089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.867446899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.867526054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.867538929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.867542982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.868006945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.868042946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.868118048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.868155956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.868169069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.868171930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.868194103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.868668079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.868854046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.868892908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.868983984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.868995905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.869133949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.869194031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.869265079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.869277000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.869280100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.869851112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.869925976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.869952917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.869967937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.870037079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.870042086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.870488882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.870522976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.870600939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.870614052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.870618105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.871351004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.871412992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.871479988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.871490955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.871550083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.871553898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.871587038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.871646881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.871711016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.871723890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.871727943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.872174025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.872287989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.872315884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.872383118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.872392893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.872451067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.872967005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.872973919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.872992039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.873035908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.873078108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.873089075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.873106956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.873809099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.873840094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.873889923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.873902082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.873905897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.873929977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.874118090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.874123096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.874155998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.874212980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.874279022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.874289036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.874290943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.874752998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.874779940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.874780893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.874797106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.874845028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.874852896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.874892950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.875370979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.875400066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.875489950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.875503063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.875508070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.875582933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.875648022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.875679016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.875689030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.875724077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.875740051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.876396894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.876425982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.876527071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.876542091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.877172947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.877233982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.877279997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.877291918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.877310991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.877362013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.877619982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.877650023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.877736092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.877747059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.877751112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.877908945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.877938986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.877991915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.878000975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.878070116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.878072977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.878737926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.878772974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.878889084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.878901958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.878905058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.879518032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.879547119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.879880905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.879895926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.880008936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.880036116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.880147934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.880160093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.880162954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.880420923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.880449057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.880496025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.880513906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.880517960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.880582094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.880584002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.880996943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.881023884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.881129026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.881140947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.881907940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.881936073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.882045031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.882059097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.882062912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.882364035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.882390976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.882494926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.882505894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.882509947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.882561922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.882622957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.882652998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.882663012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.882714987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.883105993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.883213043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.883275032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.883291006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.883294106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.884063005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.884088993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.884161949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.884171963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.884202957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.884222984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.884406090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.884442091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.884535074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.884543896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.884547949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.884737968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.884793997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.884829998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.884838104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.885318041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.885459900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.885484934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.885555983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.885569096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.885572910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.886415958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.886441946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.886528015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.886540890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.886544943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.886653900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.886682034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.886719942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.886728048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.886732101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.886776924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.886850119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.886920929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.886929989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.886945009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.887207031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.887648106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.887675047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.887753010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.887768030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.887772083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.888345003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.889115095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889163971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889249086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889259100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.889271975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889334917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.889353037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.889358044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889441013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889504910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889535904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889554024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.889560938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889575958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.889584064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889611006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.889617920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889672995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.889676094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.889692068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889816046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889851093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889889956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.889899015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.889900923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.889915943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.890662909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.890701056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.890767097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.890780926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.890784025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.890825033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.890882015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.890914917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.890954018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.890960932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.890964031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.891011953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.891022921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.891026020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.891038895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.891382933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.891791105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.891828060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.891891956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.891901970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.891928911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.892713070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.892760992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.892807007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.892817020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.892819881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.892885923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.892889977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.892914057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.892952919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.893017054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.893024921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.893027067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.893062115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.893122911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.893191099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.893201113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.893203020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.893991947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.894027948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.894092083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.894104004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.894135952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.894211054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.894750118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.894785881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.894876003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.894887924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.894891977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.894929886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.894988060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.895020008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.895029068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.895071030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.895181894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.895216942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.895293951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.895298958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.895308018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.895314932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.895560026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.895796061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.895836115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.895895004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.895903111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.895906925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.896619081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.896651030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.896701097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.896711111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.896713972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.896728039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.896783113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.896785975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.896790981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.896830082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.896888018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.896912098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.896936893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.896943092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.896945000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.896991014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.896995068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.897680044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.897743940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.897810936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.897825003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.897872925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.897876978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.897896051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.897907019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.897926092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.897965908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.897970915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.897984982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.897990942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.898040056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.898092985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.898099899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.898102045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.898649931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.898736000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.898742914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.898761034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.898803949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.898864031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.898874044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.898900986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.898911953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.898932934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.898977041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.898984909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.899003029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.899034023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.899039984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.899672985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.899766922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.899801970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.899812937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.899817944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.899826050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.899838924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.900276899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.900285006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.900595903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.900629997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.900716066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.900726080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.900728941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.900738955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.900795937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.900815964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.900820017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.900836945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.900878906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.900882959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.900890112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.900938988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.900947094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.900949955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.901556015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.901706934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.901771069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.901778936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.901806116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.901812077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.901822090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.901889086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.901896954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.901899099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.901952982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.902041912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.902048111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.902662992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.902761936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.902774096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.902792931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.902890921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.902901888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.903047085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.903139114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.903150082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.903173923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.903253078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.903331995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.903395891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.903531075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.903615952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.903660059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.903755903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.903841019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.903913975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.903925896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.903938055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.904282093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.904581070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.904612064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.904700041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.904711008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.904714108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.904736996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.904795885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.904870987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.904881001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.904882908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.905575991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.905608892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.905710936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.905725956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.905738115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.905777931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.905803919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.905858040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.905864954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.905868053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.905926943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.905931950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.906636953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.906663895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.906733990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.906769991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.906781912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.906790972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.906833887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.906842947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.906868935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.906874895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.906923056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.906925917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.907562017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.907618046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.907685041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.907712936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.907727957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.907731056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.907752037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.907768965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.907882929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.907888889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.908210993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.908411980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.908487082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.908510923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.908523083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.908566952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.908570051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.908612967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.908684015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.908751011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.908759117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.908768892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.908782005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.908844948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.908848047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.908893108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.909312963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.909398079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.909410000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.909421921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.909477949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.909485102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.909492016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.909600973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.909601927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.909615040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.909668922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.909719944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.909728050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.909730911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.910248041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.910275936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.910372019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.910384893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.910399914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.910410881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.910415888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.910446882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.910490990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.910497904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.910501003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.911189079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.911215067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.911283970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.911297083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.911346912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.911353111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.911355019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.911361933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.911415100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.911441088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.911448956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.911492109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.912050962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.912075996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.912162066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.912162066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.912167072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.912175894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.912219048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.912246943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.912256002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.912296057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.912316084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.912323952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.912357092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.912395000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.912395000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.912406921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.912467957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.912472010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.913140059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.913217068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.913284063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.913295984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.913300037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.913433075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.913455009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.913527012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.913536072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.913543940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.913594007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.913999081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.914220095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.914279938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.914303064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.914311886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.914314985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.914448977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.914984941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.915009975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.915075064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.915126085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.915127993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.915128946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.915141106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.915201902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.915736914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.915764093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.915788889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.915904045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.915910959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.915973902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.916024923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.916054964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.916060925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.916096926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.916100979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.916152954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.916661978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.916685104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.916742086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.916805029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.916807890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.916809082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.916819096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.916894913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.916903019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.917426109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.917476892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.917509079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.917541027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.917547941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.917550087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.917563915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.917709112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.917726994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.917804003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.917809963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.917814970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.918458939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.918478966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.918534994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.918580055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.918587923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.918590069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.918634892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.918692112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.918725967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.918732882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.918788910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.918792963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.919125080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.919372082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.919390917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.919446945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.919466019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.919471979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.919473886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.919523954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.919529915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.919562101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.919568062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.919621944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.919625044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.920161963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.920206070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.920262098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.920284033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.920296907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.920423031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.920443058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.920512915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.920521021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.920523882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.920965910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.920986891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.921057940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.921102047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.921109915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.921112061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.921185017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.921248913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.921255112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.921262026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.921264887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.921395063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.921844006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.921964884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.921971083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.922055960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.922096968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.922116995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.922122955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.922126055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.922168016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.922172070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.922746897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.922766924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.922863007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.922869921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.922908068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.922911882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.922916889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.922926903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.923003912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.923013926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.923616886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.923640966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.923734903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.923742056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.923808098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.923813105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.923837900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.923897982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.923907042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.923913002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.923958063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.923964977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.923986912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.924096107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.924376965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.924398899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.924587011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.924604893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.924640894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.924649000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.924700022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.924700975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.924701929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.924714088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.924762011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.924793005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.924804926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.925172091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.925302029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.925309896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.925431013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.925476074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.925487995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.925538063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.925546885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.925549984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.925928116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.925949097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.926011086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.926018000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.926074028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.926076889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.926188946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.926209927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.926280022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.926287889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.926804066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.926850080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.926898003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.926907063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.926983118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.926989079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.927114964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.927133083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.927253008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.927262068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.927651882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.927725077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.927743912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.927813053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.927822113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.927948952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.927990913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.928061008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.928071976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.928081989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.928086042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.928145885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.928267002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.928395033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.928492069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.928555965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.928711891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.928778887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.928788900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.928802013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.928884983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.929028988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.929105043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.929323912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.929475069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.929527044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.929549932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.929562092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.929574966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.929631948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.930061102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.930104017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.930113077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.930128098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.930133104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.930185080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.930197954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.930210114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.930218935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.930223942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.930330038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.930340052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.930702925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.930788040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.930795908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.930893898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.930938005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.930973053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.930984020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.930999994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.931051016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.931087017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.931096077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.931139946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.931157112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.931164980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.931170940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.931211948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.931260109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.931266069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.931710958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.931727886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.931957006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.932046890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.932055950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.932101965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.932153940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.932279110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.932378054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.932387114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.932409048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.932461023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.932504892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.932511091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.932513952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.932626963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.932682037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.932742119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.932750940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.932753086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.932780027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.932828903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.932864904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.932878971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.933192015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.933415890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.933434010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.933485031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.933542013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.933551073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.933554888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.933953047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.933973074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.934063911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.934072971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.934076071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.934166908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.934185028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.934238911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.934250116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.934762955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.934782028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.934823036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.934847116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.934854031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.934967041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.934983969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.935025930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.935031891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.935038090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.935092926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.935096979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.935220003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.935405016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.935446978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.935507059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.935517073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.935569048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.935574055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.935581923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.935630083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.935648918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.935683966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.935691118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.935693026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.935715914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.935761929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.936285973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.936302900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.936393023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.936403990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.936482906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.936532974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.936568975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.936580896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.936584949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.936618090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.936779022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.937011957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.937083960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.937094927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.937107086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.937216997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.937283039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.937288046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.937290907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.937302113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.937361002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.937387943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.937848091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.937932014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.937963009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.937973976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.937994957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.938318968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.938335896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.938374043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.938412905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.938422918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.938500881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.938507080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.938560963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.938653946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.938667059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.938682079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.938709021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.938766956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.938811064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.938822985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.938827991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.938889980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.939444065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.939461946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.939537048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.939548016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.939764977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.939783096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.939878941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.939888954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.940169096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.940186024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.940268040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.940279961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.940314054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.940404892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.940421104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.940471888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.940486908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.940506935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.940972090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.940990925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.941116095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.941132069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.941390991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.941409111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.941513062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.941524029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.941602945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.941648960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.941708088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.941721916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.941726923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.941823006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.941865921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.941920042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.941931963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.941956997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.941962004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.941987038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.942012072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.942416906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.942593098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.942656040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.942668915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.942692041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.942702055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.942778111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.942815065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.942888021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.942902088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.943022966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.943083048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.943098068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.943101883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.943260908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.943321943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.943396091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.943406105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.943418026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.943499088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.944072008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.944092035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.944180965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.944192886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.944372892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.944411993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.944430113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.944484949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.944549084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.944559097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.944569111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.944581032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.944684982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.944734097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.944742918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.944746017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.944865942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.944916964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.944962025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.944974899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.944988012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.945564032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.945607901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.945650101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.945677996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.945688963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.945693016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.945720911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.945877075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.945940971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.945951939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.945976019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.945985079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.946034908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.946042061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.946191072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.946208954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.946286917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.946300030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.946325064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.946408033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.946424961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.946715117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.946729898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.947027922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.947046041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.947171926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.947189093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.947194099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.947364092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.947427034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.947458029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.947472095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.947477102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.947506905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.947520971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.947644949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.947662115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.947738886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.947752953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.947757959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.947849035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.947866917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.947927952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.947942972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.947947979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.948484898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.948503017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.948605061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.948621988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.948944092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.948964119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.949052095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.949090004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.949107885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.949176073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.949234962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.949295998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.949312925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.949534893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.949549913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.949867964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.949897051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.949937105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.949938059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.949964046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.949970961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.949978113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.950032949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.950460911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.950479031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.950572014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.950584888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.950655937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.950716972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.950761080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.950776100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.950784922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.950870991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.950890064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.950958967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.950978994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.950984001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.951273918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.951333046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.951380014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.951400042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.951406002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.951726913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.951781988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.951852083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.951867104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.951872110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.951957941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.951975107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.952138901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.952155113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.952202082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.952218056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.952224016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.952240944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.952271938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.952689886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.952708006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.952785969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.952802896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.953104973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.953161001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.953200102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.953214884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.953219891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.953252077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.953300953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.953336000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.953353882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.953408957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.953444958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.953459978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.953500986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.953536987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.953553915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.953623056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.953639030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.953644991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.954144001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.954160929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.954235077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.954252958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.954257965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.954441071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.954457998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.954545975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.954560041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.954565048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.954634905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.954652071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.954722881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.954737902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.954762936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.954799891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.954902887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.954920053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.955012083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.955024958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.955048084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.955437899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.955455065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.955540895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.955555916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.955559969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.955811024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.955863953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.955914974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.955924034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.955952883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.955965042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.956012964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.956021070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.956068039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.956085920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.956154108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.956167936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.956190109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.956264019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.956281900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.956353903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.956372976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.956377983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.956386089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.956914902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.956931114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.957060099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.957077026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.957250118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.957268953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.957386017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.957431078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.957479000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.957504034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.957509995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.957516909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.957612991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.957650900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.957715034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.957732916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.957753897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.957848072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.957854986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.958213091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.958230972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.958323956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.958338976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.958601952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.958617926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.958669901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.958709002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.958722115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.958755016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.958889961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.958906889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.959002018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.959021091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.959027052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.959471941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.959491968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.959605932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.959619999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.959625006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.959842920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.959858894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.959940910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.959949970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.959965944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.959978104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.960043907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.960068941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.960086107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.960143089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.960176945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.960195065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.960200071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.960203886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.960207939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.960302114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.960325003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.960407972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.960431099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.960436106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.960867882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.960886002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.960968971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.960983038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.961173058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.961190939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.961272955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.961287975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.961293936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.961369038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.961390018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.961481094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.961494923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.961504936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.961524963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.961577892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.961597919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.961616993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.961699009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.962177992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.962194920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.962254047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.962349892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.962366104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.962372065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.962615013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.962632895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.962685108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.962754965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.962769985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.962781906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.962888002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.963097095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.963104010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.963116884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.963213921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.963604927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.963624954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.963752985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.963768959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.963794947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.963814974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.963851929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.963946104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.964036942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.964056015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.964139938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.964155912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.964165926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.964215994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.964248896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.964261055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.964272976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.964361906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.964373112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.964904070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.964921951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.965101004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.965143919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.965182066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.965199947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.965204954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.965212107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.965296984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.965320110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.965399027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.965414047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.965419054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.965475082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.965549946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.965564966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.965584993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.965655088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.965662956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.966106892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.966125011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.966247082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.966262102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.966306925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.966320992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.966475964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.966494083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.966613054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.966628075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.966672897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.966732979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.966783047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.966803074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.966808081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.966875076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.966934919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.966963053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.966983080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.967067003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.967076063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.967428923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.967447996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.967509985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.967519045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.967535019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.967541933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.967607021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.967740059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.967852116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.967912912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.967928886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.967945099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.967961073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.968008995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.968013048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.968034983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.968040943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.968069077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.968096972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.968097925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.968153000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.968167067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.968219042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.968221903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.968403101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.968416929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.968491077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.968508005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.968679905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.968696117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.968813896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.968883038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.968995094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.969012022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969017029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.969027042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969057083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969130039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.969149113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969153881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.969182968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969244957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969269037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969276905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.969294071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969305992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.969322920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969350100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969398022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.969405890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969407082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.969417095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969424009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.969441891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969532013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.969546080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969551086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.969708920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969867945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969871998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.969888926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969949961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.969990015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.969999075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.970007896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.970014095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.970113039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.970189095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.970256090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.970259905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.970280886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.970287085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.970334053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.970341921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.970482111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.970570087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.970642090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.970698118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.970727921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.970748901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.970756054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.970762968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.970798969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.970963955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971045017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.971052885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971086025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971134901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.971143961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.971210003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971268892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971323967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971332073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.971353054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971359968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.971402884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.971410036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.971472979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971565008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971570015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.971594095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971638918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971668005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.971679926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.971693039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971698046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.971739054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971821070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.971834898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971921921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.971972942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.972014904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.972031116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.972035885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.972170115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.972248077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.972260952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.972359896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.972417116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.972496986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.972512960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.972517967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.976380110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.988398075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.988436937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.988554001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.988578081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.988584995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.991128922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.992887974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.992909908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.993036985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.993052959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.993206024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.993259907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.993298054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.993314981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.993350029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.993670940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.993721008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.993818998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.993837118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.993854046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.994100094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.994313002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.994335890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.994483948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.994498968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.994708061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.994728088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.994774103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.994859934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.994874954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.994878054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.995138884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.995160103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.995203972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.995264053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.995280981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.995285034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.995492935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.995522022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.995738029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.995820999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.995835066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.995850086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.996109009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.996129036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.996174097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.996211052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.996241093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.996253967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.996259928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.996296883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.996392012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.996488094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.996501923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.996506929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.996735096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.996790886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.996871948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.996887922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.996901989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.997092009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.997212887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:49:59.997222900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.997248888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:49:59.998172998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.037987947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.038027048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.038142920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.038160086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.038187981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.038239956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.038242102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.038276911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.038342953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.038372040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.038413048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.038453102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.038463116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.038469076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.038532019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.038908958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.039015055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.039102077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.039237022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.039253950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.039259911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.039272070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.039349079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.039391041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.039463997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.039482117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.039489985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.039494991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.039498091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.039500952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.039552927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.040780067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.040810108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.040874958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.040987968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.041003942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.041008949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.041026115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.041095972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.041117907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.041158915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.041173935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.041177988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.041193008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.041245937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.041336060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.041343927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.043339014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.058795929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.058845043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.059035063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.059055090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.059062004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.059230089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.059292078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.059318066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.059329987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.059334040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.059387922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.059396029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.059400082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.059406996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.059433937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.059458971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.059508085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.059523106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.059587955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.059592009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.059593916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.059614897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.059640884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.059724092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.059734106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.059737921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.060045004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060079098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060167074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060197115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.060211897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060215950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.060297966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060311079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.060417891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060417891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.060434103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.060444117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060458899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.060503006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060539007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060619116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060626984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.060642004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060652971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.060694933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.060702085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.060722113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060807943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060856104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.060875893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.060889959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.061001062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.061197042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.061238050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.061367035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.061379910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.061391115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.061470032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.061536074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.061625004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.061640024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.061650038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.061728954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.061741114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.061755896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.061801910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.061837912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.061857939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.061870098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.061991930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062004089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062028885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062071085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062166929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062170982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062174082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062194109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062299967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062300920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062329054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062354088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062434912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062447071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062452078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062484980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062530041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062541962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062558889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062613964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062647104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062696934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062707901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062712908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062717915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062761068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062762976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062783003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062808037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062885046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062899113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062903881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.062920094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.062959909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063038111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063050985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063069105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063076973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063169003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063180923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063195944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063199997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063210964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063288927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063293934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063302040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063325882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063352108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063416958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063431025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063435078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063441038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063479900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063580990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063595057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063605070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063633919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063709021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063723087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063733101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063745022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063815117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063829899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063862085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063867092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063884974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.063937902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063947916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.063990116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064013004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064024925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064050913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064090967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064100027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064110041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064130068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064156055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064162016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064166069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064188957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064199924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064304113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064343929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064357042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064371109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064376116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064466953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064490080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064502954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064528942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064568996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064579010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064588070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064625025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064641953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064651012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064657927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064692974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064735889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064747095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064757109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064771891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064814091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064820051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064831972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064840078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064903021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064907074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064913988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.064927101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.064953089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065023899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.065037012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065041065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.065077066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065185070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065218925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065272093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.065293074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065298080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.065304041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.065440893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065457106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.065489054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065574884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.065574884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065597057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065643072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065649033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.065671921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.065742016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.065754890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065768957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.065778017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065860033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065860987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.065867901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.065907955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.065964937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.066024065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.066102028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.066255093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.066334009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.066440105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.066557884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.066658974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.066683054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.066696882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.066747904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.066780090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.066863060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.066876888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.066890001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.066914082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.066982031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067034006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067040920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067040920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067048073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067122936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067131042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067147017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067171097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067240000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067269087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067281961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067296982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067302942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067328930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067356110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067365885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067377090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067429066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067441940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067446947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067450047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067466021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067534924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067543030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067553043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067558050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067569971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067640066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067648888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067658901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067662954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067676067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067747116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067749023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067753077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067763090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067800999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067841053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067879915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067881107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067899942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067904949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067909956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067925930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067948103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.067967892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.067980051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068021059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068042040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068097115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068104029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068109989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068121910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068146944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068181038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068192005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068201065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068212032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068268061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068274975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068284035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068308115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068360090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068367004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068367004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068378925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068424940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068440914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068454981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068469048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068475962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068491936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068531990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068541050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068547010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068569899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068633080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068634033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068639994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068644047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068696022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068715096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068722963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068731070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068748951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068768978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068797112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068830967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068842888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068847895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068856955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068869114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068877935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068912983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.068913937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068927050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068953037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.068993092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069046974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069053888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069053888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069070101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069104910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069139004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069156885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069161892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069171906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069184065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069197893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069224119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069232941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069281101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069334030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069340944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069353104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069372892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069385052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069395065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069407940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069464922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069478989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069488049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069499969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069534063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069539070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069550991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069582939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069612980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069621086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069632053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069647074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069685936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069706917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069721937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069741964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069751024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069772005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069780111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069794893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069801092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069824934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069837093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069842100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069852114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069855928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069926023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.069936037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069945097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.069955111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070007086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070050955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070075035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070087910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070105076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070113897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070117950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070125103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070142984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070173025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070187092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070255041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070271969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070286036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070301056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070308924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070343018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070377111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070378065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070391893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070400953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070405960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070410013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070435047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070447922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070486069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070548058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070550919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070554972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070570946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070636988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070673943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070691109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070715904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070730925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.070735931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070808887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.070816994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.077102900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.077182055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.077228069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.077240944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.077280045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.077315092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.080333948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.081212044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.082115889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.082178116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.082282066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.082298040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.082321882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.082350016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.082369089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.082432032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.082442999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.082492113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.082536936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.083141088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.083162069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.083235025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.083250999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.083347082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.083422899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.083430052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.083441019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.083512068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.083523989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.083547115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.083573103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.083594084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.083668947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.083677053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.083687067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.083690882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.083749056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.083760977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.083962917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.083981991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.084059954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.084072113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.084120989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.084152937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.084269047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.084283113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.084508896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.084531069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.084604025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.084644079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.084661007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.084686995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.084721088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.084777117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.085036039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.085051060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.085072041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.085215092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.085227966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.085252047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.085278034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.085352898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.085433006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.085474014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.085488081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.085571051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.085582018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.085587025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.085978985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.086019039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.086121082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.086148977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.086169004 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.086189985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.086209059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.086225986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.086289883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.086297989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.086307049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.086429119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.086440086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.086565018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.086607933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.086630106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.086731911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.086744070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.086956978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087003946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087003946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.087038994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.087050915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087085009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.087132931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087178946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.087188959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087193012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.087300062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087342024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087380886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.087393999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087398052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.087400913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087480068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.087487936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.087497950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087567091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087584972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087743998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.087754965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087758064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.087798119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.087990046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.088042021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.088076115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.088090897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.088114977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.088154078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.088202953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.088222027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.088500977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.088550091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.088562965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.088721991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.088741064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.088783026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.088845015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.088859081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.088881969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.089154959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.089174032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.089226961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.089243889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.089247942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.089317083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.089324951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.089344978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.089385986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.089490891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.089503050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.089507103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.089890957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.090126038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.090147018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.090202093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.090213060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.090217113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.090224028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.090276957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.090297937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.090308905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.090318918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.090369940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.090378046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.090751886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.090795994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.090847969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.090861082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.090910912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.090918064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.090965033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.091006994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.091049910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.091075897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.091088057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.091092110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.091118097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.091164112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.091523886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.091588974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.091656923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.091670990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.091675997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.091701984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.091833115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.091844082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.091847897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.091851950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.091895103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.091957092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.091969967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.091974020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.092051029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.092070103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.092134953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.092149973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.092624903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.092643976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.092686892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.092730999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.092793941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.092808008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.092813015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.092895985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.092916965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.092966080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.092972994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.092983007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.092987061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.093019962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.093030930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.093039989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.093045950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.093054056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.093091011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.093101978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.093116045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.093125105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.093148947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.093698025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.093750000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.093780041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.093792915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.093796968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.093832970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.093874931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.093892097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.093900919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.093904972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.093913078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.094058037 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.094068050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.094175100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.094213009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.094293118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.094307899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.094312906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.094348907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.094479084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.094491005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.094504118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.094634056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.094882965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.094923973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.094990015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.095001936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.095005989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.095078945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.095292091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.095313072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.095381975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.095396996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.095493078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.095530987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.095583916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.095597982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.095619917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.095681906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.095700979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.095750093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.095758915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.095762968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.095846891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.095854044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.096173048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.096224070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.096318007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.096330881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.096334934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.096527100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.096548080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.096610069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.096688986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.096700907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.096704960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.096771955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.096822977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.096843004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.096899986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.096911907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.096915960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.096972942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.097013950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.097079992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.097090960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.097094059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.097547054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.097610950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.097640991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.097654104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.097659111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.097771883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.097819090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.097884893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.097897053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.097909927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.097918034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.097945929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.098011971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.098023891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.098027945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.098134995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.098218918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.098225117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.098244905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.098335028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.098352909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.098412991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.098433018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.098438025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.098443985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.098710060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.098953009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.098969936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.099066019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.099082947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.099087954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.099153996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.099217892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.099236965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.099405050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.099422932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.099486113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.099498034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.099510908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.099592924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.099608898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.099677086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.099693060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.099740028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.100141048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.100159883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.100310087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.100333929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.100344896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.100466967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.100482941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.100692034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.100756884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.100845098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.100855112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.100860119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.100863934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.100874901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.100955009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.100985050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.101003885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.101063013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.101103067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.101120949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.101126909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.101149082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.101279020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.101500034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.101679087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.101754904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.101759911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.101782084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.101788044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.101861000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.102027893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.102087975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.102113008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.102128029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.102240086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.102257967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.102304935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.102319956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.102324963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.102382898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.102387905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.102408886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.102454901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.102498055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.102513075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.102648020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.102912903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.102931976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.103039026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.103056908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.103063107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.103210926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.103230000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.103308916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.103313923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.103337049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.103342056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.103369951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.103586912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.103604078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.103677034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.103694916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.103744030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.103878021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.104083061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104100943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104173899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.104187965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104192972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.104407072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104423046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104491949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104537010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.104558945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104563951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.104754925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104773045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104823112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104871035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.104890108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104893923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.104899883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.104907990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104955912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104970932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.104981899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.104995966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.105046988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.105055094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.105063915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.105346918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.105395079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.105432987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.105447054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.105484962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.105508089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.105613947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.105676889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.105726957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.105740070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.105745077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.105911970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.105931044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.105951071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.105959892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.105969906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.106082916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.106093884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.106148958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.106185913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.106259108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.106261015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.106271029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.106308937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.106389046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.106396914 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.106406927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.106622934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.106708050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.106719971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.106848001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.106867075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.106965065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.106977940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.106981039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.106985092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.107268095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.107286930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.107326031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.107331991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.107335091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.107358932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.107384920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.107392073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.107426882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.107491016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.107501030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.107508898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.107511997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.107558966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.107989073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.108046055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.108113050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.108122110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.108124971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.108374119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.108417034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.108515978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.108525038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.108526945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.108588934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.108608007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.108726978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.108735085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.108736992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.108829975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.108848095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.108915091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.108932018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.108942032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.109282970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.109325886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.109333992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.109349966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.109353065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.109428883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.109458923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.109467030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.109533072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.109536886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.109847069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.109909058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.109925985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.109935045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.110089064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.110106945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.110160112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.110167980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.110176086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.110215902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.110251904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.110255957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.110260963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.110318899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.110321999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.110589027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.110654116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.110691071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.110697985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.111080885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.111140013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.111179113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.111186981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.111196041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.111201048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.111238003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.111279964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.111284971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.111290932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.111356974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.111416101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.111416101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.111443043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.111447096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.111459017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.111526966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.111598969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.111607075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.111608982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.112051964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.112068892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.112185001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.112193108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.112369061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.112415075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.112498045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.112507105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.112510920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.112554073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.112612009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.112632036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.112641096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.112704992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.112709045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.112775087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.112791061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.112855911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.112883091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.112890959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.112895012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.112926006 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.113358021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.113377094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.113508940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.113517046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.113519907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.113742113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.113786936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.113838911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.113847017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.113850117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.113892078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.113914013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.113965988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.113975048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.116291046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.117974043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.119349003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.126549959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.126683950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.126902103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.126924038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.127000093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.127016068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.127028942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.127084017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.127161026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.127182007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.127253056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.127264023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.127270937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.127321005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.127324104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.127374887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.127383947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.127386093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.131406069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.166431904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.172594070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.172739983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.172801971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.172812939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.172828913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.172873974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.173240900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.173329115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.173333883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.173746109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.173782110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.173863888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.173867941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.173871040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.173912048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.174062014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.174119949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.174127102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.174129009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.174503088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.174521923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.174534082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.174618006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.174690008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.174696922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.174704075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.174757004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.174815893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.174822092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.174956083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.175375938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.175498009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.175503016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.175596952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.176112890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.176148891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.176234961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.176240921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.176243067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.176446915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.176512957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.176558018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.176564932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.176706076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.177145004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.177181005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.177284956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.177290916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.177293062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.177397966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.177508116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.177512884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.177666903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.177767992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.177774906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.178276062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.178371906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.178380013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.178795099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.178953886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.179042101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.179049969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.179052114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.179083109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.179173946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.179241896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.179248095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.179846048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.179882050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.179991007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.179997921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.180000067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.180008888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.180092096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.180097103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.180282116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.180526972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.180603027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.180605888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.180609941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.180629015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.180699110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.180702925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.180994987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.181112051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.181137085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.181142092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.181242943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.181248903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.182132959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.222635031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.222775936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.222784042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.222805977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.222888947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.222896099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.222908020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.223061085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.223139048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.223153114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.223166943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.223170996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.223186016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.223222017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.223242998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.223251104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.223273039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.223330975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.223339081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.223428965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.223476887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.223582983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.223592997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.223598003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.223825932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.223942041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.223978996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.224052906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.224064112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.224087954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.224199057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.224272966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.224311113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.224312067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.224317074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.224342108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.224368095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.224379063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.224384069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.224390030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.224400043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.224458933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.224704027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.224808931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.225023031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.225111008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.225186110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.225193024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.225204945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.225208998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.225462914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.225555897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.225567102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.225581884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.225656033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.225677967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.225687027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.225749016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.225832939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.225846052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.225858927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.225867987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.225929976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.225955963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.225975990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.225986958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.226005077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.226038933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.226063967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.226074934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.226088047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.226095915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.226150036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.226157904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.226162910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.236057043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.236231089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.236329079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.236344099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.236356974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.236485958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.236572027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.236604929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.236618042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.237148046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.237154961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.242510080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.242645025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.242660999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.242681980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.242721081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.242806911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.242814064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.242816925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.242841005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.242927074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.242958069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243002892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243014097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243067980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243077040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243100882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243166924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243204117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243226051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243230104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243252993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243403912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243422031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243463039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243566990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243568897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243572950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243590117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243644953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243680000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243727922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243741989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243747950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243793964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243801117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243834972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243916035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243921995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.243927002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.243946075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244002104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244046926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244049072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244055986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244069099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244119883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244128942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244136095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244148970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244168043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244210005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244235992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244252920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244323969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244338036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244342089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244350910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244429111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244508982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244514942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244522095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244540930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244585037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244631052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244720936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244733095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244748116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244791031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244851112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244864941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244875908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244880915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244939089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244942904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244949102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.244960070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.244998932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245038033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245064020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245070934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245079994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245136976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245203018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245203018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245207071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245227098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245296001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245296955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245302916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245317936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245368958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245410919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245419979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245429993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245434999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245471954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245529890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245582104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245592117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245604992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245618105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245623112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245651007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245687008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245697021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245707989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245781898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245786905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245790005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245809078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245865107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245917082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245919943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.245923996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245929003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.245944977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246016026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246028900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246114016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246227980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246256113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246263981 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246288061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246336937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246345997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246360064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246387959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246395111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246411085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246439934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246448040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246499062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246510983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246556997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246624947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246670961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246684074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246695995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246772051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246807098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246855974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246867895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246871948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246877909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246898890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246913910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246918917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.246927023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.246967077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.247018099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247113943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.247127056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247132063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.247140884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247179031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247214079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247272968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.247279882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.247286081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247296095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247365952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.247373104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.247381926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247400045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247503996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.247512102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.247520924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247541904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247657061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247737885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247741938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.247749090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.247756958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247812986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247834921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.247843981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.247853994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.247921944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248014927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248025894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248039007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248049021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248089075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248138905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248145103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248152018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248162031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248214960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248253107 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248265028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248277903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248285055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248289108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248301983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248330116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248378038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248382092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248384953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248399973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248469114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248475075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248481035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248488903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248568058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248573065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248575926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248594999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248670101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248677015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248683929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248692989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248765945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248780012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248789072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248797894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248853922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248886108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248930931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.248982906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.248987913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249005079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249010086 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249015093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249025106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249083996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249100924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249114990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249128103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249135971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249140024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249154091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249166012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249181032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249181986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249207973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249218941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249223948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249258041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249269009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249289989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249347925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249360085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249372005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249376059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249419928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249455929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249499083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249505997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249514103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249519110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249525070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249582052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249602079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249628067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249639988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249644995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249659061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249661922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249686003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249696970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249716043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249727011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249761105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249783993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249818087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249842882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249907017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249921083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249943972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249943972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.249948978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.249999046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250026941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250057936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250072002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250087023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250093937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250118971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250128984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250176907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250195026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250207901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250222921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250291109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250303030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250309944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250319958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250370026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250442028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250448942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250458002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250468016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250530005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250588894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250612020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250613928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250618935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250628948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250691891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250700951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250710964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250724077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250788927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250791073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250797987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250806093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250849962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250879049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250943899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250955105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.250960112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.250965118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251018047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251044989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251086950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251091957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251115084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251120090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251125097 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251125097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251194954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251199961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251211882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251216888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251230955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251281977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251296997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251306057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251316071 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251349926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251437902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251441956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251447916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251455069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251530886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251565933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251579046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251624107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251638889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251647949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251653910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251662016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251688957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251691103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251743078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251745939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251760960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251810074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251842976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251851082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251859903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251883984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251930952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251939058 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.251945972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.251960039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252006054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252034903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252047062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252100945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252109051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252113104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252156973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252177954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252191067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252196074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252204895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252269030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252275944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252336025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252338886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252343893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252352953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252417088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252434969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252438068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252497911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252577066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252588987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252604008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252612114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252643108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252661943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252671957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252703905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252741098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252793074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252856016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252867937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252885103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252897024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.252901077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252933979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.252942085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253015041 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253053904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.253067970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253108025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253179073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253190041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.253197908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.253207922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253272057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.253287077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253365993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253365993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.253371000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.253381014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253437042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253451109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.253462076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253528118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.253546000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253616095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253624916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.253637075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253707886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253732920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.253745079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253799915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.253808022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.253823996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253849983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253931046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.253932953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253948927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.253995895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254008055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254017115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254026890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254081964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254096031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254117012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254185915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254187107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254204035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254239082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254249096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254272938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254349947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254362106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254365921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254378080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254434109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254466057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254518032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254527092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254540920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254545927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254556894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254563093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254617929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254682064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254689932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254755020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254759073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254760027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254765034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254775047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254837036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254854918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254873037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254887104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254894018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254900932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254923105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254967928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254976988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.254987001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.254995108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.255004883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.255028009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.255034924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.255098104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.255110979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.255120039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.255135059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.255142927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.255203962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.255285025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.255289078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.255295038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.255300999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.255341053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.255374908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.255412102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.255425930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.255434990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.255448103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.255459070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.255551100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.255563974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.255968094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.256567001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.256594896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.256705999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.256717920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.256722927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.258126974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.259124994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.273199081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.273267984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.273363113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.273396015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.273403883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.273474932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.273529053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.273600101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.273616076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.273621082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.273710012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.273751974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.273823977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.273843050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.273849010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.273924112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.273962975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.274029016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.274044037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.274091959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.274094105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.274101019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.274122000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.274149895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.274214983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.274225950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.274235964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.274295092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.274367094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.274445057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.274460077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.274465084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.274966955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.275070906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.275130987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.275146008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.275224924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.275233984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.275630951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.275784969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.275793076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.275808096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.275895119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.275998116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276036978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276124001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.276138067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276143074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.276197910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276273012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276323080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.276335001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276401997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.276410103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.276438951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276495934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276563883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.276578903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276585102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.276657104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276694059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276768923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.276781082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276784897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.276810884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276851892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276936054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.276951075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.276956081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.277056932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.277095079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.277183056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.277194977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.277199984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.277226925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.277327061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.277339935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.277491093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.277544975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.277591944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.277606010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.277631998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.277702093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.277919054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.277966022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.278050900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.278065920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.278070927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.278187037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.278224945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.278301954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.278314114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.278318882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.278573990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.278614044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.278738976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.278754950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.278947115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.278999090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.279133081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.279148102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.279225111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.279263973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.279511929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.279526949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.280117035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.280261040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.280262947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.280294895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.280447960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.281039953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.281095982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.281189919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.281204939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.281212091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.281239033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.281276941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.281366110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.281380892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.281385899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.281429052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.281483889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.281578064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.281594992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.281600952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.281667948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.281793118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.281805992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.281872988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.281963110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.282046080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.282058001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.282063007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.282123089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.282160997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.282243013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.282258034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.282263041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.282280922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.282335043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.282397032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.282411098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.282414913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.282422066 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.282470942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.282645941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.282727003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.282741070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.282746077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.282757998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.282895088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283046007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283124924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283138037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283143997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283219099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283303976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283358097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283379078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283391953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283407927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283421040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283428907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283453941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283502102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283525944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283540964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283555031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283562899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283576965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283613920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283627033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283632994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283648968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283685923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283720970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283725023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283745050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283751011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283756018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283777952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283813000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283834934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283849001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283875942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283890963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283921957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283929110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283942938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.283943892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.283974886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284050941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284060001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.284074068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284079075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.284090042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284135103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.284140110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.284142971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284162045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284173012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.284228086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284254074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.284271002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284308910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.284317970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284333944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.284346104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284395933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.284404993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284409046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.284420013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284459114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284472942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284514904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284544945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.284567118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.284581900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.284595966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.284641981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.285119057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285187960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285237074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285244942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285252094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.285264969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285270929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.285275936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.285341978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.285500050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285562992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285620928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.285634995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285640001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.285732985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285794973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285847902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285855055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.285867929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285886049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.285901070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285914898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.285923958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.285949945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.285957098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.285970926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.286024094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.286546946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.286588907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.286654949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.286668062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.286672115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.286959887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287018061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287029028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287041903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.287051916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287116051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287148952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.287163973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287169933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.287213087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287261963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287281990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287288904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.287302017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287333012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287333965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.287384033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.287389994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287409067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287415028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.287590027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.287694931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287740946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287786007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287811995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.287826061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.287831068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.287836075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.287887096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.288155079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.288238049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.288274050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.288290977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.288295984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.288307905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.288321972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.288398027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.288433075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.288475990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.288530111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.288543940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.288548946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.288575888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.288933992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.288994074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289083958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.289093018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289113998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289335012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.289419889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289449930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289557934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289601088 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.289614916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289625883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.289633036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289690971 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289742947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289747953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.289762974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289768934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.289797068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289836884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289846897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289861917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.289870024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.289879084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289897919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289932966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.289969921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.289982080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.289987087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.290178061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.290184021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.290265083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.290339947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.290363073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.290411949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.290447950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.290460110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.290465117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.290579081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.290636063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.290694952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.290709019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.290713072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.290883064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.290913105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.290975094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.290992975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.291004896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.291009903 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.291028976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.291038036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.291052103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.291104078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.291129112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.291142941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.291147947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.291152954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.291244030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.291250944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.291650057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.291673899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.291748047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.291766882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.291883945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.291986942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.292015076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.292092085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.292109966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.292114973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.292131901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.292170048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.292217016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.292233944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.292239904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.292251110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.292262077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.292284966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.292525053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.292546034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.292898893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.292921066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.293035030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.293059111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.293108940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.293119907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.293323994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.293350935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.293446064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.293448925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.293462038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.293478012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.293492079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.293519974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.293530941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.293549061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.293559074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.293569088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.293596029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.293607950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.293673992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.293685913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.294807911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.294928074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.294928074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.294953108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.295136929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.295406103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.295532942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.295563936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.295663118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.295675039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.295679092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.295691967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.295775890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.295805931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.295841932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.295851946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.295856953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.295861959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.295886993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.295905113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.295917034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296003103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296025991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296039104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296098948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296102047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296106100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296119928 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296160936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296232939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296245098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296251059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296298027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296369076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296380997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296385050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296392918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296444893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296508074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296519041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296530008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296534061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296598911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296633005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296644926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296659946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296670914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296711922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296716928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296808958 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296875954 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296886921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296911001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.296916962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.296967030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.297033072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.297065973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.297128916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.297139883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.297143936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.297262907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.297327995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.297339916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.297353983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.297431946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.297512054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.297523975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.297527075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.297535896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.297600031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.297676086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.297748089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.297748089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.297760963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.297774076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.298091888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.298121929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.298207998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.298233986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.298245907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.298249960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.298294067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.298301935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.298553944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.298705101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.298711061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.298739910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.298785925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.298851967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.298870087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.298876047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.298887968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.298935890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.299006939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.299021006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.299026012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.300381899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.300431013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.300585032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.300609112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.300615072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.300883055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.300915956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301024914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301034927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301049948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301054955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301064014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301105022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301178932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301179886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301199913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301248074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301278114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301291943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301333904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301367998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301398039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301404953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301419020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301465988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301503897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301537037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301556110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301567078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301574945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301644087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301652908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301661015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301668882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301690102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301758051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301764965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301772118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301780939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301804066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301851988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301862955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.301867008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301927090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.301935911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.302124977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.302176952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.302198887 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.302217007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.302222967 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.302227974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.302254915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.302325010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.302589893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.302638054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.302696943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.302715063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.302777052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.302783966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.302819014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.302877903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.302956104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.302962065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.302963018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.302988052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.303020954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.303083897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.303100109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.303106070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.303370953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.303680897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.303700924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.304954052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.305150032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.305202961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.305208921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.305231094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.305238962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.305320024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.305388927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.305422068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.305483103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.305495977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.305545092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.305552959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.305574894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.305607080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.305660009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.305670977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.305737019 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.305744886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.305769920 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.309902906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.309907913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.310077906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.346419096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.346518040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.346591949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.346616983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.346659899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.346668959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.347233057 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.353420019 CEST	443	63065	34.195.48.210	192.168.2.3
Jun 1, 2022 22:50:00.353862047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.354001999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.354233027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.354321003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.354382992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.354397058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.354402065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.354468107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.354617119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.354619980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.354640961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.354720116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.354882956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.355001926 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.355038881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.355079889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.355093002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.355098009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.355125904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.355175018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.355405092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.355492115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.355592012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.355603933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.355607986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.355704069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.355766058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.355843067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.355854034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.355869055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.356075048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.356113911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.356153011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.356165886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.356170893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.356198072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.356234074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.356242895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.356251955 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.356256962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.356318951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.356362104 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.356420994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.356424093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.356430054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.356441975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.356503010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.356669903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.356679916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.356692076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.356725931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.356786966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.356801033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.356806040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.356961966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.357009888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.357074976 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.357085943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.357089996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.357131004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.357239008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.357253075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.357511997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.357566118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.357620955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.357635975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.357681036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.357688904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.357983112 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.358021975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.358119011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.358144045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.358155012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.358160973 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.358205080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.358326912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.358359098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.358372927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.358390093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.358441114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.358452082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.358494043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.358880043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.358911991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.358958960 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.358973026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.358977079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.359020948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.359047890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.359056950 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.359066010 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.359071016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.359112978 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.359368086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.359399080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.359527111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.359539986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.359545946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.359574080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.359628916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.359662056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.359674931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.359996080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.360037088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.360136032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.360148907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.360153913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.360281944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.360337019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.360368967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.360418081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.360429049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.360434055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.360438108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.360440969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.360488892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.360501051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.360579014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.360596895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.360733032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.360833883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.360855103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.360866070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.360909939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.360946894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.361249924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.361282110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.361382961 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.361393929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.361555099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.361608982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.361638069 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.361650944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.361655951 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.361664057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.361675024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.361696959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.361721992 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.361732006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.361737013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.361772060 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.361833096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.361845970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.361969948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.362051964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.362063885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.362080097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.362102032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.362169981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.362183094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.362348080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.362392902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.362451077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.362484932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.362495899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.362500906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.362560987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.362570047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.362761021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.362864017 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.362875938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.362993002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.363085985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.363452911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.363509893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.363559008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.363570929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.363584995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.363655090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.363663912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.363873005 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.363918066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364016056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.364027977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364032984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.364039898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364131927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364159107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364264965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.364268064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364272118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.364285946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364362001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.364366055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.364372969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364392996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364449024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364475012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.364485025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.364495039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364540100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364576101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.364583015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.364583969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364605904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364624023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364655018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.364661932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.364670038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.364675045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.367887020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.381449938 CEST	63065	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:50:00.381486893 CEST	443	63065	34.195.48.210	192.168.2.3
Jun 1, 2022 22:50:00.382523060 CEST	443	63065	34.195.48.210	192.168.2.3
Jun 1, 2022 22:50:00.403433084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.403598070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.403609991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.403628111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.403687954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.403717995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.403728962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.403784990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.403805971 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.403811932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.403815985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.403836966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.403899908 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.403923988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.403932095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.404016018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.404064894 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.404072046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.404162884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.404169083 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.404241085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.404333115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.404387951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.404597044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.404699087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.404711008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.404851913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.404916048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.404973030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.404983044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.404988050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.405119896 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.405191898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.405267000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.405340910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.405452013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.405509949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.405533075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.405538082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.405549049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.405636072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.405641079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.405659914 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.405751944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.405796051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.405812979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.405822992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.405826092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.405879974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.405894995 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.405901909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.405909061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.405968904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.405972958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.405998945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406033039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406065941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406074047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406152964 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406156063 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406160116 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406176090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406196117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406253099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406258106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406264067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406301975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406339884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406388998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406399012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406445980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406516075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406521082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406526089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406580925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406580925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406601906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406611919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406677008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406692028 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406697989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406702995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406789064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406795025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406795025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406817913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406877995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406878948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406898975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406904936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406958103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.406982899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406990051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.406995058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407079935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407079935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407083035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407103062 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407167912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407175064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407185078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407190084 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407226086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407257080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407258987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407260895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407282114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407325983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407331944 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407356977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407392979 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407460928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407469034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407474041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407624006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407672882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407753944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407768011 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407780886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407783985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407795906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407864094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407870054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.407875061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407908916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407957077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.407994032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408003092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408041000 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408046007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408060074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408068895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408088923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408168077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408174038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408190012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408226013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408297062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408303976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408307076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408318996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408369064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408423901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408432961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408477068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408509016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408515930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408521891 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408535004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408587933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408622026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408662081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408685923 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408694029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408696890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408709049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408781052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408787966 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408796072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408826113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408874035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408946991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408951998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.408952951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.408988953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.409059048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.409121990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.409132004 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.409133911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.409152985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.409230947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.409233093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.409250021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.409285069 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.409346104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.409354925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.409358025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.409739017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.409828901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.409837008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.409868956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.409981012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.409989119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.410031080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.410037994 CEST	63065	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:50:00.410132885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.410140991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.410314083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.410403013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.410408020 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.410423994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.410489082 CEST	63065	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:50:00.410506010 CEST	443	63065	34.195.48.210	192.168.2.3
Jun 1, 2022 22:50:00.410545111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.410562038 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.410581112 CEST	443	63065	34.195.48.210	192.168.2.3
Jun 1, 2022 22:50:00.410631895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.410720110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.410804987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.410830021 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.410840988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.410849094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.410909891 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.410916090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.410921097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.410972118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411043882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411104918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411113024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411114931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411237001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411330938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411339045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411350012 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411386013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411436081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411444902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411448002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411463022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411494017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411560059 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411566973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411570072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411602974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411686897 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411715031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411734104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411741018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411809921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411828041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411835909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411842108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411885977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411915064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411925077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411932945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411937952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411967039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.411994934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411998987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.411999941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412019968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412045002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.412094116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412158012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.412166119 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412168026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.412183046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412219048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412247896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412286043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.412292957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412305117 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412312984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.412316084 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.412319899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412390947 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412441015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412465096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412465096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.412470102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.412483931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412549019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412595987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.412595987 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412606001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.412611961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412631989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412720919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412731886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.412740946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412765980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412828922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412856102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412858963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.412862062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.412873983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412961006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.412988901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413016081 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413024902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413034916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413080931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413083076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413110018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413191080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413197994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413199902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413208008 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413237095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413326025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413328886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413337946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413386106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413446903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413456917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413463116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413465977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413496017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413553953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413574934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413578033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413585901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413645029 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413650036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413669109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413718939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413781881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413789988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413799047 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413841963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413856030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413861036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413887024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413913012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413919926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.413924932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.413957119 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414005995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414016008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414025068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414112091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414130926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414138079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414180040 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414207935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414226055 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414231062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414238930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414333105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414340973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414376974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414406061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414489031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414510965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414519072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414521933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414556980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414583921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414585114 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414587975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414601088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414664030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414705038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414710045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414714098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414745092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414764881 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414769888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414774895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414819002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414843082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414850950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414854050 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414859056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414897919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414928913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414935112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414938927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414977074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.414989948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414994001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.414998055 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415049076 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415060043 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415064096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415067911 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415100098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415119886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415123940 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415127993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415147066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415164948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415205002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415210009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415225983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415292978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415332079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415342093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415361881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415366888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415385962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415391922 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415443897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415450096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415452003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415458918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415512085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415540934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415577888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415584087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415594101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415631056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415680885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415689945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415695906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415755033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415786982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415795088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415832043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415844917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415909052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.415915012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415918112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.415924072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.416003942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.416013002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.416021109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.416107893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.416124105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.416131973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.416162968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.416201115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.416228056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.416228056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.416230917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.416244030 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.416295052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.416311026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.416315079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.416320086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.416378021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.416383982 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.416388988 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.419851065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.428308964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.438433886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.438465118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.439743042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.439773083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.440190077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.440963030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.441519022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.441612959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.441817999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.441898108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.441925049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.441946983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.442147970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.442260027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.442269087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.442390919 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.442514896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.442600012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.442605019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.442665100 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.442948103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.442976952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.443049908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.443058014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.443065882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.443073034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.443109989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.443169117 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.443176985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.443429947 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.443545103 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.443576097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.443651915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.443658113 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.443660021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.443846941 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.443993092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.444000006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.444292068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.444329977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.444377899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.444385052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.444400072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.444406986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.444462061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.444468975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.444472075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.444720984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.444802046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.444808006 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.444953918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445030928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.445038080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445070982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445091963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.445097923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445163012 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.445172071 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.445177078 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445219994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445301056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445332050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445372105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.445379019 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445382118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.445446968 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.445451975 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.445456028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445475101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445552111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445620060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.445626974 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445635080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.445645094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445691109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.445698023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.445736885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.445969105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446060896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446094990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.446103096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446146011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446157932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.446162939 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.446166992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446223021 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.446228027 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.446278095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446346998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446381092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.446386099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446407080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446449041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.446455956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446470022 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.446577072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446662903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446716070 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.446722984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446724892 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.446809053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446881056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446923018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.446929932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.446933031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.447002888 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.447177887 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.447247982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.447309017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.447369099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.447376013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.447379112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.447810888 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.447839022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.447930098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.447937965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.447941065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.448057890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.448108912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.448133945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.448133945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.448146105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.448200941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.448205948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.448297977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.448383093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.448390007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.448481083 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.448627949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.448642015 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.448648930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.448736906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.448741913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.448908091 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.448982954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.449023962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.449033022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.449101925 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.449307919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.449435949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.449570894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.449662924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.449702024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.449708939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.449723959 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.449815989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.449887991 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.449894905 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.450124025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.450225115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.450280905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.450288057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.450290918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.450385094 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.450407028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.450474024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.450478077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.450486898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.450489998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.450535059 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.450587034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.450604916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.450619936 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.450624943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.450958967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.450978994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.451036930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.451046944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.451076984 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.451366901 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.451385975 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.451431990 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.451441050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.451443911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.451483965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.451687098 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.451817036 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.451836109 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.451941013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.451978922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.451987982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.452019930 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.452024937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.452426910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.452445984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.452549934 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.452558994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.452917099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.452934980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.452981949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.453010082 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.453018904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.453022957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.453275919 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.453346968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.453372002 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.453382015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.453447104 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.453452110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.507276058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.507426023 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.507553101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.507675886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.507894039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.508053064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.508279085 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.508403063 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.508445978 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.508466005 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.508486032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.508495092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.508507967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.508529902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.508554935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.508567095 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.508631945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.508640051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.508649111 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.508671045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.508790016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.508843899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.508917093 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.508923054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.508924007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.508946896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.508975029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509042025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509054899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509059906 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509090900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509140015 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509217024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509232044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509247065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509255886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509324074 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509346008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509358883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509363890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509372950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509387016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509440899 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509449959 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509468079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509552956 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509623051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509634972 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509649038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509656906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509682894 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509738922 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509742022 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509744883 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509768963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509833097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509845972 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509854078 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509862900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509939909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509946108 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.509951115 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.509973049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510037899 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510093927 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.510102987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.510113001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510198116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510289907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510364056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.510376930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510390997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.510422945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510484934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510535002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510560989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.510571957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510576963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.510592937 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510633945 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.510647058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510652065 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.510659933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510663033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.510699034 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510708094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.510720968 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510756016 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510780096 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.510790110 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510848045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510921001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.510999918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511013985 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511030912 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511077881 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511188984 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511239052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511265039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511279106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511284113 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511334896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511346102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511352062 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511363983 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511385918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511437893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511445999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511519909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511555910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511641979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511653900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511657953 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511672020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511723995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511801958 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511812925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511827946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511836052 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511929989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511930943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511935949 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.511950970 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.511976957 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512044907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512057066 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512062073 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512106895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512209892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512243986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512280941 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512293100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512296915 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512336969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512350082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512402058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512407064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512423992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512428999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512442112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512454987 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512455940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512492895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512573957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512587070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512590885 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512599945 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512702942 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512737989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512777090 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512788057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512852907 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512854099 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512859106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512885094 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512896061 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512952089 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.512959003 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512965918 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.512974024 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513000965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513062000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.513073921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513078928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.513164997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513200045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513226032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.513238907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513282061 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.513308048 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513361931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.513371944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513390064 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513397932 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.513437986 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513500929 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.513514042 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513526917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.513536930 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513597965 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513674974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.513681889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.513691902 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513766050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513911963 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.513983965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.513995886 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514000893 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.514009953 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514105082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514178038 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.514183998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.514184952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514204025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514273882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514305115 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.514331102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514358044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514435053 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514456034 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.514468908 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514492035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.514537096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514583111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.514595032 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514599085 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.514627934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514659882 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.514669895 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514714003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514714956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.514753103 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.514766932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514771938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.514836073 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514915943 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.514929056 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514960051 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.514991999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515031099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515042067 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515083075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515101910 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515110016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515120029 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515140057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515192986 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515201092 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515239954 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515358925 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515368938 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515379906 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515404940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515444040 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515456915 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515518904 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515521049 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515527010 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515539885 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515584946 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515656948 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515661001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515662909 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515681982 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515708923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515764952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515778065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515782118 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515846014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515973091 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.515975952 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.515999079 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516100883 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516115904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.516129017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516168118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516197920 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.516206026 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.516215086 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516231060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.516239882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516290903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516311884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.516324043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516381025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516417027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516449928 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.516462088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516465902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.516472101 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.516526937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.516547918 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516602039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516664028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516670942 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.516678095 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.516685009 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516711950 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516778946 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.516791105 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516796112 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.516817093 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516926050 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.516993046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517004967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517019033 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517055035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517090082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517119884 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517132044 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517137051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517143965 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517168045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517206907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517234087 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517240047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517260075 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517285109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517318964 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517324924 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517334938 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517358065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517381907 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517420053 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517433882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517437935 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517448902 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517484903 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517509937 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517519951 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517568111 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517576933 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517590046 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517626047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517699957 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517710924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517715931 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517736912 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517786026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517857075 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517869949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.517884016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.517960072 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518022060 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518035889 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518040895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518079996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518115997 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518152952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518166065 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518218994 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518224955 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518229961 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518253088 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518277884 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518316031 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518326044 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518337011 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518361092 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518369913 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518407106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518460035 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518471003 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518475056 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518558025 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518570900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518584013 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518631935 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518656969 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518667936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518676043 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518695116 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518748045 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518769979 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518779993 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518790007 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518841028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518851042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518863916 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518872976 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518918037 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.518946886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518956900 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.518965960 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519026041 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519032001 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519035101 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519056082 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519083977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519155025 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519165993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519171000 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519179106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519231081 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519290924 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519306898 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519319057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519324064 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519393921 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519402981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519412994 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519432068 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519465923 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519543886 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519547939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519551039 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519572973 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519601107 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519643068 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519654989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519659996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519717932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519750118 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519788980 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519803047 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519809008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519831896 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519866943 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519932032 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519942999 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.519947052 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.519953966 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.520035028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.520139933 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.520153999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.520169020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.520210028 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.520231962 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.520247936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.520256996 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.520263910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.520277977 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.520299911 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.520809889 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.521245956 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.526936054 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.527118921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.527189016 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.527225018 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.527234077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.527386904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.536299944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.536329031 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.536470890 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.536485910 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.536490917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.536756992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.536778927 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.536864042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.536876917 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.536880970 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.537233114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.537255049 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.537339926 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.537353992 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.537358046 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.537461042 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.537667990 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.537692070 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.537769079 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.537784100 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.537789106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.537795067 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.538083076 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.538157940 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.538182020 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.538271904 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.538285017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.538374901 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.538602114 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.538626909 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.538707018 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.538719893 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.538767099 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.538774014 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.539041996 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.539062977 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.539160013 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.539174080 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.539288998 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.539494991 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.539546967 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.539607048 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.539618969 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.539711952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.539907932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.539966106 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.540019989 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.540033102 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.540038109 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.540251017 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.540299892 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.540364981 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.540380001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.540385008 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.540751934 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.540776014 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.540858030 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.540868998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.540873051 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.541254997 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.541258097 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.541294098 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.541358948 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.541382074 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.541394949 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.541441917 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.541450024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.541665077 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.541709900 CEST	63065	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:50:00.541738033 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.541790962 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.541801929 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.541805983 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.541810036 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.541850090 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.541948080 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.541960001 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.541964054 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.542164087 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.542196989 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.542293072 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.542304993 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.542309999 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.542437077 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.542505980 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.542532921 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.542620897 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.542633057 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.542637110 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.542856932 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.542880058 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.542968988 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.542979002 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.542984009 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.543289900 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.543387890 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.543404102 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.543416023 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.543468952 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.543476105 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.543628931 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.543685913 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.543730974 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.543745995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.543772936 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.545571089 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.574055910 CEST	443	54146	34.195.48.210	192.168.2.3
Jun 1, 2022 22:50:00.574218988 CEST	54146	443	192.168.2.3	34.195.48.210
Jun 1, 2022 22:50:00.580997944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.581187963 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.581351995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.581450939 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.581459045 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.581480026 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.581594944 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.581624985 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.581679106 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.581691027 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.581777096 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.581943035 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.582120895 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.582135916 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.582262039 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.582348108 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.582391024 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.582403898 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.582408905 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.582617998 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.582695007 CEST	49320	443	192.168.2.3	143.204.98.23
Jun 1, 2022 22:50:00.582707882 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.582720995 CEST	443	49320	143.204.98.23	192.168.2.3
Jun 1, 2022 22:50:00.582782030 CEST	443	49320	143.204.98.23	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 1, 2022 22:49:36.649740934 CEST	192.168.2.3	1.1.1.1	0x260a	Standard query (0)	veryfast.io	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:46.633063078 CEST	192.168.2.3	1.1.1.1	0x1e21	Standard query (0)	s3.amazonaws.com	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:47.715272903 CEST	192.168.2.3	1.1.1.1	0xedfb	Standard query (0)	veryfast.io	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:47.716027021 CEST	192.168.2.3	1.1.1.1	0xf7fb	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:47.723742962 CEST	192.168.2.3	1.1.1.1	0xeceb	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:56.978013992 CEST	192.168.2.3	1.1.1.1	0xd2c5	Standard query (0)	d1uyoz7mfvzv4e.cloudfront.net	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:59.438657999 CEST	192.168.2.3	1.1.1.1	0x7c94	Standard query (0)	veryfast.io	A (IP address)	IN (0x0001)
Jun 1, 2022 22:50:12.879652977 CEST	192.168.2.3	1.1.1.1	0xfb92	Standard query (0)	veryfast.io	A (IP address)	IN (0x0001)
Jun 1, 2022 22:51:45.412328005 CEST	192.168.2.3	1.1.1.1	0xed65	Standard query (0)	veryfast.io	A (IP address)	IN (0x0001)
Jun 1, 2022 22:51:46.241262913 CEST	192.168.2.3	1.1.1.1	0x4b5f	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)
Jun 1, 2022 22:51:49.666976929 CEST	192.168.2.3	1.1.1.1	0x147b	Standard query (0)	veryfast.io	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 1, 2022 22:49:36.668932915 CEST	1.1.1.1	192.168.2.3	0x260a	No error (0)	veryfast.io		34.195.48.210	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:46.650700092 CEST	1.1.1.1	192.168.2.3	0x1e21	No error (0)	s3.amazonaws.com		52.217.197.24	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:47.733706951 CEST	1.1.1.1	192.168.2.3	0xf7fb	No error (0)	accounts.google.com		142.250.181.237	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:47.734436989 CEST	1.1.1.1	192.168.2.3	0xedfb	No error (0)	veryfast.io		34.195.48.210	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:47.741395950 CEST	1.1.1.1	192.168.2.3	0xeceb	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jun 1, 2022 22:49:47.741395950 CEST	1.1.1.1	192.168.2.3	0xeceb	No error (0)	clients.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:57.011714935 CEST	1.1.1.1	192.168.2.3	0xd2c5	No error (0)	d1uyoz7mfvzv4e.cloudfront.net		143.204.98.23	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:57.011714935 CEST	1.1.1.1	192.168.2.3	0xd2c5	No error (0)	d1uyoz7mfvzv4e.cloudfront.net		143.204.98.29	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:57.011714935 CEST	1.1.1.1	192.168.2.3	0xd2c5	No error (0)	d1uyoz7mfvzv4e.cloudfront.net		143.204.98.127	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:57.011714935 CEST	1.1.1.1	192.168.2.3	0xd2c5	No error (0)	d1uyoz7mfvzv4e.cloudfront.net		143.204.98.12	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:57.259135962 CEST	1.1.1.1	192.168.2.3	0xdeb4	No error (0)	gstaticadssl.l.google.com		142.250.186.99	A (IP address)	IN (0x0001)
Jun 1, 2022 22:49:59.708451986 CEST	1.1.1.1	192.168.2.3	0x7c94	No error (0)	veryfast.io		34.195.48.210	A (IP address)	IN (0x0001)
Jun 1, 2022 22:50:12.901428938 CEST	1.1.1.1	192.168.2.3	0xfb92	No error (0)	veryfast.io		34.195.48.210	A (IP address)	IN (0x0001)
Jun 1, 2022 22:51:45.432960033 CEST	1.1.1.1	192.168.2.3	0xed65	No error (0)	veryfast.io		34.195.48.210	A (IP address)	IN (0x0001)
Jun 1, 2022 22:51:46.064464092 CEST	1.1.1.1	192.168.2.3	0xb9c7	No error (0)	gstaticadssl.l.google.com		142.250.181.227	A (IP address)	IN (0x0001)
Jun 1, 2022 22:51:46.258999109 CEST	1.1.1.1	192.168.2.3	0x4b5f	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Jun 1, 2022 22:51:46.258999109 CEST	1.1.1.1	192.168.2.3	0x4b5f	No error (0)	scontent.xx.fbcdn.net		31.13.92.14	A (IP address)	IN (0x0001)
Jun 1, 2022 22:51:49.686659098 CEST	1.1.1.1	192.168.2.3	0x147b	No error (0)	veryfast.io		34.195.48.210	A (IP address)	IN (0x0001)

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Setup 2.exePID: 2852, Parent PID: 3484

General

Target ID:	1
Start time:	22:49:34
Start date:	01/06/2022
Path:	C:\Users\user\Desktop\Setup 2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup 2.exe"
Imagebase:	0x400000
File size:	142536 bytes
MD5 hash:	EC427B1BF867DC6FDFDFC2B5219F44DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 3032, Parent PID: 636

General

Target ID:	2
Start time:	22:49:34
Start date:	01/06/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff678a60000
File size:	53744 bytes
MD5 hash:	9520A99E77D6196D0D09833146424113
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1292, Parent PID: 636

General

Target ID:	5
Start time:	22:49:38
Start date:	01/06/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff678a60000
File size:	53744 bytes
MD5 hash:	9520A99E77D6196D0D09833146424113
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 7468, Parent PID: 636

General

Target ID:	7
Start time:	22:49:38
Start date:	01/06/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
Imagebase:	0x7ff678a60000
File size:	53744 bytes
MD5 hash:	9520A99E77D6196D0D09833146424113
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7884, Parent PID: 2852

General

Target ID:	8
Start time:	22:49:41
Start date:	01/06/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation --single-argument https://veryfast.io/installing.html?guid=11EB4D56-CD47-EB68-FB46-FB9922C35D94
Imagebase:	0x7ff68c970000
File size:	2438312 bytes
MD5 hash:	74859601FB4BEEA84B40D874CCB56CAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3896, Parent PID: 7884

General

Target ID:	9
Start time:	22:49:43
Start date:	01/06/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,14935635805379620180,7098128812871956072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:8
Imagebase:	0x7ff68c970000
File size:	2438312 bytes
MD5 hash:	74859601FB4BEEA84B40D874CCB56CAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: SetupEngine.exePID: 4152, Parent PID: 2852

General

Target ID:	11
Start time:	22:50:08
Start date:	01/06/2022
Path:	C:\Users\user\AppData\Local\Temp\SetupEngine.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\SetupEngine.exe"
Imagebase:	0x400000
File size:	2665608 bytes
MD5 hash:	5633DE5AF2C7D8E011EFE802CEC7B83E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5304, Parent PID: 4152

General

Target ID:	12
Start time:	22:50:20
Start date:	01/06/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c "C:\Users\user\AppData\Local\Temp\diskspd.exe -c100M -b4K -t1 -r -o32 -d10 -ag -h -Rxml C:\Users\user\AppData\Local\Temp\testfile.temp" > C:\Users\user\AppData\Local\Temp\dskres.xml
Imagebase:	0x5d0000
File size:	236032 bytes
MD5 hash:	4943BA1A9B41D69643F69685E35B2943
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4772, Parent PID: 5304

General

Target ID:	13
Start time:	22:50:20
Start date:	01/06/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a8820000
File size:	885760 bytes
MD5 hash:	C5E9B1D1103EDCEA2E408E9497A5A88F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: diskspd.exePID: 3924, Parent PID: 5304

General

Target ID:	14
Start time:	22:50:21
Start date:	01/06/2022
Path:	C:\Users\user\AppData\Local\Temp\diskspd.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\diskspd.exe -c100M -b4K -t1 -r -o32 -d10 -ag -h -Rxml C:\Users\user\AppData\Local\Temp\testfile.temp
Imagebase:	0xb40000
File size:	144688 bytes
MD5 hash:	FC41CABDD3C18079985AC5F648F58A90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6812, Parent PID: 636

General

Target ID:	17
Start time:	22:51:05
Start date:	01/06/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff678a60000
File size:	53744 bytes
MD5 hash:	9520A99E77D6196D0D09833146424113
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 3524, Parent PID: 636

General

Target ID:	21
Start time:	22:51:28
Start date:	01/06/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
Imagebase:	0x7ff678a60000
File size:	53744 bytes
MD5 hash:	9520A99E77D6196D0D09833146424113
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: SetupResources.exePID: 5888, Parent PID: 4152

General

Target ID:	23
Start time:	22:51:32
Start date:	01/06/2022
Path:	C:\Users\user\AppData\Local\Temp\SetupResources.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\SetupResources.exe
Imagebase:	0x400000
File size:	55410880 bytes
MD5 hash:	884E1463B4CB20B28C3A80960E02AC2D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Setup 2.exePID: 2852, Parent PID: 3484COMMON

Execution Graph

Execution Coverage:	21.6%
Dynamic/Decrypted Code Coverage:	24.3%
Signature Coverage:	19.7%
Total number of Nodes:	1678
Total number of Limit Nodes:	51

Executed Functions

Function 0040310D Relevance: 84.3, APIs: 25, Strings: 23, Instructions: 313
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				intOrPtr _t40;
				CHAR* _t44;
				char* _t47;
				signed int _t49;
				void* _t53;
				intOrPtr _t55;
				int _t57;
				signed int _t60;
				signed int _t61;
				int _t62;
				signed int _t64;
				signed int _t67;
				intOrPtr _t80;
				int _t84;
				intOrPtr _t86;
				void* _t88;
				void* _t100;
				intOrPtr* _t101;
				void* _t104;
				CHAR* _t109;
				signed int _t110;
				signed int _t111;
				signed int _t112;
				void* _t114;
				signed int _t116;
				char* _t118;
				signed int _t119;
				void* _t121;
				void* _t122;
				intOrPtr _t130;
				char _t139;

				 *(_t122 + 0x1c) = 0;
				 *((intOrPtr*)(_t122 + 0x14)) = "Error writing temporary file. Make sure your temp folder is valid.";
				_t111 = 0;
				 *(_t122 + 0x18) = 0x20;
				SetErrorMode(0x8001); // executed
				if(GetVersion() != 6) {
					_t101 = E00405F2D(0);
					if(_t101 != 0) {
						 *_t101(0xc00);
					}
				}
				E00405EC3("UXTHEME"); // executed
				E00405EC3("USERENV"); // executed
				E00405EC3("SETUPAPI"); // executed
				E00405F2D(0xd);
				_t40 = E00405F2D(0xb);
				 *0x42ec44 = _t40;
				__imp__#17();
				__imp__OleInitialize(0); // executed
				 *0x42ecf8 = _t40;
				SHGetFileInfoA(0x429078, 0, _t122 + 0x34, 0x160, 0); // executed
				E00405BA1("Fast! Setup", "NSIS Error");
				_t44 = GetCommandLineA();
				_t118 = "\"C:\\Users\\alfredo\\Desktop\\Setup 2.exe\" ";
				E00405BA1(_t118, _t44);
				 *0x42ec40 = GetModuleHandleA(0);
				_t47 = _t118;
				if("\"C:\\Users\\alfredo\\Desktop\\Setup 2.exe\" " == 0x22) {
					 *((char*)(_t122 + 0x14)) = 0x22;
					_t47 =  &M00434001;
				}
				_t49 = CharNextA(E004056BF(_t47,  *((intOrPtr*)(_t122 + 0x14))));
				 *(_t122 + 0x1c) = _t49;
				while(1) {
					_t104 =  *_t49;
					_t126 = _t104;
					if(_t104 == 0) {
						break;
					}
					__eflags = _t104 - 0x20;
					if(_t104 != 0x20) {
						L8:
						__eflags =  *_t49 - 0x22;
						 *((char*)(_t122 + 0x14)) = 0x20;
						if( *_t49 == 0x22) {
							_t49 = _t49 + 1;
							__eflags = _t49;
							 *((char*)(_t122 + 0x14)) = 0x22;
						}
						__eflags =  *_t49 - 0x2f;
						if( *_t49 != 0x2f) {
							L18:
							_t49 = E004056BF(_t49,  *((intOrPtr*)(_t122 + 0x14)));
							__eflags =  *_t49 - 0x22;
							if(__eflags == 0) {
								_t49 = _t49 + 1;
								__eflags = _t49;
							}
							continue;
						} else {
							_t49 = _t49 + 1;
							__eflags =  *_t49 - 0x53;
							if( *_t49 == 0x53) {
								__eflags = ( *(_t49 + 1) | 0x00000020) - 0x20;
								if(( *(_t49 + 1) | 0x00000020) == 0x20) {
									_t111 = _t111 | 0x00000002;
									__eflags = _t111;
								}
							}
							__eflags =  *_t49 - 0x4352434e;
							if( *_t49 == 0x4352434e) {
								__eflags = ( *(_t49 + 4) | 0x00000020) - 0x20;
								if(( *(_t49 + 4) | 0x00000020) == 0x20) {
									_t111 = _t111 | 0x00000004;
									__eflags = _t111;
								}
							}
							__eflags =  *((intOrPtr*)(_t49 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t49 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t49 - 2)) = 0;
								_t50 = _t49 + 2;
								__eflags = _t49 + 2;
								E00405BA1("C:\\Program Files (x86)\\Fast!", _t50);
								L23:
								_t109 = "C:\\Users\\alfredo\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t109);
								_t53 = E004030DC(_t126);
								_t127 = _t53;
								if(_t53 != 0) {
									L25:
									DeleteFileA("1033"); // executed
									_t55 = E00402C38(_t128, _t111); // executed
									 *((intOrPtr*)(_t122 + 0x10)) = _t55;
									if(_t55 != 0) {
										L35:
										E0040351A();
										__imp__OleUninitialize();
										_t135 =  *((intOrPtr*)(_t122 + 0x10));
										if( *((intOrPtr*)(_t122 + 0x10)) == 0) {
											__eflags =  *0x42ecd4; // 0x0
											if(__eflags == 0) {
												L62:
												_t57 =  *0x42ecec; // 0xffffffff
												__eflags = _t57 - 0xffffffff;
												if(_t57 != 0xffffffff) {
													 *(_t122 + 0x18) = _t57;
												}
												ExitProcess( *(_t122 + 0x18));
											}
											_t119 = E00405F2D(5);
											_t112 = E00405F2D(6);
											_t60 = E00405F2D(7);
											__eflags = _t119;
											_t110 = _t60;
											if(_t119 != 0) {
												__eflags = _t112;
												if(_t112 != 0) {
													__eflags = _t110;
													if(_t110 != 0) {
														_t67 =  *_t119(GetCurrentProcess(), 0x28, _t122 + 0x1c);
														__eflags = _t67;
														if(_t67 != 0) {
															 *_t112(0, "SeShutdownPrivilege", _t122 + 0x24);
															 *(_t122 + 0x38) = 1;
															 *(_t122 + 0x44) = 2;
															 *_t110( *((intOrPtr*)(_t122 + 0x30)), 0, _t122 + 0x28, 0, 0, 0);
														}
													}
												}
											}
											_t61 = E00405F2D(8);
											__eflags = _t61;
											if(_t61 == 0) {
												L60:
												_t62 = ExitWindowsEx(2, 0x80040002);
												__eflags = _t62;
												if(_t62 != 0) {
													goto L62;
												}
												goto L61;
											} else {
												_t64 =  *_t61(0, 0, 0, 0x25, 0x80040002);
												__eflags = _t64;
												if(_t64 == 0) {
													L61:
													E0040140B(9);
													goto L62;
												}
												goto L60;
											}
										}
										E00405462( *((intOrPtr*)(_t122 + 0x14)), 0x200010);
										ExitProcess(2);
									}
									_t130 =  *0x42ec5c; // 0x0
									if(_t130 == 0) {
										L34:
										 *0x42ecec =  *0x42ecec | 0xffffffff;
										 *(_t122 + 0x18) = E004035F4( *0x42ecec);
										goto L35;
									}
									_t116 = E004056BF(_t118, 0);
									while(_t116 >= _t118) {
										__eflags =  *_t116 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t116 = _t116 - 1;
										__eflags = _t116;
									}
									_t132 = _t116 - _t118;
									 *((intOrPtr*)(_t122 + 0x10)) = "Error launching installer";
									if(_t116 < _t118) {
										_t114 = E004053E9(_t135);
										lstrcatA(_t109, "~nsu");
										if(_t114 != 0) {
											lstrcatA(_t109, "A");
										}
										lstrcatA(_t109, ".tmp");
										_t120 = "C:\\Users\\alfredo\\Desktop";
										if(lstrcmpiA(_t109, "C:\\Users\\alfredo\\Desktop") != 0) {
											_push(_t109);
											if(_t114 == 0) {
												E004053CC();
											} else {
												E0040534F();
											}
											SetCurrentDirectoryA(_t109);
											_t139 = "C:\\Program Files (x86)\\Fast!"; // 0x43
											if(_t139 == 0) {
												E00405BA1("C:\\Program Files (x86)\\Fast!", _t120);
											}
											E00405BA1(0x42f000,  *(_t122 + 0x1c));
											 *0x42f400 = 0x41;
											_t121 = 0x1a;
											do {
												_t80 =  *0x42ec50; // 0x6d6978
												E00405BC3(0, _t109, 0x428c78, 0x428c78,  *((intOrPtr*)(_t80 + 0x120)));
												DeleteFileA(0x428c78);
												if( *((intOrPtr*)(_t122 + 0x10)) != 0) {
													_t84 = CopyFileA("C:\\Users\\alfredo\\Desktop\\Setup 2.exe", 0x428c78, 1);
													_t141 = _t84;
													if(_t84 != 0) {
														_push(0);
														_push(0x428c78);
														E004058EF(_t141);
														_t86 =  *0x42ec50; // 0x6d6978
														E00405BC3(0, _t109, 0x428c78, 0x428c78,  *((intOrPtr*)(_t86 + 0x124)));
														_t88 = E00405401(0x428c78);
														if(_t88 != 0) {
															CloseHandle(_t88);
															 *((intOrPtr*)(_t122 + 0x10)) = 0;
														}
													}
												}
												 *0x42f400 =  *0x42f400 + 1;
												_t121 = _t121 - 1;
												_t143 = _t121;
											} while (_t121 != 0);
											_push(0);
											_push(_t109);
											E004058EF(_t143);
										}
										goto L35;
									}
									 *_t116 = 0;
									_t117 = _t116 + 4;
									if(E00405775(_t132, _t116 + 4) == 0) {
										goto L35;
									}
									E00405BA1("C:\\Program Files (x86)\\Fast!", _t117);
									E00405BA1("C:\\Program Files (x86)\\Fast!", _t117);
									 *((intOrPtr*)(_t122 + 0x10)) = 0;
									goto L34;
								}
								GetWindowsDirectoryA(_t109, 0x3fb);
								lstrcatA(_t109, "\\Temp");
								_t100 = E004030DC(_t127);
								_t128 = _t100;
								if(_t100 == 0) {
									goto L35;
								}
								goto L25;
							} else {
								goto L18;
							}
						}
					} else {
						goto L7;
					}
					do {
						L7:
						_t49 = _t49 + 1;
						__eflags =  *_t49 - 0x20;
					} while ( *_t49 == 0x20);
					goto L8;
				}
				goto L23;
			}

0x0040311e
0x00403122
0x0040312a
0x0040312c
0x00403131
0x00403141
0x00403144
0x0040314b
0x00403152
0x00403152
0x0040314b
0x00403159
0x00403163
0x0040316d
0x00403174
0x0040317b
0x00403180
0x00403185
0x0040318c
0x00403192
0x004031a8
0x004031b8
0x004031bd
0x004031c3
0x004031ca
0x004031dd
0x004031e2
0x004031e4
0x004031e6
0x004031eb
0x004031eb
0x004031fb
0x00403201
0x0040326a
0x0040326a
0x0040326c
0x0040326e
0x00000000
0x00000000
0x00403207
0x0040320a
0x00403212
0x00403212
0x00403215
0x0040321a
0x0040321c
0x0040321c
0x0040321d
0x0040321d
0x00403222
0x00403225
0x0040325a
0x0040325f
0x00403264
0x00403267
0x00403269
0x00403269
0x00403269
0x00000000
0x00403227
0x00403227
0x00403228
0x0040322b
0x00403233
0x00403236
0x00403238
0x00403238
0x00403238
0x00403236
0x0040323b
0x00403241
0x00403249
0x0040324c
0x0040324e
0x0040324e
0x0040324e
0x0040324c
0x00403251
0x00403258
0x00403272
0x00403275
0x00403275
0x0040327e
0x00403283
0x00403283
0x0040328e
0x00403294
0x00403299
0x0040329b
0x004032bd
0x004032c2
0x004032c9
0x004032d0
0x004032d4
0x0040333b
0x0040333b
0x00403340
0x00403346
0x0040334a
0x0040345f
0x00403465
0x00403502
0x00403502
0x00403507
0x0040350a
0x0040350c
0x0040350c
0x00403514
0x00403514
0x00403474
0x0040347d
0x0040347f
0x00403484
0x00403486
0x00403488
0x0040348a
0x0040348c
0x0040348e
0x00403490
0x004034a0
0x004034a2
0x004034a4
0x004034b1
0x004034c0
0x004034c8
0x004034d0
0x004034d0
0x004034a4
0x00403490
0x0040348c
0x004034d4
0x004034d9
0x004034e0
0x004034ee
0x004034f1
0x004034f7
0x004034f9
0x00000000
0x00000000
0x00000000
0x004034e2
0x004034e8
0x004034ea
0x004034ec
0x004034fb
0x004034fd
0x00000000
0x004034fd
0x00000000
0x004034ec
0x004034e0
0x00403359
0x00403360
0x00403360
0x004032d6
0x004032dc
0x0040332b
0x0040332b
0x00403337
0x00000000
0x00403337
0x004032e5
0x004032f2
0x004032e9
0x004032ef
0x00000000
0x00000000
0x004032f1
0x004032f1
0x004032f1
0x004032f6
0x004032f8
0x00403300
0x00403371
0x00403373
0x0040337a
0x00403382
0x00403382
0x0040338d
0x00403392
0x004033a1
0x004033a5
0x004033a6
0x004033af
0x004033a8
0x004033a8
0x004033a8
0x004033b5
0x004033bb
0x004033c1
0x004033c9
0x004033c9
0x004033d7
0x004033de
0x004033e7
0x004033ed
0x004033ed
0x004033f9
0x004033ff
0x00403409
0x00403413
0x00403419
0x0040341b
0x0040341d
0x0040341e
0x0040341f
0x00403424
0x00403430
0x00403436
0x0040343d
0x00403440
0x00403446
0x00403446
0x0040343d
0x0040341b
0x0040344a
0x00403450
0x00403450
0x00403450
0x00403453
0x00403454
0x00403455
0x00403455
0x00000000
0x004033a1
0x00403302
0x00403304
0x0040330f
0x00000000
0x00000000
0x00403317
0x00403322
0x00403327
0x00000000
0x00403327
0x004032a3
0x004032af
0x004032b4
0x004032b9
0x004032bb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00403258
0x00000000
0x00000000
0x00000000
0x0040320c
0x0040320c
0x0040320c
0x0040320d
0x0040320d
0x00000000
0x0040320c
0x00000000

APIs

SetErrorMode.KERNEL32 ref: 00403131
GetVersion.KERNEL32 ref: 00403137
#17.COMCTL32(0000000B,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00403185
OleInitialize.OLE32(00000000), ref: 0040318C
SHGetFileInfoA.SHELL32(00429078,00000000,?,00000160,00000000), ref: 004031A8
GetCommandLineA.KERNEL32(Fast! Setup,NSIS Error), ref: 004031BD
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Setup 2.exe" ,00000000), ref: 004031D0
CharNextA.USER32(00000000,"C:\Users\user\Desktop\Setup 2.exe" ,00409188), ref: 004031FB
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040328E
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004032A3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032AF
DeleteFileA.KERNEL32(1033), ref: 004032C2

Part of subcall function 00405F2D: GetModuleHandleA.KERNEL32(?,?,00000000,00403179,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00405F3F
Part of subcall function 00405F2D: GetProcAddress.KERNEL32(00000000,?), ref: 00405F5A

OleUninitialize.OLE32(00000000), ref: 00403340
ExitProcess.KERNEL32 ref: 00403360
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Setup 2.exe" ,00000000,00000000), ref: 00403373
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00409148,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Setup 2.exe" ,00000000,00000000), ref: 00403382
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Setup 2.exe" ,00000000,00000000), ref: 0040338D
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop), ref: 00403399
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 004033B5
DeleteFileA.KERNEL32(00428C78,00428C78,?,0042F000,?), ref: 004033FF
CopyFileA.KERNEL32(C:\Users\user\Desktop\Setup 2.exe,00428C78,00000001), ref: 00403413
CloseHandle.KERNEL32(00000000,00428C78,00428C78,?,00428C78,00000000), ref: 00403440
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000006,00000005), ref: 00403499
ExitWindowsEx.USER32(00000002,80040002), ref: 004034F1
ExitProcess.KERNEL32 ref: 00403514

Strings

1033, xrefs: 004032BD
~nsu, xrefs: 0040336B
xim, xrefs: 004033ED, 00403424
UXTHEME, xrefs: 00403154
\Temp, xrefs: 004032A9
C:\Users\user\Desktop, xrefs: 00403392, 00403397, 004033C3
SETUPAPI, xrefs: 00403168
/D=, xrefs: 00403251
C:\Program Files (x86)\Fast!, xrefs: 0040331D
NCRC, xrefs: 0040323B
C:\Users\user\AppData\Local\Temp\, xrefs: 00403283, 00403288, 004032A2, 004032AE, 00403370, 00403381, 0040338C, 00403398, 004033A5, 004033B4, 00403454
Fast! Setup, xrefs: 004031B3
C:\Program Files (x86)\Fast!, xrefs: 00403279, 00403312, 004033BB, 004033C4
C:\Users\user\Desktop\Setup 2.exe, xrefs: 0040340E
USERENV, xrefs: 0040315E
", xrefs: 0040321D
SeShutdownPrivilege, xrefs: 004034AB
Error launching installer, xrefs: 004032F8
"C:\Users\user\Desktop\Setup 2.exe" , xrefs: 004031C3, 004031C9, 004032DF
.tmp, xrefs: 00403387
, xrefs: 0040312C
_?=, xrefs: 004032E9
NSIS Error, xrefs: 004031AE

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Filelstrcat$ExitHandleProcess$CurrentDeleteDirectoryModuleWindows$AddressCharCloseCommandCopyErrorInfoInitializeLineModeNextPathProcTempUninitializeVersionlstrcmpi
String ID: $ /D=$ _?=$"$"C:\Users\user\Desktop\Setup 2.exe" $.tmp$1033$C:\Program Files (x86)\Fast!$C:\Program Files (x86)\Fast!$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Setup 2.exe$Error launching installer$Fast! Setup$NCRC$NSIS Error$SETUPAPI$SeShutdownPrivilege$USERENV$UXTHEME$\Temp$xim$~nsu
API String ID: 728943206-2114237627
Opcode ID: 0319a28c6672e9b8499cf210008a255cf0d922bcf97f806866d265c029d57cb6
Instruction ID: 451575da7f46b68c591153a14feb1e54add6b468c03afba2ffefeba693a227d9
Opcode Fuzzy Hash: 0319a28c6672e9b8499cf210008a255cf0d922bcf97f806866d265c029d57cb6
Instruction Fuzzy Hash: 55A1E3705083416AE7216F629C4AF6B7EACEB4570AF04047FF541B61D2CB7C9A058A6F

Uniqueness

Uniqueness Score: -1.00%

Function 00404FCB Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00404FCB(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				unsigned int _t93;
				int _t94;
				int _t95;
				long _t98;
				void* _t101;
				intOrPtr _t112;
				void* _t120;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x42e424; // 0x903bc
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						_t120 = CreateThread(0, 0, E00404F5F, GetDlgItem(_a4, 0x3ec), 0,  &_v12); // executed
						CloseHandle(_t120);
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							__eflags = _a12 - _t154;
							if(_a12 != _t154) {
								goto L20;
							}
							_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
							__eflags = _t87 - _t149;
							_a8 = _t87;
							if(_t87 <= _t149) {
								L37:
								return 0;
							}
							_t160 = CreatePopupMenu();
							AppendMenuA(_t160, _t149, 1, E00405BC3(_t149, _t154, _t160, _t149, 0xffffffe1));
							_t92 = _a16;
							__eflags = _t92 - 0xffffffff;
							if(_t92 != 0xffffffff) {
								_t150 = _t92;
								_t93 = _t92 >> 0x10;
								__eflags = _t93;
								_t94 = _t93;
							} else {
								GetWindowRect(_t154,  &_v28);
								_t150 = _v28.left;
								_t94 = _v28.top;
							}
							_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
							_t162 = 1;
							__eflags = _t95 - 1;
							if(_t95 == 1) {
								_v60 = _t149;
								_v48 = 0x42a0c0;
								_v44 = 0xfff;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t98 = SendMessageA(_v8, 0x102d, _a4,  &_v68);
									__eflags = _a4 - _t149;
									_t162 = _t162 + _t98 + 2;
								} while (_a4 != _t149);
								OpenClipboard(_t149);
								EmptyClipboard();
								_t101 = GlobalAlloc(0x42, _t162);
								_a4 = _t101;
								_t163 = GlobalLock(_t101);
								do {
									_v48 = _t163;
									_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
									 *_t164 = 0xa0d;
									_t163 = _t164 + 2;
									_t149 = _t149 + 1;
									__eflags = _t149 - _a8;
								} while (_t149 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L37;
						}
						__eflags =  *0x42e40c - _t149; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x42ec48, 8);
							__eflags =  *0x42eccc - _t149; // 0x0
							if(__eflags == 0) {
								_t112 =  *0x429890; // 0x6d6ae4
								E00404E8D( *((intOrPtr*)(_t112 + 0x34)), _t149);
							}
							E00403E36(1);
							goto L25;
						}
						 *0x429488 = 2;
						E00403E36(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00403EC4(_a8, _a12, _a16);
						}
						ShowWindow( *0x42e410, _t149);
						ShowWindow(_t154, 8);
						E00403E92(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x42ec50; // 0x6d6978
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x42e410 = GetDlgItem(_a4, 0x403);
				 *0x42e408 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x42e424 = _t127;
				_v8 = _t127;
				E00403E92( *0x42e410);
				 *0x42e414 = E0040472F(4);
				 *0x42e42c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403E5D(_a4);
				if(( *0x42ec58 & 0x00000003) != 0) {
					ShowWindow( *0x42e410, _t149);
					if(( *0x42ec58 & 0x00000002) != 0) {
						 *0x42e410 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403E92( *0x42e408);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x42ec58 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

0x00404fd4
0x00404fda
0x00404fe3
0x00404fe6
0x00405177
0x0040517e
0x0040519b
0x004051a2
0x004051a2
0x004051a8
0x004051b5
0x004051d3
0x004051d3
0x004051da
0x00405231
0x00405231
0x00405235
0x00000000
0x00000000
0x00405237
0x0040523a
0x00000000
0x00000000
0x00405244
0x0040524a
0x0040524c
0x0040524f
0x00405348
0x00000000
0x00405348
0x0040525e
0x0040526a
0x00405270
0x00405273
0x00405276
0x0040528b
0x0040528e
0x0040528e
0x00405291
0x00405278
0x0040527d
0x00405283
0x00405286
0x00405286
0x004052a1
0x004052a9
0x004052aa
0x004052ac
0x004052b5
0x004052b8
0x004052bf
0x004052c6
0x004052ce
0x004052ce
0x004052dc
0x004052e2
0x004052e5
0x004052e5
0x004052ec
0x004052f2
0x004052fb
0x00405302
0x0040530b
0x0040530d
0x00405310
0x0040531f
0x00405321
0x00405327
0x00405328
0x00405329
0x00405329
0x00405331
0x0040533c
0x00405342
0x00405342
0x00000000
0x004052ac
0x004051dc
0x004051e2
0x00405212
0x00405214
0x0040521a
0x0040521c
0x00405225
0x00405225
0x0040522c
0x00000000
0x0040522c
0x004051e6
0x004051f0
0x00000000
0x004051b7
0x004051b7
0x004051bd
0x004051f5
0x00000000
0x004051fe
0x004051c6
0x004051cb
0x004051ce
0x00000000
0x004051ce
0x004051b5
0x00404fec
0x00404ff0
0x00404ff9
0x00405000
0x00405003
0x00405006
0x00405009
0x0040500a
0x0040500b
0x00405024
0x00405027
0x00405031
0x00405040
0x00405048
0x00405050
0x00405055
0x00405058
0x00405064
0x0040506d
0x00405076
0x00405099
0x0040509f
0x004050b0
0x004050b5
0x004050c3
0x004050d1
0x004050d1
0x004050d6
0x004050e4
0x004050e4
0x004050e9
0x004050ec
0x004050f1
0x004050fd
0x00405106
0x00405113
0x00405122
0x00405115
0x0040511a
0x0040511a
0x0040512e
0x0040512e
0x00405142
0x0040514b
0x00405154
0x00405164
0x00405170
0x00405170
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 0040502A
GetDlgItem.USER32(?,000003EE), ref: 00405039
GetClientRect.USER32(?,?), ref: 00405076
GetSystemMetrics.USER32(00000015), ref: 0040507E
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 0040509F
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004050B0
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 004050C3
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 004050D1
SendMessageA.USER32(?,00001024,00000000,?), ref: 004050E4
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405106
ShowWindow.USER32(?,00000008), ref: 0040511A
GetDlgItem.USER32(?,000003EC), ref: 0040513B
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040514B
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405164
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 00405170
GetDlgItem.USER32(?,000003F8), ref: 00405048

Part of subcall function 00403E92: SendMessageA.USER32(00000028,?,00000001,00403CC3), ref: 00403EA0

GetDlgItem.USER32(?,000003EC), ref: 0040518D
CreateThread.KERNEL32(00000000,00000000,Function_00004F5F,00000000), ref: 0040519B
CloseHandle.KERNEL32(00000000), ref: 004051A2
ShowWindow.USER32(00000000), ref: 004051C6
ShowWindow.USER32(000903BC,00000008), ref: 004051CB
ShowWindow.USER32(00000008), ref: 00405212
SendMessageA.USER32(000903BC,00001004,00000000,00000000), ref: 00405244
CreatePopupMenu.USER32 ref: 00405255
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 0040526A
GetWindowRect.USER32(000903BC,?), ref: 0040527D
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004052A1
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004052DC
OpenClipboard.USER32(00000000), ref: 004052EC
EmptyClipboard.USER32 ref: 004052F2
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004052FB
GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405305
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405319
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405331
SetClipboardData.USER32(00000001,00000000), ref: 0040533C
CloseClipboard.USER32 ref: 00405342

Strings

xim, xrefs: 0040500B
jm, xrefs: 0040521C
{, xrefs: 00405231

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: xim${$jm
API String ID: 590372296-785651975
Opcode ID: e65c7ed93ec362230b02207a1bb7ae1b29827c0c358cf25c559d0a374f8d29c7
Instruction ID: 9773a58430cbfeecb670b401eb949321dafbae4239e93fa01985779c5be3160a
Opcode Fuzzy Hash: e65c7ed93ec362230b02207a1bb7ae1b29827c0c358cf25c559d0a374f8d29c7
Instruction Fuzzy Hash: ADA14A70900208BFDB11AFA1DC89AAE7F79FB08354F40853AFA04BA1A0C7755A51DF99

Uniqueness

Uniqueness Score: -1.00%

Function 10001855 Relevance: 54.5, APIs: 21, Strings: 10, Instructions: 215
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E10001855() {
				signed int _v8;
				long _v12;
				long _v16;
				int _v20;
				int _v24;
				int _v28;
				int _v32;
				CHAR* _v36;
				void* _v40;
				CHAR* _v44;
				int _t64;
				void* _t66;
				int _t73;
				signed int _t74;
				signed int _t75;
				int _t79;
				int _t80;
				int _t81;
				int _t82;
				int _t83;
				int _t84;
				int _t85;
				int _t86;
				void* _t87;
				int _t92;
				struct HWND__* _t95;
				void* _t100;
				CHAR* _t110;
				struct HWND__* _t111;
				signed int _t118;

				_t110 = HeapAlloc(GetProcessHeap(), 8,  *0x100050dc +  *0x100050dc);
				_t113 =  *0x100050dc + _t110;
				_v44 = _t110;
				_v36 =  *0x100050dc + _t110;
				if(_t110 == 0) {
					return E10001E27("error");
				}
				_t64 = E10001DD9(_t110, 0);
				__eflags = _t64;
				if(__eflags != 0) {
					L4:
					E10001E27("error");
					_push(_t110);
					_push(0);
					_t66 = GetProcessHeap();
					goto L27;
				} else {
					L10001FEC();
					_v12 = _t64;
					L10001FEC();
					_v16 = _t64;
					E10001252(__eflags,  &_v32,  &_v28,  &_v24,  &_v20);
					_t73 = E10001DD9(_t113, 0);
					__eflags = _t73;
					if(_t73 == 0) {
						_t74 =  *0x100050d4;
						_v8 = _t74;
						_t75 = _t74 + 1;
						_v40 = _t75;
						 *0x100050d4 = _t75;
						 *0x100050d8 = HeapReAlloc(GetProcessHeap(), 8,  *0x100050d8, _t75 * 0x418);
						_t79 = lstrcmpiA(_t110, "BUTTON");
						__eflags = _t79;
						if(_t79 != 0) {
							_t80 = lstrcmpiA(_t110, "EDIT");
							__eflags = _t80;
							if(_t80 != 0) {
								_t81 = lstrcmpiA(_t110, "COMBOBOX");
								__eflags = _t81;
								if(_t81 != 0) {
									_t82 = lstrcmpiA(_t110, "LISTBOX");
									__eflags = _t82;
									if(_t82 != 0) {
										_t83 = lstrcmpiA(_t110, "RichEdit");
										__eflags = _t83;
										if(_t83 != 0) {
											_t84 = lstrcmpiA(_t110, "RICHEDIT_CLASS");
											__eflags = _t84;
											if(_t84 != 0) {
												_t85 = lstrcmpiA(_t110, "STATIC");
												__eflags = _t85;
												if(_t85 != 0) {
													_t86 = lstrcmpiA(_t110, "LINK");
													_t118 = _v8 * 0x418;
													__eflags = _t86;
													_t87 =  *0x100050d8;
													if(_t86 != 0) {
														_t36 = _t118 + _t87 + 4;
														 *_t36 =  *(_t118 + _t87 + 4) & 0x00000000;
														__eflags =  *_t36;
													} else {
														 *(_t118 + _t87 + 4) = 8;
													}
												} else {
													_t118 = _v8 * 0x418;
													 *(_t118 +  *0x100050d8 + 4) = 7;
												}
											} else {
												_t118 = _v8 * 0x418;
												 *(_t118 +  *0x100050d8 + 4) = 6;
											}
										} else {
											_t118 = _v8 * 0x418;
											 *(_t118 +  *0x100050d8 + 4) = 5;
										}
									} else {
										_t118 = _v8 * 0x418;
										 *(_t118 +  *0x100050d8 + 4) = 4;
									}
								} else {
									_t118 = _v8 * 0x418;
									 *(_t118 +  *0x100050d8 + 4) = 3;
								}
							} else {
								_t118 = _v8 * 0x418;
								 *(_t118 +  *0x100050d8 + 4) = 2;
							}
						} else {
							_t118 = _v8 * 0x418;
							 *(_t118 +  *0x100050d8 + 4) = 1;
						}
						E10001D0C( *(_t118 +  *0x100050d8 + 4),  &_v12,  &_v16);
						_t92 = lstrcmpiA(_t110, "LINK");
						__eflags = _t92;
						if(_t92 == 0) {
							_t110 = "BUTTON";
						}
						_t95 = CreateWindowExA(_v16, _t110, _v36, _v12, _v32, _v28, _v24, _v20,  *0x100050c0, _v8 + 0x4b0,  *0x100050a4, 0); // executed
						_t111 = _t95;
						 *( *0x100050d8 + _t118) = _t111;
						SetPropA(_t111, "NSIS: nsControl pointer property", _v40); // executed
						SendMessageA(_t111, 0x30, SendMessageA( *0x100050c4, 0x31, 0, 0), 1);
						_t100 =  *0x100050d8;
						__eflags =  *((intOrPtr*)(_t118 + _t100 + 4)) - 8;
						if( *((intOrPtr*)(_t118 + _t100 + 4)) == 8) {
							 *((intOrPtr*)(_t118 +  *0x100050d8 + 0x414)) = SetWindowLongA(_t111, 0xfffffffc, E10001480);
						}
						_push(_t111);
						L10002016();
						_push(_v44);
						_push(0);
						_t66 = GetProcessHeap();
						L27:
						return HeapFree(_t66, ??, ??);
					}
					goto L4;
				}
			}

0x10001877
0x10001880
0x10001883
0x10001886
0x10001889
0x00000000
0x10001890
0x1000189d
0x100018a2
0x100018a4
0x100018d7
0x100018dc
0x100018e1
0x100018e2
0x100018e4
0x00000000
0x100018a6
0x100018a6
0x100018ab
0x100018ae
0x100018b3
0x100018c6
0x100018ce
0x100018d3
0x100018d5
0x100018eb
0x100018f0
0x100018f3
0x100018f4
0x100018f7
0x10001920
0x10001925
0x10001927
0x10001929
0x1000194c
0x1000194e
0x10001950
0x10001973
0x10001975
0x10001977
0x1000199a
0x1000199c
0x1000199e
0x100019c1
0x100019c3
0x100019c5
0x100019e5
0x100019e7
0x100019e9
0x10001a09
0x10001a0b
0x10001a0d
0x10001a2d
0x10001a32
0x10001a38
0x10001a3a
0x10001a3f
0x10001a4b
0x10001a4b
0x10001a4b
0x10001a41
0x10001a41
0x10001a41
0x10001a0f
0x10001a17
0x10001a1d
0x10001a1d
0x100019eb
0x100019f3
0x100019f9
0x100019f9
0x100019c7
0x100019cf
0x100019d5
0x100019d5
0x100019a0
0x100019a8
0x100019ae
0x100019ae
0x10001979
0x10001981
0x10001987
0x10001987
0x10001952
0x1000195a
0x10001960
0x10001960
0x1000192b
0x10001933
0x10001939
0x10001939
0x10001a61
0x10001a6c
0x10001a6e
0x10001a70
0x10001a72
0x10001a72
0x10001aa4
0x10001aad
0x10001aba
0x10001abd
0x10001add
0x10001adf
0x10001ae4
0x10001ae9
0x10001aff
0x10001aff
0x10001b06
0x10001b07
0x10001b0c
0x10001b0f
0x10001b11
0x10001b17
0x00000000
0x10001b18
0x00000000
0x100018d5

APIs

GetProcessHeap.KERNEL32(00000008,?), ref: 1000186E
HeapAlloc.KERNEL32(00000000), ref: 10001871
GetProcessHeap.KERNEL32(00000000,00000000,error,00000000,00000000), ref: 100018E4
HeapFree.KERNEL32(00000000), ref: 10001B18

Part of subcall function 10001E27: GlobalAlloc.KERNEL32(00000040,?,?,100010BE,error,?,00000104), ref: 10001E3C
Part of subcall function 10001E27: lstrcpynA.KERNEL32(00000004,?,?,100010BE,error,?,00000104), ref: 10001E52

Strings

LISTBOX, xrefs: 10001994
BUTTON, xrefs: 1000191A, 10001A72, 10001AA0
STATIC, xrefs: 10001A03
COMBOBOX, xrefs: 1000196D
RichEdit, xrefs: 100019BB
LINK, xrefs: 10001A27, 10001A66
error, xrefs: 1000188B, 100018D7
EDIT, xrefs: 10001946
NSIS: nsControl pointer property, xrefs: 10001AB4
RICHEDIT_CLASS, xrefs: 100019DF

Memory Dump Source

Source File: 00000001.00000002.2975197977.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2975169750.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975269413.0000000010003000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975296586.0000000010004000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975376888.0000000010007000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Setup 2.jbxd

Similarity

API ID: Heap$AllocProcess$FreeGloballstrcpyn
String ID: BUTTON$COMBOBOX$EDIT$LINK$LISTBOX$NSIS: nsControl pointer property$RICHEDIT_CLASS$RichEdit$STATIC$error
API String ID: 1913068523-3375361224
Opcode ID: 396ee5e151b1c760e8dae6fb84be9faa7cfe0bccb899ae45509933263550e0aa
Instruction ID: 151c4fe2bd675fdd235840e266e0e02c961261a7e736882da66085055472ad48
Opcode Fuzzy Hash: 396ee5e151b1c760e8dae6fb84be9faa7cfe0bccb899ae45509933263550e0aa
Instruction Fuzzy Hash: 4B812DB2900219ABF711DBA4CD85FDFBBFCEB043C5F128025EA05B7159DB35A9448BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004054C6 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E004054C6(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E00405775(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72); // executed
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x42ecc8 =  *0x42ecc8 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E00405BA1(0x42b0c8, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E004056DB(_t72);
					} else {
						lstrcatA(0x42b0c8, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x409010);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]);
						_t37 = FindFirstFileA(0x42b0c8,  &_v332);
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E004056BF( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E00405BA1(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E00405859(_t72);
									_t52 = DeleteFileA(_t72);
									__eflags = _t52;
									if(_t52 != 0) {
										E00404E8D(0xfffffff2, _t72);
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x42ecc8 =  *0x42ecc8 + 1;
										} else {
											E00404E8D(0xfffffff1, _t72);
											E004058EF(__eflags, _t72, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E004054C6(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332);
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4);
						goto L29;
					}
					__eflags =  *0x42b0c8 - 0x5c;
					if( *0x42b0c8 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405E9C(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E00405694(_t72);
							E00405859(_t72);
							_t37 = RemoveDirectoryA(_t72);
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404E8D(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404E8D(0xfffffff1, _t72);
							return E004058EF(__eflags, _t72, 0);
						}
						L33:
						 *0x42ecc8 =  *0x42ecc8 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x004054d1
0x004054d5
0x004054de
0x004054e1
0x004054e4
0x004054ec
0x004054ee
0x004054ef
0x00000000
0x004054ef
0x004054fe
0x004054fe
0x00405501
0x00405504
0x00405518
0x0040551f
0x00405524
0x00405526
0x00405536
0x00405528
0x0040552e
0x0040552e
0x0040553b
0x0040553e
0x00405549
0x0040554f
0x00405554
0x00405564
0x00405566
0x0040556c
0x0040556f
0x00405572
0x0040562f
0x0040562f
0x00405633
0x00405635
0x00405635
0x00405635
0x00405635
0x00000000
0x00000000
0x00000000
0x00000000
0x00405578
0x00405578
0x00405581
0x00405587
0x0040558c
0x0040558f
0x00405591
0x00405595
0x00405597
0x00405597
0x00405595
0x0040559a
0x0040559d
0x004055b0
0x004055b2
0x004055b7
0x004055be
0x004055d6
0x004055dc
0x004055e2
0x004055e4
0x00405609
0x004055e6
0x004055e6
0x004055ea
0x004055fe
0x004055ec
0x004055ef
0x004055f7
0x004055f7
0x004055ea
0x004055c0
0x004055c6
0x004055c8
0x004055ce
0x004055ce
0x004055c8
0x00000000
0x004055be
0x0040559f
0x004055a2
0x004055a4
0x00000000
0x00000000
0x004055a6
0x004055a8
0x00000000
0x00000000
0x004055aa
0x004055ae
0x00000000
0x00000000
0x00000000
0x0040560e
0x00405618
0x0040561e
0x0040561e
0x00405629
0x00000000
0x00405629
0x00405540
0x00405547
0x00000000
0x00000000
0x00000000
0x00405506
0x00405506
0x00405508
0x00405639
0x0040563c
0x0040563f
0x00405691
0x00405691
0x00405691
0x00405641
0x00405644
0x0040564f
0x00405654
0x00405656
0x00000000
0x00000000
0x00405659
0x0040565f
0x00405665
0x0040566b
0x0040566d
0x00000000
0x00405689
0x0040566f
0x00405673
0x00000000
0x00000000
0x00405678
0x00000000
0x0040567f
0x00405646
0x00405646
0x00000000
0x00405646
0x0040550e
0x00405512
0x00000000
0x00000000
0x00000000
0x00405512

APIs

DeleteFileA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004054E4
lstrcatA.KERNEL32(0042B0C8,\*.*,0042B0C8,?,00000000,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040552E
lstrcatA.KERNEL32(?,00409010,?,0042B0C8,?,00000000,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040554F
lstrlenA.KERNEL32(?,?,00409010,?,0042B0C8,?,00000000,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405555
FindFirstFileA.KERNEL32(0042B0C8,?,?,?,00409010,?,0042B0C8,?,00000000,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405566
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 00405618
FindClose.KERNEL32(?), ref: 00405629

Strings

\*.*, xrefs: 00405528
"C:\Users\user\Desktop\Setup 2.exe" , xrefs: 004054C6
C:\Users\user\AppData\Local\Temp\, xrefs: 004054D0

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Setup 2.exe" $C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-2243380206
Opcode ID: ad6c7cf66d117ae4599fe49224b28dde54b9d70e3c4c05928877fb1b4a441b68
Instruction ID: 7349ebf4964971957ddff473b41d0a41d9b63905a7032000284e6e99f459cf31
Opcode Fuzzy Hash: ad6c7cf66d117ae4599fe49224b28dde54b9d70e3c4c05928877fb1b4a441b68
Instruction Fuzzy Hash: 6C51F130404A487ADB226B228C45BBF3A69DF42318F50853BF909711D1DB7D9982DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405E9C Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E9C(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x42c110); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x42c110;
			}

0x00405ea7
0x00405eb0
0x00000000
0x00405ebd
0x00405eb3
0x00000000

APIs

FindFirstFileA.KERNEL32(?,0042C110,0042B4C8,004057B8,0042B4C8,0042B4C8,00000000,0042B4C8,0042B4C8,?,?,00000000,004054DA,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EA7
FindClose.KERNEL32(00000000), ref: 00405EB3

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6aebaf9d7798dbd017b42e649449a55c665c1a78b7402752724ce15f47781116
Instruction ID: c926c128dd9a58e72073d921ff5d887e323c8f6286bbbccf5b0fc9dd9174debe
Opcode Fuzzy Hash: 6aebaf9d7798dbd017b42e649449a55c665c1a78b7402752724ce15f47781116
Instruction Fuzzy Hash: 60D0C931A0A4205BD3011738AD0985B7A589B453713108E32F565F62E1D37899628AED

Uniqueness

Uniqueness Score: -1.00%

Function 0040398A Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E0040398A(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				intOrPtr _t44;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t142;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x42a0a4 = _t35;
					if(_t115 == 0x110) {
						 *0x42ec48 = _t125;
						 *0x42a0b8 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x429080 = _t91;
						E00403E5D(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x42e428);
						 *0x42e40c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x42a0a4 = 1;
					}
					_t122 =  *0x4091cc; // 0x1
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x42ec60;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403EA9(0x40b);
						while(1) {
							_t37 =  *0x42a0a4;
							 *0x4091cc =  *0x4091cc + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091cc; // 0x1
							__eflags = _t39 -  *0x42ec64; // 0x3
							if(__eflags == 0) {
								E0040140B(1);
							}
							__eflags =  *0x42e40c - _t133; // 0x0
							if(__eflags != 0) {
								break;
							}
							_t44 =  *0x42ec64; // 0x3
							__eflags =  *0x4091cc - _t44; // 0x1
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E00405BC3(_t116, _t125, _t130, 0x436800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403E5D(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403E5D(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403E5D(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x42eccc - _t133; // 0x0
							_v32 = _t49;
							if(__eflags != 0) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008); // executed
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100); // executed
							E00403E7F(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x429080, _t117); // executed
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x42eccc - _t133; // 0x0
							if(__eflags == 0) {
								_push( *0x42a0b8);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x429080);
							}
							E00403E92();
							E00405BA1(0x42a0c0, "Fast! Setup");
							E00405BC3(0x42a0c0, _t125, _t130,  &(0x42a0c0[lstrlenA(0x42a0c0)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x42a0c0); // executed
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x42e418); // executed
									 *0x429890 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x42ec40,  *_t130 +  *0x42e420 & 0x0000ffff, _t125,  *(0x4091d0 +  *(_t130 + 4) * 4), _t130); // executed
									__eflags = _t73 - _t133;
									 *0x42e418 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403E5D(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x42e418, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42e40c - _t133; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x42e418, 8); // executed
									E00403EA9(0x405);
									goto L58;
								}
								__eflags =  *0x42eccc - _t133; // 0x0
								if(__eflags != 0) {
									goto L61;
								}
								__eflags =  *0x42ecc0 - _t133; // 0x0
								if(__eflags != 0) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x42e418);
						 *0x42ec48 = _t133;
						EndDialog(_t125,  *0x429488);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x42e418, 0x40f, 0, 1);
						__eflags =  *0x42e40c - _t133; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x42a098, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x42a098,  ~(_a12 - 1) & _t115); // executed
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403EC4(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x42e418, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x42eccc - _t133; // 0x0
										if(__eflags == 0) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x429488 = 1;
											L21:
											_push(0x78);
											L22:
											E00403E36();
											goto L26;
										}
										E0040140B(_t127);
										 *0x429488 = _t127;
										goto L21;
									}
									__eflags =  *0x4091cc - _t133; // 0x1
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x42e418); // executed
						 *0x42e418 = _a12;
						L58:
						if( *0x42b0c0 == _t133) {
							_t142 =  *0x42e418 - _t133; // 0x303b4
							if(_t142 != 0) {
								ShowWindow(_t125, 0xa); // executed
								 *0x42b0c0 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x00403993
0x0040399c
0x00403add
0x00403ae1
0x00403ae5
0x00403ae7
0x00403aec
0x00403af7
0x00403b02
0x00403b07
0x00403b09
0x00403b0b
0x00403b0e
0x00403b13
0x00403b21
0x00403b2e
0x00403b35
0x00403b35
0x00403b36
0x00403b36
0x00403b3b
0x00403b41
0x00403b48
0x00403b4e
0x00403b50
0x00403b90
0x00403b95
0x00403b9a
0x00403b9a
0x00403b9f
0x00403ba8
0x00403baa
0x00403baf
0x00403bb5
0x00403bb9
0x00403bb9
0x00403bbe
0x00403bc4
0x00000000
0x00000000
0x00403bca
0x00403bcf
0x00403bd5
0x00000000
0x00000000
0x00403bde
0x00403be6
0x00403beb
0x00403bee
0x00403bf4
0x00403bf9
0x00403bfc
0x00403c02
0x00403c07
0x00403c0a
0x00403c10
0x00403c18
0x00403c1e
0x00403c24
0x00403c28
0x00403c2f
0x00403c2f
0x00403c2f
0x00403c39
0x00403c4b
0x00403c57
0x00403c5c
0x00403c66
0x00403c6c
0x00403c6e
0x00403c73
0x00403c70
0x00403c70
0x00403c70
0x00403c83
0x00403c9b
0x00403c9d
0x00403ca3
0x00403cb8
0x00403ca5
0x00403cae
0x00403cb0
0x00403cb0
0x00403cbe
0x00403cce
0x00403cdf
0x00403ce6
0x00403cec
0x00403cf0
0x00403cf5
0x00403cf7
0x00000000
0x00403cfd
0x00403cfd
0x00403cff
0x00000000
0x00000000
0x00403d05
0x00403d09
0x00403d2e
0x00403d34
0x00403d3a
0x00403d3c
0x00000000
0x00000000
0x00403d62
0x00403d68
0x00403d6a
0x00403d6f
0x00000000
0x00000000
0x00403d75
0x00403d78
0x00403d7b
0x00403d92
0x00403d9e
0x00403db7
0x00403dbd
0x00403dc1
0x00403dc6
0x00403dcc
0x00000000
0x00000000
0x00403dd6
0x00403de1
0x00000000
0x00403de1
0x00403d0b
0x00403d11
0x00000000
0x00000000
0x00403d17
0x00403d1d
0x00000000
0x00000000
0x00000000
0x00403d23
0x00403cf7
0x00403dee
0x00403dfa
0x00403e01
0x00000000
0x00403b52
0x00403b52
0x00403b55
0x00403b88
0x00403b88
0x00403b8a
0x00000000
0x00000000
0x00000000
0x00403b8a
0x00403b57
0x00403b5b
0x00403b60
0x00403b62
0x00000000
0x00000000
0x00403b72
0x00403b7a
0x00000000
0x00403b80
0x004039ae
0x004039ae
0x004039b2
0x004039b7
0x004039c6
0x004039c6
0x004039cf
0x004039d8
0x004039e3
0x004039e3
0x004039ef
0x00403a0b
0x00403a0e
0x00403a21
0x00403a27
0x00403aca
0x00000000
0x00403ad3
0x00403a2d
0x00403a3a
0x00403a3c
0x00403a3e
0x00403a5d
0x00403a5d
0x00403a60
0x00403a65
0x00403a68
0x00403a78
0x00403a79
0x00403a7b
0x00403ab1
0x00403ac4
0x00000000
0x00403ac4
0x00403a7d
0x00403a83
0x00403a9c
0x00403aa1
0x00403aa3
0x00000000
0x00000000
0x00403aa5
0x00403a91
0x00403a91
0x00403a93
0x00403a93
0x00000000
0x00403a93
0x00403a86
0x00403a8b
0x00000000
0x00403a8b
0x00403a6a
0x00403a70
0x00000000
0x00000000
0x00403a72
0x00000000
0x00403a72
0x00403a62
0x00000000
0x00403a62
0x00403a48
0x00403a4f
0x00403a55
0x00403a57
0x00000000
0x00000000
0x00000000
0x00403a57
0x00403a13
0x00000000
0x004039f1
0x004039f7
0x00403a01
0x00403e07
0x00403e0d
0x00403e0f
0x00403e15
0x00403e1a
0x00403e20
0x00403e20
0x00403e15
0x00403e2a
0x00000000
0x00403e2a
0x004039ef

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039C6
ShowWindow.USER32(?), ref: 004039E3
DestroyWindow.USER32 ref: 004039F7
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A13
GetDlgItem.USER32(?,?), ref: 00403A34
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A48
IsWindowEnabled.USER32(00000000), ref: 00403A4F
GetDlgItem.USER32(?,00000001), ref: 00403AFD
GetDlgItem.USER32(?,00000002), ref: 00403B07
SetClassLongA.USER32(?,000000F2,?), ref: 00403B21
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B72
GetDlgItem.USER32(?,00000003), ref: 00403C18
ShowWindow.USER32(00000000,?), ref: 00403C39
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403C4B
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403C66
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C7C
EnableMenuItem.USER32(00000000), ref: 00403C83
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403C9B
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403CAE
lstrlenA.KERNEL32(0042A0C0,?,0042A0C0,Fast! Setup), ref: 00403CD7
SetWindowTextA.USER32(?,0042A0C0), ref: 00403CE6
ShowWindow.USER32(?,0000000A), ref: 00403E1A

Strings

jm, xrefs: 00403D34
Fast! Setup, xrefs: 00403CC8

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherLongMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
String ID: Fast! Setup$jm
API String ID: 1252290697-1471539498
Opcode ID: f37d912e389ff35b5f2e3d6fe2aeb75ce8efd3987cf1f0c8c2098123954ad298
Instruction ID: 5f76212842cc3a2ea0064beba359403a4e9feef3dd5448b927816276c7a72de1
Opcode Fuzzy Hash: f37d912e389ff35b5f2e3d6fe2aeb75ce8efd3987cf1f0c8c2098123954ad298
Instruction Fuzzy Hash: 1BC1D431604205ABDB216F62ED85D2B3EACFB49706F40053EF541B62E1C739A942DF6E

Uniqueness

Uniqueness Score: -1.00%

Function 004035F4 Relevance: 49.2, APIs: 13, Strings: 15, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E004035F4(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				signed int _t24;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				int _t37;
				int _t38;
				intOrPtr _t39;
				int _t42;
				intOrPtr _t60;
				char _t62;
				CHAR* _t64;
				signed char _t68;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				intOrPtr _t81;
				CHAR* _t85;

				_t81 =  *0x42ec50; // 0x6d6978
				_t20 = E00405F2D(3);
				_t88 = _t20;
				if(_t20 == 0) {
					_t79 = 0x42a0c0;
					"1033" = 0x7830;
					E00405A88(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x42a0c0, 0);
					__eflags =  *0x42a0c0;
					if(__eflags == 0) {
						E00405A88(0x80000003, ".DEFAULT\\Control Panel\\International",  &M004072F6, 0x42a0c0, 0);
					}
					lstrcatA("1033", _t79);
				} else {
					E00405AFF("1033",  *_t20() & 0x0000ffff);
				}
				E004038BD(_t76, _t88);
				_t24 =  *0x42ec58; // 0x80
				_t84 = "C:\\Program Files (x86)\\Fast!";
				 *0x42ecc0 = _t24 & 0x00000020;
				 *0x42ecdc = 0x10000;
				if(E00405775(_t88, "C:\\Program Files (x86)\\Fast!") != 0) {
					L16:
					if(E00405775(_t96, _t84) == 0) {
						E00405BC3(0, _t79, _t81, _t84,  *((intOrPtr*)(_t81 + 0x118))); // executed
					}
					_t28 = LoadImageA( *0x42ec40, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x42e428 = _t28;
					if( *((intOrPtr*)(_t81 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E004038BD(_t76, __eflags);
							__eflags =  *0x42ece0; // 0x0
							if(__eflags != 0) {
								_t31 = E00404F5F(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42e40c; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x42a098, 5); // executed
							_t37 = E00405EC3("RichEd20"); // executed
							__eflags = _t37;
							if(_t37 == 0) {
								E00405EC3("RichEd32");
							}
							_t85 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t85, 0x42e3e0);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x42e3e0);
								 *0x42e404 = _t85;
								RegisterClassA(0x42e3e0);
							}
							_t39 =  *0x42e420; // 0x0
							_t42 = DialogBoxParamA( *0x42ec40, _t39 + 0x00000069 & 0x0000ffff, 0, E0040398A, 0); // executed
							E00403544(E0040140B(5), 1);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t76 =  *0x42ec40; // 0x400000
						 *0x42e3f4 = _t28;
						_v20 = 0x624e5f;
						 *0x42e3e4 = E00401000;
						 *0x42e3f0 = _t76;
						 *0x42e404 =  &_v20;
						if(RegisterClassA(0x42e3e0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x42a098 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x42ec40, 0);
						goto L21;
					}
				} else {
					_t76 =  *(_t81 + 0x48);
					if(_t76 == 0) {
						goto L16;
					}
					_t60 =  *0x42ec78; // 0x6dc2d4
					_t79 = 0x42dbe0;
					E00405A88( *((intOrPtr*)(_t81 + 0x44)), _t76,  *((intOrPtr*)(_t81 + 0x4c)) + _t60, 0x42dbe0, 0);
					_t62 =  *0x42dbe0; // 0x43
					if(_t62 == 0) {
						goto L16;
					}
					if(_t62 == 0x22) {
						_t79 = 0x42dbe1;
						 *((char*)(E004056BF(0x42dbe1, 0x22))) = 0;
					}
					_t64 = lstrlenA(_t79) + _t79 - 4;
					if(_t64 <= _t79 || lstrcmpiA(_t64, ?str?) != 0) {
						L15:
						E00405BA1(_t84, E00405694(_t79));
						goto L16;
					} else {
						_t68 = GetFileAttributesA(_t79);
						if(_t68 == 0xffffffff) {
							L14:
							E004056DB(_t79);
							goto L15;
						}
						_t96 = _t68 & 0x00000010;
						if((_t68 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x004035fa
0x00403603
0x0040360a
0x0040360c
0x00403620
0x00403632
0x0040363c
0x00403641
0x00403647
0x0040365a
0x0040365a
0x00403665
0x0040360e
0x00403619
0x00403619
0x0040366a
0x0040366f
0x00403674
0x0040367d
0x00403682
0x00403693
0x0040371a
0x00403722
0x0040372b
0x0040372b
0x00403741
0x00403747
0x00403755
0x004037e4
0x004037ec
0x004037f6
0x004037fb
0x00403801
0x0040388b
0x00403890
0x00403892
0x004038ae
0x00000000
0x004038ae
0x00403894
0x0040389a
0x004038a2
0x004038a2
0x00000000
0x0040389a
0x0040380f
0x0040381a
0x0040381f
0x00403821
0x00403828
0x00403828
0x00403833
0x0040383b
0x0040383d
0x0040383f
0x00403848
0x0040384b
0x00403851
0x00403851
0x00403857
0x00403870
0x00403881
0x00000000
0x00403886
0x004037ee
0x004037f0
0x00000000
0x0040375b
0x0040375b
0x00403761
0x0040376b
0x00403773
0x0040377d
0x00403783
0x00403791
0x004038b3
0x004038b3
0x00000000
0x004038b3
0x00403797
0x004037a0
0x004037df
0x00000000
0x004037df
0x00403699
0x00403699
0x0040369e
0x00000000
0x00000000
0x004036a3
0x004036a8
0x004036b8
0x004036bd
0x004036c4
0x00000000
0x00000000
0x004036c8
0x004036ca
0x004036d7
0x004036d7
0x004036df
0x004036e5
0x0040370d
0x00403715
0x00000000
0x004036f7
0x004036f8
0x00403701
0x00403707
0x00403708
0x00000000
0x00403708
0x00403703
0x00403705
0x00000000
0x00000000
0x00000000
0x00403705
0x004036e5

APIs

Part of subcall function 00405F2D: GetModuleHandleA.KERNEL32(?,?,00000000,00403179,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00405F3F
Part of subcall function 00405F2D: GetProcAddress.KERNEL32(00000000,?), ref: 00405F5A

lstrcatA.KERNEL32(1033,0042A0C0,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A0C0,00000000,00000003,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\Setup 2.exe" ,00000000), ref: 00403665
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Program Files (x86)\Fast!,1033,0042A0C0,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A0C0,00000000,00000003,C:\Users\user\AppData\Local\Temp\), ref: 004036DA
lstrcmpiA.KERNEL32(?,.exe), ref: 004036ED
GetFileAttributesA.KERNEL32(Call), ref: 004036F8
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files (x86)\Fast!), ref: 00403741

Part of subcall function 00405AFF: wsprintfA.USER32 ref: 00405B0C

RegisterClassA.USER32 ref: 00403788
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 004037A0
CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 004037D9
ShowWindow.USER32(00000005,00000000), ref: 0040380F
GetClassInfoA.USER32(00000000,RichEdit20A,0042E3E0), ref: 0040383B
GetClassInfoA.USER32(00000000,RichEdit,0042E3E0), ref: 00403848
RegisterClassA.USER32(0042E3E0), ref: 00403851
DialogBoxParamA.USER32(?,00000000,0040398A,00000000), ref: 00403870

Strings

1033, xrefs: 00403614, 00403660
RichEd32, xrefs: 00403823
xim, xrefs: 004035FA
.DEFAULT\Control Panel\International, xrefs: 00403650
_Nb, xrefs: 00403797, 0040379C
RichEdit20A, xrefs: 00403833, 00403839
B, xrefs: 00403750
C:\Users\user\AppData\Local\Temp\, xrefs: 00403600
RichEdit, xrefs: 00403842
C:\Program Files (x86)\Fast!, xrefs: 00403674, 0040367C, 00403714, 0040371A, 0040372A
Control Panel\Desktop\ResourceLocale, xrefs: 00403628
.exe, xrefs: 004036E7
"C:\Users\user\Desktop\Setup 2.exe" , xrefs: 004035F8
RichEd20, xrefs: 00403815
Call, xrefs: 004036A8, 004036B0, 004036BD, 00403707, 0040370D

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Setup 2.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Program Files (x86)\Fast!$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$xim$B
API String ID: 1975747703-3805290952
Opcode ID: ae0ce974919670cb25059356fffaf20608a15eb2efc53d55221e8398fb09681d
Instruction ID: 069ef0fb9a42e1b4956c000ddcdb280bce5473b1ca4ea0d36e0de5988d82752f
Opcode Fuzzy Hash: ae0ce974919670cb25059356fffaf20608a15eb2efc53d55221e8398fb09681d
Instruction Fuzzy Hash: EE61D8B16442007FD220AFA69C45F273A6CEB44749F44457FF940B32D1CA7DA9018A7E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C38 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00402C38(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				signed int _t54;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\alfredo\\Desktop\\Setup 2.exe";
				 *0x42ec4c = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\alfredo\\Desktop\\Setup 2.exe", 0x400);
				_t89 = E00405878(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409014 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\alfredo\\Desktop";
				E00405BA1("C:\\Users\\alfredo\\Desktop", _t91);
				E00405BA1(0x436000, E004056DB(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x428c70 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402BD4(1);
					__eflags =  *0x42ec54 - _t82; // 0x9e00
					if(__eflags == 0) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						_t54 =  *0x42ec54; // 0x9e00
						E004030C5(_t54 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff);
						_t57 = E00402E71();
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x42ec50 = _t94;
							 *0x42ec58 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x42ec5c =  *0x42ec5c + 1;
								__eflags =  *0x42ec5c;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405839(0x42ec60, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E004030C5( *0x414c60);
					_t65 = E00403093( &_a4, 4); // executed
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t67 =  *0x42ec54; // 0x9e00
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~_t67 & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E00403093(0x420c70, _t90); // executed
						__eflags = _t71;
						if(_t71 == 0) {
							E00402BD4(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x42ec54;
						if( *0x42ec54 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402BD4(0);
							}
							goto L20;
						}
						E00405839( &_v44, 0x420c70, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x414c60; // 0x1f606
						 *0x42ece0 =  *0x42ece0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x42ec54 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t93 = _t80 - 4;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x428c70; // 0x22cc8
						if(__eflags < 0) {
							_v12 = E00405F9C(_v12, 0x420c70, _t90);
						}
						 *0x414c60 =  *0x414c60 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 > 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402c40
0x00402c43
0x00402c46
0x00402c49
0x00402c4f
0x00402c60
0x00402c65
0x00402c78
0x00402c7d
0x00402c80
0x00402c86
0x00000000
0x00402c88
0x00402c93
0x00402c99
0x00402caa
0x00402cb1
0x00402cb7
0x00402cb9
0x00402cbe
0x00402cc0
0x00402dad
0x00402daf
0x00402db4
0x00402dbb
0x00000000
0x00000000
0x00402dbd
0x00402dc0
0x00402de4
0x00402de9
0x00402def
0x00402df1
0x00402dfa
0x00402dff
0x00402e02
0x00402e03
0x00402e04
0x00402e06
0x00402e0b
0x00402e0e
0x00402e21
0x00402e25
0x00402e2d
0x00402e32
0x00402e34
0x00402e34
0x00402e34
0x00402e3c
0x00402e3c
0x00402e3f
0x00402e40
0x00402e40
0x00402e43
0x00402e45
0x00402e45
0x00402e45
0x00402e4f
0x00402e55
0x00402e63
0x00402e68
0x00000000
0x00402e68
0x00000000
0x00402e0e
0x00402dc8
0x00402dd3
0x00402dd8
0x00402dda
0x00000000
0x00000000
0x00402ddf
0x00402de2
0x00000000
0x00000000
0x00000000
0x00402cc6
0x00402ccb
0x00402ccb
0x00402cd0
0x00402cd4
0x00402cdb
0x00402ce0
0x00402ce2
0x00402ce4
0x00402ce4
0x00402ce8
0x00402ced
0x00402cef
0x00402e19
0x00402e10
0x00000000
0x00402e10
0x00402cf5
0x00402cfc
0x00402d78
0x00402d7c
0x00402d80
0x00402d85
0x00000000
0x00402d7c
0x00402d05
0x00402d0a
0x00402d0d
0x00402d12
0x00000000
0x00000000
0x00402d14
0x00402d1b
0x00000000
0x00000000
0x00402d1d
0x00402d24
0x00000000
0x00000000
0x00402d26
0x00402d2d
0x00000000
0x00000000
0x00402d2f
0x00402d36
0x00000000
0x00000000
0x00402d38
0x00402d3e
0x00402d47
0x00402d4d
0x00402d50
0x00402d52
0x00402d58
0x00000000
0x00000000
0x00402d5e
0x00402d62
0x00402d6a
0x00402d6a
0x00402d6d
0x00402d70
0x00402d72
0x00402d74
0x00402d74
0x00000000
0x00402d72
0x00402d64
0x00402d68
0x00000000
0x00000000
0x00000000
0x00402d86
0x00402d86
0x00402d8c
0x00402d98
0x00402d98
0x00402d9b
0x00402da1
0x00402da3
0x00402da3
0x00402dab
0x00402dab
0x00000000
0x00402dab

APIs

GetTickCount.KERNEL32 ref: 00402C49
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Setup 2.exe,00000400), ref: 00402C65

Part of subcall function 00405878: GetFileAttributesA.KERNEL32(00000003,00402C78,C:\Users\user\Desktop\Setup 2.exe,80000000,00000003), ref: 0040587C
Part of subcall function 00405878: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040589E

GetFileSize.KERNEL32(00000000,00000000,00436000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Setup 2.exe,C:\Users\user\Desktop\Setup 2.exe,80000000,00000003), ref: 00402CB1

Strings

xim, xrefs: 00402E25
C:\Users\user\Desktop\Setup 2.exe, xrefs: 00402C4F, 00402C5E, 00402C72, 00402C92
soft, xrefs: 00402D26
C:\Users\user\Desktop, xrefs: 00402C93, 00402C98, 00402C9E
Error launching installer, xrefs: 00402C88
"C:\Users\user\Desktop\Setup 2.exe" , xrefs: 00402C38
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E10
Inst, xrefs: 00402D1D
Null, xrefs: 00402D2F
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C42

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Setup 2.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Setup 2.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft$xim
API String ID: 4283519449-2013522041
Opcode ID: 52dd5125f2beb4c5a01725ee1ecfb7cda6383a0ef784e60b7ebdc9a7c5e8d2b4
Instruction ID: d5d64c7dde767481ec9b836f5bb8cc7fe4476435a14377af370c0b56c56fa9d6
Opcode Fuzzy Hash: 52dd5125f2beb4c5a01725ee1ecfb7cda6383a0ef784e60b7ebdc9a7c5e8d2b4
Instruction Fuzzy Hash: 7B51D971901214ABDB219FA6DE89B9E7BB8FB40354F10413BF900B62D1D7BC9D418B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405BC3 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 197
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00405BC3(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t36;
				CHAR* _t37;
				signed int _t39;
				int _t40;
				char _t50;
				char _t51;
				char _t53;
				char _t55;
				void* _t63;
				signed int _t69;
				intOrPtr _t73;
				signed int _t74;
				signed int _t75;
				intOrPtr _t79;
				char _t83;
				void* _t85;
				CHAR* _t86;
				void* _t88;
				signed int _t95;
				signed int _t97;
				void* _t98;

				_t88 = __esi;
				_t85 = __edi;
				_t63 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t79 =  *0x42e41c; // 0x6dd263
					_t36 =  *(_t79 - 4 + _t36 * 4);
				}
				_t73 =  *0x42ec78; // 0x6dc2d4
				_t74 = _t73 + _t36;
				_t37 = 0x42dbe0;
				_push(_t63);
				_push(_t88);
				_push(_t85);
				_t86 = 0x42dbe0;
				if(_a4 - 0x42dbe0 < 0x800) {
					_t86 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t83 =  *_t74;
					if(_t83 == 0) {
						break;
					}
					__eflags = _t86 - _t37 - 0x400;
					if(_t86 - _t37 >= 0x400) {
						break;
					}
					_t74 = _t74 + 1;
					__eflags = _t83 - 0xfc;
					_a8 = _t74;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t86 = _t83;
							_t86 =  &(_t86[1]);
							__eflags = _t86;
						} else {
							 *_t86 =  *_t74;
							_t86 =  &(_t86[1]);
							_t74 = _t74 + 1;
						}
						continue;
					}
					_t39 =  *(_t74 + 1);
					_t75 =  *_t74;
					_t95 = (_t39 & 0x0000007f) << 0x00000007 | _t75 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t75 | 0x00000080;
					_t69 = _t75;
					_v24 = _t69;
					__eflags = _t83 - 0xfe;
					_v20 = _t39 | 0x00000080;
					_v16 = _t39;
					if(_t83 != 0xfe) {
						__eflags = _t83 - 0xfd;
						if(_t83 != 0xfd) {
							__eflags = _t83 - 0xff;
							if(_t83 == 0xff) {
								__eflags = (_t39 | 0xffffffff) - _t95;
								E00405BC3(_t69, _t86, _t95, _t86, (_t39 | 0xffffffff) - _t95);
							}
							L41:
							_t40 = lstrlenA(_t86);
							_t74 = _a8;
							_t86 =  &(_t86[_t40]);
							_t37 = 0x42dbe0;
							continue;
						}
						__eflags = _t95 - 0x1d;
						if(_t95 != 0x1d) {
							__eflags = (_t95 << 0xa) + 0x42f000;
							E00405BA1(_t86, (_t95 << 0xa) + 0x42f000);
						} else {
							E00405AFF(_t86,  *0x42ec48);
						}
						__eflags = _t95 + 0xffffffeb - 7;
						if(_t95 + 0xffffffeb < 7) {
							L32:
							E00405E03(_t86);
						}
						goto L41;
					}
					_t97 = 2;
					_t50 = GetVersion();
					__eflags = _t50;
					if(_t50 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x42ecc4;
						if( *0x42ecc4 != 0) {
							_t97 = 4;
						}
						__eflags = _t69;
						if(_t69 >= 0) {
							__eflags = _t69 - 0x25;
							if(_t69 != 0x25) {
								__eflags = _t69 - 0x24;
								if(_t69 == 0x24) {
									GetWindowsDirectoryA(_t86, 0x400);
									_t97 = 0;
								}
								while(1) {
									__eflags = _t97;
									if(_t97 == 0) {
										goto L29;
									}
									_t51 =  *0x42ec44; // 0x746d1370
									_t97 = _t97 - 1;
									__eflags = _t51;
									if(_t51 == 0) {
										L25:
										_t53 = SHGetSpecialFolderLocation( *0x42ec48,  *(_t98 + _t97 * 4 - 0x18),  &_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											L27:
											 *_t86 =  *_t86 & 0x00000000;
											__eflags =  *_t86;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t86);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t55 =  *_t51( *0x42ec48,  *(_t98 + _t97 * 4 - 0x18), 0, 0, _t86);
									__eflags = _t55;
									if(_t55 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t86, 0x400);
							goto L29;
						} else {
							_t72 = (_t69 & 0x0000003f) +  *0x42ec78;
							E00405A88(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t69 & 0x0000003f) +  *0x42ec78, _t86, _t69 & 0x00000040); // executed
							__eflags =  *_t86;
							if( *_t86 != 0) {
								L30:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t86, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E00405BC3(_t72, _t86, _t97, _t86, _v16);
							L29:
							__eflags =  *_t86;
							if( *_t86 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t50 - 0x5a04;
					if(_t50 == 0x5a04) {
						goto L12;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L12;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t86 =  *_t86 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E00405BA1(_a4, _t37);
			}

0x00405bc3
0x00405bc3
0x00405bc3
0x00405bc9
0x00405bce
0x00405bd0
0x00405bdf
0x00405bdf
0x00405be1
0x00405bea
0x00405bec
0x00405bf1
0x00405bf4
0x00405bf5
0x00405bfc
0x00405bfe
0x00405c04
0x00405c07
0x00405c07
0x00405de0
0x00405de0
0x00405de4
0x00000000
0x00000000
0x00405c14
0x00405c1a
0x00000000
0x00000000
0x00405c20
0x00405c21
0x00405c24
0x00405c27
0x00405dd3
0x00405ddd
0x00405ddf
0x00405ddf
0x00405dd5
0x00405dd7
0x00405dd9
0x00405dda
0x00405dda
0x00000000
0x00405dd3
0x00405c2d
0x00405c31
0x00405c41
0x00405c45
0x00405c4c
0x00405c4f
0x00405c53
0x00405c59
0x00405c5c
0x00405c5f
0x00405c62
0x00405d7d
0x00405d80
0x00405db0
0x00405db3
0x00405db8
0x00405dbc
0x00405dbc
0x00405dc1
0x00405dc2
0x00405dc7
0x00405dca
0x00405dcc
0x00000000
0x00405dcc
0x00405d82
0x00405d85
0x00405d9a
0x00405da1
0x00405d87
0x00405d8e
0x00405d8e
0x00405da9
0x00405dac
0x00405d75
0x00405d76
0x00405d76
0x00000000
0x00405dac
0x00405c6a
0x00405c6b
0x00405c71
0x00405c73
0x00405c8d
0x00405c8d
0x00405c94
0x00405c94
0x00405c9b
0x00405c9f
0x00405c9f
0x00405ca0
0x00405ca2
0x00405cdb
0x00405cde
0x00405cee
0x00405cf1
0x00405cf9
0x00405cff
0x00405cff
0x00405d5b
0x00405d5b
0x00405d5d
0x00000000
0x00000000
0x00405d03
0x00405d0a
0x00405d0b
0x00405d0d
0x00405d27
0x00405d35
0x00405d3b
0x00405d3d
0x00405d58
0x00405d58
0x00405d58
0x00000000
0x00405d58
0x00405d43
0x00405d4e
0x00405d54
0x00405d56
0x00000000
0x00000000
0x00000000
0x00405d56
0x00405d0f
0x00405d12
0x00000000
0x00000000
0x00405d21
0x00405d23
0x00405d25
0x00000000
0x00000000
0x00000000
0x00405d25
0x00000000
0x00405d5b
0x00405ce6
0x00000000
0x00405ca4
0x00405ca9
0x00405cbf
0x00405cc4
0x00405cc7
0x00405d64
0x00405d64
0x00405d68
0x00405d70
0x00405d70
0x00000000
0x00405d68
0x00405cd1
0x00405d5f
0x00405d5f
0x00405d62
0x00000000
0x00000000
0x00000000
0x00405d62
0x00405ca2
0x00405c75
0x00405c79
0x00000000
0x00000000
0x00405c7b
0x00405c7f
0x00000000
0x00000000
0x00405c81
0x00405c85
0x00000000
0x00405c87
0x00405c87
0x00000000
0x00405c87
0x00405c85
0x00405dea
0x00405df4
0x00405e00
0x00405e00
0x00000000

APIs

GetVersion.KERNEL32(00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,00404EC5,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000), ref: 00405C6B
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405CE6
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405CF9
SHGetSpecialFolderLocation.SHELL32(?,0041B668), ref: 00405D35
SHGetPathFromIDListA.SHELL32(0041B668,Call), ref: 00405D43
CoTaskMemFree.OLE32(0041B668), ref: 00405D4E
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D70
lstrlenA.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,00404EC5,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000), ref: 00405DC2

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405CB5
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D6A
Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll, xrefs: 00405BF4
Call, xrefs: 00405BEC, 00405CB3, 00405CD0, 00405CE5, 00405CF8, 00405D14, 00405D3F, 00405D6F, 00405D75, 00405D8D, 00405DA0, 00405DBB, 00405DC1, 00405DCC, 00405DF6

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3246191579
Opcode ID: 56c6644338f5748cd9e4adb5f2c50b348e185d39bfc66a16460e33acb065d9ec
Instruction ID: fa1e0b9f47c9474f0aa02006464afd466a30f7754b548aa089decd5b8df859b0
Opcode Fuzzy Hash: 56c6644338f5748cd9e4adb5f2c50b348e185d39bfc66a16460e33acb065d9ec
Instruction Fuzzy Hash: B8512531A04A15ABEB205B698C88BBB3B64DF11314F54827BE511BA2D0D37C5942DF4E

Uniqueness

Uniqueness Score: -1.00%

Function 00402E71 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00402E71(int _a4, void* _a8, long _a12, int _a16, signed char _a19) {
				signed int _v8;
				long _v12;
				void* _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				char _v92;
				void* _t67;
				void* _t68;
				long _t74;
				intOrPtr _t79;
				long _t80;
				void* _t82;
				int _t84;
				intOrPtr _t95;
				void* _t97;
				void* _t100;
				long _t101;
				signed int _t102;
				long _t103;
				int _t104;
				intOrPtr _t105;
				long _t106;
				void* _t107;

				_t102 = _a16;
				_t97 = _a12;
				_v12 = _t102;
				if(_t97 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_v16 = _t97;
				if(_t97 == 0) {
					_v16 = 0x418c68;
				}
				_t65 = _a4;
				if(_a4 >= 0) {
					_t95 =  *0x42ec98; // 0xb04a
					E004030C5(_t95 + _t65);
				}
				_t67 = E00403093( &_a16, 4); // executed
				if(_t67 == 0) {
					L34:
					_push(0xfffffffd);
					goto L35;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t97 == 0) {
							while(_a16 > 0) {
								_t103 = _v12;
								if(_a16 < _t103) {
									_t103 = _a16;
								}
								if(E00403093(0x414c68, _t103) == 0) {
									goto L34;
								} else {
									if(WriteFile(_a8, 0x414c68, _t103,  &_a12, 0) == 0 || _t103 != _a12) {
										L29:
										_push(0xfffffffe);
										L35:
										_pop(_t68);
										return _t68;
									} else {
										_v8 = _v8 + _t103;
										_a16 = _a16 - _t103;
										continue;
									}
								}
							}
							L45:
							return _v8;
						}
						if(_a16 < _t102) {
							_t102 = _a16;
						}
						if(E00403093(_t97, _t102) != 0) {
							_v8 = _t102;
							goto L45;
						} else {
							goto L34;
						}
					}
					_t74 = GetTickCount();
					 *0x40b5cc =  *0x40b5cc & 0x00000000;
					 *0x40b5c8 =  *0x40b5c8 & 0x00000000;
					_t14 =  &_a16;
					 *_t14 = _a16 & 0x7fffffff;
					_v20 = _t74;
					 *0x40b0b0 = 8;
					 *0x414c58 = 0x40cc50;
					 *0x414c54 = 0x40cc50;
					 *0x414c50 = 0x414c50;
					_a4 = _a16;
					if( *_t14 <= 0) {
						goto L45;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t104 = 0x4000;
						if(_a16 < 0x4000) {
							_t104 = _a16;
						}
						if(E00403093(0x414c68, _t104) == 0) {
							goto L34;
						}
						_a16 = _a16 - _t104;
						 *0x40b0a0 = 0x414c68;
						 *0x40b0a4 = _t104;
						while(1) {
							_t100 = _v16;
							 *0x40b0a8 = _t100;
							 *0x40b0ac = _v12;
							_t79 = E0040600A("vdA");
							_v28 = _t79;
							if(_t79 < 0) {
								break;
							}
							_t105 =  *0x40b0a8; // 0x41b668
							_t106 = _t105 - _t100;
							_t80 = GetTickCount();
							_t101 = _t80;
							if(( *0x42ecf4 & 0x00000001) != 0 && (_t80 - _v20 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v92, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t107 = _t107 + 0xc;
								E00404E8D(0,  &_v92);
								_v20 = _t101;
							}
							if(_t106 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L45;
							} else {
								if(_a12 != 0) {
									_t82 =  *0x40b0a8; // 0x41b668
									_v8 = _v8 + _t106;
									_v12 = _v12 - _t106;
									_v16 = _t82;
									L24:
									if(_v28 != 1) {
										continue;
									}
									goto L45;
								}
								_t84 = WriteFile(_a8, _v16, _t106,  &_v24, 0); // executed
								if(_t84 == 0 || _v24 != _t106) {
									goto L29;
								} else {
									_v8 = _v8 + _t106;
									goto L24;
								}
							}
						}
						_push(0xfffffffc);
						goto L35;
					}
					goto L34;
				}
			}

0x00402e79
0x00402e7d
0x00402e80
0x00402e85
0x00402e87
0x00402e87
0x00402e8e
0x00402e92
0x00402e97
0x00402e99
0x00402e99
0x00402ea0
0x00402ea5
0x00402ea7
0x00402eb0
0x00402eb0
0x00402ebb
0x00402ec2
0x0040303e
0x0040303e
0x00000000
0x00402ec8
0x00402ecc
0x00403029
0x0040307e
0x00403043
0x00403049
0x0040304b
0x0040304b
0x0040305c
0x00000000
0x0040305e
0x00403071
0x00403023
0x00403023
0x00403040
0x00403040
0x00000000
0x00403078
0x00403078
0x0040307b
0x00000000
0x0040307b
0x00403071
0x0040305c
0x00403089
0x00000000
0x00403089
0x0040302e
0x00403030
0x00403030
0x0040303c
0x00403086
0x00000000
0x00000000
0x00000000
0x00000000
0x0040303c
0x00402ed8
0x00402eda
0x00402ee1
0x00402ee8
0x00402ee8
0x00402eef
0x00402ef7
0x00402f01
0x00402f06
0x00402f0e
0x00402f18
0x00402f1b
0x00000000
0x00000000
0x00000000
0x00000000
0x00402f21
0x00402f21
0x00402f21
0x00402f29
0x00402f2b
0x00402f2b
0x00402f3c
0x00000000
0x00000000
0x00402f42
0x00402f45
0x00402f4b
0x00402f51
0x00402f51
0x00402f5c
0x00402f62
0x00402f67
0x00402f6e
0x00402f71
0x00000000
0x00000000
0x00402f77
0x00402f7d
0x00402f7f
0x00402f88
0x00402f8a
0x00402fb8
0x00402fbe
0x00402fc7
0x00402fcc
0x00402fcc
0x00402fd3
0x00403017
0x00000000
0x00000000
0x00000000
0x00402fd5
0x00402fd8
0x00402ffa
0x00402fff
0x00403002
0x00403005
0x00403008
0x0040300c
0x00000000
0x00000000
0x00000000
0x00403012
0x00402fe6
0x00402fee
0x00000000
0x00402ff5
0x00402ff5
0x00000000
0x00402ff5
0x00402fee
0x00402fd3
0x0040301f
0x00000000
0x0040301f
0x00000000
0x00402f21

APIs

GetTickCount.KERNEL32 ref: 00402ED8
GetTickCount.KERNEL32 ref: 00402F7F
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402FA8
wsprintfA.USER32 ref: 00402FB8
WriteFile.KERNEL32(00000000,00000000,0041B668,7FFFFFFF,00000000), ref: 00402FE6

Strings

... %d%%, xrefs: 00402FB2
vdA, xrefs: 00402F45, 00402F57
hLA, xrefs: 00402F2E
hLA, xrefs: 0040304E

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%$hLA$hLA$vdA
API String ID: 4209647438-2367115750
Opcode ID: f87f9ab17943881f4136e4bacdf0cd757ac4c6284e5f5bea3f3a56447b1d5481
Instruction ID: 8a95cf2a137d7550cfd21daf0583010478331d15a29cb338fc351ae0d0d0651f
Opcode Fuzzy Hash: f87f9ab17943881f4136e4bacdf0cd757ac4c6284e5f5bea3f3a56447b1d5481
Instruction Fuzzy Hash: D261AE7190221AEBDB10DFA5DA44AAF7BB8EB40355F10417BF910B72C4D7789A40CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 00401734 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00401734(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402A0C(0x31);
				 *(_t85 - 0xc) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x28) & 0x00000007;
				_t33 = E00405701(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E00405694(E00405BA1(0x409c60, "C:\\Program Files (x86)\\Fast!")), ??);
				} else {
					_push(0x409c60);
					E00405BA1();
				}
				E00405E03(0x409c60);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405E9C(0x409c60);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x1c);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405859(0x409c60);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E00405878(0x409c60, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 8) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404E8D(0xffffffe2,  *(_t85 - 0xc));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x42ecc8;
						goto L32;
					} else {
						E00405BA1(0x40a460, 0x42f000);
						E00405BA1(0x42f000, 0x409c60);
						E00405BC3(_t75, 0x40a460, 0x409c60, "C:\Users\alfredo\AppData\Local\Temp\nsyD27B.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x14)));
						E00405BA1(0x42f000, 0x40a460);
						_t62 = E00405462("C:\Users\alfredo\AppData\Local\Temp\nsyD27B.tmp\System.dll",  *(_t85 - 0x28) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x42ecc8 =  &( *0x42ecc8->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x409c60);
								_push(0xfffffffa);
								E00404E8D();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404E8D(0xffffffea,  *(_t85 - 0xc));
				 *0x42ecf4 =  *0x42ecf4 + 1;
				_t43 = E00402E71( *((intOrPtr*)(_t85 - 0x20)),  *(_t85 - 8), _t75, _t75); // executed
				 *0x42ecf4 =  *0x42ecf4 - 1;
				__eflags =  *(_t85 - 0x1c) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 8), _t85 - 0x1c, _t75, _t85 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 8)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405BC3(_t75, _t80, 0x409c60, 0x409c60, 0xffffffee);
					} else {
						E00405BC3(_t75, _t80, 0x409c60, 0x409c60, 0xffffffe9);
						lstrcatA(0x409c60,  *(_t85 - 0xc));
					}
					_push(0x200010);
					_push(0x409c60);
					E00405462();
					goto L29;
				}
				goto L33;
			}

0x00401734
0x0040173b
0x00401744
0x00401747
0x0040174a
0x0040174f
0x00401757
0x00401773
0x00401759
0x00401759
0x0040175a
0x0040175a
0x00401779
0x00401783
0x00401783
0x00401787
0x0040178a
0x0040178f
0x00401791
0x00401793
0x00401798
0x00401798
0x004017a3
0x004017a3
0x004017b4
0x004017b6
0x004017b6
0x004017b7
0x004017b7
0x004017ba
0x004017bd
0x004017c0
0x004017c0
0x004017c7
0x004017d6
0x004017db
0x004017de
0x004017e1
0x00000000
0x00000000
0x004017e3
0x004017e6
0x00401840
0x00401845
0x004015a8
0x00402672
0x00402672
0x004028a1
0x004028a4
0x004028a4
0x00000000
0x004017e8
0x004017ee
0x004017f9
0x00401806
0x00401811
0x00401827
0x00401827
0x0040182a
0x00000000
0x00401830
0x00401830
0x00401831
0x0040184e
0x004028aa
0x004028aa
0x004028aa
0x00401833
0x00401833
0x00401834
0x00401492
0x00402224
0x00402224
0x00402224
0x00401831
0x0040182a
0x004028ac
0x004028b0
0x004028b0
0x0040185e
0x00401863
0x00401871
0x00401876
0x0040187c
0x00401880
0x00401882
0x0040188a
0x00401896
0x00401884
0x00401884
0x00401888
0x00000000
0x00000000
0x00401888
0x0040189f
0x004018a5
0x004018a7
0x00000000
0x004018ad
0x004018ad
0x004018b0
0x004018c8
0x004018b2
0x004018b5
0x004018be
0x004018be
0x004018cd
0x004018d2
0x0040221f
0x00000000
0x0040221f
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Program Files (x86)\Fast!,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Program Files (x86)\Fast!,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 00405BA1: lstrcpynA.KERNEL32(?,?,00000400,004031BD,Fast! Setup,NSIS Error), ref: 00405BAE

Part of subcall function 00404E8D: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,0041B668,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000,?), ref: 00404EC6
Part of subcall function 00404E8D: lstrlenA.KERNEL32(00402FCC,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,0041B668,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000), ref: 00404ED6
Part of subcall function 00404E8D: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00402FCC,00402FCC,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,0041B668,765F3130), ref: 00404EE9
Part of subcall function 00404E8D: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll), ref: 00404EFB
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F21
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F3B
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F49

Strings

C:\Program Files (x86)\Fast!, xrefs: 00401761
C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll, xrefs: 00401801, 0040181D
Call, xrefs: 00401750, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2
C:\Users\user\AppData\Local\Temp\nsyD27B.tmp, xrefs: 0040177E, 004017ED, 0040180B

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Program Files (x86)\Fast!$C:\Users\user\AppData\Local\Temp\nsyD27B.tmp$C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll$Call
API String ID: 1941528284-2316476460
Opcode ID: 6a234c5fe7cda98cd2efbfb090db1e61d053bf1d9ced46114ecb772eb7d2b7d0
Instruction ID: e79ae9243306ab86068bc1e71be5748962656d45b0e0834c5e2f96de839f3da3
Opcode Fuzzy Hash: 6a234c5fe7cda98cd2efbfb090db1e61d053bf1d9ced46114ecb772eb7d2b7d0
Instruction Fuzzy Hash: 71419632914514BADF107BB9CC45EAF3679EF01329B20823BF421F11E1D77C9A418A6E

Uniqueness

Uniqueness Score: -1.00%

Function 10001759 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E10001759(void* __eflags, struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				struct tagPOINT _v20;
				struct HWND__* _t24;
				void* _t28;
				int _t33;
				void* _t34;
				intOrPtr _t35;
				struct HWND__* _t38;

				 *0x100050dc = _a8;
				_t35 = _a20;
				 *0x100050e0 = _a16;
				 *0x100050e4 = _a12;
				 *((intOrPtr*)(_t35 + 0xc))( *0x100050a4, E10001852, _t34);
				_t38 = _a4;
				 *0x100050a0 = _t35;
				 *0x100050c4 = _t38;
				GetWindowRect(GetDlgItem(_t38, E10001FC2(__eflags)),  &_v20);
				MapWindowPoints(0, _t38,  &_v20, 2);
				_t24 = CreateDialogParamA( *0x100050a4, 1, _t38, E100014CA, 0); // executed
				 *0x100050c0 = _t24;
				if(_t24 != 0) {
					_t33 = _v12 - _v20.x;
					__eflags = _t33;
					SetWindowPos(_t24, 0, _v20, _v20.y, _t33, _v8 - _v20.y, 0x14);
					 *0x100050c8 = SetWindowLongA(_t38, 4, E100013FB);
					 *0x100050cc = 0;
					 *0x100050d4 = 0;
					_t28 = HeapAlloc(GetProcessHeap(), 8, 0);
					_push( *0x100050c0);
					 *0x100050d8 = _t28;
					 *0x100050d0 = 0;
					L10002016();
				} else {
					_t28 = E10001E27("error");
				}
				return _t28;
			}

0x10001763
0x1000176c
0x10001774
0x10001782
0x10001787
0x1000178a
0x1000178d
0x10001793
0x100017ab
0x100017bb
0x100017d0
0x100017d8
0x100017dd
0x100017f7
0x100017f7
0x10001803
0x1000181a
0x1000181f
0x10001825
0x10001832
0x10001838
0x1000183e
0x10001843
0x10001849
0x100017df
0x100017e4
0x100017e4
0x10001851

APIs

GetDlgItem.USER32(?,00000000), ref: 100017A0
GetWindowRect.USER32(00000000,?), ref: 100017AB
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 100017BB
CreateDialogParamA.USER32(00000001,?,100014CA,00000000), ref: 100017D0
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000014), ref: 10001803
SetWindowLongA.USER32(?,00000004,100013FB), ref: 10001811
GetProcessHeap.KERNEL32(00000008,00000000), ref: 1000182B
HeapAlloc.KERNEL32(00000000), ref: 10001832

Part of subcall function 10001E27: GlobalAlloc.KERNEL32(00000040,?,?,100010BE,error,?,00000104), ref: 10001E3C
Part of subcall function 10001E27: lstrcpynA.KERNEL32(00000004,?,?,100010BE,error,?,00000104), ref: 10001E52

Strings

error, xrefs: 100017DF

Memory Dump Source

Source File: 00000001.00000002.2975197977.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2975169750.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975269413.0000000010003000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975296586.0000000010004000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975376888.0000000010007000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Setup 2.jbxd

Similarity

API ID: Window$AllocHeap$CreateDialogGlobalItemLongParamPointsProcessRectlstrcpyn
String ID: error
API String ID: 1928716940-1574812785
Opcode ID: 0ee1387781e475fb3018119435db561422285f9b647d5c56060c9764d2b48e42
Instruction ID: 49ee08a46b31e17026ca78ef06e67b8f965973941c552544d8d625db586257b3
Opcode Fuzzy Hash: 0ee1387781e475fb3018119435db561422285f9b647d5c56060c9764d2b48e42
Instruction Fuzzy Hash: 9621F576901225EFFB01DFA5CC99EAFBFB9FB49382B008509F61597268DB715500CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00404E8D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404E8D(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x42e424; // 0x903bc
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x42ecf4; // 0x0
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405BC3(0, _t39, 0x429898, 0x429898, _a4);
					}
					_t26 = lstrlenA(0x429898);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x42e408, 0x429898); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x429898;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52); // executed
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x429898)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x429898, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00404e93
0x00404e9f
0x00404ea2
0x00404ea8
0x00404eb4
0x00404eb7
0x00404eba
0x00404ec0
0x00404ec0
0x00404ec6
0x00404ece
0x00404ed1
0x00404eee
0x00404ef2
0x00404efb
0x00404efb
0x00404f05
0x00404f0e
0x00404f1a
0x00404f21
0x00404f25
0x00404f28
0x00404f3b
0x00404f49
0x00404f49
0x00404f4d
0x00404f4f
0x00404f52
0x00000000
0x00404f52
0x00404ed3
0x00404edb
0x00404ee3
0x00404ee9
0x00000000
0x00404ee9
0x00404ee3
0x00404ed1
0x00404f5c

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,0041B668,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000,?), ref: 00404EC6
lstrlenA.KERNEL32(00402FCC,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,0041B668,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000), ref: 00404ED6
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00402FCC,00402FCC,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,0041B668,765F3130), ref: 00404EE9
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll), ref: 00404EFB
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F21
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F3B
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F49

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll, xrefs: 00404EAD, 00404EBF, 00404EC5, 00404EE8, 00404EF4

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll
API String ID: 2531174081-2330456209
Opcode ID: b9bd97d855335461d49e39303d4d63c0ba14004c0d3fb8e2a59ec645a9842c76
Instruction ID: d5e3cfdbeb95b60488c6f1e99959168c2d2eab17d02c72d4f5409838ea1ae410
Opcode Fuzzy Hash: b9bd97d855335461d49e39303d4d63c0ba14004c0d3fb8e2a59ec645a9842c76
Instruction Fuzzy Hash: 2C21CF71900119BBDF11AFA5CD849DEBFB9EF45354F04807AF608B6290C779AE408FA8

Uniqueness

Uniqueness Score: -1.00%

Function 10001C59 Relevance: 12.1, APIs: 8, Instructions: 51
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E10001C59(struct HWND__* _a4) {
				struct tagMSG _v32;
				int _t14;

				SendMessageA(_a4, 0x40d,  *0x100050c0, 0);
				ShowWindow( *0x100050c0, 8); // executed
				if( *0x100050c0 != 0) {
					do {
						GetMessageA( &_v32, 0, 0, 0); // executed
						_t14 = IsDialogMessageA( *0x100050c0,  &_v32); // executed
						if(_t14 == 0 && IsDialogMessageA( *0x100050c4,  &_v32) == 0) {
							TranslateMessage( &_v32);
							DispatchMessageA( &_v32); // executed
						}
					} while ( *0x100050c0 != 0);
				}
				return SetWindowLongA(_a4, 4,  *0x100050c8);
			}

0x10001c71
0x10001c7f
0x10001c8b
0x10001c94
0x10001c9b
0x10001cab
0x10001caf
0x10001cc5
0x10001ccf
0x10001ccf
0x10001cd5
0x10001cdd
0x10001cf1

APIs

SendMessageA.USER32(?,0000040D,00000000), ref: 10001C71
ShowWindow.USER32(00000008), ref: 10001C7F
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 10001C9B
IsDialogMessageA.USER32(?), ref: 10001CAB
IsDialogMessageA.USER32(?), ref: 10001CBB
TranslateMessage.USER32(?), ref: 10001CC5
DispatchMessageA.USER32(?), ref: 10001CCF
SetWindowLongA.USER32(?,00000004), ref: 10001CE9

Memory Dump Source

Source File: 00000001.00000002.2975197977.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2975169750.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975269413.0000000010003000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975296586.0000000010004000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975376888.0000000010007000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Setup 2.jbxd

Similarity

API ID: Message$DialogWindow$CallbackDispatchDispatcherLongSendShowTranslateUser
String ID:
API String ID: 4159918924-0
Opcode ID: 24479a2be0e1d836739d5b7581d34a7aef2be0d201f04a2619e9cf4b89fe4dc3
Instruction ID: 32c21caa59b8cc04dadf06fe2b3b6010a06e489f57930eae8d14c46c9e48105b
Opcode Fuzzy Hash: 24479a2be0e1d836739d5b7581d34a7aef2be0d201f04a2619e9cf4b89fe4dc3
Instruction Fuzzy Hash: 3E111B31801229EBFB029BA5DD98E9F7FBEFB457C2B408125F60192028D7319405CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E004015B3(struct _SECURITY_ATTRIBUTES* __ebx) {
				struct _SECURITY_ATTRIBUTES** _t10;
				int _t19;
				struct _SECURITY_ATTRIBUTES* _t20;
				signed char _t22;
				struct _SECURITY_ATTRIBUTES* _t23;
				CHAR* _t25;
				struct _SECURITY_ATTRIBUTES** _t29;
				void* _t30;

				_t23 = __ebx;
				_t25 = E00402A0C(0xfffffff0);
				_t10 = E00405728(_t25);
				_t27 = _t10;
				if(_t10 != __ebx) {
					do {
						_t29 = E004056BF(_t27, 0x5c);
						 *_t29 = _t23;
						 *((char*)(_t30 + 0xb)) =  *_t29;
						_t19 = CreateDirectoryA(_t25, _t23); // executed
						if(_t19 == 0) {
							if(GetLastError() != 0xb7) {
								L4:
								 *((intOrPtr*)(_t30 - 4)) =  *((intOrPtr*)(_t30 - 4)) + 1;
							} else {
								_t22 = GetFileAttributesA(_t25); // executed
								if((_t22 & 0x00000010) == 0) {
									goto L4;
								}
							}
						}
						_t20 =  *((intOrPtr*)(_t30 + 0xb));
						 *_t29 = _t20;
						_t27 =  &(_t29[0]);
					} while (_t20 != _t23);
				}
				if( *((intOrPtr*)(_t30 - 0x24)) == _t23) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405BA1("C:\\Program Files (x86)\\Fast!", _t25);
					SetCurrentDirectoryA(_t25); // executed
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x004015b3
0x004015ba
0x004015bd
0x004015c2
0x004015c6
0x004015c8
0x004015d0
0x004015d6
0x004015d8
0x004015db
0x004015e3
0x004015f0
0x004015fd
0x004015fd
0x004015f2
0x004015f3
0x004015fb
0x00000000
0x00000000
0x004015fb
0x004015f0
0x00401600
0x00401603
0x00401605
0x00401606
0x004015c8
0x0040160d
0x0040162d
0x0040217a
0x0040160f
0x00401611
0x0040161c
0x00401622
0x00401622
0x004028a4
0x004028b0

APIs

Part of subcall function 00405728: CharNextA.USER32(004054DA,?,0042B4C8,00000000,0040578C,0042B4C8,0042B4C8,?,?,00000000,004054DA,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405736
Part of subcall function 00405728: CharNextA.USER32(00000000), ref: 0040573B
Part of subcall function 00405728: CharNextA.USER32(00000000), ref: 0040574A

CreateDirectoryA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNEL32(00000000,C:\Program Files (x86)\Fast!,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Program Files (x86)\Fast!, xrefs: 00401617

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Program Files (x86)\Fast!
API String ID: 3751793516-1788482285
Opcode ID: 9600dd9018e9461b37e30ba5723a9ce1774d318771259623f716c5f1620301f3
Instruction ID: bb8d1e4e690ad92a523629274e31cd42690718b140f669fc0321f517961e655e
Opcode Fuzzy Hash: 9600dd9018e9461b37e30ba5723a9ce1774d318771259623f716c5f1620301f3
Instruction Fuzzy Hash: AB010831908140AFDB217B795D44D6F77B49E56365B24063FF491B22E1C53C0941962E

Uniqueness

Uniqueness Score: -1.00%

Function 00405EC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405EC3(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				_t5 = _t16 + 0x409010; // 0x5c
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
				_t14 = LoadLibraryA( &_v292); // executed
				return _t14;
			}

0x00405eda
0x00405ee3
0x00405ee5
0x00405ee5
0x00405ee9
0x00405efb
0x00405ef5
0x00405ef5
0x00405ef5
0x00405eff
0x00405f13
0x00405f23
0x00405f2a

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405EDA
wsprintfA.USER32 ref: 00405F13
LoadLibraryA.KERNEL32(?), ref: 00405F23

Strings

%s%s.dll, xrefs: 00405F0D
\, xrefs: 00405EEB

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$\
API String ID: 2200240437-500877883
Opcode ID: bac9a2fc6f46d7ce26ef8fb07d33782f421afe65be062073a8d3b7340457a89d
Instruction ID: bb15d2e5d25401263bf0b052e26ed8f2ff91206720ea4b5c6b623b775464ebc4
Opcode Fuzzy Hash: bac9a2fc6f46d7ce26ef8fb07d33782f421afe65be062073a8d3b7340457a89d
Instruction Fuzzy Hash: 3FF02B309042095BDB149768DC0DEFB3B5CEB08304F1405BBA1C6E10D2E678ED558FD8

Uniqueness

Uniqueness Score: -1.00%

Function 004058A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004058A7(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

0x004058ab
0x004058b1
0x004058b2
0x004058b2
0x004058b3
0x004058ba
0x004058c4
0x004058d1
0x004058d4
0x004058dc
0x00000000
0x00000000
0x004058e0
0x00000000
0x00000000
0x004058e2
0x00000000
0x004058e2
0x00000000

APIs

GetTickCount.KERNEL32 ref: 004058BA
GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 004058D4

Strings

nsa, xrefs: 004058B3
"C:\Users\user\Desktop\Setup 2.exe" , xrefs: 004058A7
C:\Users\user\AppData\Local\Temp\, xrefs: 004058AA, 004058AE

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Setup 2.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2012007868
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 40dff32a3e5f00750648796d4805ff32b13dc741bded237dc881b6ef32aeca23
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: 91F0A73734820476E7105E55DC04B9B7F6DDF91750F14C027FD449A1C0D6B4995497A5

Uniqueness

Uniqueness Score: -1.00%

Function 02AB198F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E02AB198F(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				struct HINSTANCE__* _t34;
				intOrPtr _t38;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t50;
				intOrPtr _t53;
				signed int _t57;
				signed int _t61;
				void* _t65;
				void* _t66;
				void* _t70;
				void* _t74;

				_t74 = __esi;
				_t66 = __edi;
				_t65 = __edx;
				 *0x2ab4058 = _a8;
				 *0x2ab405c = _a16;
				 *0x2ab4060 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x2ab4038, E02AB189E);
				_push(1);
				_t34 = E02AB1D3B();
				_t50 = _t34;
				if(_t50 == 0) {
					L28:
					return _t34;
				} else {
					if( *((intOrPtr*)(_t50 + 4)) != 1) {
						E02AB23F6(_t50);
					}
					E02AB2440(_t65, _t50);
					_t53 =  *((intOrPtr*)(_t50 + 4));
					if(_t53 == 0xffffffff) {
						L14:
						if(( *(_t50 + 0x810) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t50 + 4)) == 0) {
								_t34 = E02AB25FE(_t65, _t50);
							} else {
								_push(_t74);
								_push(_t66);
								_t12 = _t50 + 0x818; // 0x818
								_t57 = 8;
								memcpy( &_v36, _t12, _t57 << 2);
								_t38 = E02AB18A1(_t50);
								_t15 = _t50 + 0x818; // 0x818
								_t70 = _t15;
								 *((intOrPtr*)(_t50 + 0x820)) = _t38;
								 *_t70 = 3;
								E02AB25FE(_t65, _t50);
								_t61 = 8;
								_t34 = memcpy(_t70,  &_v36, _t61 << 2);
							}
						} else {
							E02AB25FE(_t65, _t50);
							_t34 = GlobalFree(E02AB159E(E02AB18A1(_t50)));
						}
						if( *((intOrPtr*)(_t50 + 4)) != 1) {
							_t34 = E02AB25C4(_t50);
							if(( *(_t50 + 0x810) & 0x00000040) != 0 &&  *_t50 == 1) {
								_t34 =  *(_t50 + 0x808);
								if(_t34 != 0) {
									_t34 = FreeLibrary(_t34);
								}
							}
							if(( *(_t50 + 0x810) & 0x00000020) != 0) {
								_t34 = E02AB1825( *0x2ab4054);
							}
						}
						if(( *(_t50 + 0x810) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t50);
						}
					}
					_t44 =  *_t50;
					if(_t44 == 0) {
						if(_t53 != 1) {
							goto L14;
						}
						E02AB14C7(_t50);
						L12:
						_t50 = _t44;
						L13:
						goto L14;
					}
					_t45 = _t44 - 1;
					if(_t45 == 0) {
						L8:
						_t44 = E02AB120C(_t53, _t50); // executed
						goto L12;
					}
					_t46 = _t45 - 1;
					if(_t46 == 0) {
						E02AB27AC(_t50);
						goto L13;
					}
					if(_t46 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x02ab198f
0x02ab198f
0x02ab198f
0x02ab1999
0x02ab19a1
0x02ab19ae
0x02ab19bc
0x02ab19bf
0x02ab19c1
0x02ab19c6
0x02ab19cb
0x02ab1ade
0x02ab1ade
0x02ab19d1
0x02ab19d5
0x02ab19d8
0x02ab19dd
0x02ab19df
0x02ab19e5
0x02ab19eb
0x02ab1a1b
0x02ab1a22
0x02ab1a46
0x02ab1a85
0x02ab1a48
0x02ab1a48
0x02ab1a49
0x02ab1a4c
0x02ab1a52
0x02ab1a56
0x02ab1a59
0x02ab1a5e
0x02ab1a5e
0x02ab1a65
0x02ab1a6b
0x02ab1a71
0x02ab1a7d
0x02ab1a7e
0x02ab1a81
0x02ab1a24
0x02ab1a25
0x02ab1a3a
0x02ab1a3a
0x02ab1a8f
0x02ab1a92
0x02ab1a9f
0x02ab1aa6
0x02ab1aae
0x02ab1ab1
0x02ab1ab1
0x02ab1aae
0x02ab1abe
0x02ab1ac6
0x02ab1acb
0x02ab1abe
0x02ab1ad3
0x00000000
0x02ab1ad5
0x00000000
0x02ab1ad6
0x02ab1ad3
0x02ab19ef
0x02ab19f2
0x02ab1a10
0x00000000
0x00000000
0x02ab1a13
0x02ab1a18
0x02ab1a18
0x02ab1a1a
0x00000000
0x02ab1a1a
0x02ab19f4
0x02ab19f5
0x02ab19fd
0x02ab19fe
0x00000000
0x02ab19fe
0x02ab19f7
0x02ab19f8
0x02ab1a06
0x00000000
0x02ab1a06
0x02ab19fb
0x00000000
0x00000000
0x00000000
0x02ab19fb

APIs

Part of subcall function 02AB1D3B: GlobalFree.KERNEL32(?), ref: 02AB1F80
Part of subcall function 02AB1D3B: GlobalFree.KERNEL32(?), ref: 02AB1F85
Part of subcall function 02AB1D3B: GlobalFree.KERNEL32(?), ref: 02AB1F8A

GlobalFree.KERNEL32(00000000), ref: 02AB1A3A
FreeLibrary.KERNEL32(?), ref: 02AB1AB1
GlobalFree.KERNEL32(00000000), ref: 02AB1AD6

Part of subcall function 02AB23F6: GlobalAlloc.KERNEL32(00000040,E8002080), ref: 02AB2428

Part of subcall function 02AB27AC: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,?,02AB1A0B,00000000), ref: 02AB27FC

Part of subcall function 02AB18A1: lstrcpyA.KERNEL32(00000000,02AB4018,00000000,02AB1967,00000000), ref: 02AB18BA

Part of subcall function 02AB25FE: wsprintfA.USER32 ref: 02AB2661
Part of subcall function 02AB25FE: GlobalFree.KERNEL32(?), ref: 02AB2706
Part of subcall function 02AB25FE: GlobalFree.KERNEL32(00000000), ref: 02AB272F

Strings

, xrefs: 02AB1AB7

Memory Dump Source

Source File: 00000001.00000002.2972899107.0000000002AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 02AB0000, based on PE: true

Associated: 00000001.00000002.2972852006.0000000002AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2972964416.0000000002AB3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2973006111.0000000002AB5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2ab0000_Setup 2.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: 11c492664ab2ff028a3ea1b970a594c3215ec8a388614a5b3367adbe2d9e2663
Instruction ID: 566a92cb7459e8259b998c3ab9ea84272e98feeb3124508cd37e33f73d32c813
Opcode Fuzzy Hash: 11c492664ab2ff028a3ea1b970a594c3215ec8a388614a5b3367adbe2d9e2663
Instruction Fuzzy Hash: 4831B3715402449ACF17AF6499E8BD63BADFF06314F048969ED0DAA083DF74E096CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BAD() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 8) = E004029EF(3);
				 *(_t55 + 8) = E004029EF(4);
				if(( *(_t55 - 0x14) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 8)) = E00402A0C(0x33);
				}
				__eflags =  *(_t55 - 0x14) & 0x00000002;
				if(( *(_t55 - 0x14) & 0x00000002) != 0) {
					 *(_t55 + 8) = E00402A0C(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x2c)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E00402A0C();
					_t28 = E00402A0C();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 8),  *(_t55 + 8), _t31,  ~( *_t28) & _t28); // executed
					goto L10;
				} else {
					_t52 = E004029EF();
					_t37 = E004029EF();
					_t48 =  *(_t55 - 0x14) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8)); // executed
						L10:
						 *(_t55 - 0xc) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8), _t42, _t48, _t55 - 0xc);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x28)) >= _t42) {
					_push( *(_t55 - 0xc));
					E00405AFF();
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

0x00401bb6
0x00401bc2
0x00401bc5
0x00401bce
0x00401bce
0x00401bd1
0x00401bd5
0x00401bde
0x00401bde
0x00401be1
0x00401be5
0x00401be7
0x00401c34
0x00401c36
0x00401c3f
0x00401c47
0x00401c4a
0x00401c4a
0x00401c53
0x00000000
0x00401be9
0x00401bf0
0x00401bf2
0x00401bfa
0x00401bfd
0x00401c25
0x00401c59
0x00401c59
0x00401bff
0x00401c0d
0x00401c15
0x00401c18
0x00401c18
0x00401bfd
0x00401c5c
0x00401c5f
0x00401c65
0x00402849
0x00402849
0x004028a4
0x004028b0

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e392da7139347f63c408211002f75456f017542e4151f627b34d3607e76d39d5
Instruction ID: e2d4d96ca7e059e12ef29128c845d67dbcf5a6688523181a8ec59df7cc8b106d
Opcode Fuzzy Hash: e392da7139347f63c408211002f75456f017542e4151f627b34d3607e76d39d5
Instruction Fuzzy Hash: B021A171A44208BFEF01AFB5CD8AAAE7B75EF44344F14407AF501BA1D1D6B88A40DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00401F67 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401F67(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x42ecf8");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x42ecc8 =  *0x42ecc8 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402A0C(0xfffffff0);
				 *(_t34 + 8) = E00402A0C(1);
				if( *((intOrPtr*)(_t34 - 0x18)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404E8D(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x20)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x42f000, 0x40b060, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x20)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x1c)) == _t27 && E00403594(_t30) != 0) {
						FreeLibrary(_t30); // executed
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00401f67
0x00401f67
0x00401f6c
0x00401f73
0x0040202f
0x0040217a
0x0040217a
0x004028a1
0x004028a4
0x004028b0
0x004028b0
0x00401f82
0x00401f8c
0x00401f8f
0x00401f9e
0x00401fa2
0x00401fa8
0x00401fac
0x00402028
0x00000000
0x00402028
0x00401fae
0x00401fb8
0x00401fbc
0x00402000
0x00401fbe
0x00401fc1
0x00401fc4
0x00401ff4
0x00401fc6
0x00401fc9
0x00401fd2
0x00401fd4
0x00401fd4
0x00401fd2
0x00401fc4
0x00402008
0x0040201d
0x0040201d
0x00000000
0x00402008
0x00401f92
0x00401f98
0x00401f9c
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F92

Part of subcall function 00404E8D: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,0041B668,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000,?), ref: 00404EC6
Part of subcall function 00404E8D: lstrlenA.KERNEL32(00402FCC,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,0041B668,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000), ref: 00404ED6
Part of subcall function 00404E8D: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00402FCC,00402FCC,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,0041B668,765F3130), ref: 00404EE9
Part of subcall function 00404E8D: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll), ref: 00404EFB
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F21
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F3B
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F49

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FA2
GetProcAddress.KERNEL32(00000000,?), ref: 00401FB2
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040201D

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 9446dcce10bdbd9e239e1b3f0f75280925cd3020356801e7777c9a6c6d659965
Instruction ID: c2750792bbdc63a1f1471102f5095df33ec689d5572da80d747626f78b0a8a56
Opcode Fuzzy Hash: 9446dcce10bdbd9e239e1b3f0f75280925cd3020356801e7777c9a6c6d659965
Instruction Fuzzy Hash: 86210B32904115BBDF206FA5CE8CA6E3571BF44358F20423BF901B62E1DBBC49419A5E

Uniqueness

Uniqueness Score: -1.00%

Function 100013FB Relevance: 6.0, APIs: 4, Instructions: 44
memoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E100013FB(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t20;

				if(_a8 != 0x408 || _a12 != 0xffffffff) {
					L4:
					_t20 = CallWindowProcA( *0x100050c8, _a4, _a8, _a12, _a16);
					if(_a8 == 0x408 && _t20 == 0) {
						DestroyWindow( *0x100050c0); // executed
						HeapFree(GetProcessHeap(), _t20,  *0x100050d8);
						 *0x100050c0 =  *0x100050c0 & _t20;
						 *0x100050d8 =  *0x100050d8 & _t20;
					}
					return _t20;
				} else {
					_push(0);
					_push( *0x100050d0 - 1);
					if( *((intOrPtr*)( *0x100050a0 + 4))() == 0) {
						goto L4;
					}
					return 0;
				}
			}

0x10001407
0x10001428
0x10001444
0x10001446
0x10001452
0x10001466
0x1000146c
0x10001472
0x10001472
0x00000000
0x1000140f
0x10001414
0x10001417
0x10001422
0x00000000
0x00000000
0x00000000
0x10001424

APIs

CallWindowProcA.USER32(?,?,?,?), ref: 1000143B
DestroyWindow.USER32 ref: 10001452
GetProcessHeap.KERNEL32(00000000), ref: 1000145F
HeapFree.KERNEL32(00000000), ref: 10001466

Memory Dump Source

Source File: 00000001.00000002.2975197977.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2975169750.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975269413.0000000010003000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975296586.0000000010004000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975376888.0000000010007000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Setup 2.jbxd

Similarity

API ID: HeapWindow$CallDestroyFreeProcProcess
String ID:
API String ID: 1278960361-0
Opcode ID: c96bcd1cbc03a3e6358ddfa187109def7b4e7432dd6c517d8c0c534236f528ca
Instruction ID: 4ffa49c0482a477224267c60226a95dad6a3768d29c6b4cffe9fba659c21200b
Opcode Fuzzy Hash: c96bcd1cbc03a3e6358ddfa187109def7b4e7432dd6c517d8c0c534236f528ca
Instruction Fuzzy Hash: D0011E32500266EBEB029F95DC98A9F3BB9FB453E3B518525FA5482078C7328850DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				intOrPtr _t15;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t15 =  *0x42ec70; // 0x6d6f7c
					_t6 = _t17 * 0x1c + _t15;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42e42c =  *0x42e42c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42e42c, 0x7530,  *0x42e414), 0); // executed
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x00401392
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(00000020,00000402,00000000), ref: 004013F4

Strings

|om, xrefs: 00401392

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: MessageSend
String ID: |om
API String ID: 3850602802-1942758059
Opcode ID: 42849ed48d919fde42c0d44f840d19e9f7e342482cf35ba8d4f2414d886d90f9
Instruction ID: 86a6a9173f7d20567c8ae2bb249fddc303668c970c82e3d032b9735ebafba260
Opcode Fuzzy Hash: 42849ed48d919fde42c0d44f840d19e9f7e342482cf35ba8d4f2414d886d90f9
Instruction Fuzzy Hash: B30128317242209BE7195B399C05B6A369CE714328F50853BF851F72F2DA78DC039B8D

Uniqueness

Uniqueness Score: -1.00%

Function 02AB10D6 Relevance: 5.1, APIs: 4, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02AB10D6(void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _t17;
				char _t19;
				void* _t20;
				void* _t24;
				void* _t27;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				signed int _t43;
				void* _t52;
				char* _t53;
				char* _t55;
				void* _t56;
				void* _t58;

				 *0x2ab4058 = _a8;
				 *0x2ab405c = _a16;
				 *0x2ab4060 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x2ab4038, E02AB189E, _t52);
				_t43 =  *0x2ab4058 +  *0x2ab4058 * 4 << 2;
				_t17 = E02AB1561();
				_a8 = _t17;
				_t53 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_a8);
				} else {
					do {
						_t19 =  *_t53;
						_t55 = _t53 + 1;
						_t58 = _t19 - 0x6c;
						if(_t58 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t53 = _t55 + 1;
								_t24 = E02AB159E(E02AB15E5( *_t55 - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t27 = _t20;
							if(_t27 == 0) {
								L10:
								_t53 = _t55 + 1;
								_t24 = E02AB160E( *_t55 - 0x30, E02AB1561());
								goto L13;
							}
							L7:
							if(_t27 == 1) {
								_t31 = GlobalAlloc(0x40, _t43 + 4); // executed
								 *_t31 =  *0x2ab4030;
								 *0x2ab4030 = _t31;
								E02AB1854(_t31 + 4,  *0x2ab4060, _t43);
								_t56 = _t56 + 0xc;
							}
							goto L14;
						}
						if(_t58 == 0) {
							L17:
							_t34 =  *0x2ab4030;
							if( *0x2ab4030 != 0) {
								E02AB1854( *0x2ab4060, _t34 + 4, _t43);
								_t37 =  *0x2ab4030;
								_t56 = _t56 + 0xc;
								GlobalFree(_t37);
								 *0x2ab4030 =  *_t37;
							}
							goto L14;
						}
						_t39 = _t19 - 0x4c;
						if(_t39 == 0) {
							goto L17;
						}
						_t40 = _t39 - 4;
						if(_t40 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L12;
						}
						_t27 = _t40;
						if(_t27 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t53 != 0);
					goto L16;
				}
			}

0x02ab10dd
0x02ab10e5
0x02ab10f9
0x02ab1101
0x02ab110c
0x02ab110f
0x02ab1117
0x02ab111a
0x02ab111c
0x02ab11ba
0x02ab11c6
0x02ab1122
0x02ab1123
0x02ab1123
0x02ab1126
0x02ab1127
0x02ab112a
0x02ab11f9
0x02ab11fc
0x02ab1194
0x02ab119a
0x02ab11a2
0x02ab11a7
0x02ab11aa
0x00000000
0x02ab11aa
0x02ab11ff
0x02ab1200
0x02ab117c
0x02ab1182
0x02ab118a
0x00000000
0x02ab118a
0x02ab1148
0x02ab1149
0x02ab1151
0x02ab115e
0x02ab1166
0x02ab116f
0x02ab1174
0x02ab1174
0x00000000
0x02ab1149
0x02ab1130
0x02ab11c7
0x02ab11c7
0x02ab11ce
0x02ab11db
0x02ab11e0
0x02ab11e5
0x02ab11eb
0x02ab11f1
0x02ab11f1
0x00000000
0x02ab11ce
0x02ab1136
0x02ab1139
0x00000000
0x00000000
0x02ab113f
0x02ab1142
0x02ab1191
0x00000000
0x02ab1191
0x02ab1145
0x02ab1146
0x02ab1179
0x00000000
0x02ab1179
0x00000000
0x02ab11b0
0x02ab11b0
0x00000000
0x02ab11b9

APIs

Part of subcall function 02AB1561: lstrcpyA.KERNEL32(00000000,?,?,?,02AB1804,?,02AB1017), ref: 02AB157E
Part of subcall function 02AB1561: GlobalFree.KERNEL32 ref: 02AB158F

GlobalAlloc.KERNELBASE(00000040,?), ref: 02AB1151
GlobalFree.KERNEL32(00000000), ref: 02AB11AA
GlobalFree.KERNEL32(?), ref: 02AB11BD
GlobalFree.KERNEL32(?), ref: 02AB11EB

Memory Dump Source

Source File: 00000001.00000002.2972899107.0000000002AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 02AB0000, based on PE: true

Associated: 00000001.00000002.2972852006.0000000002AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2972964416.0000000002AB3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2973006111.0000000002AB5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2ab0000_Setup 2.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: cf9c53e1dd6c106e16c9ed96e2bc65069d837634cb679a0af19c981dcf8db012
Instruction ID: 426071ec2cd0a3ae7c1dab02f045fa4b98b660f1a34df3254180ec457abdd6d5
Opcode Fuzzy Hash: cf9c53e1dd6c106e16c9ed96e2bc65069d837634cb679a0af19c981dcf8db012
Instruction Fuzzy Hash: 89319CB18802449FEB139F68E9E8AA67FBCFF09354B040569E84DC2123EF34C516CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00401B06 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B06(void* __ebx, void* __edx) {
				intOrPtr _t7;
				void* _t8;
				void _t11;
				void* _t13;
				void* _t21;
				void* _t24;
				void* _t30;
				void* _t33;
				void* _t34;
				void* _t37;

				_t27 = __ebx;
				_t7 =  *((intOrPtr*)(_t37 - 0x20));
				_t30 =  *0x40b060; // 0x701bb0
				if(_t7 == __ebx) {
					if(__edx == __ebx) {
						_t8 = GlobalAlloc(0x40, 0x404); // executed
						_t34 = _t8;
						_t4 = _t34 + 4; // 0x4
						E00405BC3(__ebx, _t30, _t34, _t4,  *((intOrPtr*)(_t37 - 0x28)));
						_t11 =  *0x40b060; // 0x701bb0
						 *_t34 = _t11;
						 *0x40b060 = _t34;
					} else {
						if(_t30 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t2 = _t30 + 4; // 0x701bb4
							E00405BA1(_t33, _t2);
							_push(_t30);
							 *0x40b060 =  *_t30;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t7 = _t7 - 1;
						if(_t30 == _t27) {
							break;
						}
						_t30 =  *_t30;
						if(_t7 != _t27) {
							continue;
						} else {
							if(_t30 == _t27) {
								break;
							} else {
								_t32 = _t30 + 4;
								E00405BA1(0x409c60, _t30 + 4);
								_t21 =  *0x40b060; // 0x701bb0
								E00405BA1(_t32, _t21 + 4);
								_t24 =  *0x40b060; // 0x701bb0
								_push(0x409c60);
								_push(_t24 + 4);
								E00405BA1();
								L15:
								 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t37 - 4));
								_t13 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E00405BC3(_t27, _t30, _t33, _t27, 0xffffffe8));
					E00405462();
					_t13 = 0x7fffffff;
				}
				L17:
				return _t13;
			}

0x00401b06
0x00401b06
0x00401b09
0x00401b11
0x00401b59
0x00401b87
0x00401b90
0x00401b92
0x00401b96
0x00401b9b
0x00401ba0
0x00401ba2
0x00401b5b
0x00401b5d
0x00402672
0x00401b63
0x00401b63
0x00401b68
0x00401b6f
0x00401b70
0x00401b75
0x00401b75
0x00401b5d
0x00000000
0x00401b13
0x00401b13
0x00401b13
0x00401b16
0x00000000
0x00000000
0x00401b1c
0x00401b20
0x00000000
0x00401b22
0x00401b24
0x00000000
0x00401b2a
0x00401b2a
0x00401b34
0x00401b39
0x00401b43
0x00401b48
0x00401b4d
0x00401b51
0x004027c7
0x004028a1
0x004028a4
0x004028aa
0x004028aa
0x00401b24
0x00000000
0x00401b20
0x00402211
0x0040221e
0x0040221f
0x00402224
0x00402224
0x004028ac
0x004028b0

APIs

GlobalFree.KERNEL32(00701BB0), ref: 00401B75
GlobalAlloc.KERNEL32(00000040,00000404), ref: 00401B87

Strings

Call, xrefs: 00401B2D, 00401B33, 00401B4D

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 6921d2f111358b2b71379782b4c2f5598868bfbb8356097301825a73876979ea
Instruction ID: cc00a111a875a158010fb0437ff6a2ad2fcab022a3b836d45fe26aacbc009528
Opcode Fuzzy Hash: 6921d2f111358b2b71379782b4c2f5598868bfbb8356097301825a73876979ea
Instruction Fuzzy Hash: 67219376604104ABD710ABA8DEC9E5B72B9FB84314B24453BF611F32D1EB7CB8018B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1B Relevance: 4.5, APIs: 3, Instructions: 48
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00401E1B() {
				void* _t15;
				void* _t24;
				void* _t26;
				void* _t31;

				_t28 = E00402A0C(_t24);
				E00404E8D(0xffffffeb, _t13);
				_t15 = E00405401(_t28);
				 *(_t31 + 8) = _t15;
				if(_t15 == _t24) {
					 *((intOrPtr*)(_t31 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t31 - 0x20)) != _t24) {
						while(WaitForSingleObject( *(_t31 + 8), 0x64) == 0x102) {
							E00405F69(0xf);
						}
						GetExitCodeProcess( *(_t31 + 8), _t31 - 0xc);
						if( *((intOrPtr*)(_t31 - 0x24)) < _t24) {
							if( *(_t31 - 0xc) != _t24) {
								 *((intOrPtr*)(_t31 - 4)) = 1;
							}
						} else {
							E00405AFF(_t26,  *(_t31 - 0xc));
						}
					}
					_push( *(_t31 + 8));
					FindCloseChangeNotification(); // executed
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t31 - 4));
				return 0;
			}

0x00401e21
0x00401e26
0x00401e2c
0x00401e33
0x00401e36
0x00402672
0x00401e3c
0x00401e3f
0x00401e50
0x00401e4b
0x00401e4b
0x00401e65
0x00401e6e
0x00401e7e
0x00401e80
0x00401e80
0x00401e70
0x00401e74
0x00401e74
0x00401e6e
0x00401e87
0x00401e8a
0x00401e8a
0x004028a4
0x004028b0

APIs

Part of subcall function 00404E8D: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,0041B668,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000,?), ref: 00404EC6
Part of subcall function 00404E8D: lstrlenA.KERNEL32(00402FCC,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,0041B668,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000), ref: 00404ED6
Part of subcall function 00404E8D: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00402FCC,00402FCC,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,0041B668,765F3130), ref: 00404EE9
Part of subcall function 00404E8D: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll), ref: 00404EFB
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F21
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F3B
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F49

Part of subcall function 00405401: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,0042C0C8,Error launching installer), ref: 00405426
Part of subcall function 00405401: CloseHandle.KERNEL32(?), ref: 00405433

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E55
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E65
FindCloseChangeNotification.KERNEL32(?,00000000,000000EB,00000000), ref: 00401E8A

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: MessageSend$CloseProcesslstrlen$ChangeCodeCreateExitFindHandleNotificationObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3954718778-0
Opcode ID: d9f6adca2f477af5b443bbfb9924eeac5cd73aa9c475ae1e6e24a69626e56680
Instruction ID: 2a50f7c186f8d6ad55db8ec4cc548a4808b9981e8607132828513abc09ff4306
Opcode Fuzzy Hash: d9f6adca2f477af5b443bbfb9924eeac5cd73aa9c475ae1e6e24a69626e56680
Instruction Fuzzy Hash: 2A016931D04114EBDF21AFA1CD85A9E7B71EF00358F24813BF905B61E1C7B94A81DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00405A88 Relevance: 4.5, APIs: 3, Instructions: 45
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00405A88(void* _a4, int _a8, char* _a12, int _a16, void* _a20) {
				long _t20;
				long _t23;
				long _t24;
				char* _t26;

				asm("sbb eax, eax");
				_t26 = _a16;
				 *_t26 = 0;
				_t20 = RegOpenKeyExA(_a4, _a8, 0,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				if(_t20 == 0) {
					_a8 = 0x400;
					_t23 = RegQueryValueExA(_a20, _a12, 0,  &_a16, _t26,  &_a8); // executed
					if(_t23 != 0 || _a16 != 1 && _a16 != 2) {
						 *_t26 = 0;
					}
					_t26[0x3ff] = 0;
					_t24 = RegCloseKey(_a20); // executed
					return _t24;
				}
				return _t20;
			}

0x00405a98
0x00405a9a
0x00405aa7
0x00405ab1
0x00405ab9
0x00405abe
0x00405ad2
0x00405ada
0x00405ae8
0x00405ae8
0x00405aed
0x00405af3
0x00000000
0x00405af3
0x00405afc

APIs

RegOpenKeyExA.KERNEL32(80000002,00405CC4,00000000,00000002,?,00000002,002AD65D,?,00405CC4,80000002,Software\Microsoft\Windows\CurrentVersion,002AD65D,Call,006DC2D5), ref: 00405AB1
RegQueryValueExA.KERNEL32(002AD65D,?,00000000,00405CC4,002AD65D,00405CC4), ref: 00405AD2
RegCloseKey.KERNEL32(?), ref: 00405AF3

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 67b3e0d3ded8972df4b5bccd868b78f6ad8d4f27bd32828d0c76414c952c029f
Instruction ID: 73a274855f42cec9a7ce3e58aeff3d3433a4445e8632c2ebf8a036d33102cd28
Opcode Fuzzy Hash: 67b3e0d3ded8972df4b5bccd868b78f6ad8d4f27bd32828d0c76414c952c029f
Instruction Fuzzy Hash: 8701487114020AEFDF128F64EC88AEB3FACEF14358F004126F904A6160D235D964DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401DC1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401DC1() {
				char* _t6;
				void* _t16;
				void* _t19;
				void* _t26;

				_t24 = E00402A0C(_t19);
				_t6 = E00402A0C(0x31);
				_t22 = E00402A0C(0x22);
				E00402A0C(0x15);
				E00401423(0xffffffec);
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				_t16 = ShellExecuteA( *(_t26 - 8),  ~( *_t5) & _t24, _t6,  ~( *_t7) & _t22, "C:\\Program Files (x86)\\Fast!",  *(_t26 - 0x1c)); // executed
				if(_t16 < 0x21) {
					 *((intOrPtr*)(_t26 - 4)) = 1;
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t26 - 4));
				return 0;
			}

0x00401dc9
0x00401dcb
0x00401ddb
0x00401ddd
0x00401de4
0x00401df0
0x00401dfe
0x00401e07
0x00401e10
0x00402672
0x00402672
0x004028a4
0x004028b0

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Program Files (x86)\Fast!,?), ref: 00401E07

Strings

C:\Program Files (x86)\Fast!, xrefs: 00401DF2

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Program Files (x86)\Fast!
API String ID: 587946157-1788482285
Opcode ID: 77df207de77508185c8c9cb82d9d74c621a57b79e033ef8b57d7c9527209f2e4
Instruction ID: ba14c07d206d1718bc9d8e8203e48321a71375e296f6bcf92d5e814be43a876d
Opcode Fuzzy Hash: 77df207de77508185c8c9cb82d9d74c621a57b79e033ef8b57d7c9527209f2e4
Instruction Fuzzy Hash: D6F0FC32B041406AD711BBB59D8EE5E2B659F41324F100637F400F71D2DDFC88415718

Uniqueness

Uniqueness Score: -1.00%

Function 02AB2910 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x2ab4038 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x2ab404c, 4, 0x40, 0x2ab403c); // executed
					 *0x2ab404c = 0xc2;
					 *0x2ab403c = 0;
					 *0x2ab4044 = 0;
					 *0x2ab4054 = 0;
					 *0x2ab4048 = 0;
					 *0x2ab4040 = 0;
					 *0x2ab404e = 0;
				}
				return 1;
			}

0x02ab2919
0x02ab291e
0x02ab292e
0x02ab2936
0x02ab293d
0x02ab2942
0x02ab2947
0x02ab294c
0x02ab2951
0x02ab2956
0x02ab2956
0x02ab295e

APIs

VirtualProtect.KERNELBASE(02AB404C,00000004,00000040,02AB403C), ref: 02AB292E

Strings

p|^v, xrefs: 02AB292E

Memory Dump Source

Source File: 00000001.00000002.2972899107.0000000002AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 02AB0000, based on PE: true

Associated: 00000001.00000002.2972852006.0000000002AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2972964416.0000000002AB3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2973006111.0000000002AB5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2ab0000_Setup 2.jbxd

Similarity

API ID: ProtectVirtual
String ID: p|^v
API String ID: 544645111-2328775271
Opcode ID: f54860b4dfc7040e4b4f8e624d08553d373d6fbf81e5393162e2207e1c33d891
Instruction ID: 9d4b6199f250b7481eca167705127e0d6ff9b5b351e60846d4e79070f422119f
Opcode Fuzzy Hash: f54860b4dfc7040e4b4f8e624d08553d373d6fbf81e5393162e2207e1c33d891
Instruction Fuzzy Hash: 25E0A571E88340EED362CB68A4657013FF4BB1C744B014C6AE248D6263EB7CC126CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00403E36 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E36(int _a4) {
				long _t3;

				if(_a4 == 0x78) {
					 *0x42e40c =  *0x42e40c + 1;
				}
				_t3 = SendMessageA( *0x42ec48, 0x408, _a4, 0); // executed
				return _t3;
			}

0x00403e3b
0x00403e3d
0x00403e3d
0x00403e54
0x00403e5a

APIs

SendMessageA.USER32(00000408,?,00000000,00403A98), ref: 00403E54

Strings

x, xrefs: 00403E36

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: MessageSend
String ID: x
API String ID: 3850602802-2363233923
Opcode ID: e6e6a61ead4af85831cb67e27b83a0ab76bdf8c14621e6abc8975df18522f4f8
Instruction ID: 01e630482bc5aa7651d2843b03b3bb467686e88fed72d651a0a9240d5e30c69e
Opcode Fuzzy Hash: e6e6a61ead4af85831cb67e27b83a0ab76bdf8c14621e6abc8975df18522f4f8
Instruction Fuzzy Hash: 3DC01236648201EADA245B42EE04B067A20B768B02F208039F341240B5C6301622EB0E

Uniqueness

Uniqueness Score: -1.00%

Function 02AB120C Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

LoadImageA.USER32(00000000), ref: 02AB12CB
GetLastError.KERNEL32 ref: 02AB13D2

Memory Dump Source

Source File: 00000001.00000002.2972899107.0000000002AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 02AB0000, based on PE: true

Associated: 00000001.00000002.2972852006.0000000002AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2972964416.0000000002AB3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2973006111.0000000002AB5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2ab0000_Setup 2.jbxd

Similarity

API ID: ErrorImageLastLoad
String ID:
API String ID: 2189606529-0
Opcode ID: b351047233959ae26deb15812e15434feda2bbeb3b0791bb47273a8d189afead
Instruction ID: 3b170a339a62ca7ec66dfe7adb39662cb4045208946d171d2ef8dc7851c9b299
Opcode Fuzzy Hash: b351047233959ae26deb15812e15434feda2bbeb3b0791bb47273a8d189afead
Instruction Fuzzy Hash: 4D514B72D842049BDB23AFA4E9A5BD97BB9EF4C354F10482AD808C6213DF38D592CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0040251C Relevance: 3.1, APIs: 2, Instructions: 79
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040251C(intOrPtr __ebx, void* __edi, void* __esi) {
				intOrPtr _t28;
				void* _t37;
				void* _t40;

				 *((intOrPtr*)(_t37 - 0x30)) = __ebx;
				_t28 = E004029EF(2);
				_t40 = _t28 - 1;
				 *((intOrPtr*)(_t37 - 8)) = _t28;
				if(_t40 < 0) {
					L25:
					 *0x42ecc8 =  *0x42ecc8 +  *(_t37 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *((intOrPtr*)(__ebp - 8)) = 0x3ff;
					}
					if( *__esi == __bl) {
						L22:
						__esi =  *((intOrPtr*)(__ebp - 0x30));
						goto L23;
					} else {
						 *((char*)(__ebp + 0xb)) = __bl;
						 *(__ebp - 0xc) = E00405B18(__ecx, __esi);
						if( *((intOrPtr*)(__ebp - 8)) <= __ebx) {
							goto L22;
						} else {
							__esi =  *((intOrPtr*)(__ebp - 0x30));
							while(1) {
								__ebp - 0x34 = __ebp - 0xd;
								__eax = ReadFile( *(__ebp - 0xc), __ebp - 0xd, 1, __ebp - 0x34, __ebx); // executed
								if(__eax == 0 ||  *(__ebp - 0x34) != 1) {
									break;
								}
								if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx) {
									 *(__ebp - 0xd) & 0x000000ff = E00405AFF(__edi,  *(__ebp - 0xd) & 0x000000ff);
								} else {
									if( *((char*)(__ebp + 0xb)) == 0xd ||  *((char*)(__ebp + 0xb)) == 0xa) {
										__al =  *(__ebp - 0xd);
										if( *((intOrPtr*)(__ebp + 0xb)) == __al || __al != 0xd && __al != 0xa) {
											__eax = SetFilePointer( *(__ebp - 0xc), 0xffffffff, __ebx, 1);
										} else {
											 *((char*)(__esi + __edi)) = __al;
											__esi = __esi + 1;
										}
										break;
									} else {
										__al =  *(__ebp - 0xd);
										 *((char*)(__esi + __edi)) = __al;
										__esi = __esi + 1;
										 *((char*)(__ebp + 0xb)) = __al;
										if(__al == __bl) {
											break;
										} else {
											if(__esi <  *((intOrPtr*)(__ebp - 8))) {
												continue;
											} else {
												break;
											}
										}
									}
								}
								goto L26;
							}
							L23:
							 *((char*)(__esi + __edi)) = __bl;
							if(_t40 == 0) {
								 *(_t37 - 4) = 1;
							}
							goto L25;
						}
					}
				}
				L26:
				return 0;
			}

0x0040251e
0x00402521
0x00402526
0x00402529
0x0040252c
0x004028a1
0x004028a4
0x00402532
0x00402532
0x00402539
0x0040253b
0x0040253b
0x00402540
0x004025d4
0x004025d4
0x00000000
0x00402546
0x00402547
0x00402552
0x00402555
0x00000000
0x00402557
0x00402557
0x0040255a
0x0040255f
0x00402568
0x00402570
0x00000000
0x00000000
0x0040257b
0x004025a4
0x0040257d
0x00402581
0x004025ae
0x004025b4
0x004025cc
0x004025be
0x004025be
0x004025c1
0x004025c1
0x00000000
0x00402589
0x00402589
0x0040258c
0x0040258f
0x00402592
0x00402595
0x00000000
0x00402597
0x0040259a
0x00000000
0x0040259c
0x00000000
0x0040259c
0x0040259a
0x00402595
0x00402581
0x00000000
0x0040257b
0x004025d7
0x004025d7
0x004015a8
0x00402672
0x00402672
0x00000000
0x004015a8
0x00402555
0x00402540
0x004028aa
0x004028b0

APIs

ReadFile.KERNEL32(?,?,00000001,?,?,?,00000002), ref: 00402568

Part of subcall function 00405AFF: wsprintfA.USER32 ref: 00405B0C

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: FileReadwsprintf
String ID:
API String ID: 3326442220-0
Opcode ID: b477d60ff94f73c1c0bb044503b76951384e81d4576d319d4125a1203f1dc534
Instruction ID: 19eab3b86d9b75e5e7be3b308233c29603b61c08bd2d52ff7fc178e77211348e
Opcode Fuzzy Hash: b477d60ff94f73c1c0bb044503b76951384e81d4576d319d4125a1203f1dc534
Instruction Fuzzy Hash: D821F871C04199BFDF318B988E596AEBB749F01304F14417BE581B62D1C6BC8A81CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00405F2D Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F2D(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x409228);
				_t5 = GetModuleHandleA( *(_t10 + 0x409228));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40922c));
				}
				_t5 = E00405EC3(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00405f35
0x00405f38
0x00405f3f
0x00405f47
0x00405f53
0x00000000
0x00405f5a
0x00405f4a
0x00405f51
0x00000000
0x00405f62
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,00403179,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00405F3F
GetProcAddress.KERNEL32(00000000,?), ref: 00405F5A

Part of subcall function 00405EC3: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405EDA
Part of subcall function 00405EC3: wsprintfA.USER32 ref: 00405F13
Part of subcall function 00405EC3: LoadLibraryA.KERNEL32(?), ref: 00405F23

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 1d5d05e119682ff417a48f130b5ba42363bbc93cead61c2bd8601333870f7f39
Instruction ID: 5a94b1a02772503a3f00306f9b3f9683cc322e661ee482fd999d4dc3ca30496d
Opcode Fuzzy Hash: 1d5d05e119682ff417a48f130b5ba42363bbc93cead61c2bd8601333870f7f39
Instruction Fuzzy Hash: 3AE0863260861176D6105B74AD0496B72A8DE8C7503054C7EF945F6190D738DC119AA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040287C Relevance: 3.0, APIs: 2, Instructions: 21
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040287C(signed int __eax) {
				RECT* _t10;
				void* _t16;

				SendMessageA( *(_t16 - 8), 0xb,  *0x42b0c0 & __eax, _t10); // executed
				if( *((intOrPtr*)(_t16 - 0x28)) != _t10) {
					InvalidateRect( *(_t16 - 8), _t10, _t10);
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t16 - 4));
				return 0;
			}

0x0040288b
0x00402894
0x0040289b
0x0040289b
0x004028a4
0x004028b0

APIs

SendMessageA.USER32(?,0000000B,?), ref: 0040288B
InvalidateRect.USER32(?), ref: 0040289B

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: InvalidateMessageRectSend
String ID:
API String ID: 909852535-0
Opcode ID: 08dcfb9834c95f89ad541780f3876cf505edd94ac534487e8fe09633a376a490
Instruction ID: f8a96fc1e36c5b93f6f214f627bc77ef160ce1b27a8f698795edc455daabadaa
Opcode Fuzzy Hash: 08dcfb9834c95f89ad541780f3876cf505edd94ac534487e8fe09633a376a490
Instruction Fuzzy Hash: F6E04672A00008AFEB118B94ECC89AEBB79FB00319F00003AE102A11A0D7341D41DA28

Uniqueness

Uniqueness Score: -1.00%

Function 00401D95 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DAB
EnableWindow.USER32(00000000,00000000), ref: 00401DB6

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 4b91b45f4026f97bd9beb82d67beae29b1f9c0c3cc10d42029c057caa3b17660
Instruction ID: 984ebb461e7b3d17f7d90f3cfa72f58d5920c2121cea36e24e5a662f071b7263
Opcode Fuzzy Hash: 4b91b45f4026f97bd9beb82d67beae29b1f9c0c3cc10d42029c057caa3b17660
Instruction Fuzzy Hash: 4BE08672A04100DBD750A7B59D4D95E3264AF00369B104037E402F11C1C97C5C018659

Uniqueness

Uniqueness Score: -1.00%

Function 00405878 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405878(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x0040587c
0x00405889
0x0040589e
0x004058a4

APIs

GetFileAttributesA.KERNEL32(00000003,00402C78,C:\Users\user\Desktop\Setup 2.exe,80000000,00000003), ref: 0040587C
CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040589E

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction ID: 518821d5ca0a74227a37217cadb520a33af9faec79942caa6648154b48e23ab6
Opcode Fuzzy Hash: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction Fuzzy Hash: DDD09E71658301AFEF098F20DE1AF2E7AA2EB84B01F10962CB646940E0D6715C15DB16

Uniqueness

Uniqueness Score: -1.00%

Function 00405859 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405859(CHAR* _a4) {
				signed char _t3;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					return SetFileAttributesA(_a4, _t3 & 0x000000fe);
				}
				return _t3;
			}

0x0040585d
0x00405866
0x00000000
0x0040586f
0x00405875

APIs

GetFileAttributesA.KERNEL32(?,00405664,?,?,?), ref: 0040585D
SetFileAttributesA.KERNEL32(?,00000000), ref: 0040586F

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 074f941138e9f1df105fff9ec0b177d36ae7deb3ea45ba36f2ce8c3e98632dd9
Instruction ID: 15299d6900fb3f0dcfcb805ba40550cd3d393431f2dda1ea0104ff8e742be84e
Opcode Fuzzy Hash: 074f941138e9f1df105fff9ec0b177d36ae7deb3ea45ba36f2ce8c3e98632dd9
Instruction Fuzzy Hash: 8AC04CB1808505BBD6016B35DF4DC1F7B66EB50321B108B35F569A01F0CB319C66DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 004053CC Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004053CC(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x004053d2
0x004053da
0x00000000
0x004053e0
0x00000000

APIs

CreateDirectoryA.KERNEL32(?,00000000,00403100,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 004053D2
GetLastError.KERNEL32 ref: 004053E0

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 62594c709cce2f5b8fb8ca5d54e7f3286412bfa0f130784d9dc04a2d264f0cc1
Instruction ID: 0a32bba0594ce4c50c7d18531d00583a5fdebb7a5bad339d624f0ac39b1a71a3
Opcode Fuzzy Hash: 62594c709cce2f5b8fb8ca5d54e7f3286412bfa0f130784d9dc04a2d264f0cc1
Instruction Fuzzy Hash: B0C04C30A08501EBD6105B31AE49B177AE49B547C1F1045366506E41E0D7B49411D93E

Uniqueness

Uniqueness Score: -1.00%

Function 004025E2 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E004025E2(void* __eflags) {
				long _t6;
				long _t8;
				LONG* _t10;
				void* _t12;
				void* _t15;
				void* _t17;

				_push(ds);
				if(__eflags != 0) {
					_t6 = E004029EF(2);
					_t8 = SetFilePointer(E00405B18(_t12, _t15), _t6, _t10,  *(_t17 - 0x1c)); // executed
					if( *((intOrPtr*)(_t17 - 0x24)) >= _t10) {
						_push(_t8);
						E00405AFF();
					}
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x004025e2
0x004025e3
0x004025ef
0x004025fc
0x00402605
0x00402847
0x00402849
0x00402849
0x00402605
0x004028a4
0x004028b0

APIs

SetFilePointer.KERNEL32(00000000,?,00000000,00000002,?,?), ref: 004025FC

Part of subcall function 00405AFF: wsprintfA.USER32 ref: 00405B0C

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 7802b7b00399cfaf2990ab86e23f61d39cfe8f9262743632c11858e8c721a55f
Instruction ID: af763d8a78a761db22c42ff553d5b38efdf029ab42d771ce7adfc9ea42a260e9
Opcode Fuzzy Hash: 7802b7b00399cfaf2990ab86e23f61d39cfe8f9262743632c11858e8c721a55f
Instruction Fuzzy Hash: 8BE01A77A04100ABE741B7A69E8A8BF7269EF40309B10413BF501B10D1CABD5C025A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403093 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403093(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409014, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x00403097
0x004030aa
0x004030b2
0x00000000
0x004030b9
0x00000000
0x004030bb

APIs

ReadFile.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,00402EC0,000000FF,00000004,00000000,00000000,00000000), ref: 004030AA

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0be395bbe571093c8e78859d05ee89954336de5599fe3087c5eab9dc4054fae4
Instruction ID: fff8dc69d300bf088447089d7068fb6aaa903b2c1760e3ba56c5ad9840b64b03
Opcode Fuzzy Hash: 0be395bbe571093c8e78859d05ee89954336de5599fe3087c5eab9dc4054fae4
Instruction Fuzzy Hash: BAE08C32161118BBCF215E52EC00EE73B5CEB047A2F008033BA14E62A0D670EA14DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00403E5D Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E5D(intOrPtr _a12) {
				intOrPtr _v0;
				struct HWND__* _v4;
				int _t7;
				void* _t8;
				void* _t9;
				void* _t10;

				_t7 = SetDlgItemTextA(_v4, _v0 + 0x3e8, E00405BC3(_t8, _t9, _t10, 0, _a12)); // executed
				return _t7;
			}

0x00403e77
0x00403e7c

APIs

SetDlgItemTextA.USER32(?,?,00000000), ref: 00403E77

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: bd088f7f00d811be993cb0fa1566991d2d73bb63516f205f68802a77c6a304db
Instruction ID: ef3ffff1d02dc7de7135e56bd9a3da932b159402b42e9e0b37d7e7a6cf7c8a2a
Opcode Fuzzy Hash: bd088f7f00d811be993cb0fa1566991d2d73bb63516f205f68802a77c6a304db
Instruction Fuzzy Hash: 15C08C31048300BFD281A704CC02F0FB7E8EF9031AF40C82EB16CA40D1C634D4208E2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403EA9 Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403EA9(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x42e418; // 0x303b4
				if(_t2 != 0) {
					_t3 = SendMessageA(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x00403ea9
0x00403eb0
0x00403ebb
0x00000000
0x00403ebb
0x00403ec1

APIs

SendMessageA.USER32(000303B4,00000000,00000000,00000000), ref: 00403EBB

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 43c32328bbefc1a3920a48ff71181bee35ee5e1fabb1ba4cd28715ef016f3240
Instruction ID: 754643320ca30f69397f413a8b8db00d71b0532af1d09d8a00dcaf1ba171179f
Opcode Fuzzy Hash: 43c32328bbefc1a3920a48ff71181bee35ee5e1fabb1ba4cd28715ef016f3240
Instruction Fuzzy Hash: B0C09B717543017BEE20DF65DD45F0B7B586754B01F148435B200FB1D1C675E411DA6D

Uniqueness

Uniqueness Score: -1.00%

Function 004030C5 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030C5(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409014, _a4, 0, 0); // executed
				return _t2;
			}

0x004030d3
0x004030d9

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00402DFF,00009DE4), ref: 004030D3

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1fe8ad6970e23be315a08abdb90e0b058f57890677f29add635e0ec7003afc6f
Instruction ID: 89776e93a0172b97a38fb7948c015c90ed7fb14eba3da05579cbd58eb2c2bcc6
Opcode Fuzzy Hash: 1fe8ad6970e23be315a08abdb90e0b058f57890677f29add635e0ec7003afc6f
Instruction Fuzzy Hash: 87B01271644200BFDB214F00DF06F057B61A794701F108030B744380F082712830EB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00403E92 Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E92(int _a4) {
				long _t2;

				_t2 = SendMessageA( *0x42ec48, 0x28, _a4, 1); // executed
				return _t2;
			}

0x00403ea0
0x00403ea6

APIs

SendMessageA.USER32(00000028,?,00000001,00403CC3), ref: 00403EA0

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4bd8982626c92abb2357f82476bd4d99c5d7f29670624c06be2de6c5191f01be
Instruction ID: 44392e581bbb4aa9116d087c90e7fb2cdd31efd5ead07ebe883a28bd9b35942d
Opcode Fuzzy Hash: 4bd8982626c92abb2357f82476bd4d99c5d7f29670624c06be2de6c5191f01be
Instruction Fuzzy Hash: DAB01236688202BBEE214B41DD09F457E62F768701F008030F300280F4CAB200A1EF09

Uniqueness

Uniqueness Score: -1.00%

Function 00403E7F Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E7F(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x42a0b8, _a4); // executed
				return _t2;
			}

0x00403e89
0x00403e8f

APIs

KiUserCallbackDispatcher.NTDLL(?,00403C5C), ref: 00403E89

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 8c5842e903119d4e54e6dca0c52f7b0b198653f2e5d8341527d4c31334f50caf
Instruction ID: 95dc7da4476d59103c26fcc6ae799d7f945830a776bf5e17fb181abdd4047406
Opcode Fuzzy Hash: 8c5842e903119d4e54e6dca0c52f7b0b198653f2e5d8341527d4c31334f50caf
Instruction Fuzzy Hash: EDA002755041009BCB555F50DF04D057B62A7547017415435A5455417486315579EB1F

Uniqueness

Uniqueness Score: -1.00%

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 17
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004014D6() {
				long _t2;
				void* _t6;
				void* _t10;

				_t2 = E004029EF(_t6);
				if(_t2 <= 1) {
					_t2 = 1;
				}
				Sleep(_t2); // executed
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t10 - 4));
				return 0;
			}

0x004014d7
0x004014df
0x004014e3
0x004014e3
0x004014e5
0x004028a4
0x004028b0

APIs

Sleep.KERNEL32(00000000), ref: 004014E5

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 78d2e6e0d4cef65e2203bc32a72a52e1585775b4b48775cde150ca72926f469a
Instruction ID: 2279a1eb59868a7384db17342a960448875f3c9b0d9377e09ad035f05ac00328
Opcode Fuzzy Hash: 78d2e6e0d4cef65e2203bc32a72a52e1585775b4b48775cde150ca72926f469a
Instruction Fuzzy Hash: A9D0A973B241008BE790E7BEAE8945B23A8FB4032A3204833D802E2092D93CC8028218

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004047DC Relevance: 67.0, APIs: 33, Strings: 5, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E004047DC(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				intOrPtr _t183;
				int _t189;
				int _t196;
				intOrPtr _t198;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				intOrPtr _t231;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				signed int _t242;
				signed int _t245;
				signed int _t247;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t274;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				signed int* _t284;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				int _t294;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				intOrPtr _t309;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;
				void* _t328;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x42ec68; // 0x6d6b64
				_t320 = SendMessageA;
				_v8 = _t182;
				_t183 =  *0x42ec50; // 0x6d6978
				_t315 = 0;
				_v32 = _t280;
				_v20 = _t183 + 0x94;
				if(_a8 != 0x110) {
					L23:
					__eflags = _a8 - 0x405;
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					__eflags = _a8 - 0x4e;
					if(_a8 == 0x4e) {
						L28:
						__eflags = _a8 - 0x413;
						_v16 = _t289;
						if(_a8 == 0x413) {
							L30:
							__eflags =  *0x42ec59 & 0x00000002;
							if(( *0x42ec59 & 0x00000002) != 0) {
								L41:
								__eflags = _v16 - _t315;
								if(_v16 != _t315) {
									_t232 = _v16;
									__eflags =  *((intOrPtr*)(_t232 + 8)) - 0xfffffe6e;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									__eflags =  *((intOrPtr*)(_t233 + 8)) - 0xfffffe6a;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										__eflags =  *((intOrPtr*)(_t233 + 0xc)) - 2;
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											_t284 =  *(_t233 + 0x5c) * 0x418 + _t280 + 8;
											 *_t284 =  *_t284 & 0xffffffdf;
											__eflags =  *_t284;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							__eflags = _a8 - 0x413;
							if(_a8 == 0x413) {
								L33:
								__eflags = _a8 - 0x413;
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E0040475C(_v8, _a8 != 0x413);
								__eflags = _t240 - _t315;
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									__eflags = _t289 & 0x00000010;
									if((_t289 & 0x00000010) == 0) {
										__eflags = _t289 & 0x00000040;
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
											__eflags = _t298;
										} else {
											_t300 = _t289 ^ 0x00000080;
											__eflags = _t300;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t242 =  *0x42ec58; // 0x80
										_t289 = 1;
										_a8 = 0x40f;
										_t245 =  !_t242 >> 0x00000008 & 1;
										__eflags = _t245;
										_a12 = 1;
										_a16 = _t245;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							__eflags =  *((intOrPtr*)(_t289 + 8)) - 0xfffffffe;
							if( *((intOrPtr*)(_t289 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						}
						__eflags =  *((intOrPtr*)(_t289 + 4)) - 0x408;
						if( *((intOrPtr*)(_t289 + 4)) != 0x408) {
							goto L48;
						}
						goto L30;
					} else {
						__eflags = _a8 - 0x413;
						if(_a8 != 0x413) {
							L48:
							__eflags = _a8 - 0x111;
							if(_a8 != 0x111) {
								L56:
								__eflags = _a8 - 0x200;
								if(_a8 == 0x200) {
									SendMessageA(_v8, 0x200, _t315, _t315);
								}
								__eflags = _a8 - 0x40b;
								if(_a8 == 0x40b) {
									_t220 =  *0x42a09c;
									__eflags = _t220 - _t315;
									if(_t220 != _t315) {
										ImageList_Destroy(_t220);
									}
									_t221 =  *0x42a0b4;
									__eflags = _t221 - _t315;
									if(_t221 != _t315) {
										GlobalFree(_t221);
									}
									 *0x42a09c = _t315;
									 *0x42a0b4 = _t315;
									 *0x42eca0 = _t315;
								}
								__eflags = _a8 - 0x40f;
								if(_a8 != 0x40f) {
									L86:
									__eflags = _a8 - 0x420;
									if(_a8 == 0x420) {
										__eflags =  *0x42ec59 & 0x00000001;
										if(( *0x42ec59 & 0x00000001) != 0) {
											__eflags = _a16 - 0x20;
											_t189 = (0 | _a16 == 0x00000020) << 3;
											__eflags = _t189;
											_t316 = _t189;
											ShowWindow(_v8, _t316);
											ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
										}
									}
									goto L89;
								} else {
									E004011EF(_t289, _t315, _t315);
									__eflags = _a12 - _t315;
									if(_a12 != _t315) {
										E0040140B(8);
									}
									__eflags = _a16 - _t315;
									if(_a16 == _t315) {
										L73:
										E004011EF(_t289, _t315, _t315);
										__eflags =  *0x42ec6c - _t315; // 0x1
										_v32 =  *0x42a0b4;
										_t196 =  *0x42ec68; // 0x6d6b64
										_v60 = 0xf030;
										_v16 = _t315;
										if(__eflags <= 0) {
											L84:
											InvalidateRect(_v8, _t315, 1);
											_t198 =  *0x42e41c; // 0x6dd263
											__eflags =  *((intOrPtr*)(_t198 + 0x10)) - _t315;
											if( *((intOrPtr*)(_t198 + 0x10)) != _t315) {
												E00404717(0x3ff, 0xfffffffb, E0040472F(5));
											}
											goto L86;
										} else {
											_t142 = _t196 + 8; // 0x6d6b6c
											_t281 = _t142;
											do {
												_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
												__eflags = _t202 - _t315;
												if(_t202 != _t315) {
													_t291 =  *_t281;
													_v68 = _t202;
													__eflags = _t291 & 0x00000001;
													_v72 = 8;
													if((_t291 & 0x00000001) != 0) {
														_t151 =  &(_t281[4]); // 0x6d6b7c
														_v72 = 9;
														_v56 = _t151;
														_t154 =  &(_t281[0]);
														 *_t154 = _t281[0] & 0x000000fe;
														__eflags =  *_t154;
													}
													__eflags = _t291 & 0x00000040;
													if((_t291 & 0x00000040) == 0) {
														_t206 = (_t291 & 0x00000001) + 1;
														__eflags = _t291 & 0x00000010;
														if((_t291 & 0x00000010) != 0) {
															_t206 = _t206 + 3;
															__eflags = _t206;
														}
													} else {
														_t206 = 3;
													}
													_t294 = (_t291 >> 0x00000005 & 0x00000001) + 1;
													__eflags = _t294;
													_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
													SendMessageA(_v8, 0x1102, _t294, _v68);
													SendMessageA(_v8, 0x110d, _t315,  &_v72);
												}
												_v16 = _v16 + 1;
												_t281 =  &(_t281[0x106]);
												__eflags = _v16 -  *0x42ec6c; // 0x1
											} while (__eflags < 0);
											goto L84;
										}
									} else {
										_t282 = E004012E2( *0x42a0b4);
										E00401299(_t282);
										_t217 = 0;
										_t289 = 0;
										__eflags = _t282 - _t315;
										if(_t282 <= _t315) {
											L72:
											SendMessageA(_v12, 0x14e, _t289, _t315);
											_a16 = _t282;
											_a8 = 0x420;
											goto L73;
										} else {
											goto L69;
										}
										do {
											L69:
											_t309 = _v20;
											__eflags =  *((intOrPtr*)(_t309 + _t217 * 4)) - _t315;
											if( *((intOrPtr*)(_t309 + _t217 * 4)) != _t315) {
												_t289 = _t289 + 1;
												__eflags = _t289;
											}
											_t217 = _t217 + 1;
											__eflags = _t217 - _t282;
										} while (_t217 < _t282);
										goto L72;
									}
								}
							}
							__eflags = _a12 - 0x3f9;
							if(_a12 != 0x3f9) {
								goto L89;
							}
							__eflags = _a12 >> 0x10 - 1;
							if(_a12 >> 0x10 != 1) {
								goto L89;
							}
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							__eflags = _t227 - 0xffffffff;
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							__eflags = _t283 - 0xffffffff;
							if(_t283 == 0xffffffff) {
								L54:
								_t283 = 0x20;
								L55:
								E00401299(_t283);
								SendMessageA(_a4, 0x420, _t315, _t283);
								_a12 = 1;
								_a16 = _t315;
								_a8 = 0x40f;
								goto L56;
							}
							_t231 = _v20;
							__eflags =  *((intOrPtr*)(_t231 + _t283 * 4)) - _t315;
							if( *((intOrPtr*)(_t231 + _t283 * 4)) != _t315) {
								goto L55;
							}
							goto L54;
						}
						goto L28;
					}
				} else {
					 *0x42eca0 = _a4;
					_t247 =  *0x42ec6c; // 0x1
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x42a0b4 = GlobalAlloc(0x40, _t247 << 2);
					_t250 = LoadBitmapA( *0x42ec40, 0x6e);
					 *0x42a0a8 =  *0x42a0a8 | 0xffffffff;
					_v24 = _t250;
					 *0x42a0b0 = SetWindowLongA(_v8, 0xfffffffc, E00404DDD);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x42a09c = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x42a09c);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t315, E00405BC3(_t286, _t315, _t320, _t315, _t258)), _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403E5D(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403E5D(_a4);
					_t318 = 0;
					_t288 = 0;
					_t328 =  *0x42ec6c - _t318; // 0x1
					if(_t328 <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									__eflags = _t269 & 0x00000004;
									if((_t269 & 0x00000004) == 0) {
										 *( *0x42a0b4 + _t318 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v84);
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_v28 = 1;
									 *( *0x42a0b4 + _t318 * 4) = _t274;
									_t288 =  *( *0x42a0b4 + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_t331 = _t318 -  *0x42ec6c; // 0x1
							_v24 = _t311;
						} while (_t331 < 0);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403E92(_v8);
								_t280 = _v32;
								_t315 = 0;
								__eflags = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403E92(_v12);
								L89:
								return E00403EC4(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x004047fa
0x00404800
0x00404802
0x00404808
0x0040480e
0x00404811
0x0040481b
0x00404824
0x00404827
0x0040482a
0x00404a52
0x00404a52
0x00404a59
0x00404a6d
0x00404a5b
0x00404a5d
0x00404a60
0x00404a61
0x00404a68
0x00404a68
0x00404a70
0x00404a79
0x00404a84
0x00404a84
0x00404a87
0x00404a8a
0x00404a99
0x00404a99
0x00404aa0
0x00404b18
0x00404b18
0x00404b1b
0x00404b1d
0x00404b20
0x00404b27
0x00404b35
0x00404b35
0x00404b37
0x00404b3a
0x00404b41
0x00404b43
0x00404b47
0x00404b64
0x00404b68
0x00404b68
0x00404b49
0x00404b56
0x00404b56
0x00404b47
0x00404b41
0x00000000
0x00404b1b
0x00404aa2
0x00404aa5
0x00404ab0
0x00404ab2
0x00404ab5
0x00404abc
0x00404ac1
0x00404ac3
0x00404acd
0x00404acd
0x00404ad1
0x00404ad3
0x00404ad6
0x00404ad8
0x00404adb
0x00404af1
0x00404af1
0x00404add
0x00404add
0x00404ae3
0x00404ae5
0x00404aec
0x00404ae7
0x00404ae7
0x00404ae7
0x00404ae5
0x00404af5
0x00404af7
0x00404afc
0x00404b05
0x00404b06
0x00404b10
0x00404b10
0x00404b12
0x00404b15
0x00404b15
0x00404ad6
0x00000000
0x00404ac3
0x00404aa7
0x00404aaa
0x00404aae
0x00000000
0x00000000
0x00000000
0x00404aae
0x00404a8c
0x00404a93
0x00000000
0x00000000
0x00000000
0x00404a7b
0x00404a7b
0x00404a7e
0x00404b6b
0x00404b6b
0x00404b72
0x00404be6
0x00404be6
0x00404bed
0x00404bf9
0x00404bf9
0x00404bfb
0x00404c02
0x00404c04
0x00404c09
0x00404c0b
0x00404c0e
0x00404c0e
0x00404c14
0x00404c19
0x00404c1b
0x00404c1e
0x00404c1e
0x00404c24
0x00404c2a
0x00404c30
0x00404c30
0x00404c36
0x00404c3d
0x00404d8a
0x00404d8a
0x00404d91
0x00404d93
0x00404d9a
0x00404d9e
0x00404dab
0x00404dab
0x00404dae
0x00404db4
0x00404dc6
0x00404dc6
0x00404d9a
0x00000000
0x00404c43
0x00404c45
0x00404c4a
0x00404c4d
0x00404c51
0x00404c51
0x00404c56
0x00404c59
0x00404c9a
0x00404c9c
0x00404ca6
0x00404cac
0x00404caf
0x00404cb4
0x00404cbb
0x00404cbe
0x00404d60
0x00404d66
0x00404d6c
0x00404d71
0x00404d74
0x00404d85
0x00404d85
0x00000000
0x00404cc4
0x00404cc4
0x00404cc4
0x00404cc7
0x00404ccd
0x00404cd0
0x00404cd2
0x00404cd4
0x00404cd6
0x00404cd9
0x00404cdc
0x00404ce3
0x00404ce5
0x00404ce8
0x00404cef
0x00404cf2
0x00404cf2
0x00404cf2
0x00404cf2
0x00404cf6
0x00404cf9
0x00404d05
0x00404d06
0x00404d09
0x00404d0b
0x00404d0b
0x00404d0b
0x00404cfb
0x00404cfd
0x00404cfd
0x00404d2a
0x00404d2a
0x00404d2b
0x00404d37
0x00404d46
0x00404d46
0x00404d48
0x00404d4b
0x00404d54
0x00404d54
0x00000000
0x00404cc7
0x00404c5b
0x00404c66
0x00404c69
0x00404c6e
0x00404c70
0x00404c72
0x00404c74
0x00404c84
0x00404c8e
0x00404c90
0x00404c93
0x00000000
0x00000000
0x00000000
0x00000000
0x00404c76
0x00404c76
0x00404c76
0x00404c79
0x00404c7c
0x00404c7e
0x00404c7e
0x00404c7e
0x00404c7f
0x00404c80
0x00404c80
0x00000000
0x00404c76
0x00404c59
0x00404c3d
0x00404b74
0x00404b7a
0x00000000
0x00000000
0x00404b86
0x00404b8a
0x00000000
0x00000000
0x00404b9a
0x00404b9c
0x00404b9f
0x00000000
0x00000000
0x00404bb1
0x00404bb3
0x00404bb6
0x00404bc0
0x00404bc2
0x00404bc3
0x00404bc4
0x00404bd3
0x00404bd5
0x00404bdc
0x00404bdf
0x00000000
0x00404bdf
0x00404bb8
0x00404bbb
0x00404bbe
0x00000000
0x00000000
0x00000000
0x00404bbe
0x00000000
0x00404a7e
0x00404830
0x00404835
0x0040483a
0x0040483f
0x00404840
0x00404849
0x00404854
0x0040485f
0x00404865
0x00404873
0x00404888
0x0040488d
0x00404898
0x004048a1
0x004048b6
0x004048c7
0x004048d4
0x004048d4
0x004048d9
0x004048df
0x004048e1
0x004048e4
0x004048e9
0x004048ee
0x004048f0
0x004048f0
0x00404910
0x00404910
0x00404912
0x00404913
0x00404918
0x0040491b
0x0040491e
0x00404922
0x00404927
0x0040492c
0x00404930
0x00404935
0x0040493a
0x0040493c
0x0040493e
0x00404944
0x00404a0e
0x00404a21
0x00000000
0x0040494a
0x0040494d
0x00404950
0x00404953
0x00404953
0x00404959
0x0040495f
0x00404962
0x00404968
0x00404969
0x0040496e
0x00404977
0x0040497e
0x00404981
0x00404984
0x00404987
0x004049c1
0x004049c3
0x004049ec
0x004049c5
0x004049d2
0x004049d2
0x00404989
0x0040498c
0x0040499b
0x004049a5
0x004049ad
0x004049b4
0x004049bc
0x004049bc
0x00404987
0x004049f2
0x004049f3
0x004049f9
0x004049ff
0x004049ff
0x00404a0c
0x00404a27
0x00404a2b
0x00404a48
0x00404a4d
0x00404a50
0x00404a50
0x00000000
0x00404a2d
0x00404a32
0x00404a3b
0x00404dc8
0x00404dda
0x00404dda
0x00404a2b
0x00000000
0x00404a0c
0x00404944

APIs

GetDlgItem.USER32(?,000003F9), ref: 004047F3
GetDlgItem.USER32(?,00000408), ref: 00404800
GlobalAlloc.KERNEL32(00000040,00000001), ref: 0040484C
LoadBitmapA.USER32(0000006E), ref: 0040485F
SetWindowLongA.USER32(?,000000FC,00404DDD), ref: 00404879
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040488D
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 004048A1
SendMessageA.USER32(?,00001109,00000002), ref: 004048B6
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004048C2
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004048D4
DeleteObject.GDI32(?), ref: 004048D9
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404904
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404910
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049A5
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 004049D0
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049E4
GetWindowLongA.USER32(?,000000F0), ref: 00404A13
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A21
ShowWindow.USER32(?,00000005), ref: 00404A32
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404B35
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404B9A
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404BAF
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404BD3
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404BF9
ImageList_Destroy.COMCTL32(?), ref: 00404C0E
GlobalFree.KERNEL32(?), ref: 00404C1E
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404C8E
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404D37
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404D46
InvalidateRect.USER32(?,00000000,00000001), ref: 00404D66
ShowWindow.USER32(?,00000000), ref: 00404DB4
GetDlgItem.USER32(?,000003FE), ref: 00404DBF
ShowWindow.USER32(00000000), ref: 00404DC6

Strings

xim, xrefs: 00404811
dkm, xrefs: 00404802, 00404CAF
, xrefs: 00404D9E
N, xrefs: 00404A70
M, xrefs: 0040498C

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N$dkm$xim
API String ID: 1638840714-433931922
Opcode ID: 4e63ca6e9464e87f5d4ab94560d5c99c95fe02dad02888ea5b3d52ac9d8c04b8
Instruction ID: 458a4472cc575749f24c7bcde6f1b2e9246033a2a8d3a9469834700d3721ba37
Opcode Fuzzy Hash: 4e63ca6e9464e87f5d4ab94560d5c99c95fe02dad02888ea5b3d52ac9d8c04b8
Instruction Fuzzy Hash: E7028EB0A00209EFDB21DF55DD85AAE7BB5FB84314F10813AF610BA2E1C7799A41DF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040429B Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 273
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040429B(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr _t124;
				intOrPtr* _t138;
				CHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				struct HWND__* _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x429890; // 0x6d6ae4
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xa) + 0x42f000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405446(0x3fb, _t146);
					E00405E03(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405446(0x3fb, _t146);
							if(E00405775(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E00405BA1(0x429088, _t146);
							_t87 = E00405F2D(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00405BA1(0x429088, _t146);
								_t89 = E00405728(0x429088);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x429088,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x429088) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x429088,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t159 = E004056DB(0x429088) - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x429088) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E0040472F(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x42e41c; // 0x6dd263
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E00404717(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x429078);
									} else {
										E00404652(_t168, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x42ece4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E00403E7F(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x42a0ac == _t158) {
									E00404230();
								}
								 *0x42a0ac = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x42a0c0;
							_v60 = E004045EC;
							_v56 = _t146;
							_v68 = E00405BC3(_t146, 0x42a0c0, _t166, 0x429490, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405694(_t146);
								_t124 =  *0x42ec50; // 0x6d6978
								_t125 =  *((intOrPtr*)(_t124 + 0x11c));
								if( *((intOrPtr*)(_t124 + 0x11c)) != 0 && _t146 == "C:\\Program Files (x86)\\Fast!") {
									E00405BC3(_t146, 0x42a0c0, _t166, 0, _t125);
									if(lstrcmpiA(0x42dbe0, 0x42a0c0) != 0) {
										lstrcatA(_t146, 0x42dbe0);
									}
								}
								 *0x42a0ac =  *0x42a0ac + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E00405701(_t146) != 0 && E00405728(_t146) == 0) {
						E00405694(_t146);
					}
					 *0x42e418 = _t166;
					SetWindowTextA(_t165, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403E5D(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403E5D(_t166);
					E00403E92(_t165);
					_t138 = E00405F2D(0xa);
					if(_t138 == 0) {
						L53:
						return E00403EC4(_a8, _a12, _a16);
					} else {
						 *_t138(_t165, 1);
						goto L8;
					}
				}
			}

0x0040429b
0x004042a1
0x004042a7
0x004042b4
0x004042c2
0x004042c5
0x004042cd
0x004042d3
0x004042d3
0x004042df
0x004042e2
0x00404350
0x00404357
0x0040442e
0x00404435
0x00404444
0x00404444
0x00404448
0x00404452
0x0040445f
0x00404461
0x00404461
0x0040446f
0x00404476
0x0040447d
0x00404480
0x004044b7
0x004044b9
0x004044bf
0x004044c4
0x004044c8
0x004044ca
0x004044ca
0x004044e6
0x00000000
0x004044e8
0x004044eb
0x004044f9
0x004044ff
0x00404500
0x00404503
0x00404506
0x00000000
0x00404506
0x00404482
0x00404484
0x00404488
0x00000000
0x00000000
0x00000000
0x00000000
0x0040448a
0x0040448a
0x00404497
0x0040449c
0x00000000
0x00000000
0x004044a0
0x004044a2
0x004044a2
0x004044ad
0x004044b0
0x004044b5
0x00000000
0x00000000
0x00000000
0x00000000
0x004044b5
0x00404512
0x0040451c
0x0040451f
0x00404522
0x00404529
0x00404529
0x0040452b
0x0040452b
0x00404530
0x00404532
0x0040453a
0x00404541
0x00404543
0x0040454e
0x0040454e
0x00404543
0x00404555
0x0040455e
0x00404568
0x00404570
0x0040458b
0x00404572
0x0040457b
0x0040457b
0x00404570
0x00404590
0x00404595
0x0040459a
0x004045a3
0x004045a3
0x004045ac
0x004045ae
0x004045ae
0x004045ba
0x004045c2
0x004045cc
0x004045cc
0x004045d1
0x00000000
0x004045d1
0x00404480
0x00404437
0x0040443e
0x00000000
0x00000000
0x00000000
0x0040443e
0x0040435d
0x00404366
0x00404380
0x00404385
0x0040438f
0x00404396
0x004043a2
0x004043a5
0x004043a8
0x004043af
0x004043b7
0x004043ba
0x004043be
0x004043c5
0x004043cd
0x00404427
0x004043cf
0x004043d0
0x004043d7
0x004043dc
0x004043e1
0x004043e9
0x004043f6
0x0040440a
0x0040440e
0x0040440e
0x0040440a
0x00404413
0x00404420
0x00404420
0x004043cd
0x00000000
0x00404385
0x00404373
0x00000000
0x00000000
0x00404379
0x00000000
0x004042e4
0x004042f1
0x004042fa
0x00404307
0x00404307
0x0040430e
0x00404314
0x0040431d
0x00404320
0x00404323
0x0040432b
0x0040432e
0x00404331
0x00404337
0x0040433e
0x00404345
0x004045d7
0x004045e9
0x0040434b
0x0040434e
0x00000000
0x0040434e
0x00404345

APIs

GetDlgItem.USER32(?,000003FB), ref: 004042EA
SetWindowTextA.USER32(00000000,?), ref: 00404314
SHBrowseForFolderA.SHELL32(?,00429490,?), ref: 004043C5
CoTaskMemFree.OLE32(00000000), ref: 004043D0
lstrcmpiA.KERNEL32(Call,0042A0C0), ref: 00404402
lstrcatA.KERNEL32(?,Call), ref: 0040440E
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404420

Part of subcall function 00405446: GetDlgItemTextA.USER32(?,?,00000400,00404457), ref: 00405459

Part of subcall function 00405E03: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Setup 2.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E5B
Part of subcall function 00405E03: CharNextA.USER32(?,?,?,00000000), ref: 00405E68
Part of subcall function 00405E03: CharNextA.USER32(?,"C:\Users\user\Desktop\Setup 2.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E6D
Part of subcall function 00405E03: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E7D

GetDiskFreeSpaceA.KERNEL32(00429088,?,?,0000040F,?,00429088,00429088,?,00000001,00429088,?,?,000003FB,?), ref: 004044DE
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004044F9

Part of subcall function 00404652: lstrlenA.KERNEL32(0042A0C0,0042A0C0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040456D,000000DF,00000000,00000400,?), ref: 004046F0
Part of subcall function 00404652: wsprintfA.USER32 ref: 004046F8
Part of subcall function 00404652: SetDlgItemTextA.USER32(?,0042A0C0), ref: 0040470B

Strings

C:\Program Files (x86)\Fast!, xrefs: 004043EB
xim, xrefs: 004043DC
jm, xrefs: 004042A1
A, xrefs: 004043BE
Call, xrefs: 004043FC, 00404401, 0040440C

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Program Files (x86)\Fast!$Call$xim$jm
API String ID: 2624150263-2048359391
Opcode ID: 651704e9fdbceafa19cbcaa3072621ff73f1ed0c40465ee915921c67da8dd18a
Instruction ID: 25cf576a769d2d8a049a3aeadb65d5b4cdf4f75aeaeb5f9dd55cec19ee375662
Opcode Fuzzy Hash: 651704e9fdbceafa19cbcaa3072621ff73f1ed0c40465ee915921c67da8dd18a
Instruction Fuzzy Hash: A6A170B1900218ABDB11AFA5DC41BAF77B8EF84315F10843BF611B62D1D77C9A418F69

Uniqueness

Uniqueness Score: -1.00%

Function 02AB1D3B Relevance: 21.5, APIs: 14, Instructions: 499
stringlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E02AB1D3B() {
				void* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				CHAR* _v24;
				CHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				CHAR* _v44;
				intOrPtr _v48;
				void* _v52;
				CHAR* _t180;
				void* _t182;
				signed int _t183;
				void* _t186;
				void* _t188;
				CHAR* _t190;
				void* _t198;
				struct HINSTANCE__* _t199;
				_Unknown_base(*)()* _t200;
				_Unknown_base(*)()* _t202;
				struct HINSTANCE__* _t203;
				void* _t205;
				char* _t206;
				_Unknown_base(*)()* _t207;
				void* _t218;
				signed char _t219;
				struct HINSTANCE__* _t226;
				void* _t227;
				void* _t228;
				void* _t232;
				void* _t235;
				void* _t237;
				void* _t244;
				void* _t245;
				void* _t248;
				struct HINSTANCE__* _t253;
				CHAR* _t254;
				signed char _t257;
				void _t258;
				void* _t259;
				void* _t266;
				void* _t267;
				void* _t271;
				void* _t272;
				void* _t276;
				void* _t277;
				void* _t278;
				void* _t279;
				signed char _t282;
				signed int _t283;
				CHAR* _t284;
				CHAR* _t286;
				struct HINSTANCE__* _t288;
				void* _t290;
				void* _t291;

				_t253 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v12 = 0;
				_v40 = 0;
				_t291 = 0;
				_t180 = E02AB1541();
				_v24 = _t180;
				_v28 = _t180;
				_v44 = E02AB1541();
				_t182 = E02AB1561();
				_v52 = _t182;
				_v8 = _t182;
				while(1) {
					_t183 = _v32;
					_t283 = 3;
					_v48 = _t183;
					if(_t183 != _t253 && _t291 == _t253) {
						break;
					}
					_t282 =  *_v8;
					_t257 = _t282;
					_t186 = _t257 - _t253;
					if(_t186 == 0) {
						_t29 =  &_v32;
						 *_t29 = _v32 | 0xffffffff;
						__eflags =  *_t29;
						L13:
						_t188 = _v48 - _t253;
						if(_t188 == 0) {
							 *_v28 =  *_v28 & 0x00000000;
							__eflags = _t291 - _t253;
							if(_t291 == _t253) {
								_t291 = GlobalAlloc(0x40, 0x14a4);
								 *(_t291 + 0x810) = _t253;
								 *(_t291 + 0x814) = _t253;
							}
							_t258 = _v36;
							_t39 = _t291 + 8; // 0x8
							_t190 = _t39;
							_t40 = _t291 + 0x408; // 0x408
							_t284 = _t40;
							 *_t291 = _t258;
							 *_t190 =  *_t190 & 0x00000000;
							 *(_t291 + 0x808) = _t253;
							 *_t284 =  *_t284 & 0x00000000;
							_t259 = _t258 - _t253;
							__eflags = _t259;
							 *(_t291 + 0x80c) = _t253;
							 *(_t291 + 4) = _t253;
							if(_t259 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L56;
								}
								_t290 = 0;
								GlobalFree(_t291);
								_t291 = E02AB1641(_v24);
								__eflags = _t291 - _t253;
								if(_t291 == _t253) {
									goto L56;
								} else {
									goto L28;
								}
								while(1) {
									L28:
									_t218 =  *(_t291 + 0x14a0);
									__eflags = _t218 - _t253;
									if(_t218 == _t253) {
										break;
									}
									_t290 = _t291;
									_t291 = _t218;
									__eflags = _t291 - _t253;
									if(_t291 != _t253) {
										continue;
									}
									break;
								}
								__eflags = _t290 - _t253;
								if(_t290 != _t253) {
									 *(_t290 + 0x14a0) = _t253;
								}
								_t219 =  *(_t291 + 0x810);
								__eflags = _t219 & 0x00000008;
								if((_t219 & 0x00000008) == 0) {
									 *(_t291 + 0x810) = _t219 | 0x00000002;
								} else {
									_t291 = E02AB187C(_t291);
									 *(_t291 + 0x810) =  *(_t291 + 0x810) & 0xfffffff5;
								}
								goto L56;
							} else {
								_t266 = _t259 - 1;
								__eflags = _t266;
								if(_t266 == 0) {
									L24:
									lstrcpyA(_t190, _v44);
									L25:
									lstrcpyA(_t284, _v24);
									L56:
									_v28 = _v24;
									L57:
									_v8 = _v8 + 1;
									if(_v32 != 0xffffffff) {
										continue;
									}
									break;
								}
								_t267 = _t266 - 1;
								__eflags = _t267;
								if(_t267 == 0) {
									goto L25;
								}
								__eflags = _t267 != 1;
								if(_t267 != 1) {
									goto L56;
								}
								goto L24;
							}
						}
						if(_t188 == 1) {
							_t226 = _v16;
							if(_v40 == _t253) {
								_t226 = _t226 - 1;
							}
							 *(_t291 + 0x814) = _t226;
						}
						goto L56;
					}
					_t227 = _t186 - 0x23;
					if(_t227 == 0) {
						_v32 = _t253;
						_v36 = _t253;
						goto L13;
					}
					_t228 = _t227 - 5;
					if(_t228 == 0) {
						__eflags = _v36 - _t283;
						_v32 = 1;
						_v12 = _t253;
						_v20 = _t253;
						_v16 = (0 | _v36 == _t283) + 1;
						_v40 = _t253;
						goto L13;
					}
					_t232 = _t228 - 1;
					if(_t232 == 0) {
						_v32 = 2;
						_v12 = _t253;
						_v20 = _t253;
						goto L13;
					}
					if(_t232 != 0x16) {
						_t235 = _v32 - _t253;
						__eflags = _t235;
						if(_t235 == 0) {
							__eflags = _t282 - 0x2a;
							if(_t282 == 0x2a) {
								_v36 = 2;
								L55:
								_t253 = 0;
								__eflags = 0;
								goto L56;
							}
							__eflags = _t282 - 0x2d;
							if(_t282 == 0x2d) {
								L124:
								_t237 = _v8 + 1;
								__eflags =  *_t237 - 0x3e;
								if( *_t237 != 0x3e) {
									L126:
									_t237 = _v8 + 1;
									__eflags =  *_t237 - 0x3a;
									if( *_t237 != 0x3a) {
										L133:
										_v28 =  &(_v28[1]);
										 *_v28 = _t282;
										goto L57;
									}
									__eflags = _t282 - 0x2d;
									if(_t282 == 0x2d) {
										goto L133;
									}
									_v36 = 1;
									L129:
									_v8 = _t237;
									__eflags = _v28 - _v24;
									if(_v28 <= _v24) {
										 *_v44 =  *_v44 & 0x00000000;
									} else {
										 *_v28 =  *_v28 & 0x00000000;
										lstrcpyA(_v44, _v24);
									}
									goto L55;
								}
								_v36 = _t283;
								goto L129;
							}
							__eflags = _t282 - 0x3a;
							if(_t282 != 0x3a) {
								goto L133;
							}
							__eflags = _t282 - 0x2d;
							if(_t282 != 0x2d) {
								goto L126;
							}
							goto L124;
						}
						_t244 = _t235 - 1;
						__eflags = _t244;
						if(_t244 == 0) {
							L68:
							_t245 = _t257 - 0x22;
							__eflags = _t245 - 0x55;
							if(_t245 > 0x55) {
								goto L55;
							}
							switch( *((intOrPtr*)(( *(_t245 + 0x2ab23a0) & 0x000000ff) * 4 +  &M02AB2344))) {
								case 0:
									__eax = _v24;
									__edi = _v8;
									while(1) {
										__edi = __edi + 1;
										_v8 = __edi;
										__cl =  *__edi;
										__eflags = __cl - __dl;
										if(__cl != __dl) {
											goto L108;
										}
										L107:
										__eflags =  *(__edi + 1) - __dl;
										if( *(__edi + 1) != __dl) {
											L112:
											 *__eax =  *__eax & 0x00000000;
											__ebx = E02AB1550(_v24);
											goto L84;
										}
										L108:
										__eflags = __cl;
										if(__cl == 0) {
											goto L112;
										}
										__eflags = __cl - __dl;
										if(__cl == __dl) {
											__edi = __edi + 1;
											__eflags = __edi;
										}
										__cl =  *__edi;
										 *__eax =  *__edi;
										__eax = __eax + 1;
										__edi = __edi + 1;
										_v8 = __edi;
										__cl =  *__edi;
										__eflags = __cl - __dl;
										if(__cl != __dl) {
											goto L108;
										}
										goto L107;
									}
								case 1:
									_v12 = 1;
									goto L55;
								case 2:
									_v12 = _v12 | 0xffffffff;
									goto L55;
								case 3:
									_v12 = _v12 & 0x00000000;
									_v20 = _v20 & 0x00000000;
									_v16 = _v16 + 1;
									goto L73;
								case 4:
									__eflags = _v20;
									if(_v20 != 0) {
										goto L55;
									}
									_v8 = _v8 - 1;
									__ebx = E02AB1541();
									 &_v8 = E02AB1CD9( &_v8);
									__eax = E02AB176C(__edx, __eax, __edx, __ebx);
									goto L84;
								case 5:
									L92:
									_v20 = _v20 + 1;
									goto L55;
								case 6:
									_push(0x19);
									goto L119;
								case 7:
									_push(0x15);
									goto L119;
								case 8:
									_push(0x16);
									goto L119;
								case 9:
									_push(0x18);
									goto L119;
								case 0xa:
									_push(5);
									goto L99;
								case 0xb:
									__eax = 0;
									__eax = 1;
									goto L78;
								case 0xc:
									_push(6);
									goto L99;
								case 0xd:
									_push(2);
									goto L99;
								case 0xe:
									_push(3);
									goto L99;
								case 0xf:
									_push(0x17);
									L119:
									_pop(__ebx);
									goto L85;
								case 0x10:
									__eax =  &_v8;
									__eax = E02AB1CD9( &_v8);
									__ebx = __eax;
									__ebx = __eax + 1;
									__eflags = __ebx - 0xb;
									if(__ebx < 0xb) {
										__ebx = __ebx + 0xa;
									}
									goto L84;
								case 0x11:
									__ebx = 0xffffffff;
									goto L85;
								case 0x12:
									__eax = 0;
									__eflags = 0;
									goto L78;
								case 0x13:
									_push(4);
									L99:
									_pop(__eax);
									L78:
									__edx = _v16;
									__ecx = 0;
									__edx = _v16 << 5;
									__ecx = 1;
									__eflags = _v12 - 0xffffffff;
									__edi = (_v16 << 5) + __esi;
									_v40 = 1;
									 *(__edi + 0x818) = __eax;
									if(_v12 == 0xffffffff) {
										L80:
										__eax = __ecx;
										L81:
										__eflags = _v12 - __ecx;
										 *(__edi + 0x828) = __eax;
										if(_v12 == __ecx) {
											__eax =  &_v8;
											__eax = E02AB1CD9( &_v8);
											__eax = __eax + 1;
											__eflags = __eax;
											_v12 = __eax;
										}
										__eax = _v12;
										 *((intOrPtr*)(__edi + 0x81c)) = _v12;
										_t126 = _v16 + 0x41; // 0x41
										_t126 = _t126 << 5;
										__eax = 0;
										__eflags = 0;
										 *((intOrPtr*)((_t126 << 5) + __esi)) = 0;
										 *((intOrPtr*)(__edi + 0x82c)) = 0;
										 *((intOrPtr*)(__edi + 0x830)) = 0;
										goto L84;
									}
									__eax =  *(0x2ab3058 + __eax * 4);
									__eflags = __eax;
									if(__eax > 0) {
										goto L81;
									}
									goto L80;
								case 0x14:
									_t247 =  *(_t291 + 0x814);
									__eflags = _t247 - _v16;
									if(_t247 > _v16) {
										_v16 = _t247;
									}
									_v12 = _v12 & 0x00000000;
									_v20 = _v20 & 0x00000000;
									_v36 - 3 = _t247 - (_v36 == 3);
									if(_t247 != _v36 == 3) {
										L73:
										_v40 = 1;
									}
									goto L55;
								case 0x15:
									__eax =  &_v8;
									__eax = E02AB1CD9( &_v8);
									__ebx = __eax;
									__ebx = __eax + 1;
									L84:
									__eflags = __ebx;
									if(__ebx == 0) {
										goto L55;
									}
									L85:
									__eflags = _v20;
									_v40 = 1;
									if(_v20 != 0) {
										L90:
										__eflags = _v20 - 1;
										if(_v20 == 1) {
											__eax = _v16;
											__eax = _v16 << 5;
											__eflags = __eax;
											 *(__eax + __esi + 0x830) = __ebx;
										}
										goto L92;
									}
									_v16 = _v16 << 5;
									_t134 = __esi + 0x82c; // 0x82c
									__edi = (_v16 << 5) + _t134;
									__eax =  *__edi;
									__eflags = __eax - 0xffffffff;
									if(__eax <= 0xffffffff) {
										L88:
										__eax = GlobalFree(__eax);
										L89:
										 *__edi = __ebx;
										goto L90;
									}
									__eflags = __eax - 0x19;
									if(__eax <= 0x19) {
										goto L89;
									}
									goto L88;
								case 0x16:
									goto L55;
							}
						}
						_t248 = _t244 - 1;
						__eflags = _t248;
						if(_t248 == 0) {
							_v16 = _t253;
							goto L68;
						}
						__eflags = _t248 != 1;
						if(_t248 != 1) {
							goto L133;
						}
						_t271 = _t257 - 0x21;
						__eflags = _t271;
						if(_t271 == 0) {
							_v12 =  ~_v12;
							goto L55;
						}
						_t272 = _t271 - 0x42;
						__eflags = _t272;
						if(_t272 == 0) {
							L51:
							__eflags = _v12 - 1;
							if(_v12 != 1) {
								_t84 = _t291 + 0x810;
								 *_t84 =  *(_t291 + 0x810) &  !0x00000001;
								__eflags =  *_t84;
							} else {
								 *(_t291 + 0x810) =  *(_t291 + 0x810) | 1;
							}
							_v12 = 1;
							goto L55;
						}
						_t276 = _t272;
						__eflags = _t276;
						if(_t276 == 0) {
							_push(0x20);
							L50:
							_pop(1);
							goto L51;
						}
						_t277 = _t276 - 9;
						__eflags = _t277;
						if(_t277 == 0) {
							_push(8);
							goto L50;
						}
						_push(4);
						_pop(1);
						_t278 = _t277 - 1;
						__eflags = _t278;
						if(_t278 == 0) {
							goto L51;
						}
						_t279 = _t278 - 1;
						__eflags = _t279;
						if(_t279 == 0) {
							_push(0x10);
							goto L50;
						}
						__eflags = _t279 != 0;
						if(_t279 != 0) {
							goto L55;
						}
						_push(0x40);
						goto L50;
					} else {
						_v32 = _t283;
						_v12 = 1;
						goto L13;
					}
				}
				GlobalFree(_v52);
				GlobalFree(_v24);
				GlobalFree(_v44);
				if(_t291 == _t253 ||  *(_t291 + 0x80c) != _t253) {
					L145:
					return _t291;
				} else {
					_t198 =  *_t291 - 1;
					if(_t198 == 0) {
						_t169 = _t291 + 8; // 0x8
						_t286 = _t169;
						__eflags =  *_t286;
						if( *_t286 != 0) {
							_t199 = GetModuleHandleA(_t286);
							__eflags = _t199 - _t253;
							 *(_t291 + 0x808) = _t199;
							if(_t199 != _t253) {
								L141:
								_t173 = _t291 + 0x408; // 0x408
								_t254 = _t173;
								_t200 = GetProcAddress( *(_t291 + 0x808), _t254);
								__eflags = _t200;
								 *(_t291 + 0x80c) = _t200;
								if(_t200 != 0) {
									goto L145;
								}
								lstrcatA(_t254, 0x2ab4024);
								_t202 = GetProcAddress( *(_t291 + 0x808), _t254);
								__eflags = _t202;
								L143:
								 *(_t291 + 0x80c) = _t202;
								if(__eflags != 0) {
									goto L145;
								}
								L144:
								_t178 = _t291 + 4;
								 *_t178 =  *(_t291 + 4) | 0xffffffff;
								__eflags =  *_t178;
								goto L145;
							}
							_t203 = LoadLibraryA(_t286);
							__eflags = _t203 - _t253;
							 *(_t291 + 0x808) = _t203;
							if(_t203 == _t253) {
								goto L144;
							}
							goto L141;
						}
						_t170 = _t291 + 0x408; // 0x408
						_t202 = E02AB1641(_t170);
						__eflags = _t202 - _t253;
						goto L143;
					}
					_t205 = _t198 - 1;
					if(_t205 == 0) {
						_t167 = _t291 + 0x408; // 0x408
						_t206 = _t167;
						__eflags =  *_t206;
						if( *_t206 == 0) {
							goto L145;
						}
						_t207 = E02AB1641(_t206);
						L136:
						 *(_t291 + 0x80c) = _t207;
						goto L145;
					}
					if(_t205 != 1) {
						goto L145;
					}
					_t72 = _t291 + 8; // 0x8
					_t255 = _t72;
					_t288 = E02AB1641(_t72);
					 *(_t291 + 0x808) = _t288;
					if(_t288 == 0) {
						goto L144;
					}
					 *(_t291 + 0x850) =  *(_t291 + 0x850) & 0x00000000;
					 *((intOrPtr*)(_t291 + 0x84c)) = E02AB1550(_t255);
					 *(_t291 + 0x83c) =  *(_t291 + 0x83c) & 0x00000000;
					 *((intOrPtr*)(_t291 + 0x848)) = 1;
					 *((intOrPtr*)(_t291 + 0x838)) = 1;
					_t81 = _t291 + 0x408; // 0x408
					_t207 =  *(_t288->i + E02AB1641(_t81) * 4);
					goto L136;
				}
			}

0x02ab1d43
0x02ab1d46
0x02ab1d49
0x02ab1d4c
0x02ab1d4f
0x02ab1d52
0x02ab1d55
0x02ab1d57
0x02ab1d5c
0x02ab1d5f
0x02ab1d67
0x02ab1d6a
0x02ab1d6f
0x02ab1d72
0x02ab1d75
0x02ab1d75
0x02ab1d7c
0x02ab1d7d
0x02ab1d80
0x00000000
0x00000000
0x02ab1d8d
0x02ab1d8f
0x02ab1d94
0x02ab1d96
0x02ab1def
0x02ab1def
0x02ab1def
0x02ab1df3
0x02ab1df6
0x02ab1df8
0x02ab1e1a
0x02ab1e1d
0x02ab1e1f
0x02ab1e2e
0x02ab1e30
0x02ab1e36
0x02ab1e36
0x02ab1e3c
0x02ab1e3f
0x02ab1e3f
0x02ab1e42
0x02ab1e42
0x02ab1e48
0x02ab1e4a
0x02ab1e4d
0x02ab1e53
0x02ab1e56
0x02ab1e56
0x02ab1e58
0x02ab1e5e
0x02ab1e61
0x02ab1e8c
0x02ab1e8f
0x00000000
0x00000000
0x02ab1e96
0x02ab1e98
0x02ab1ea6
0x02ab1ea9
0x02ab1eab
0x00000000
0x00000000
0x00000000
0x00000000
0x02ab1eb1
0x02ab1eb1
0x02ab1eb1
0x02ab1eb7
0x02ab1eb9
0x00000000
0x00000000
0x02ab1ebb
0x02ab1ebd
0x02ab1ebf
0x02ab1ec1
0x00000000
0x00000000
0x00000000
0x02ab1ec1
0x02ab1ec3
0x02ab1ec5
0x02ab1ec7
0x02ab1ec7
0x02ab1ecd
0x02ab1ed3
0x02ab1ed5
0x02ab1eeb
0x02ab1ed7
0x02ab1edd
0x02ab1ee0
0x02ab1ee0
0x00000000
0x02ab1e63
0x02ab1e63
0x02ab1e63
0x02ab1e64
0x02ab1e70
0x02ab1e74
0x02ab1e7a
0x02ab1e7e
0x02ab1f64
0x02ab1f67
0x02ab1f6a
0x02ab1f6a
0x02ab1f71
0x00000000
0x00000000
0x00000000
0x02ab1f71
0x02ab1e66
0x02ab1e66
0x02ab1e67
0x00000000
0x00000000
0x02ab1e69
0x02ab1e6a
0x00000000
0x00000000
0x00000000
0x02ab1e6a
0x02ab1e61
0x02ab1dfb
0x02ab1e04
0x02ab1e07
0x02ab1e14
0x02ab1e14
0x02ab1e09
0x02ab1e09
0x00000000
0x02ab1dfb
0x02ab1d98
0x02ab1d9b
0x02ab1de7
0x02ab1dea
0x00000000
0x02ab1dea
0x02ab1d9d
0x02ab1da0
0x02ab1dcb
0x02ab1dce
0x02ab1dd5
0x02ab1ddc
0x02ab1ddf
0x02ab1de2
0x00000000
0x02ab1de2
0x02ab1da2
0x02ab1da3
0x02ab1dba
0x02ab1dc1
0x02ab1dc4
0x00000000
0x02ab1dc4
0x02ab1da8
0x02ab1ef6
0x02ab1ef6
0x02ab1ef8
0x02ab2225
0x02ab2228
0x02ab2289
0x02ab1f62
0x02ab1f62
0x02ab1f62
0x00000000
0x02ab1f62
0x02ab222a
0x02ab222d
0x02ab2239
0x02ab223c
0x02ab223d
0x02ab2240
0x02ab2247
0x02ab224a
0x02ab224b
0x02ab224e
0x02ab2295
0x02ab2298
0x02ab229b
0x00000000
0x02ab229b
0x02ab2250
0x02ab2253
0x00000000
0x00000000
0x02ab2255
0x02ab225c
0x02ab225c
0x02ab2262
0x02ab2265
0x02ab2281
0x02ab2267
0x02ab2270
0x02ab2273
0x02ab2273
0x00000000
0x02ab2265
0x02ab2242
0x00000000
0x02ab2242
0x02ab222f
0x02ab2232
0x00000000
0x00000000
0x02ab2234
0x02ab2237
0x00000000
0x00000000
0x00000000
0x02ab2237
0x02ab1efe
0x02ab1efe
0x02ab1eff
0x02ab2026
0x02ab2026
0x02ab202b
0x02ab202e
0x00000000
0x00000000
0x02ab203b
0x00000000
0x02ab21cd
0x02ab21d0
0x02ab21d3
0x02ab21d3
0x02ab21d4
0x02ab21d7
0x02ab21d9
0x02ab21db
0x00000000
0x00000000
0x02ab21dd
0x02ab21dd
0x02ab21e0
0x02ab21f2
0x02ab21f5
0x02ab21fe
0x00000000
0x02ab21fe
0x02ab21e2
0x02ab21e2
0x02ab21e4
0x00000000
0x00000000
0x02ab21e6
0x02ab21e8
0x02ab21ea
0x02ab21ea
0x02ab21ea
0x02ab21eb
0x02ab21ed
0x02ab21ef
0x02ab21d3
0x02ab21d4
0x02ab21d7
0x02ab21d9
0x02ab21db
0x00000000
0x00000000
0x00000000
0x02ab21db
0x00000000
0x02ab2082
0x00000000
0x00000000
0x02ab208e
0x00000000
0x00000000
0x02ab2075
0x02ab2079
0x02ab207d
0x00000000
0x00000000
0x02ab219f
0x02ab21a3
0x00000000
0x00000000
0x02ab21a9
0x02ab21b1
0x02ab21b8
0x02ab21c0
0x00000000
0x00000000
0x02ab2147
0x02ab2147
0x00000000
0x00000000
0x02ab221d
0x00000000
0x00000000
0x02ab220d
0x00000000
0x00000000
0x02ab2211
0x00000000
0x00000000
0x02ab2219
0x00000000
0x00000000
0x02ab215f
0x00000000
0x00000000
0x02ab214f
0x02ab2151
0x00000000
0x00000000
0x02ab2167
0x00000000
0x00000000
0x02ab2157
0x00000000
0x00000000
0x02ab215b
0x00000000
0x00000000
0x02ab2215
0x02ab221f
0x02ab221f
0x00000000
0x00000000
0x02ab216f
0x02ab2173
0x02ab2178
0x02ab217b
0x02ab217c
0x02ab217f
0x02ab2185
0x02ab2185
0x00000000
0x00000000
0x02ab2205
0x00000000
0x00000000
0x02ab2097
0x02ab2097
0x00000000
0x00000000
0x02ab2163
0x02ab2169
0x02ab2169
0x02ab2099
0x02ab2099
0x02ab209c
0x02ab209e
0x02ab20a1
0x02ab20a2
0x02ab20a6
0x02ab20a9
0x02ab20ac
0x02ab20b2
0x02ab20bf
0x02ab20bf
0x02ab20c1
0x02ab20c1
0x02ab20c4
0x02ab20ca
0x02ab20cc
0x02ab20d0
0x02ab20d5
0x02ab20d5
0x02ab20d7
0x02ab20d7
0x02ab20da
0x02ab20dd
0x02ab20e6
0x02ab20e9
0x02ab20ec
0x02ab20ec
0x02ab20ee
0x02ab20f1
0x02ab20f7
0x00000000
0x02ab20f7
0x02ab20b4
0x02ab20bb
0x02ab20bd
0x00000000
0x00000000
0x00000000
0x00000000
0x02ab2042
0x02ab2048
0x02ab204b
0x02ab204d
0x02ab204d
0x02ab2050
0x02ab2054
0x02ab2061
0x02ab2063
0x02ab2069
0x02ab2069
0x02ab2069
0x00000000
0x00000000
0x02ab218d
0x02ab2191
0x02ab2196
0x02ab2199
0x02ab20fd
0x02ab20fd
0x02ab20ff
0x00000000
0x00000000
0x02ab2105
0x02ab2105
0x02ab2109
0x02ab2110
0x02ab2134
0x02ab2134
0x02ab2138
0x02ab213a
0x02ab213d
0x02ab213d
0x02ab2140
0x02ab2140
0x00000000
0x02ab2138
0x02ab2115
0x02ab2118
0x02ab2118
0x02ab211f
0x02ab2121
0x02ab2124
0x02ab212b
0x02ab212c
0x02ab2132
0x02ab2132
0x00000000
0x02ab2132
0x02ab2126
0x02ab2129
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x02ab203b
0x02ab1f05
0x02ab1f05
0x02ab1f06
0x02ab2023
0x00000000
0x02ab2023
0x02ab1f0c
0x02ab1f0d
0x00000000
0x00000000
0x02ab1f13
0x02ab1f13
0x02ab1f16
0x02ab1f5f
0x00000000
0x02ab1f5f
0x02ab1f18
0x02ab1f18
0x02ab1f1b
0x02ab1f43
0x02ab1f46
0x02ab1f49
0x02ab2015
0x02ab2015
0x02ab2015
0x02ab1f4f
0x02ab1f4f
0x02ab1f4f
0x02ab201b
0x00000000
0x02ab201b
0x02ab1f1e
0x02ab1f1e
0x02ab1f1f
0x02ab1f40
0x02ab1f42
0x02ab1f42
0x00000000
0x02ab1f42
0x02ab1f21
0x02ab1f21
0x02ab1f24
0x02ab1f3c
0x00000000
0x02ab1f3c
0x02ab1f26
0x02ab1f28
0x02ab1f29
0x02ab1f29
0x02ab1f2b
0x00000000
0x00000000
0x02ab1f2d
0x02ab1f2d
0x02ab1f2e
0x02ab1f38
0x00000000
0x02ab1f38
0x02ab1f31
0x02ab1f32
0x00000000
0x00000000
0x02ab1f34
0x00000000
0x02ab1dae
0x02ab1dae
0x02ab1db1
0x00000000
0x02ab1db1
0x02ab1da8
0x02ab1f80
0x02ab1f85
0x02ab1f8a
0x02ab1f8e
0x02ab233d
0x02ab2343
0x02ab1fa0
0x02ab1fa2
0x02ab1fa3
0x02ab22c0
0x02ab22c0
0x02ab22c3
0x02ab22c6
0x02ab22da
0x02ab22e0
0x02ab22e2
0x02ab22e8
0x02ab22fb
0x02ab2301
0x02ab2301
0x02ab230e
0x02ab2310
0x02ab2312
0x02ab2318
0x00000000
0x00000000
0x02ab2320
0x02ab232d
0x02ab232f
0x02ab2331
0x02ab2331
0x02ab2337
0x00000000
0x00000000
0x02ab2339
0x02ab2339
0x02ab2339
0x02ab2339
0x00000000
0x02ab2339
0x02ab22eb
0x02ab22f1
0x02ab22f3
0x02ab22f9
0x00000000
0x00000000
0x00000000
0x02ab22f9
0x02ab22c8
0x02ab22cf
0x02ab22d5
0x00000000
0x02ab22d5
0x02ab1fa9
0x02ab1faa
0x02ab22a2
0x02ab22a2
0x02ab22a8
0x02ab22ab
0x00000000
0x00000000
0x02ab22b2
0x02ab22b7
0x02ab22b8
0x00000000
0x02ab22b8
0x02ab1fb1
0x00000000
0x00000000
0x02ab1fb7
0x02ab1fb7
0x02ab1fc0
0x02ab1fc5
0x02ab1fcb
0x00000000
0x00000000
0x02ab1fd1
0x02ab1fde
0x02ab1fe4
0x02ab1fee
0x02ab1ff4
0x02ab1ffc
0x02ab200c
0x00000000
0x02ab200c

APIs

Part of subcall function 02AB1541: GlobalAlloc.KERNEL32(00000040,02AB1577,?,?,02AB1804,?,02AB1017), ref: 02AB1549

Part of subcall function 02AB1561: lstrcpyA.KERNEL32(00000000,?,?,?,02AB1804,?,02AB1017), ref: 02AB157E
Part of subcall function 02AB1561: GlobalFree.KERNEL32 ref: 02AB158F

GlobalAlloc.KERNEL32(00000040,000014A4), ref: 02AB1E28
lstrcpyA.KERNEL32(00000008,?), ref: 02AB1E74
lstrcpyA.KERNEL32(00000408,?), ref: 02AB1E7E
GlobalFree.KERNEL32(00000000), ref: 02AB1E98
GlobalFree.KERNEL32(?), ref: 02AB1F80
GlobalFree.KERNEL32(?), ref: 02AB1F85
GlobalFree.KERNEL32(?), ref: 02AB1F8A
GlobalFree.KERNEL32(00000000), ref: 02AB212C
lstrcpyA.KERNEL32(?,?), ref: 02AB2273
GetModuleHandleA.KERNEL32(00000008), ref: 02AB22DA
LoadLibraryA.KERNEL32(00000008), ref: 02AB22EB
GetProcAddress.KERNEL32(?,00000408), ref: 02AB230E
lstrcatA.KERNEL32(00000408,02AB4024), ref: 02AB2320
GetProcAddress.KERNEL32(?,00000408), ref: 02AB232D

Memory Dump Source

Source File: 00000001.00000002.2972899107.0000000002AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 02AB0000, based on PE: true

Associated: 00000001.00000002.2972852006.0000000002AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2972964416.0000000002AB3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2973006111.0000000002AB5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2ab0000_Setup 2.jbxd

Similarity

API ID: Global$Free$lstrcpy$AddressAllocProc$HandleLibraryLoadModulelstrcat
String ID:
API String ID: 2432367840-0
Opcode ID: 90d8cb44910b1e9fb6c55c2515c712e4250f7c8e8778b44b5bec23c2fd2f3ea9
Instruction ID: e09d8e7c6ca6bb2abfcd9d59f785ba06ea7b36df8315ea95eeefa54116dfacfd
Opcode Fuzzy Hash: 90d8cb44910b1e9fb6c55c2515c712e4250f7c8e8778b44b5bec23c2fd2f3ea9
Instruction Fuzzy Hash: 19026A71D4420ADECB229FA8C8947EDBBF8BF04304F50856BD5AAE6182DF749A45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00402036 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402036() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E00402A0C(0xfffffff0);
				_t96 = E00402A0C(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x34)) = E00402A0C(2);
				 *((intOrPtr*)(_t100 - 0xc)) = E00402A0C(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x38)) = E00402A0C(0x45);
				if(E00405701(_t96) == 0) {
					E00402A0C(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x4074b8, _t75, 1, 0x4074a8, _t44);
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x4074c8, _t100 - 8);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, "C:\\Program Files (x86)\\Fast!");
						_t81 =  *(_t100 - 0x18);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x18);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 0xc)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 0xc)),  *(_t100 - 0x18) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x34)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x38)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x409458, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 8));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x409458, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 8));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

0x0040203f
0x00402049
0x00402052
0x0040205c
0x00402065
0x0040206f
0x00402073
0x00402073
0x00402078
0x00402089
0x00402091
0x00402171
0x00402171
0x00402178
0x00402097
0x00402097
0x004020a8
0x004020ac
0x004020b2
0x004020bc
0x004020be
0x004020c9
0x004020cc
0x004020d9
0x004020db
0x004020dd
0x004020e4
0x004020e7
0x004020e7
0x004020ea
0x004020f4
0x004020fc
0x00402101
0x0040210d
0x0040210d
0x00402110
0x00402119
0x0040211c
0x00402125
0x0040212a
0x0040213c
0x0040214b
0x0040214d
0x00402159
0x00402159
0x0040214b
0x0040215b
0x00402161
0x00402161
0x00402164
0x0040216a
0x0040216f
0x00402184
0x00000000
0x00000000
0x00000000
0x0040216f
0x0040217a
0x004028a4
0x004028b0

APIs

CoCreateInstance.OLE32(004074B8,?,00000001,004074A8,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402089
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409458,00000400,?,00000001,004074A8,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402143

Strings

C:\Program Files (x86)\Fast!, xrefs: 004020C1

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Program Files (x86)\Fast!
API String ID: 123533781-1788482285
Opcode ID: 089d836d197c9fcc50a53b18f49cd8a015546262fcb82e37291253ae6d4f0e16
Instruction ID: 191a2b8eefbfb1bddfad8f8f84b6cbb7561eb223b9fb57f38d09f1a7a57a31e1
Opcode Fuzzy Hash: 089d836d197c9fcc50a53b18f49cd8a015546262fcb82e37291253ae6d4f0e16
Instruction Fuzzy Hash: 39413075A00104BFDB00EFA4CD89E9E7BBAEF49364B20426AF505EB2D1CA799D41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00402654 Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00402654(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E00402A0C(2), _t19 - 0x19c) != 0xffffffff) {
					E00405AFF(__edi, _t6);
					_push(_t19 - 0x170);
					_push(__esi);
					E00405BA1();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x0040266c
0x00402680
0x0040268b
0x0040268c
0x004027c7
0x0040266e
0x0040266e
0x00402670
0x00402672
0x00402672
0x004028a4
0x004028b0

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402663

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: a1c633566bb42718fd209a1295be4839a4acb94dd37ef7f011ee4d14f6f5a913
Instruction ID: 4742aed74e2d5c2fbc4c68297bab01de776a4a0a464f4ce0b78a7fb1d39a8d7e
Opcode Fuzzy Hash: a1c633566bb42718fd209a1295be4839a4acb94dd37ef7f011ee4d14f6f5a913
Instruction Fuzzy Hash: DAF0A032608100ABD710E7B99989AEEB368AF11324F60467BE105F21C1DAB859459B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040632A Relevance: .3, Instructions: 334
COMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E0040632A(signed int __ebx, signed int* __esi) {
				signed int _t396;
				signed int _t425;
				signed int _t442;
				signed int _t443;
				signed int* _t446;
				void* _t448;

				L0:
				while(1) {
					L0:
					_t446 = __esi;
					_t425 = __ebx;
					if( *(_t448 - 0x34) == 0) {
						break;
					}
					L55:
					__eax =  *(__ebp - 0x38);
					 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
					__ecx = __ebx;
					 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
					 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
					 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
					__ebx = __ebx + 8;
					while(1) {
						L56:
						if(__ebx < 0xe) {
							goto L0;
						}
						L57:
						__eax =  *(__ebp - 0x40);
						__eax =  *(__ebp - 0x40) & 0x00003fff;
						__ecx = __eax;
						__esi[1] = __eax;
						__ecx = __eax & 0x0000001f;
						if(__cl > 0x1d) {
							L9:
							_t443 = _t442 | 0xffffffff;
							 *_t446 = 0x11;
							L10:
							_t446[0x147] =  *(_t448 - 0x40);
							_t446[0x146] = _t425;
							( *(_t448 + 8))[1] =  *(_t448 - 0x34);
							L11:
							 *( *(_t448 + 8)) =  *(_t448 - 0x38);
							_t446[0x26ea] =  *(_t448 - 0x30);
							E00406A99( *(_t448 + 8));
							return _t443;
						}
						L58:
						__eax = __eax & 0x000003e0;
						if(__eax > 0x3a0) {
							goto L9;
						}
						L59:
						 *(__ebp - 0x40) =  *(__ebp - 0x40) >> 0xe;
						__ebx = __ebx - 0xe;
						_t94 =  &(__esi[2]);
						 *_t94 = __esi[2] & 0x00000000;
						 *__esi = 0xc;
						while(1) {
							L60:
							__esi[1] = __esi[1] >> 0xa;
							__eax = (__esi[1] >> 0xa) + 4;
							if(__esi[2] >= (__esi[1] >> 0xa) + 4) {
								goto L68;
							}
							L61:
							while(1) {
								L64:
								if(__ebx >= 3) {
									break;
								}
								L62:
								if( *(__ebp - 0x34) == 0) {
									goto L182;
								}
								L63:
								__eax =  *(__ebp - 0x38);
								 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
								__ecx = __ebx;
								 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
								 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
								 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
								__ebx = __ebx + 8;
							}
							L65:
							__ecx = __esi[2];
							 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000007;
							__ebx = __ebx - 3;
							_t108 = __ecx + 0x40739c; // 0x121110
							__ecx =  *_t108;
							 *(__ebp - 0x40) =  *(__ebp - 0x40) >> 3;
							 *(__esi + 0xc +  *_t108 * 4) =  *(__ebp - 0x40) & 0x00000007;
							__ecx = __esi[1];
							__esi[2] = __esi[2] + 1;
							__eax = __esi[2];
							__esi[1] >> 0xa = (__esi[1] >> 0xa) + 4;
							if(__esi[2] < (__esi[1] >> 0xa) + 4) {
								goto L64;
							}
							L66:
							while(1) {
								L68:
								if(__esi[2] >= 0x13) {
									break;
								}
								L67:
								_t119 = __esi[2] + 0x40739c; // 0x4000300
								__eax =  *_t119;
								 *(__esi + 0xc +  *_t119 * 4) =  *(__esi + 0xc +  *_t119 * 4) & 0x00000000;
								_t126 =  &(__esi[2]);
								 *_t126 = __esi[2] + 1;
							}
							L69:
							__ecx = __ebp - 8;
							__edi =  &(__esi[0x143]);
							 &(__esi[0x148]) =  &(__esi[0x144]);
							__eax = 0;
							 *(__ebp - 8) = 0;
							__eax =  &(__esi[3]);
							 *__edi = 7;
							__eax = E00406B01( &(__esi[3]), 0x13, 0x13, 0, 0,  &(__esi[0x144]), __edi,  &(__esi[0x148]), __ebp - 8);
							if(__eax != 0) {
								L72:
								 *__esi = 0x11;
								while(1) {
									L180:
									_t396 =  *_t446;
									if(_t396 > 0xf) {
										break;
									}
									L1:
									switch( *((intOrPtr*)(_t396 * 4 +  &M00406A59))) {
										case 0:
											L101:
											__eax = __esi[4] & 0x000000ff;
											__esi[3] = __esi[4] & 0x000000ff;
											__eax = __esi[5];
											__esi[2] = __esi[5];
											 *__esi = 1;
											goto L102;
										case 1:
											L102:
											__eax = __esi[3];
											while(1) {
												L105:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L103:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L104:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L106:
											__eax =  *(0x409428 + __eax * 2) & 0x0000ffff;
											__eax = __eax &  *(__ebp - 0x40);
											__ecx = __esi[2];
											__eax = __esi[2] + __eax * 4;
											__ecx =  *(__eax + 1) & 0x000000ff;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - ( *(__eax + 1) & 0x000000ff);
											__ecx =  *__eax & 0x000000ff;
											__eflags = __ecx;
											if(__ecx != 0) {
												L108:
												__eflags = __cl & 0x00000010;
												if((__cl & 0x00000010) == 0) {
													L110:
													__eflags = __cl & 0x00000040;
													if((__cl & 0x00000040) == 0) {
														goto L125;
													}
													L111:
													__eflags = __cl & 0x00000020;
													if((__cl & 0x00000020) == 0) {
														goto L9;
													}
													L112:
													 *__esi = 7;
													goto L180;
												}
												L109:
												__esi[2] = __ecx;
												__esi[1] = __eax;
												 *__esi = 2;
												goto L180;
											}
											L107:
											__esi[2] = __eax;
											 *__esi = 6;
											goto L180;
										case 2:
											L113:
											__eax = __esi[2];
											while(1) {
												L116:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L114:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L115:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L117:
											 *(0x409428 + __eax * 2) & 0x0000ffff =  *(0x409428 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
											__esi[1] = __esi[1] + ( *(0x409428 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
											__ecx = __eax;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - __eax;
											__eflags = __ebx;
											__eax = __esi[4] & 0x000000ff;
											__esi[3] = __esi[4] & 0x000000ff;
											__eax = __esi[6];
											__esi[2] = __esi[6];
											 *__esi = 3;
											goto L118;
										case 3:
											L118:
											__eax = __esi[3];
											while(1) {
												L121:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L119:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L120:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L122:
											__eax =  *(0x409428 + __eax * 2) & 0x0000ffff;
											__eax = __eax &  *(__ebp - 0x40);
											__ecx = __esi[2];
											__eax = __esi[2] + __eax * 4;
											__ecx =  *(__eax + 1) & 0x000000ff;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - ( *(__eax + 1) & 0x000000ff);
											__ecx =  *__eax & 0x000000ff;
											__eflags = __cl & 0x00000010;
											if((__cl & 0x00000010) == 0) {
												L124:
												__eflags = __cl & 0x00000040;
												if((__cl & 0x00000040) != 0) {
													goto L9;
												}
												L125:
												__esi[3] = __ecx;
												__ecx =  *(__eax + 2) & 0x0000ffff;
												__esi[2] = __eax;
												goto L180;
											}
											L123:
											__esi[2] = __ecx;
											__esi[3] = __eax;
											 *__esi = 4;
											goto L180;
										case 4:
											L126:
											__eax = __esi[2];
											while(1) {
												L129:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L127:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L128:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L130:
											 *(0x409428 + __eax * 2) & 0x0000ffff =  *(0x409428 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
											__esi[3] = __esi[3] + ( *(0x409428 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
											__ecx = __eax;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - __eax;
											__eflags = __ebx;
											 *__esi = 5;
											goto L131;
										case 5:
											L131:
											__eax =  *(__ebp - 0x30);
											__edx = __esi[3];
											__eax = __eax - __esi;
											__ecx = __eax - __esi - 0x1ba0;
											__eflags = __eax - __esi - 0x1ba0 - __edx;
											if(__eax - __esi - 0x1ba0 >= __edx) {
												__ecx = __eax;
												__ecx = __eax - __edx;
												__eflags = __ecx;
											} else {
												__esi[0x26e8] = __esi[0x26e8] - __edx;
												__ecx = __esi[0x26e8] - __edx - __esi;
												__ecx = __esi[0x26e8] - __edx - __esi + __eax - 0x1ba0;
											}
											__eflags = __esi[1];
											 *(__ebp - 0x20) = __ecx;
											if(__esi[1] != 0) {
												L135:
												__edi =  *(__ebp - 0x2c);
												do {
													L136:
													__eflags = __edi;
													if(__edi != 0) {
														goto L152;
													}
													L137:
													__edi = __esi[0x26e8];
													__eflags = __eax - __edi;
													if(__eax != __edi) {
														L143:
														__esi[0x26ea] = __eax;
														__eax = E00406A99( *((intOrPtr*)(__ebp + 8)));
														__eax = __esi[0x26ea];
														__ecx = __esi[0x26e9];
														__eflags = __eax - __ecx;
														 *(__ebp - 0x30) = __eax;
														if(__eax >= __ecx) {
															__edi = __esi[0x26e8];
															__edi = __esi[0x26e8] - __eax;
															__eflags = __edi;
														} else {
															__ecx = __ecx - __eax;
															__edi = __ecx - __eax - 1;
														}
														__edx = __esi[0x26e8];
														__eflags = __eax - __edx;
														 *(__ebp - 8) = __edx;
														if(__eax == __edx) {
															__edx =  &(__esi[0x6e8]);
															__eflags = __ecx - __edx;
															if(__ecx != __edx) {
																__eax = __edx;
																__eflags = __eax - __ecx;
																 *(__ebp - 0x30) = __eax;
																if(__eax >= __ecx) {
																	__edi =  *(__ebp - 8);
																	__edi =  *(__ebp - 8) - __eax;
																	__eflags = __edi;
																} else {
																	__ecx = __ecx - __eax;
																	__edi = __ecx;
																}
															}
														}
														__eflags = __edi;
														if(__edi == 0) {
															goto L183;
														} else {
															goto L152;
														}
													}
													L138:
													__ecx = __esi[0x26e9];
													__edx =  &(__esi[0x6e8]);
													__eflags = __ecx - __edx;
													if(__ecx == __edx) {
														goto L143;
													}
													L139:
													__eax = __edx;
													__eflags = __eax - __ecx;
													if(__eax >= __ecx) {
														__edi = __edi - __eax;
														__eflags = __edi;
													} else {
														__ecx = __ecx - __eax;
														__edi = __ecx;
													}
													__eflags = __edi;
													if(__edi == 0) {
														goto L143;
													}
													L152:
													__ecx =  *(__ebp - 0x20);
													 *__eax =  *__ecx;
													__eax = __eax + 1;
													__ecx = __ecx + 1;
													__edi = __edi - 1;
													__eflags = __ecx - __esi[0x26e8];
													 *(__ebp - 0x30) = __eax;
													 *(__ebp - 0x20) = __ecx;
													 *(__ebp - 0x2c) = __edi;
													if(__ecx == __esi[0x26e8]) {
														__ecx =  &(__esi[0x6e8]);
														 *(__ebp - 0x20) =  &(__esi[0x6e8]);
													}
													_t357 =  &(__esi[1]);
													 *_t357 = __esi[1] - 1;
													__eflags =  *_t357;
												} while ( *_t357 != 0);
											}
											goto L23;
										case 6:
											L156:
											__eax =  *(__ebp - 0x2c);
											__edi =  *(__ebp - 0x30);
											__eflags = __eax;
											if(__eax != 0) {
												L172:
												__cl = __esi[2];
												 *__edi = __cl;
												__edi = __edi + 1;
												__eax = __eax - 1;
												 *(__ebp - 0x30) = __edi;
												 *(__ebp - 0x2c) = __eax;
												goto L23;
											}
											L157:
											__ecx = __esi[0x26e8];
											__eflags = __edi - __ecx;
											if(__edi != __ecx) {
												L163:
												__esi[0x26ea] = __edi;
												__eax = E00406A99( *((intOrPtr*)(__ebp + 8)));
												__edi = __esi[0x26ea];
												__ecx = __esi[0x26e9];
												__eflags = __edi - __ecx;
												 *(__ebp - 0x30) = __edi;
												if(__edi >= __ecx) {
													__eax = __esi[0x26e8];
													__eax = __esi[0x26e8] - __edi;
													__eflags = __eax;
												} else {
													__ecx = __ecx - __edi;
													__eax = __ecx - __edi - 1;
												}
												__edx = __esi[0x26e8];
												__eflags = __edi - __edx;
												 *(__ebp - 8) = __edx;
												if(__edi == __edx) {
													__edx =  &(__esi[0x6e8]);
													__eflags = __ecx - __edx;
													if(__ecx != __edx) {
														__edi = __edx;
														__eflags = __edi - __ecx;
														 *(__ebp - 0x30) = __edi;
														if(__edi >= __ecx) {
															__eax =  *(__ebp - 8);
															__eax =  *(__ebp - 8) - __edi;
															__eflags = __eax;
														} else {
															__ecx = __ecx - __edi;
															__eax = __ecx;
														}
													}
												}
												__eflags = __eax;
												if(__eax == 0) {
													goto L183;
												} else {
													goto L172;
												}
											}
											L158:
											__eax = __esi[0x26e9];
											__edx =  &(__esi[0x6e8]);
											__eflags = __eax - __edx;
											if(__eax == __edx) {
												goto L163;
											}
											L159:
											__edi = __edx;
											__eflags = __edi - __eax;
											if(__edi >= __eax) {
												__ecx = __ecx - __edi;
												__eflags = __ecx;
												__eax = __ecx;
											} else {
												__eax = __eax - __edi;
												__eax = __eax - 1;
											}
											__eflags = __eax;
											if(__eax != 0) {
												goto L172;
											} else {
												goto L163;
											}
										case 7:
											L173:
											__eflags = __ebx - 7;
											if(__ebx > 7) {
												__ebx = __ebx - 8;
												 *(__ebp - 0x34) =  *(__ebp - 0x34) + 1;
												_t380 = __ebp - 0x38;
												 *_t380 =  *(__ebp - 0x38) - 1;
												__eflags =  *_t380;
											}
											goto L175;
										case 8:
											L4:
											while(_t425 < 3) {
												if( *(_t448 - 0x34) == 0) {
													goto L182;
												} else {
													 *(_t448 - 0x34) =  *(_t448 - 0x34) - 1;
													 *(_t448 - 0x40) =  *(_t448 - 0x40) | ( *( *(_t448 - 0x38)) & 0x000000ff) << _t425;
													 *(_t448 - 0x38) =  &(( *(_t448 - 0x38))[1]);
													_t425 = _t425 + 8;
													continue;
												}
											}
											_t425 = _t425 - 3;
											 *(_t448 - 0x40) =  *(_t448 - 0x40) >> 3;
											_t406 =  *(_t448 - 0x40) & 0x00000007;
											asm("sbb ecx, ecx");
											_t408 = _t406 >> 1;
											_t446[0x145] = ( ~(_t406 & 0x00000001) & 0x00000007) + 8;
											if(_t408 == 0) {
												L24:
												 *_t446 = 9;
												_t436 = _t425 & 0x00000007;
												 *(_t448 - 0x40) =  *(_t448 - 0x40) >> _t436;
												_t425 = _t425 - _t436;
												goto L180;
											}
											L6:
											_t411 = _t408 - 1;
											if(_t411 == 0) {
												L13:
												__eflags =  *0x42dbd8;
												if( *0x42dbd8 != 0) {
													L22:
													_t412 =  *0x40944c; // 0x9
													_t446[4] = _t412;
													_t413 =  *0x409450; // 0x5
													_t446[4] = _t413;
													_t414 =  *0x42ca54; // 0x0
													_t446[5] = _t414;
													_t415 =  *0x42ca50; // 0x0
													_t446[6] = _t415;
													L23:
													 *_t446 =  *_t446 & 0x00000000;
													goto L180;
												} else {
													_t26 = _t448 - 8;
													 *_t26 =  *(_t448 - 8) & 0x00000000;
													__eflags =  *_t26;
													_t416 = 0x42ca58;
													goto L15;
													L20:
													 *_t416 = _t438;
													_t416 = _t416 + 4;
													__eflags = _t416 - 0x42ced8;
													if(_t416 < 0x42ced8) {
														L15:
														__eflags = _t416 - 0x42cc94;
														_t438 = 8;
														if(_t416 > 0x42cc94) {
															__eflags = _t416 - 0x42ce58;
															if(_t416 >= 0x42ce58) {
																__eflags = _t416 - 0x42ceb8;
																if(_t416 < 0x42ceb8) {
																	_t438 = 7;
																}
															} else {
																_t438 = 9;
															}
														}
														goto L20;
													} else {
														E00406B01(0x42ca58, 0x120, 0x101, 0x4073b0, 0x4073f0, 0x42ca54, 0x40944c, 0x42d358, _t448 - 8);
														_push(0x1e);
														_pop(_t440);
														_push(5);
														_pop(_t419);
														memset(0x42ca58, _t419, _t440 << 2);
														_t450 = _t450 + 0xc;
														_t442 = 0x42ca58 + _t440;
														E00406B01(0x42ca58, 0x1e, 0, 0x407430, 0x40746c, 0x42ca50, 0x409450, 0x42d358, _t448 - 8);
														 *0x42dbd8 =  *0x42dbd8 + 1;
														__eflags =  *0x42dbd8;
														goto L22;
													}
												}
											}
											L7:
											_t423 = _t411 - 1;
											if(_t423 == 0) {
												 *_t446 = 0xb;
												goto L180;
											}
											L8:
											if(_t423 != 1) {
												goto L180;
											}
											goto L9;
										case 9:
											while(1) {
												L27:
												__eflags = __ebx - 0x10;
												if(__ebx >= 0x10) {
													break;
												}
												L25:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L26:
												__eax =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__ecx = __ebx;
												 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L28:
											__eax =  *(__ebp - 0x40);
											__ebx = 0;
											__eax =  *(__ebp - 0x40) & 0x0000ffff;
											 *(__ebp - 0x40) = 0;
											__eflags = __eax;
											__esi[1] = __eax;
											if(__eax == 0) {
												goto L53;
											}
											L29:
											_push(0xa);
											_pop(__eax);
											goto L54;
										case 0xa:
											L30:
											__eflags =  *(__ebp - 0x34);
											if( *(__ebp - 0x34) == 0) {
												goto L182;
											}
											L31:
											__eax =  *(__ebp - 0x2c);
											__eflags = __eax;
											if(__eax != 0) {
												L48:
												__eflags = __eax -  *(__ebp - 0x34);
												if(__eax >=  *(__ebp - 0x34)) {
													__eax =  *(__ebp - 0x34);
												}
												__ecx = __esi[1];
												__eflags = __ecx - __eax;
												__edi = __ecx;
												if(__ecx >= __eax) {
													__edi = __eax;
												}
												__eax = E00405839( *(__ebp - 0x30),  *(__ebp - 0x38), __edi);
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + __edi;
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - __edi;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __edi;
												 *(__ebp - 0x2c) =  *(__ebp - 0x2c) - __edi;
												_t80 =  &(__esi[1]);
												 *_t80 = __esi[1] - __edi;
												__eflags =  *_t80;
												if( *_t80 == 0) {
													L53:
													__eax = __esi[0x145];
													L54:
													 *__esi = __eax;
												}
												goto L180;
											}
											L32:
											__ecx = __esi[0x26e8];
											__edx =  *(__ebp - 0x30);
											__eflags = __edx - __ecx;
											if(__edx != __ecx) {
												L38:
												__esi[0x26ea] = __edx;
												__eax = E00406A99( *((intOrPtr*)(__ebp + 8)));
												__edx = __esi[0x26ea];
												__ecx = __esi[0x26e9];
												__eflags = __edx - __ecx;
												 *(__ebp - 0x30) = __edx;
												if(__edx >= __ecx) {
													__eax = __esi[0x26e8];
													__eax = __esi[0x26e8] - __edx;
													__eflags = __eax;
												} else {
													__ecx = __ecx - __edx;
													__eax = __ecx - __edx - 1;
												}
												__edi = __esi[0x26e8];
												 *(__ebp - 0x2c) = __eax;
												__eflags = __edx - __edi;
												if(__edx == __edi) {
													__edx =  &(__esi[0x6e8]);
													__eflags = __edx - __ecx;
													if(__eflags != 0) {
														 *(__ebp - 0x30) = __edx;
														if(__eflags >= 0) {
															__edi = __edi - __edx;
															__eflags = __edi;
															__eax = __edi;
														} else {
															__ecx = __ecx - __edx;
															__eax = __ecx;
														}
														 *(__ebp - 0x2c) = __eax;
													}
												}
												__eflags = __eax;
												if(__eax == 0) {
													goto L183;
												} else {
													goto L48;
												}
											}
											L33:
											__eax = __esi[0x26e9];
											__edi =  &(__esi[0x6e8]);
											__eflags = __eax - __edi;
											if(__eax == __edi) {
												goto L38;
											}
											L34:
											__edx = __edi;
											__eflags = __edx - __eax;
											 *(__ebp - 0x30) = __edx;
											if(__edx >= __eax) {
												__ecx = __ecx - __edx;
												__eflags = __ecx;
												__eax = __ecx;
											} else {
												__eax = __eax - __edx;
												__eax = __eax - 1;
											}
											__eflags = __eax;
											 *(__ebp - 0x2c) = __eax;
											if(__eax != 0) {
												goto L48;
											} else {
												goto L38;
											}
										case 0xb:
											goto L56;
										case 0xc:
											L60:
											__esi[1] = __esi[1] >> 0xa;
											__eax = (__esi[1] >> 0xa) + 4;
											if(__esi[2] >= (__esi[1] >> 0xa) + 4) {
												goto L68;
											}
											goto L61;
										case 0xd:
											while(1) {
												L93:
												__eax = __esi[1];
												__ecx = __esi[2];
												__edx = __eax;
												__eax = __eax & 0x0000001f;
												__edx = __edx >> 5;
												__eax = __edx + __eax + 0x102;
												__eflags = __esi[2] - __eax;
												if(__esi[2] >= __eax) {
													break;
												}
												L73:
												__eax = __esi[0x143];
												while(1) {
													L76:
													__eflags = __ebx - __eax;
													if(__ebx >= __eax) {
														break;
													}
													L74:
													__eflags =  *(__ebp - 0x34);
													if( *(__ebp - 0x34) == 0) {
														goto L182;
													}
													L75:
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
													__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
													__ecx = __ebx;
													__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
													 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
													 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
													__ebx = __ebx + 8;
													__eflags = __ebx;
												}
												L77:
												__eax =  *(0x409428 + __eax * 2) & 0x0000ffff;
												__eax = __eax &  *(__ebp - 0x40);
												__ecx = __esi[0x144];
												__eax = __esi[0x144] + __eax * 4;
												__edx =  *(__eax + 1) & 0x000000ff;
												__eax =  *(__eax + 2) & 0x0000ffff;
												__eflags = __eax - 0x10;
												 *(__ebp - 0x14) = __eax;
												if(__eax >= 0x10) {
													L79:
													__eflags = __eax - 0x12;
													if(__eax != 0x12) {
														__eax = __eax + 0xfffffff2;
														 *(__ebp - 8) = 3;
													} else {
														_push(7);
														 *(__ebp - 8) = 0xb;
														_pop(__eax);
													}
													while(1) {
														L84:
														__ecx = __eax + __edx;
														__eflags = __ebx - __eax + __edx;
														if(__ebx >= __eax + __edx) {
															break;
														}
														L82:
														__eflags =  *(__ebp - 0x34);
														if( *(__ebp - 0x34) == 0) {
															goto L182;
														}
														L83:
														__ecx =  *(__ebp - 0x38);
														 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
														__edi =  *( *(__ebp - 0x38)) & 0x000000ff;
														__ecx = __ebx;
														__edi = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
														 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
														 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
														__ebx = __ebx + 8;
														__eflags = __ebx;
													}
													L85:
													__ecx = __edx;
													__ebx = __ebx - __edx;
													 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
													 *(0x409428 + __eax * 2) & 0x0000ffff =  *(0x409428 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
													__edx =  *(__ebp - 8);
													__ebx = __ebx - __eax;
													__edx =  *(__ebp - 8) + ( *(0x409428 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
													__ecx = __eax;
													__eax = __esi[1];
													 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
													__ecx = __esi[2];
													__eax = __eax >> 5;
													__edi = __eax >> 0x00000005 & 0x0000001f;
													__eax = __eax & 0x0000001f;
													__eax = __edi + __eax + 0x102;
													__edi = __edx + __ecx;
													__eflags = __edx + __ecx - __eax;
													if(__edx + __ecx > __eax) {
														goto L9;
													}
													L86:
													__eflags =  *(__ebp - 0x14) - 0x10;
													if( *(__ebp - 0x14) != 0x10) {
														L89:
														__edi = 0;
														__eflags = 0;
														L90:
														__eax = __esi + 0xc + __ecx * 4;
														do {
															L91:
															 *__eax = __edi;
															__ecx = __ecx + 1;
															__eax = __eax + 4;
															__edx = __edx - 1;
															__eflags = __edx;
														} while (__edx != 0);
														__esi[2] = __ecx;
														continue;
													}
													L87:
													__eflags = __ecx - 1;
													if(__ecx < 1) {
														goto L9;
													}
													L88:
													__edi =  *(__esi + 8 + __ecx * 4);
													goto L90;
												}
												L78:
												__ecx = __edx;
												__ebx = __ebx - __edx;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
												__ecx = __esi[2];
												 *(__esi + 0xc + __esi[2] * 4) = __eax;
												__esi[2] = __esi[2] + 1;
											}
											L94:
											__eax = __esi[1];
											__esi[0x144] = __esi[0x144] & 0x00000000;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) & 0x00000000;
											__edi = __eax;
											__eax = __eax >> 5;
											__edi = __edi & 0x0000001f;
											__ecx = 0x101;
											__eax = __eax & 0x0000001f;
											__edi = __edi + 0x101;
											__eax = __eax + 1;
											__edx = __ebp - 0xc;
											 *(__ebp - 0x14) = __eax;
											 &(__esi[0x148]) = __ebp - 4;
											 *(__ebp - 4) = 9;
											__ebp - 0x18 =  &(__esi[3]);
											 *(__ebp - 0x10) = 6;
											__eax = E00406B01( &(__esi[3]), __edi, 0x101, 0x4073b0, 0x4073f0, __ebp - 0x18, __ebp - 4,  &(__esi[0x148]), __ebp - 0xc);
											__eflags =  *(__ebp - 4);
											if( *(__ebp - 4) == 0) {
												__eax = __eax | 0xffffffff;
												__eflags = __eax;
											}
											__eflags = __eax;
											if(__eax != 0) {
												goto L9;
											} else {
												L97:
												__ebp - 0xc =  &(__esi[0x148]);
												__ebp - 0x10 = __ebp - 0x1c;
												__eax = __esi + 0xc + __edi * 4;
												__eax = E00406B01(__esi + 0xc + __edi * 4,  *(__ebp - 0x14), 0, 0x407430, 0x40746c, __ebp - 0x1c, __ebp - 0x10,  &(__esi[0x148]), __ebp - 0xc);
												__eflags = __eax;
												if(__eax != 0) {
													goto L9;
												}
												L98:
												__eax =  *(__ebp - 0x10);
												__eflags =  *(__ebp - 0x10);
												if( *(__ebp - 0x10) != 0) {
													L100:
													__cl =  *(__ebp - 4);
													 *__esi =  *__esi & 0x00000000;
													__eflags =  *__esi;
													__esi[4] = __al;
													__eax =  *(__ebp - 0x18);
													__esi[5] =  *(__ebp - 0x18);
													__eax =  *(__ebp - 0x1c);
													__esi[4] = __cl;
													__esi[6] =  *(__ebp - 0x1c);
													goto L101;
												}
												L99:
												__eflags = __edi - 0x101;
												if(__edi > 0x101) {
													goto L9;
												}
												goto L100;
											}
										case 0xe:
											goto L9;
										case 0xf:
											L175:
											__eax =  *(__ebp - 0x30);
											__esi[0x26ea] =  *(__ebp - 0x30);
											__eax = E00406A99( *((intOrPtr*)(__ebp + 8)));
											__ecx = __esi[0x26ea];
											__edx = __esi[0x26e9];
											__eflags = __ecx - __edx;
											 *(__ebp - 0x30) = __ecx;
											if(__ecx >= __edx) {
												__eax = __esi[0x26e8];
												__eax = __esi[0x26e8] - __ecx;
												__eflags = __eax;
											} else {
												__edx = __edx - __ecx;
												__eax = __edx - __ecx - 1;
											}
											__eflags = __ecx - __edx;
											 *(__ebp - 0x2c) = __eax;
											if(__ecx != __edx) {
												L183:
												__edi = 0;
												goto L10;
											} else {
												L179:
												__eax = __esi[0x145];
												__eflags = __eax - 8;
												 *__esi = __eax;
												if(__eax != 8) {
													L184:
													0 = 1;
													goto L10;
												}
												goto L180;
											}
									}
								}
								L181:
								goto L9;
							}
							L70:
							if( *__edi == __eax) {
								goto L72;
							}
							L71:
							__esi[2] = __esi[2] & __eax;
							 *__esi = 0xd;
							goto L93;
						}
					}
				}
				L182:
				_t443 = 0;
				_t446[0x147] =  *(_t448 - 0x40);
				_t446[0x146] = _t425;
				( *(_t448 + 8))[1] = 0;
				goto L11;
			}

0x0040632a
0x0040632a
0x0040632a
0x0040632a
0x0040632a
0x0040632e
0x00000000
0x00000000
0x00406334
0x00406334
0x00406337
0x0040633a
0x0040633f
0x00406341
0x00406344
0x00406347
0x0040634a
0x0040634a
0x0040634d
0x00000000
0x00000000
0x0040634f
0x0040634f
0x00406352
0x00406357
0x00406359
0x0040635c
0x00406362
0x004060c1
0x004060c1
0x004060c4
0x004060ca
0x004060d0
0x004060d9
0x004060df
0x004060e2
0x004060e9
0x004060ee
0x004060f4
0x004060ff
0x004060ff
0x00406368
0x00406368
0x00406372
0x00000000
0x00000000
0x00406378
0x00406378
0x0040637c
0x0040637f
0x0040637f
0x00406383
0x00406389
0x00406389
0x0040638c
0x0040638f
0x00406395
0x00000000
0x00000000
0x00406397
0x004063b9
0x004063b9
0x004063bc
0x00000000
0x00000000
0x00406399
0x0040639d
0x00000000
0x00000000
0x004063a3
0x004063a3
0x004063a6
0x004063a9
0x004063ae
0x004063b0
0x004063b3
0x004063b6
0x004063b6
0x004063be
0x004063be
0x004063c4
0x004063c7
0x004063ca
0x004063ca
0x004063d1
0x004063d5
0x004063d9
0x004063dc
0x004063df
0x004063e5
0x004063ea
0x00000000
0x00000000
0x004063ec
0x00406400
0x00406400
0x00406404
0x00000000
0x00000000
0x004063ee
0x004063f1
0x004063f1
0x004063f8
0x004063fd
0x004063fd
0x004063fd
0x00406406
0x00406406
0x00406409
0x00406417
0x0040641d
0x00406422
0x00406428
0x0040642e
0x00406434
0x0040643b
0x0040644f
0x0040644f
0x00406a1e
0x00406a1e
0x00406a1e
0x00406a23
0x00000000
0x00000000
0x0040605b
0x0040605b
0x00000000
0x00406656
0x00406656
0x0040665a
0x0040665d
0x00406660
0x00406663
0x00000000
0x00000000
0x00406669
0x00406669
0x0040668e
0x0040668e
0x0040668e
0x00406690
0x00000000
0x00000000
0x0040666e
0x0040666e
0x00406672
0x00000000
0x00000000
0x00406678
0x00406678
0x0040667b
0x0040667e
0x00406681
0x00406683
0x00406685
0x00406688
0x0040668b
0x0040668b
0x0040668b
0x00406692
0x00406692
0x0040669a
0x0040669d
0x004066a0
0x004066a3
0x004066a7
0x004066aa
0x004066ac
0x004066af
0x004066b1
0x004066c5
0x004066c5
0x004066c8
0x004066e2
0x004066e2
0x004066e5
0x00000000
0x00000000
0x004066eb
0x004066eb
0x004066ee
0x00000000
0x00000000
0x004066f4
0x004066f4
0x00000000
0x004066f4
0x004066ca
0x004066cd
0x004066d4
0x004066d7
0x00000000
0x004066d7
0x004066b3
0x004066b7
0x004066ba
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406724
0x00406724
0x00406724
0x00406726
0x00000000
0x00000000
0x00406704
0x00406704
0x00406708
0x00000000
0x00000000
0x0040670e
0x0040670e
0x00406711
0x00406714
0x00406717
0x00406719
0x0040671b
0x0040671e
0x00406721
0x00406721
0x00406721
0x00406728
0x00406730
0x00406733
0x00406736
0x00406738
0x0040673b
0x0040673b
0x0040673d
0x00406741
0x00406744
0x00406747
0x0040674a
0x00000000
0x00000000
0x00406750
0x00406750
0x00406775
0x00406775
0x00406775
0x00406777
0x00000000
0x00000000
0x00406755
0x00406755
0x00406759
0x00000000
0x00000000
0x0040675f
0x0040675f
0x00406762
0x00406765
0x00406768
0x0040676a
0x0040676c
0x0040676f
0x00406772
0x00406772
0x00406772
0x00406779
0x00406779
0x00406781
0x00406784
0x00406787
0x0040678a
0x0040678e
0x00406791
0x00406793
0x00406796
0x00406799
0x004067b3
0x004067b3
0x004067b6
0x00000000
0x00000000
0x004067bc
0x004067bc
0x004067bf
0x004067c6
0x00000000
0x004067c6
0x0040679b
0x0040679e
0x004067a5
0x004067a8
0x00000000
0x00000000
0x004067ce
0x004067ce
0x004067f3
0x004067f3
0x004067f3
0x004067f5
0x00000000
0x00000000
0x004067d3
0x004067d3
0x004067d7
0x00000000
0x00000000
0x004067dd
0x004067dd
0x004067e0
0x004067e3
0x004067e6
0x004067e8
0x004067ea
0x004067ed
0x004067f0
0x004067f0
0x004067f0
0x004067f7
0x004067ff
0x00406802
0x00406805
0x00406807
0x0040680a
0x0040680a
0x0040680c
0x00000000
0x00000000
0x00406812
0x00406812
0x00406815
0x0040681a
0x0040681c
0x00406822
0x00406824
0x00406839
0x0040683b
0x0040683b
0x00406826
0x0040682c
0x0040682e
0x00406830
0x00406830
0x0040683d
0x00406841
0x00406844
0x0040684a
0x0040684a
0x0040684d
0x0040684d
0x0040684d
0x0040684f
0x00000000
0x00000000
0x00406855
0x00406855
0x0040685b
0x0040685d
0x00406882
0x00406885
0x0040688b
0x00406890
0x00406896
0x0040689c
0x0040689e
0x004068a1
0x004068aa
0x004068b0
0x004068b0
0x004068a3
0x004068a5
0x004068a7
0x004068a7
0x004068b2
0x004068b8
0x004068ba
0x004068bd
0x004068bf
0x004068c5
0x004068c7
0x004068c9
0x004068cb
0x004068cd
0x004068d0
0x004068d9
0x004068dc
0x004068dc
0x004068d2
0x004068d2
0x004068d5
0x004068d5
0x004068d0
0x004068c7
0x004068de
0x004068e0
0x00000000
0x00000000
0x00000000
0x00000000
0x004068e0
0x0040685f
0x0040685f
0x00406865
0x0040686b
0x0040686d
0x00000000
0x00000000
0x0040686f
0x0040686f
0x00406871
0x00406873
0x0040687c
0x0040687c
0x00406875
0x00406875
0x00406878
0x00406878
0x0040687e
0x00406880
0x00000000
0x00000000
0x004068e6
0x004068e6
0x004068eb
0x004068ed
0x004068ee
0x004068ef
0x004068f0
0x004068f6
0x004068f9
0x004068fc
0x004068ff
0x00406901
0x00406907
0x00406907
0x0040690a
0x0040690a
0x0040690a
0x0040690a
0x00406913
0x00000000
0x00000000
0x00406918
0x00406918
0x0040691b
0x0040691e
0x00406920
0x004069b7
0x004069b7
0x004069ba
0x004069bc
0x004069bd
0x004069be
0x004069c1
0x00000000
0x004069c1
0x00406926
0x00406926
0x0040692c
0x0040692e
0x00406953
0x00406956
0x0040695c
0x00406961
0x00406967
0x0040696d
0x0040696f
0x00406972
0x0040697b
0x00406981
0x00406981
0x00406974
0x00406976
0x00406978
0x00406978
0x00406983
0x00406989
0x0040698b
0x0040698e
0x00406990
0x00406996
0x00406998
0x0040699a
0x0040699c
0x0040699e
0x004069a1
0x004069aa
0x004069ad
0x004069ad
0x004069a3
0x004069a3
0x004069a6
0x004069a6
0x004069a1
0x00406998
0x004069af
0x004069b1
0x00000000
0x00000000
0x00000000
0x00000000
0x004069b1
0x00406930
0x00406930
0x00406936
0x0040693c
0x0040693e
0x00000000
0x00000000
0x00406940
0x00406940
0x00406942
0x00406944
0x0040694b
0x0040694b
0x0040694d
0x00406946
0x00406946
0x00406948
0x00406948
0x0040694f
0x00406951
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004069c9
0x004069c9
0x004069cc
0x004069ce
0x004069d1
0x004069d4
0x004069d4
0x004069d4
0x004069d4
0x00000000
0x00000000
0x00000000
0x00406082
0x00406066
0x00000000
0x0040606c
0x0040606f
0x00406079
0x0040607c
0x0040607f
0x00000000
0x0040607f
0x00406066
0x0040608a
0x0040608d
0x00406091
0x0040609b
0x004060a5
0x004060a8
0x004060ae
0x004061e2
0x004061e4
0x004061ea
0x004061ed
0x004061f0
0x00000000
0x004061f0
0x004060b4
0x004060b4
0x004060b5
0x0040610d
0x0040610d
0x00406114
0x004061ba
0x004061ba
0x004061bf
0x004061c2
0x004061c7
0x004061ca
0x004061cf
0x004061d2
0x004061d7
0x004061da
0x004061da
0x00000000
0x0040611a
0x0040611a
0x0040611a
0x0040611a
0x0040611e
0x0040611e
0x00406140
0x00406143
0x00406145
0x00406148
0x0040614d
0x00406123
0x00406123
0x00406128
0x0040612a
0x0040612c
0x00406131
0x00406137
0x0040613c
0x0040613e
0x0040613e
0x00406133
0x00406133
0x00406133
0x00406131
0x00000000
0x0040614f
0x0040617c
0x00406181
0x00406183
0x00406184
0x00406186
0x00406187
0x00406187
0x00406187
0x004061af
0x004061b4
0x004061b4
0x00000000
0x004061b4
0x0040614d
0x00406114
0x004060b7
0x004060b7
0x004060b8
0x00406102
0x00000000
0x00406102
0x004060ba
0x004060bb
0x00000000
0x00000000
0x00000000
0x00000000
0x00406217
0x00406217
0x00406217
0x0040621a
0x00000000
0x00000000
0x004061f7
0x004061f7
0x004061fb
0x00000000
0x00000000
0x00406201
0x00406201
0x00406204
0x00406207
0x0040620c
0x0040620e
0x00406211
0x00406214
0x00406214
0x00406214
0x0040621c
0x0040621c
0x0040621f
0x00406221
0x00406226
0x00406229
0x0040622b
0x0040622e
0x00000000
0x00000000
0x00406234
0x00406234
0x00406236
0x00000000
0x00000000
0x0040623c
0x0040623c
0x00406240
0x00000000
0x00000000
0x00406246
0x00406246
0x00406249
0x0040624b
0x004062e9
0x004062e9
0x004062ec
0x004062ee
0x004062ee
0x004062f1
0x004062f4
0x004062f6
0x004062f8
0x004062fa
0x004062fa
0x00406303
0x00406308
0x0040630b
0x0040630e
0x00406311
0x00406314
0x00406314
0x00406314
0x00406317
0x0040631d
0x0040631d
0x00406323
0x00406323
0x00406323
0x00000000
0x00406317
0x00406251
0x00406251
0x00406257
0x0040625a
0x0040625c
0x00406287
0x0040628a
0x00406290
0x00406295
0x0040629b
0x004062a1
0x004062a3
0x004062a6
0x004062af
0x004062b5
0x004062b5
0x004062a8
0x004062aa
0x004062ac
0x004062ac
0x004062b7
0x004062bd
0x004062c0
0x004062c2
0x004062c4
0x004062ca
0x004062cc
0x004062ce
0x004062d1
0x004062da
0x004062da
0x004062dc
0x004062d3
0x004062d3
0x004062d6
0x004062d6
0x004062de
0x004062de
0x004062cc
0x004062e1
0x004062e3
0x00000000
0x00000000
0x00000000
0x00000000
0x004062e3
0x0040625e
0x0040625e
0x00406264
0x0040626a
0x0040626c
0x00000000
0x00000000
0x0040626e
0x0040626e
0x00406270
0x00406272
0x00406275
0x0040627c
0x0040627c
0x0040627e
0x00406277
0x00406277
0x00406279
0x00406279
0x00406280
0x00406282
0x00406285
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406389
0x0040638c
0x0040638f
0x00406395
0x00000000
0x00000000
0x00000000
0x00000000
0x0040656c
0x0040656c
0x0040656c
0x0040656f
0x00406572
0x00406574
0x00406577
0x0040657d
0x00406584
0x00406586
0x00000000
0x00000000
0x0040645a
0x0040645a
0x00406482
0x00406482
0x00406482
0x00406484
0x00000000
0x00000000
0x00406462
0x00406462
0x00406466
0x00000000
0x00000000
0x0040646c
0x0040646c
0x0040646f
0x00406472
0x00406475
0x00406477
0x00406479
0x0040647c
0x0040647f
0x0040647f
0x0040647f
0x00406486
0x00406486
0x0040648e
0x00406491
0x00406497
0x0040649a
0x0040649e
0x004064a2
0x004064a5
0x004064a8
0x004064c0
0x004064c0
0x004064c3
0x004064d1
0x004064d4
0x004064c5
0x004064c5
0x004064c7
0x004064ce
0x004064ce
0x004064fd
0x004064fd
0x004064fd
0x00406500
0x00406502
0x00000000
0x00000000
0x004064dd
0x004064dd
0x004064e1
0x00000000
0x00000000
0x004064e7
0x004064e7
0x004064ea
0x004064ed
0x004064f0
0x004064f2
0x004064f4
0x004064f7
0x004064fa
0x004064fa
0x004064fa
0x00406504
0x00406504
0x00406506
0x00406508
0x00406513
0x00406516
0x00406519
0x0040651b
0x0040651d
0x0040651f
0x00406522
0x00406525
0x0040652a
0x0040652d
0x00406530
0x00406533
0x0040653a
0x0040653d
0x0040653f
0x00000000
0x00000000
0x00406545
0x00406545
0x00406549
0x0040655a
0x0040655a
0x0040655a
0x0040655c
0x0040655c
0x00406560
0x00406560
0x00406560
0x00406562
0x00406563
0x00406566
0x00406566
0x00406566
0x00406569
0x00000000
0x00406569
0x0040654b
0x0040654b
0x0040654e
0x00000000
0x00000000
0x00406554
0x00406554
0x00000000
0x00406554
0x004064aa
0x004064aa
0x004064ac
0x004064ae
0x004064b1
0x004064b4
0x004064b8
0x004064b8
0x0040658c
0x0040658c
0x0040658f
0x00406596
0x0040659a
0x0040659c
0x0040659f
0x004065a2
0x004065a7
0x004065aa
0x004065ac
0x004065ad
0x004065b0
0x004065bb
0x004065be
0x004065d5
0x004065da
0x004065e1
0x004065e6
0x004065ea
0x004065ec
0x004065ec
0x004065ec
0x004065ef
0x004065f1
0x00000000
0x004065f7
0x004065f7
0x004065fb
0x00406606
0x00406619
0x0040661e
0x00406623
0x00406625
0x00000000
0x00000000
0x0040662b
0x0040662b
0x0040662e
0x00406630
0x0040663e
0x0040663e
0x00406641
0x00406641
0x00406644
0x00406647
0x0040664a
0x0040664d
0x00406650
0x00406653
0x00000000
0x00406653
0x00406632
0x00406632
0x00406638
0x00000000
0x00000000
0x00000000
0x00406638
0x00000000
0x00000000
0x00000000
0x004069d7
0x004069d7
0x004069dd
0x004069e3
0x004069e8
0x004069ee
0x004069f4
0x004069f6
0x004069f9
0x00406a02
0x00406a08
0x00406a08
0x004069fb
0x004069fd
0x004069ff
0x004069ff
0x00406a0a
0x00406a0c
0x00406a0f
0x00406a4a
0x00406a4a
0x00000000
0x00406a11
0x00406a11
0x00406a11
0x00406a17
0x00406a1a
0x00406a1c
0x00406a51
0x00406a53
0x00000000
0x00406a53
0x00000000
0x00406a1c
0x00000000
0x0040605b
0x00406a29
0x00000000
0x00406a29
0x0040643d
0x0040643f
0x00000000
0x00000000
0x00406441
0x00406441
0x00406444
0x00000000
0x00406444
0x00406389
0x0040634a
0x00406a2e
0x00406a31
0x00406a33
0x00406a3c
0x00406a42
0x00000000

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a819559cac325912a5da870af16f2072e900c9bb0763f72fbb9437a3d348546
Instruction ID: 430467d656314c7e37725f6accf0e98df37da47b2ee055c5ee71eb9d2680c55a
Opcode Fuzzy Hash: 5a819559cac325912a5da870af16f2072e900c9bb0763f72fbb9437a3d348546
Instruction Fuzzy Hash: 5BE18B71A00709DFDB24CF58D880BAABBF1FB45305F15852EE897A7291D738AA95CF04

Uniqueness

Uniqueness Score: -1.00%

Function 00406B01 Relevance: .3, Instructions: 300
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00406B01(signed char _a4, char _a5, short _a6, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int* _a24, signed int _a28, intOrPtr _a32, signed int* _a36) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr* _v32;
				signed int* _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				void _v116;
				signed int _v176;
				signed int _v180;
				signed int _v240;
				signed int _t166;
				signed int _t168;
				intOrPtr _t175;
				signed int _t181;
				void* _t182;
				intOrPtr _t183;
				signed int* _t184;
				signed int _t186;
				signed int _t187;
				signed int* _t189;
				signed int _t190;
				intOrPtr* _t191;
				intOrPtr _t192;
				signed int _t193;
				signed int _t195;
				signed int _t200;
				signed int _t205;
				void* _t207;
				short _t208;
				signed char _t222;
				signed int _t224;
				signed int _t225;
				signed int* _t232;
				signed int _t233;
				signed int _t234;
				void* _t235;
				signed int _t236;
				signed int _t244;
				signed int _t246;
				signed int _t251;
				signed int _t254;
				signed int _t256;
				signed int _t259;
				signed int _t262;
				void* _t263;
				void* _t264;
				signed int _t267;
				intOrPtr _t269;
				intOrPtr _t271;
				signed int _t274;
				intOrPtr* _t275;
				unsigned int _t276;
				void* _t277;
				signed int _t278;
				intOrPtr* _t279;
				signed int _t281;
				intOrPtr _t282;
				intOrPtr _t283;
				signed int* _t284;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t296;
				signed int* _t297;
				intOrPtr _t298;
				void* _t299;

				_t278 = _a8;
				_t187 = 0x10;
				memset( &_v116, 0, _t187 << 2);
				_t189 = _a4;
				_t233 = _t278;
				do {
					_t166 =  *_t189;
					_t189 =  &(_t189[1]);
					 *((intOrPtr*)(_t299 + _t166 * 4 - 0x70)) =  *((intOrPtr*)(_t299 + _t166 * 4 - 0x70)) + 1;
					_t233 = _t233 - 1;
				} while (_t233 != 0);
				if(_v116 != _t278) {
					_t279 = _a28;
					_t267 =  *_t279;
					_t190 = 1;
					_a28 = _t267;
					_t234 = 0xf;
					while(1) {
						_t168 = 0;
						if( *((intOrPtr*)(_t299 + _t190 * 4 - 0x70)) != 0) {
							break;
						}
						_t190 = _t190 + 1;
						if(_t190 <= _t234) {
							continue;
						}
						break;
					}
					_v8 = _t190;
					if(_t267 < _t190) {
						_a28 = _t190;
					}
					while( *((intOrPtr*)(_t299 + _t234 * 4 - 0x70)) == _t168) {
						_t234 = _t234 - 1;
						if(_t234 != 0) {
							continue;
						}
						break;
					}
					_v28 = _t234;
					if(_a28 > _t234) {
						_a28 = _t234;
					}
					 *_t279 = _a28;
					_t181 = 1 << _t190;
					while(_t190 < _t234) {
						_t182 = _t181 -  *((intOrPtr*)(_t299 + _t190 * 4 - 0x70));
						if(_t182 < 0) {
							L64:
							return _t168 | 0xffffffff;
						}
						_t190 = _t190 + 1;
						_t181 = _t182 + _t182;
					}
					_t281 = _t234 << 2;
					_t191 = _t299 + _t281 - 0x70;
					_t269 =  *_t191;
					_t183 = _t181 - _t269;
					_v52 = _t183;
					if(_t183 < 0) {
						goto L64;
					}
					_v176 = _t168;
					 *_t191 = _t269 + _t183;
					_t192 = 0;
					_t235 = _t234 - 1;
					if(_t235 == 0) {
						L21:
						_t184 = _a4;
						_t271 = 0;
						do {
							_t193 =  *_t184;
							_t184 =  &(_t184[1]);
							if(_t193 != _t168) {
								_t232 = _t299 + _t193 * 4 - 0xb0;
								_t236 =  *_t232;
								 *((intOrPtr*)(0x42ced8 + _t236 * 4)) = _t271;
								 *_t232 = _t236 + 1;
							}
							_t271 = _t271 + 1;
						} while (_t271 < _a8);
						_v16 = _v16 | 0xffffffff;
						_v40 = _v40 & 0x00000000;
						_a8 =  *((intOrPtr*)(_t299 + _t281 - 0xb0));
						_t195 = _v8;
						_t186 =  ~_a28;
						_v12 = _t168;
						_v180 = _t168;
						_v36 = 0x42ced8;
						_v240 = _t168;
						if(_t195 > _v28) {
							L62:
							_t168 = 0;
							if(_v52 == 0 || _v28 == 1) {
								return _t168;
							} else {
								goto L64;
							}
						}
						_v44 = _t195 - 1;
						_v32 = _t299 + _t195 * 4 - 0x70;
						do {
							_t282 =  *_v32;
							if(_t282 == 0) {
								goto L61;
							}
							while(1) {
								_t283 = _t282 - 1;
								_t200 = _a28 + _t186;
								_v48 = _t283;
								_v24 = _t200;
								if(_v8 <= _t200) {
									goto L45;
								}
								L31:
								_v20 = _t283 + 1;
								do {
									_v16 = _v16 + 1;
									_t296 = _v28 - _v24;
									if(_t296 > _a28) {
										_t296 = _a28;
									}
									_t222 = _v8 - _v24;
									_t254 = 1 << _t222;
									if(1 <= _v20) {
										L40:
										_t256 =  *_a36;
										_t168 = 1 << _t222;
										_v40 = 1;
										_t274 = _t256 + 1;
										if(_t274 > 0x5a0) {
											goto L64;
										}
									} else {
										_t275 = _v32;
										_t263 = _t254 + (_t168 | 0xffffffff) - _v48;
										if(_t222 >= _t296) {
											goto L40;
										}
										while(1) {
											_t222 = _t222 + 1;
											if(_t222 >= _t296) {
												goto L40;
											}
											_t275 = _t275 + 4;
											_t264 = _t263 + _t263;
											_t175 =  *_t275;
											if(_t264 <= _t175) {
												goto L40;
											}
											_t263 = _t264 - _t175;
										}
										goto L40;
									}
									_t168 = _a32 + _t256 * 4;
									_t297 = _t299 + _v16 * 4 - 0xec;
									 *_a36 = _t274;
									_t259 = _v16;
									 *_t297 = _t168;
									if(_t259 == 0) {
										 *_a24 = _t168;
									} else {
										_t276 = _v12;
										_t298 =  *((intOrPtr*)(_t297 - 4));
										 *(_t299 + _t259 * 4 - 0xb0) = _t276;
										_a5 = _a28;
										_a4 = _t222;
										_t262 = _t276 >> _t186;
										_a6 = (_t168 - _t298 >> 2) - _t262;
										 *(_t298 + _t262 * 4) = _a4;
									}
									_t224 = _v24;
									_t186 = _t224;
									_t225 = _t224 + _a28;
									_v24 = _t225;
								} while (_v8 > _t225);
								L45:
								_t284 = _v36;
								_a5 = _v8 - _t186;
								if(_t284 < 0x42ced8 + _a8 * 4) {
									_t205 =  *_t284;
									if(_t205 >= _a12) {
										_t207 = _t205 - _a12 + _t205 - _a12;
										_v36 =  &(_v36[1]);
										_a4 =  *((intOrPtr*)(_t207 + _a20)) + 0x50;
										_t208 =  *((intOrPtr*)(_t207 + _a16));
									} else {
										_a4 = (_t205 & 0xffffff00 | _t205 - 0x00000100 > 0x00000000) - 0x00000001 & 0x00000060;
										_t208 =  *_t284;
										_v36 =  &(_t284[1]);
									}
									_a6 = _t208;
								} else {
									_a4 = 0xc0;
								}
								_t286 = 1 << _v8 - _t186;
								_t244 = _v12 >> _t186;
								while(_t244 < _v40) {
									 *(_t168 + _t244 * 4) = _a4;
									_t244 = _t244 + _t286;
								}
								_t287 = _v12;
								_t246 = 1 << _v44;
								while((_t287 & _t246) != 0) {
									_t287 = _t287 ^ _t246;
									_t246 = _t246 >> 1;
								}
								_t288 = _t287 ^ _t246;
								_v20 = 1;
								_v12 = _t288;
								_t251 = _v16;
								if(((1 << _t186) - 0x00000001 & _t288) ==  *((intOrPtr*)(_t299 + _t251 * 4 - 0xb0))) {
									L60:
									if(_v48 != 0) {
										_t282 = _v48;
										_t283 = _t282 - 1;
										_t200 = _a28 + _t186;
										_v48 = _t283;
										_v24 = _t200;
										if(_v8 <= _t200) {
											goto L45;
										}
										goto L31;
									}
									break;
								} else {
									goto L58;
								}
								do {
									L58:
									_t186 = _t186 - _a28;
									_t251 = _t251 - 1;
								} while (((1 << _t186) - 0x00000001 & _v12) !=  *((intOrPtr*)(_t299 + _t251 * 4 - 0xb0)));
								_v16 = _t251;
								goto L60;
							}
							L61:
							_v8 = _v8 + 1;
							_v32 = _v32 + 4;
							_v44 = _v44 + 1;
						} while (_v8 <= _v28);
						goto L62;
					}
					_t277 = 0;
					do {
						_t192 = _t192 +  *((intOrPtr*)(_t299 + _t277 - 0x6c));
						_t277 = _t277 + 4;
						_t235 = _t235 - 1;
						 *((intOrPtr*)(_t299 + _t277 - 0xac)) = _t192;
					} while (_t235 != 0);
					goto L21;
				}
				 *_a24 =  *_a24 & 0x00000000;
				 *_a28 =  *_a28 & 0x00000000;
				return 0;
			}

0x00406b0c
0x00406b14
0x00406b18
0x00406b1a
0x00406b1d
0x00406b1f
0x00406b1f
0x00406b21
0x00406b28
0x00406b2a
0x00406b2a
0x00406b30
0x00406b45
0x00406b4d
0x00406b4f
0x00406b51
0x00406b54
0x00406b55
0x00406b55
0x00406b5b
0x00000000
0x00000000
0x00406b5d
0x00406b60
0x00000000
0x00000000
0x00000000
0x00406b60
0x00406b64
0x00406b67
0x00406b69
0x00406b69
0x00406b6c
0x00406b72
0x00406b73
0x00000000
0x00000000
0x00000000
0x00406b73
0x00406b78
0x00406b7b
0x00406b7d
0x00406b7d
0x00406b83
0x00406b85
0x00406b96
0x00406b89
0x00406b8d
0x00406e32
0x00000000
0x00406e32
0x00406b93
0x00406b94
0x00406b94
0x00406b9c
0x00406b9f
0x00406ba3
0x00406ba5
0x00406ba7
0x00406baa
0x00000000
0x00000000
0x00406bb2
0x00406bb8
0x00406bba
0x00406bbc
0x00406bbd
0x00406bd2
0x00406bd2
0x00406bd5
0x00406bd7
0x00406bd7
0x00406bd9
0x00406bde
0x00406be0
0x00406be7
0x00406be9
0x00406bf1
0x00406bf1
0x00406bf3
0x00406bf4
0x00406c03
0x00406c07
0x00406c0b
0x00406c0e
0x00406c11
0x00406c16
0x00406c19
0x00406c1f
0x00406c26
0x00406c2c
0x00406e25
0x00406e25
0x00406e2a
0x00406e39
0x00000000
0x00000000
0x00000000
0x00406e2a
0x00406c39
0x00406c3c
0x00406c3f
0x00406c42
0x00406c46
0x00000000
0x00000000
0x00406c51
0x00406c54
0x00406c55
0x00406c57
0x00406c5d
0x00406c60
0x00000000
0x00000000
0x00406c66
0x00406c67
0x00406c6a
0x00406c6d
0x00406c70
0x00406c76
0x00406c78
0x00406c78
0x00406c80
0x00406c84
0x00406c89
0x00406cae
0x00406cb4
0x00406cb6
0x00406cb8
0x00406cbb
0x00406cc4
0x00000000
0x00000000
0x00406c8b
0x00406c8b
0x00406c94
0x00406c98
0x00000000
0x00000000
0x00406ca9
0x00406ca9
0x00406cac
0x00000000
0x00000000
0x00406c9c
0x00406c9f
0x00406ca1
0x00406ca5
0x00000000
0x00000000
0x00406ca7
0x00406ca7
0x00000000
0x00406ca9
0x00406ccd
0x00406cd3
0x00406cdd
0x00406cdf
0x00406ce4
0x00406ce6
0x00406d1c
0x00406ce8
0x00406ce8
0x00406ceb
0x00406cee
0x00406cf8
0x00406cfb
0x00406d02
0x00406d0d
0x00406d14
0x00406d14
0x00406d1e
0x00406d21
0x00406d23
0x00406d29
0x00406d29
0x00406d32
0x00406d35
0x00406d3a
0x00406d49
0x00406d51
0x00406d56
0x00406d7a
0x00406d82
0x00406d86
0x00406d8c
0x00406d58
0x00406d66
0x00406d69
0x00406d6f
0x00406d6f
0x00406d90
0x00406d4b
0x00406d4b
0x00406d4b
0x00406da1
0x00406da5
0x00406db1
0x00406dac
0x00406daf
0x00406daf
0x00406db9
0x00406dbe
0x00406dc6
0x00406dc2
0x00406dc4
0x00406dc4
0x00406dcc
0x00406dce
0x00406dd5
0x00406ddf
0x00406de9
0x00406e05
0x00406e09
0x00406c4e
0x00406c54
0x00406c55
0x00406c57
0x00406c5d
0x00406c60
0x00000000
0x00000000
0x00000000
0x00406c60
0x00000000
0x00000000
0x00000000
0x00000000
0x00406deb
0x00406deb
0x00406deb
0x00406df0
0x00406df9
0x00406e02
0x00000000
0x00406e02
0x00406e0f
0x00406e0f
0x00406e12
0x00406e19
0x00406e1c
0x00000000
0x00406c3f
0x00406bbf
0x00406bc1
0x00406bc1
0x00406bc5
0x00406bc8
0x00406bc9
0x00406bc9
0x00000000
0x00406bc1
0x00406b35
0x00406b3b
0x00000000

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6271c98690b1cfc42e3136c50631b776cf05fd7e3b644bcdccc108723492fea8
Instruction ID: 31e596356fdf544bef750598cd2398cea7ffcaa0c07f8aabd85cf97c85a13bdb
Opcode Fuzzy Hash: 6271c98690b1cfc42e3136c50631b776cf05fd7e3b644bcdccc108723492fea8
Instruction Fuzzy Hash: F6C14C71A00229CBDF14CF68D4905EEB7B2FF98314F26816AD856BB384D734A952CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00403FA5 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00403FA5(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char* _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				intOrPtr _t71;
				intOrPtr _t85;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t103;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x42a0a0 =  *0x42a0a0 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403EC4(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x42dbe0;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								ShellExecuteA(_a4, "open", _v8, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x42ec48, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x42ec48, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x42a0a0 != 0) {
						goto L25;
					} else {
						_t103 =  *0x429890; // 0x6d6ae4
						_t25 = _t103 + 0x14; // 0x6d6af8
						_t112 = _t25;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403E7F(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404230();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t107 =  *0x42e41c; // 0x6dd263
					_t113 =  *(_t107 - 4 + _t113 * 4);
				}
				_t71 =  *0x42ec78; // 0x6dc2d4
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 + _t71;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E00403F71;
				E00403E5D(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403E5D(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403E7F( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403E92(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t85 =  *0x42ec50; // 0x6d6978
				_t86 =  *(_t85 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x429084 =  *0x429084 & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16);
				 *0x42a0a0 =  *0x42a0a0 & 0x00000000;
				return 0;
			}

0x00403fb5
0x004040db
0x00404137
0x0040413b
0x00404212
0x00404214
0x00404214
0x0040421a
0x0040421a
0x0040421d
0x00000000
0x00404224
0x00404149
0x0040414b
0x00404155
0x00404160
0x00404163
0x00404166
0x00404171
0x00404174
0x0040417b
0x00404189
0x004041a1
0x004041b4
0x004041c4
0x004041c6
0x004041c6
0x0040417b
0x004041d0
0x00000000
0x004041db
0x004041df
0x004041f0
0x004041f0
0x004041f6
0x00404204
0x00404204
0x00000000
0x00404208
0x004041d0
0x004040e6
0x00000000
0x004040fa
0x004040fa
0x00404100
0x00404100
0x00404106
0x00000000
0x00000000
0x0040412b
0x0040412d
0x00404132
0x00000000
0x00404132
0x004040e6
0x00403fbb
0x00403fbe
0x00403fc3
0x00403fc5
0x00403fd4
0x00403fd4
0x00403fd6
0x00403fdb
0x00403fde
0x00403fe0
0x00403fe5
0x00403fee
0x00403ff4
0x00404000
0x00404003
0x0040400c
0x00404011
0x00404014
0x00404019
0x00404030
0x00404037
0x0040404a
0x0040404d
0x00404062
0x00404064
0x00404069
0x0040406e
0x00404073
0x00404073
0x00404082
0x00404091
0x00404093
0x004040a9
0x004040b8
0x004040ba
0x00000000

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404030
GetDlgItem.USER32(00000000,000003E8), ref: 00404044
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00404062
GetSysColor.USER32(?), ref: 00404073
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404082
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404091
lstrlenA.KERNEL32(?), ref: 0040409B
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004040A9
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004040B8
GetDlgItem.USER32(?,0000040A), ref: 0040411B
SendMessageA.USER32(00000000), ref: 0040411E
GetDlgItem.USER32(?,000003E8), ref: 00404149
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404189
LoadCursorA.USER32(00000000,00007F02), ref: 00404198
SetCursor.USER32(00000000), ref: 004041A1
ShellExecuteA.SHELL32(0000070B,open,0042DBE0,00000000,00000000,00000001), ref: 004041B4
LoadCursorA.USER32(00000000,00007F00), ref: 004041C1
SetCursor.USER32(00000000), ref: 004041C4
SendMessageA.USER32(00000111,00000001,00000000), ref: 004041F0
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404204

Strings

xim, xrefs: 00404064
open, xrefs: 004041AC
jm, xrefs: 004040FA
N, xrefs: 00404137
Call, xrefs: 00404174
q?@, xrefs: 004041A9

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$open$q?@$xim$jm
API String ID: 3615053054-1480172447
Opcode ID: 43e4b1bebc352cc37ab134c8e21d344cf3974b6da0146347b86895c6f7b453af
Instruction ID: 8cc316ab489d754ba064ab1d5a66df449127ca6112c148b2bdc2fdd16cb80ba7
Opcode Fuzzy Hash: 43e4b1bebc352cc37ab134c8e21d344cf3974b6da0146347b86895c6f7b453af
Instruction Fuzzy Hash: 9361DFB1A40209BFEB109F60CC45F6A3B68FB54745F10853AFB04BA2D1C7B8A951CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				intOrPtr _t115;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x42ec50; // 0x6d6978
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, "Fast! Setup", 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					_t115 =  *0x42ec48; // 0x30390
					 *((intOrPtr*)(_t102 + 4)) = _t115;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x00401019
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Fast! Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

xim, xrefs: 00401039
F, xrefs: 0040100C
Fast! Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Fast! Setup$xim
API String ID: 941294808-3124607758
Opcode ID: 9ef4e76bf49e76a01cd413a5d017736c2cab636d92d5aa9aaf47e7e990c9ee05
Instruction ID: 7d427dbe4d4bacd88da03279d54ab8fa369b0c74db3328ba00a5b4b95e7f032c
Opcode Fuzzy Hash: 9ef4e76bf49e76a01cd413a5d017736c2cab636d92d5aa9aaf47e7e990c9ee05
Instruction Fuzzy Hash: 0B41AC71804249AFCB058F95CD459BFBFB9FF44314F00802AF961AA2A0C738EA50DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 100010EF Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E100010EF(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v12;
				intOrPtr _v36;
				CHAR* _v44;
				long _v56;
				CHAR* _v60;
				CHAR* _v76;
				void _v84;
				char _v88;
				signed int _t33;
				signed char _t34;
				CHAR* _t35;
				int _t38;
				int _t43;
				signed int _t48;
				void* _t55;

				_t48 = 0x12;
				memset( &_v84, 0, _t48 << 2);
				 *0x100050dc = _a8;
				 *0x100050e0 = _a16;
				 *0x100050e4 = _a12;
				_v84 = _a4;
				_v88 = 0x4c;
				_v76 = 0x100044a0;
				_v60 = 0x100048a0;
				_v56 = 0x400;
				_v36 = 0x82000;
				E10001DD9( &_v12, 5);
				E10001DD9(0x100048a0, 0x400);
				E10001DD9(0x100044a0, 0x400);
				_t33 = lstrcmpiA( &_v12, "save");
				asm("sbb edi, edi");
				_t55 =  ~_t33 + 1;
				_t34 = GetFileAttributesA(0x100048a0);
				if(_t34 != 0xffffffff && (_t34 & 0x00000010) != 0) {
					lstrcpyA(0x10004ca0, 0x100048a0);
					 *0x100048a0 =  *0x100048a0 & 0x00000000;
					_v44 = 0x10004ca0;
				}
				if( *0x100044a0 == 0) {
					lstrcpyA(0x100044a0, "All Files|*.*");
				}
				_t35 = 0x100044a0;
				if( *0x100044a0 != 0) {
					do {
						if( *_t35 != 0x7c) {
							_t35 = CharNextA(_t35);
						} else {
							 *_t35 =  *_t35 & 0x00000000;
							_t35 =  &(_t35[1]);
						}
					} while ( *_t35 != 0);
				}
				_t35[1] = _t35[1] & 0x00000000;
				GetCurrentDirectoryA(0x400, 0x100040a0);
				_push( &_v88);
				if(_t55 == 0) {
					_t38 = GetOpenFileNameA();
				} else {
					_t38 = GetSaveFileNameA();
				}
				if(_t38 != 0) {
					L19:
					_push(0x100048a0);
				} else {
					if(CommDlgExtendedError() != 0x3002) {
						L20:
						_push(0x10004098);
					} else {
						 *0x100048a0 =  *0x100048a0 & 0x00000000;
						_push( &_v88);
						if(_t55 == 0) {
							_t43 = GetOpenFileNameA();
						} else {
							_t43 = GetSaveFileNameA();
						}
						if(_t43 == 0) {
							goto L20;
						} else {
							goto L19;
						}
					}
				}
				E10001E27();
				return SetCurrentDirectoryA(??);
			}

0x100010fa
0x10001105
0x1000110f
0x10001117
0x1000111f
0x10001127
0x10001135
0x1000113c
0x1000113f
0x10001142
0x10001145
0x1000114c
0x10001153
0x1000115a
0x10001168
0x10001177
0x10001179
0x1000117a
0x10001183
0x10001193
0x10001199
0x100011a0
0x100011a0
0x100011ae
0x100011b6
0x100011b6
0x100011c3
0x100011c5
0x100011c7
0x100011ca
0x100011d3
0x100011cc
0x100011cc
0x100011cf
0x100011cf
0x100011d9
0x100011c7
0x100011de
0x100011e9
0x100011fa
0x100011fb
0x10001205
0x100011fd
0x100011fd
0x100011fd
0x10001209
0x10001235
0x10001235
0x1000120b
0x10001216
0x1000123c
0x1000123c
0x10001218
0x10001218
0x10001224
0x10001225
0x1000122f
0x10001227
0x10001227
0x10001227
0x10001233
0x00000000
0x00000000
0x00000000
0x00000000
0x10001233
0x10001216
0x10001241
0x10001251

APIs

Part of subcall function 10001DD9: lstrcpynA.KERNEL32(10001054,?,?,?,10001054,?), ref: 10001E06
Part of subcall function 10001DD9: GlobalFree.KERNEL32 ref: 10001E16

lstrcmpiA.KERNEL32(?,save), ref: 10001168
GetFileAttributesA.KERNEL32(100048A0), ref: 1000117A
lstrcpyA.KERNEL32(10004CA0,100048A0), ref: 10001193
lstrcpyA.KERNEL32(100044A0,All Files|*.*), ref: 100011B6
CharNextA.USER32(100044A0), ref: 100011D3
GetCurrentDirectoryA.KERNEL32(00000400,100040A0), ref: 100011E9
GetSaveFileNameA.COMDLG32(0000004C), ref: 100011FD
GetOpenFileNameA.COMDLG32(0000004C), ref: 10001205
CommDlgExtendedError.COMDLG32 ref: 1000120B
GetSaveFileNameA.COMDLG32(0000004C), ref: 10001227
GetOpenFileNameA.COMDLG32(0000004C), ref: 1000122F
SetCurrentDirectoryA.KERNEL32(100040A0,100048A0), ref: 10001247

Strings

save, xrefs: 10001162
All Files|*.*, xrefs: 100011B0
L, xrefs: 10001135

Memory Dump Source

Source File: 00000001.00000002.2975197977.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2975169750.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975269413.0000000010003000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975296586.0000000010004000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975376888.0000000010007000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Setup 2.jbxd

Similarity

API ID: File$Name$CurrentDirectoryOpenSavelstrcpy$AttributesCharCommErrorExtendedFreeGlobalNextlstrcmpilstrcpyn
String ID: All Files|*.*$L$save
API String ID: 3853173656-601108453
Opcode ID: f55524211b1bf37b2234b3b11f4be8b4076286c2a7b91c529647de0df39f4d6b
Instruction ID: 169befa61e4bb6e9e145b8173647c2d0c0d502fba5c87e7580c72872a59d520f
Opcode Fuzzy Hash: f55524211b1bf37b2234b3b11f4be8b4076286c2a7b91c529647de0df39f4d6b
Instruction Fuzzy Hash: 9641AEB4901298AFF701DF60DC88BCF7FECEB063D4F528016E605E6199CB7499148B66

Uniqueness

Uniqueness Score: -1.00%

Function 004058EF Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004058EF(void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				intOrPtr _t18;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00405F2D(2);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x42ecd0 =  *0x42ecd0 + 1;
						return _t20;
					}
				}
				 *0x42c250 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x42bcc8, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x42b8c8, "%s=%s\r\n", 0x42c250, 0x42bcc8);
						_t18 =  *0x42ec50; // 0x6d6978
						_t56 = _t55 + 0x10;
						E00405BC3(_t43, 0x400, 0x42bcc8, 0x42bcc8,  *((intOrPtr*)(_t18 + 0x128)));
						_t20 = E00405878(0x42bcc8, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E004057ED(_t51, "[Rename]\r\n") != 0) {
								_t28 = E004057ED(_t26 + 0xa, 0x409404);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E00405839(_t51 + _t29, 0x42b8c8, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E00405BA1(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E00405878(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x42c250, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

0x004058f5
0x004058fc
0x00405900
0x00405909
0x0040590d
0x00405a4c
0x00405a4c
0x00000000
0x00405a4c
0x0040590d
0x00405919
0x0040592f
0x00405957
0x00405962
0x00405966
0x00405986
0x00405988
0x0040598d
0x00405997
0x004059a4
0x004059a9
0x004059ae
0x004059b2
0x00000000
0x00000000
0x004059c1
0x004059c3
0x004059d0
0x004059d4
0x00405a45
0x00405a46
0x00000000
0x004059f0
0x004059fd
0x00405a62
0x00405a69
0x00405a10
0x00405a10
0x00405a12
0x00405a1b
0x00405a26
0x00405a38
0x00405a3f
0x00000000
0x00405a3f
0x00405a6b
0x00405a6c
0x00405a71
0x00405a73
0x00405a80
0x00405a80
0x00405a84
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a75
0x00405a75
0x00405a78
0x00405a7b
0x00405a7c
0x00000000
0x00405a75
0x00405a08
0x00405a0d
0x00000000
0x00405a0d
0x004059d4
0x00405931
0x0040593c
0x00405945
0x00405949
0x00000000
0x00000000
0x00405949
0x00405a56

APIs

Part of subcall function 00405F2D: GetModuleHandleA.KERNEL32(?,?,00000000,00403179,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00405F3F
Part of subcall function 00405F2D: GetProcAddress.KERNEL32(00000000,?), ref: 00405F5A

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000002,?,00000000,?,?,00405684,?,00000000,000000F1,?), ref: 0040593C
GetShortPathNameA.KERNEL32(?,0042C250,00000400), ref: 00405945
GetShortPathNameA.KERNEL32(00000000,0042BCC8,00000400), ref: 00405962
wsprintfA.USER32 ref: 00405980
GetFileSize.KERNEL32(00000000,00000000,0042BCC8,C0000000,00000004,0042BCC8,?,?,?,00000000,000000F1,?), ref: 004059BB
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 004059CA
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 004059E0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,0042B8C8,00000000,-0000000A,00409404,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405A26
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 00405A38
GlobalFree.KERNEL32(00000000), ref: 00405A3F
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405A46

Part of subcall function 004057ED: lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059FB,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057F4
Part of subcall function 004057ED: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059FB,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405824

Strings

xim, xrefs: 00405988
[Rename], xrefs: 004059F0, 00405A02
%s=%s, xrefs: 00405976

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$[Rename]$xim
API String ID: 3445103937-1438981517
Opcode ID: 93dbfb435071f571f0ab808dd2be6fd4af636485bab0aeb09ba325dd39622752
Instruction ID: f45ed1bdfbf8c4b03de67142e423a5701368854c8b403738f0f2c648216b24c4
Opcode Fuzzy Hash: 93dbfb435071f571f0ab808dd2be6fd4af636485bab0aeb09ba325dd39622752
Instruction Fuzzy Hash: D741D471B05B157BD7206B619C89F6B3B5CDF85754F040136F905F62D2EA38E8018EAD

Uniqueness

Uniqueness Score: -1.00%

Function 100014CA Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 202
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E100014CA(struct HWND__* _a4, int _a8, unsigned int _a12, long _a16) {
				struct tagRECT _v20;
				char _v1044;
				int _t62;
				signed int _t66;
				intOrPtr _t75;
				signed int _t76;
				void* _t88;
				void* _t95;
				intOrPtr* _t101;
				struct HWND__* _t102;
				intOrPtr _t105;
				intOrPtr _t106;
				unsigned int _t110;
				void* _t111;
				void* _t115;
				signed int _t117;
				intOrPtr* _t119;
				intOrPtr* _t120;

				_t62 = _a8;
				if(_t62 == 2) {
					_t111 = 0;
					if( *0x100050d4 <= 0) {
						L48:
						return 0;
					}
					_t115 = 0;
					do {
						RemovePropA( *(_t115 +  *0x100050d8), "NSIS: nsControl pointer property");
						_t111 = _t111 + 1;
						_t115 = _t115 + 0x418;
					} while (_t111 <  *0x100050d4);
					goto L48;
				}
				_t101 = _a16;
				if(_t62 == 0x2b) {
					L28:
					_t66 =  *(_t101 + 0x10);
					_a12 = _t66 & 0x00000100;
					_a16 = _t66 & 0x00000200;
					if(E100013C6( *(_t101 + 0x14)) == 0) {
						goto L48;
					}
					asm("movsd");
					asm("movsd");
					_v1044 = _v1044 & 0x00000000;
					asm("movsd");
					asm("movsd");
					GetWindowTextA( *(_t101 + 0x14),  &_v1044, 0x400);
					DrawTextA( *(_t101 + 0x18),  &_v1044, 0xffffffff,  &_v20, 0x414);
					_t105 =  *((intOrPtr*)(_t101 + 0x24));
					_t75 = _v20.right + 2;
					_v20.right = _t75;
					if(_t75 >= _t105) {
						_v20.right = _t105;
					}
					_t76 =  *0x100050cc;
					if(_t76 != 0) {
						_v20.right = _t105;
						_v20.left = _v20.left + _t105 - _v20.right;
					}
					if(( *(_t101 + 0xc) & 0x00000001) != 0) {
						asm("sbb eax, eax");
						_t117 =  ~_t76 & 0x00020000;
						if(_a12 != 0) {
							_t117 = _t117 | 0x00100000;
						}
						if(GetWindowLongA( *(_t101 + 0x14), 0xffffffeb) == 0) {
							SetTextColor( *(_t101 + 0x18), 0xff0000);
						}
						DrawTextA( *(_t101 + 0x18),  &_v1044, 0xffffffff,  &_v20, _t117 | 0x00000015);
					}
					if(( *(_t101 + 0x10) & 0x00000010) == 0 || ( *(_t101 + 0xc) & 0x00000001) == 0) {
						if(( *(_t101 + 0xc) & 0x00000004) == 0) {
							goto L44;
						}
						goto L42;
					} else {
						L42:
						if(_a16 == 0) {
							DrawFocusRect( *(_t101 + 0x18),  &_v20);
						}
						L44:
						return 1;
					}
				}
				if(_t62 == 0x4e) {
					_t88 = E100013C6( *_t101);
					if(_t88 == 0) {
						goto L48;
					}
					_t16 = _t88 + 0x410; // 0x410
					_t119 = _t16;
					if( *_t119 == 0) {
						goto L48;
					}
					L10002016();
					L10002016();
					L10002016();
					 *((intOrPtr*)( *0x100050a0 + 4))( *_t119 - 1, 0,  *_t101,  *((intOrPtr*)(_t101 + 8)), _t101);
					goto L28;
				}
				if(_t62 == 0x111) {
					_t102 = GetDlgItem(_a4, _a12 & 0x0000ffff);
					_t95 = E100013C6(_t102);
					if(_t95 == 0) {
						goto L48;
					}
					_t110 = _a12 >> 0x10;
					if(_t110 != 0) {
						L12:
						if(_t110 != 0x300 ||  *((intOrPtr*)(_t95 + 4)) != 2) {
							if(_t110 != 1 ||  *((intOrPtr*)(_t95 + 4)) != 4) {
								if(_t110 == 6 || _t110 == 1) {
									if( *((intOrPtr*)(_t95 + 4)) != 3) {
										goto L22;
									}
									goto L19;
								} else {
									L22:
									if(_t110 != 0 ||  *((intOrPtr*)(_t95 + 4)) != 7) {
										goto L48;
									} else {
										L24:
										_t15 = _t95 + 0x408; // 0x408
										_t120 = _t15;
										goto L20;
									}
								}
							} else {
								goto L19;
							}
						} else {
							L19:
							_t12 = _t95 + 0x40c; // 0x40c
							_t120 = _t12;
							L20:
							if( *_t120 != 0) {
								L10002016();
								 *((intOrPtr*)( *0x100050a0 + 4))( *_t120 - 1, 0, _t102);
							}
							goto L48;
						}
					}
					_t106 =  *((intOrPtr*)(_t95 + 4));
					if(_t106 == 1 || _t106 == 8) {
						goto L24;
					} else {
						goto L12;
					}
				}
				if(_t62 > 0x132 && (_t62 <= 0x136 || _t62 == 0x138)) {
					return SendMessageA( *0x100050c4, _t62, _a12, _a16);
				}
				goto L48;
			}

0x100014d3
0x100014dc
0x10001722
0x1000172a
0x10001750
0x00000000
0x10001750
0x1000172c
0x1000172e
0x1000173b
0x10001741
0x10001742
0x10001748
0x00000000
0x1000172e
0x100014e2
0x100014e8
0x10001618
0x10001618
0x1000162b
0x1000162e
0x10001638
0x00000000
0x00000000
0x10001644
0x10001645
0x10001646
0x10001653
0x1000165d
0x1000165e
0x1000167f
0x10001684
0x10001687
0x1000168c
0x1000168f
0x10001691
0x10001691
0x10001694
0x1000169b
0x100016a2
0x100016a5
0x100016a5
0x100016ac
0x100016b0
0x100016bb
0x100016bd
0x100016bf
0x100016bf
0x100016d2
0x100016dc
0x100016dc
0x100016f6
0x100016f6
0x100016fc
0x10001708
0x00000000
0x00000000
0x00000000
0x1000170a
0x1000170a
0x1000170e
0x10001717
0x10001717
0x1000171d
0x00000000
0x1000171f
0x100016fc
0x100014f1
0x100015d9
0x100015e0
0x00000000
0x00000000
0x100015e6
0x100015e6
0x100015ef
0x00000000
0x00000000
0x100015f6
0x100015fe
0x10001605
0x10001615
0x00000000
0x10001615
0x100014fc
0x10001541
0x10001544
0x1000154d
0x00000000
0x00000000
0x10001556
0x1000155c
0x1000156b
0x10001570
0x1000157c
0x10001588
0x10001594
0x00000000
0x00000000
0x00000000
0x100015bc
0x100015bc
0x100015bf
0x00000000
0x100015cf
0x100015cf
0x100015cf
0x100015cf
0x00000000
0x100015cf
0x100015bf
0x00000000
0x00000000
0x00000000
0x10001596
0x10001596
0x10001596
0x10001596
0x1000159c
0x1000159e
0x100015a5
0x100015b4
0x100015b4
0x00000000
0x1000159e
0x10001570
0x1000155e
0x10001564
0x00000000
0x00000000
0x00000000
0x00000000
0x10001564
0x10001503
0x00000000
0x10001528
0x00000000

APIs

SendMessageA.USER32(?,?,?), ref: 10001528
GetDlgItem.USER32(?,?), ref: 1000153B
GetWindowTextA.USER32(?,00000000,00000400), ref: 1000165E
DrawTextA.USER32(?,00000000,000000FF,?,00000414), ref: 1000167F
GetWindowLongA.USER32(?,000000EB), ref: 100016CA
SetTextColor.GDI32(?,00FF0000), ref: 100016DC
DrawTextA.USER32(?,00000000,000000FF,00000000,?), ref: 100016F6
DrawFocusRect.USER32(?,00000010), ref: 10001717
RemovePropA.USER32(00000000,NSIS: nsControl pointer property), ref: 1000173B

Strings

NSIS: nsControl pointer property, xrefs: 10001733

Memory Dump Source

Source File: 00000001.00000002.2975197977.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2975169750.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975269413.0000000010003000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975296586.0000000010004000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975376888.0000000010007000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Setup 2.jbxd

Similarity

API ID: Text$Draw$Window$ColorFocusItemLongMessagePropRectRemoveSend
String ID: NSIS: nsControl pointer property
API String ID: 2331901045-1714965683
Opcode ID: 795539084cf330eec5e8b4e994aee0748164e649e5a27d0bddbade90649883ef
Instruction ID: 8ef9ef8b2d6220626c055da3ff7f881bf8cdfea496c57b30b7552a7efb72e642
Opcode Fuzzy Hash: 795539084cf330eec5e8b4e994aee0748164e649e5a27d0bddbade90649883ef
Instruction Fuzzy Hash: 95717A7090461A9BFB11CF64CC84BEA7BFAFB443C1F518565E905AA1AEC771DC80CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00405E03 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E03(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E00405701(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E004056BF("*?|<>/\":", _t5))) == 0) {
							E00405839(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00405e05
0x00405e0d
0x00405e21
0x00405e21
0x00405e27
0x00405e34
0x00405e34
0x00405e35
0x00405e37
0x00405e3b
0x00405e3d
0x00405e46
0x00405e48
0x00405e62
0x00405e6a
0x00405e6a
0x00405e6f
0x00405e71
0x00405e73
0x00405e77
0x00405e78
0x00405e7b
0x00405e83
0x00405e85
0x00405e89
0x00000000
0x00000000
0x00405e8f
0x00405e94
0x00000000
0x00000000
0x00000000
0x00405e94
0x00405e99

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Setup 2.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E5B
CharNextA.USER32(?,?,?,00000000), ref: 00405E68
CharNextA.USER32(?,"C:\Users\user\Desktop\Setup 2.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E6D
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E7D

Strings

"C:\Users\user\Desktop\Setup 2.exe" , xrefs: 00405E3F
*?|<>/":, xrefs: 00405E4B
C:\Users\user\AppData\Local\Temp\, xrefs: 00405E04, 00405E09

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Setup 2.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2276748018
Opcode ID: 3b5f3268fa1fae19e58d0ad2ced72642c676bfd811e2c7a6988a98807c9a22ca
Instruction ID: 8c0debaa59703488c7458a94fa91a8896e4240cf3d31b331365b77cfd974a1c9
Opcode Fuzzy Hash: 3b5f3268fa1fae19e58d0ad2ced72642c676bfd811e2c7a6988a98807c9a22ca
Instruction Fuzzy Hash: 4E11B671804A912DEB3217289C44B777FC8CB66790F18447BD4D5723C2D67C5D428AAD

Uniqueness

Uniqueness Score: -1.00%

Function 02AB25FE Relevance: 12.1, APIs: 8, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E02AB25FE(void* __edx, intOrPtr* _a4) {
				char _v80;
				intOrPtr _v84;
				char _v92;
				intOrPtr* _t20;
				intOrPtr _t23;
				void* _t25;
				CHAR* _t26;
				void* _t27;
				void* _t32;
				void* _t34;
				void* _t36;
				intOrPtr _t38;
				void* _t41;
				intOrPtr _t42;
				void* _t44;
				char* _t45;
				int _t48;
				int _t49;
				void* _t53;
				intOrPtr _t54;
				CHAR** _t57;
				CHAR** _t58;
				void* _t59;
				void* _t60;

				_t53 = __edx;
				_t60 =  &_v84;
				_t20 = _a4;
				_t54 =  *((intOrPtr*)(_t20 + 0x814));
				_v84 = _t54;
				_t57 = (_t54 + 0x41 << 5) + _t20;
				do {
					if( *((intOrPtr*)(_t57 - 4)) != 0xffffffff) {
						_t58 = _t57;
					} else {
						_t58 =  *_t57;
					}
					_t59 = E02AB1541();
					_t48 = 0;
					_t23 =  *((intOrPtr*)(_t57 - 8));
					if(_t23 == 0) {
						lstrcpyA(_t59, 0x2ab4034);
					} else {
						_t32 = _t23 - 1;
						if(_t32 == 0) {
							_push( *_t58);
							goto L12;
						} else {
							_t34 = _t32 - 1;
							if(_t34 == 0) {
								E02AB176C(_t53,  *_t58, _t58[1], _t59);
								goto L13;
							} else {
								_t36 = _t34 - 1;
								if(_t36 == 0) {
									_t49 = lstrlenA( *_t58);
									_t38 =  *0x2ab4058;
									if(_t49 >= _t38) {
										_t49 = _t38 - 1;
									}
									_t9 = _t49 + 1; // 0x1
									lstrcpynA(_t59,  *_t58, _t9);
									 *(_t49 + _t59) =  *(_t49 + _t59) & 0x00000000;
									_t48 = 0;
								} else {
									_t41 = _t36 - 1;
									if(_t41 == 0) {
										_t42 =  *0x2ab4058;
										_push(0);
										_push(0);
										_push(_t42);
										_push(_t59);
										_push(_t42);
										_push( *_t58);
										goto L16;
									} else {
										_t44 = _t41 - 1;
										if(_t44 == 0) {
											_t45 =  &_v80;
											__imp__StringFromGUID2( *_t58, _t45, 0x27);
											_push(0);
											_push(0);
											_push( *0x2ab4058);
											_push(_t59);
											_push(_t45);
											_push( &_v92);
											L16:
											WideCharToMultiByte(_t48, _t48, ??, ??, ??, ??, ??, ??);
										} else {
											if(_t44 == 1) {
												_push( *_t57);
												L12:
												wsprintfA(_t59, 0x2ab4008);
												L13:
												_t60 = _t60 + 0xc;
											}
										}
									}
								}
							}
						}
					}
					_t25 = _t57[5];
					if(_t25 != _t48 && ( *_a4 != 2 ||  *((intOrPtr*)(_t57 - 4)) > _t48)) {
						GlobalFree(_t25);
					}
					_t26 = _t57[4];
					if(_t26 != _t48) {
						if(_t26 != 0xffffffff) {
							if(_t26 > _t48) {
								E02AB160E(_t26 - 1, _t59);
								goto L32;
							}
						} else {
							E02AB159E(_t59);
							L32:
						}
					}
					_t27 = GlobalFree(_t59);
					_v84 = _v84 - 1;
					_t57 = _t57 - 0x20;
				} while (_v84 >= _t48);
				return _t27;
			}

0x02ab25fe
0x02ab25fe
0x02ab2601
0x02ab2609
0x02ab260f
0x02ab2619
0x02ab261b
0x02ab261f
0x02ab2625
0x02ab2621
0x02ab2621
0x02ab2621
0x02ab262c
0x02ab2631
0x02ab2633
0x02ab2635
0x02ab26ea
0x02ab263b
0x02ab263b
0x02ab263c
0x02ab26dd
0x00000000
0x02ab2642
0x02ab2642
0x02ab2643
0x02ab26d6
0x00000000
0x02ab2649
0x02ab2649
0x02ab264a
0x02ab26ad
0x02ab26af
0x02ab26b6
0x02ab26b8
0x02ab26b8
0x02ab26bb
0x02ab26c2
0x02ab26c8
0x02ab26cc
0x02ab264c
0x02ab264c
0x02ab264d
0x02ab268f
0x02ab2694
0x02ab2695
0x02ab2696
0x02ab2697
0x02ab2698
0x02ab2699
0x00000000
0x02ab264f
0x02ab264f
0x02ab2650
0x02ab266f
0x02ab2678
0x02ab267e
0x02ab267f
0x02ab2680
0x02ab2686
0x02ab2687
0x02ab268c
0x02ab269b
0x02ab269d
0x02ab2652
0x02ab2653
0x02ab2659
0x02ab265b
0x02ab2661
0x02ab2667
0x02ab2667
0x02ab2667
0x02ab2653
0x02ab2650
0x02ab264d
0x02ab264a
0x02ab2643
0x02ab263c
0x02ab26f0
0x02ab26f5
0x02ab2706
0x02ab2706
0x02ab270c
0x02ab2711
0x02ab2716
0x02ab2722
0x02ab2727
0x00000000
0x02ab272c
0x02ab2718
0x02ab2719
0x02ab272d
0x02ab272d
0x02ab2716
0x02ab272f
0x02ab2735
0x02ab2739
0x02ab273c
0x02ab274d

APIs

wsprintfA.USER32 ref: 02AB2661
StringFromGUID2.OLE32(?,?,00000027,?,?,?,00000000), ref: 02AB2678
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000,?,?,?,00000000), ref: 02AB269D

Part of subcall function 02AB160E: lstrcpyA.KERNEL32(-02AB4047,00000000,?,02AB118F,?,00000000), ref: 02AB1636

GlobalFree.KERNEL32(?), ref: 02AB2706
GlobalFree.KERNEL32(00000000), ref: 02AB272F

Memory Dump Source

Source File: 00000001.00000002.2972899107.0000000002AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 02AB0000, based on PE: true

Associated: 00000001.00000002.2972852006.0000000002AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2972964416.0000000002AB3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2973006111.0000000002AB5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2ab0000_Setup 2.jbxd

Similarity

API ID: FreeGlobal$ByteCharFromMultiStringWidelstrcpywsprintf
String ID:
API String ID: 3910409330-0
Opcode ID: da538405756c11ee605119921f19c660d73f26949545baeff4004a5297ae8e73
Instruction ID: bee99c31f3e14c8000e3646b6ecceddd51fd024b38b718752a4ecbd3d65e92dc
Opcode Fuzzy Hash: da538405756c11ee605119921f19c660d73f26949545baeff4004a5297ae8e73
Instruction Fuzzy Hash: 7C41C271944209EFDB239F60D9D4AA6BBBDFF08394B000926FD4682153CF35AC55CB25

Uniqueness

Uniqueness Score: -1.00%

Function 00403EC4 Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403EC4(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x00403ed6
0x00403f6a
0x00000000
0x00403f6a
0x00403ee7
0x00403eeb
0x00000000
0x00000000
0x00403ef1
0x00403efa
0x00403efd
0x00403efd
0x00403f03
0x00403f09
0x00403f09
0x00403f15
0x00403f1b
0x00403f22
0x00403f25
0x00403f28
0x00403f2a
0x00403f2a
0x00403f32
0x00403f38
0x00403f38
0x00403f42
0x00403f47
0x00403f4a
0x00403f4f
0x00403f52
0x00403f52
0x00403f62
0x00403f62
0x00000000

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403EE1
GetSysColor.USER32(00000000), ref: 00403EFD
SetTextColor.GDI32(?,00000000), ref: 00403F09
SetBkMode.GDI32(?,?), ref: 00403F15
GetSysColor.USER32(?), ref: 00403F28
SetBkColor.GDI32(?,?), ref: 00403F38
DeleteObject.GDI32(?), ref: 00403F52
CreateBrushIndirect.GDI32(?), ref: 00403F5C

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 244050047767258f024cc5d970fbc24e44c9485df9f09a7a1d92820c249c5868
Instruction ID: 0d89a351d513fb24bb3d4bb4099581c898fc75933690e96f4850fc1bb23eeaf2
Opcode Fuzzy Hash: 244050047767258f024cc5d970fbc24e44c9485df9f09a7a1d92820c249c5868
Instruction Fuzzy Hash: 91214271904745ABCB219F78DD08B4B7FF8AF05715B048629F995A22E0D734E9048B65

Uniqueness

Uniqueness Score: -1.00%

Function 02AB2440 Relevance: 10.6, APIs: 7, Instructions: 136
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E02AB2440(void* __edx, intOrPtr _a4) {
				signed int _v4;
				CHAR* _t32;
				intOrPtr _t33;
				void* _t34;
				void* _t36;
				void* _t43;
				void** _t49;
				CHAR* _t58;
				void* _t59;
				signed int* _t60;
				void* _t61;
				intOrPtr* _t62;
				CHAR* _t63;
				void* _t73;

				_t59 = __edx;
				_v4 = 0 |  *((intOrPtr*)(_a4 + 0x814)) > 0x00000000;
				while(1) {
					_t9 = _a4 + 0x818; // 0x818
					_t62 = (_v4 << 5) + _t9;
					_t32 =  *(_t62 + 0x14);
					if(_t32 == 0) {
						goto L9;
					}
					_t58 = 0x1a;
					if(_t32 == _t58) {
						goto L9;
					}
					if(_t32 != 0xffffffff) {
						if(_t32 <= 0 || _t32 > 0x19) {
							 *(_t62 + 0x14) = _t58;
						} else {
							_t32 = E02AB15E5(_t32 - 1);
							L10:
						}
						goto L11;
					} else {
						_t32 = E02AB1561();
						L11:
						_t63 = _t32;
						_t13 = _t62 + 8; // 0x820
						_t60 = _t13;
						if( *((intOrPtr*)(_t62 + 4)) != 0xffffffff) {
							_t49 = _t60;
						} else {
							_t49 =  *_t60;
						}
						_t33 =  *_t62;
						 *(_t62 + 0x1c) =  *(_t62 + 0x1c) & 0x00000000;
						if(_t33 == 0) {
							 *_t60 =  *_t60 & 0x00000000;
						} else {
							if(_t33 == 1) {
								_t36 = E02AB1641(_t63);
								L27:
								 *_t49 = _t36;
								L31:
								_t34 = GlobalFree(_t63);
								if(_v4 == 0) {
									return _t34;
								}
								if(_v4 !=  *((intOrPtr*)(_a4 + 0x814))) {
									_v4 = _v4 + 1;
								} else {
									_v4 = _v4 & 0x00000000;
								}
								continue;
							}
							if(_t33 == 2) {
								 *_t49 = E02AB1641(_t63);
								_t49[1] = _t59;
								goto L31;
							}
							_t73 = _t33 - 3;
							if(_t73 == 0) {
								_t36 = E02AB1550(_t63);
								 *(_t62 + 0x1c) = _t36;
								goto L27;
							}
							if(_t73 > 0) {
								if(_t33 <= 5) {
									_t61 = GlobalAlloc(0x40,  *0x2ab4058 +  *0x2ab4058);
									 *(_t62 + 0x1c) = _t61;
									MultiByteToWideChar(0, 0, _t63,  *0x2ab4058, _t61,  *0x2ab4058);
									if( *_t62 != 5) {
										 *_t49 = _t61;
									} else {
										_t43 = GlobalAlloc(0x40, 0x10);
										 *(_t62 + 0x1c) = _t43;
										 *_t49 = _t43;
										__imp__CLSIDFromString(_t61, _t43);
										GlobalFree(_t61);
									}
								} else {
									if(_t33 == 6 && lstrlenA(_t63) > 0) {
										 *_t60 = E02AB274E(E02AB1641(_t63));
									}
								}
							}
						}
						goto L31;
					}
					L9:
					_t32 = E02AB1550(0x2ab4034);
					goto L10;
				}
			}

0x02ab2440
0x02ab2454
0x02ab2458
0x02ab2463
0x02ab2463
0x02ab246a
0x02ab246f
0x00000000
0x00000000
0x02ab2473
0x02ab2476
0x00000000
0x00000000
0x02ab247b
0x02ab2486
0x02ab2496
0x02ab248d
0x02ab248f
0x02ab24a5
0x02ab24a5
0x00000000
0x02ab247d
0x02ab247d
0x02ab24a6
0x02ab24aa
0x02ab24ac
0x02ab24ac
0x02ab24af
0x02ab24b5
0x02ab24b1
0x02ab24b1
0x02ab24b1
0x02ab24b7
0x02ab24b9
0x02ab24bf
0x02ab258a
0x02ab24c5
0x02ab24c8
0x02ab2583
0x02ab256f
0x02ab2570
0x02ab258d
0x02ab258e
0x02ab2599
0x02ab25c3
0x02ab25c3
0x02ab25a9
0x02ab25b5
0x02ab25ab
0x02ab25ab
0x02ab25ab
0x00000000
0x02ab25a9
0x02ab24d1
0x02ab257b
0x02ab257d
0x00000000
0x02ab257d
0x02ab24d7
0x02ab24da
0x02ab2567
0x02ab256c
0x00000000
0x02ab256c
0x02ab24e0
0x02ab24e9
0x02ab2525
0x02ab2527
0x02ab2537
0x02ab2540
0x02ab2562
0x02ab2542
0x02ab2546
0x02ab254d
0x02ab2551
0x02ab2553
0x02ab255a
0x02ab255a
0x02ab24eb
0x02ab24ee
0x02ab2510
0x02ab2512
0x02ab24ee
0x02ab24e9
0x02ab24e0
0x00000000
0x02ab24bf
0x02ab249b
0x02ab24a0
0x00000000
0x02ab24a0

APIs

lstrlenA.KERNEL32(?), ref: 02AB24F5
GlobalAlloc.KERNEL32(00000040,?), ref: 02AB251F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 02AB2537
GlobalAlloc.KERNEL32(00000040,00000010), ref: 02AB2546
CLSIDFromString.OLE32(00000000,00000000), ref: 02AB2553
GlobalFree.KERNEL32(00000000), ref: 02AB255A
GlobalFree.KERNEL32(00000000), ref: 02AB258E

Part of subcall function 02AB1550: lstrcpyA.KERNEL32(00000000,?,02AB1607,?,02AB11A1,-000000A0), ref: 02AB155A

Memory Dump Source

Source File: 00000001.00000002.2972899107.0000000002AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 02AB0000, based on PE: true

Associated: 00000001.00000002.2972852006.0000000002AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2972964416.0000000002AB3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2973006111.0000000002AB5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2ab0000_Setup 2.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpylstrlen
String ID:
API String ID: 520554397-0
Opcode ID: 1fd1129d19f91acba99b44f2636d1730aca427eb5efb71283056c4eaa2f08aee
Instruction ID: e7de4ebd38107e85fc263e92d2209a4099cd1b5194138427e5c45740f930053e
Opcode Fuzzy Hash: 1fd1129d19f91acba99b44f2636d1730aca427eb5efb71283056c4eaa2f08aee
Instruction Fuzzy Hash: 13418F71544205DFD7229F2488A4BAA77FCFF44311F104A1BE94ACA593DF74D581CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00402692 Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00402692(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *((intOrPtr*)(_t58 - 0xc)) = 0xfffffd66;
				_t52 = E00402A0C(0xfffffff0);
				 *(_t58 - 0x38) = _t24;
				if(E00405701(_t52) == 0) {
					E00402A0C(0xffffffed);
				}
				E00405859(_t52);
				_t27 = E00405878(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x42ec54; // 0x9e00
					 *(_t58 - 0x30) = _t32;
					_t51 = GlobalAlloc(0x40, _t32);
					if(_t51 != _t47) {
						E004030C5(_t47);
						E00403093(_t51,  *(_t58 - 0x30));
						_t56 = GlobalAlloc(0x40,  *(_t58 - 0x20));
						 *(_t58 - 0x34) = _t56;
						if(_t56 != _t47) {
							E00402E71( *((intOrPtr*)(_t58 - 0x24)), _t47, _t56,  *(_t58 - 0x20));
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x48) =  *_t56;
								E00405839( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x48);
							}
							GlobalFree( *(_t58 - 0x34));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x30), _t58 - 0x3c, _t47);
						GlobalFree(_t51);
						 *((intOrPtr*)(_t58 - 0xc)) = E00402E71(0xffffffff,  *(_t58 + 8), _t47, _t47);
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *((intOrPtr*)(_t58 - 0xc)) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x38));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

0x00402692
0x00402694
0x004026a0
0x004026a3
0x004026ad
0x004026b1
0x004026b1
0x004026b7
0x004026c4
0x004026cc
0x004026cf
0x004026d5
0x004026e3
0x004026e8
0x004026ec
0x004026ef
0x004026f8
0x00402704
0x00402708
0x0040270b
0x00402715
0x00402734
0x0040271c
0x00402721
0x00402729
0x0040272c
0x00402731
0x00402731
0x0040273b
0x0040273b
0x0040274d
0x00402754
0x00402766
0x00402766
0x0040276c
0x0040276c
0x00402777
0x00402778
0x0040277c
0x00402780
0x00402786
0x00402786
0x0040278d
0x0040217a
0x004028a4
0x004028b0

APIs

GlobalAlloc.KERNEL32(00000040,00009E00,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004026E6
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402702
GlobalFree.KERNEL32(?), ref: 0040273B
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,000000F0), ref: 0040274D
GlobalFree.KERNEL32(00000000), ref: 00402754
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040276C
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402780

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 9c2b519bab710da34c4f93b0ba9d6d86cd7c01b4cb3bb32b5413ac78432567f7
Instruction ID: 5b53ae4c2b613e87b8af51cb2b1d5881ebc53a54f05e9f53cd44442d287e2222
Opcode Fuzzy Hash: 9c2b519bab710da34c4f93b0ba9d6d86cd7c01b4cb3bb32b5413ac78432567f7
Instruction Fuzzy Hash: 3131A971C00128BBCF216FA5CE88DAE7F79EF05364F10423AF920762E1C67949408FA9

Uniqueness

Uniqueness Score: -1.00%

Function 004038BD Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038BD(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				intOrPtr _t15;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405B18(__ecx, "1033");
				while(1) {
					_t26 =  *0x42ec84; // 0x1
					if(_t26 == 0) {
						goto L7;
					}
					_t15 =  *0x42ec50; // 0x6d6978
					_t16 =  *(_t15 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x42ec80;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x42e420 = _t18[1];
					 *0x42ece8 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42e41c = _t23;
						E00405AFF(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x42a098, E00405BC3(_t13, _t24, _t26, "Fast! Setup", 0xfffffffe));
						_t11 =  *0x42ec6c; // 0x1
						_t27 =  *0x42ec68; // 0x6d6b64
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t5 = _t27 + 0x18; // 0x6d6b7c
								_t11 = E00405BC3(_t13, _t25, _t27, _t5, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

0x004038c1
0x004038c6
0x004038cc
0x004038d1
0x004038d1
0x004038d9
0x00000000
0x00000000
0x004038db
0x004038e1
0x004038e9
0x004038eb
0x004038f1
0x004038f1
0x004038f3
0x004038ff
0x00000000
0x00000000
0x00403903
0x00000000
0x00000000
0x00000000
0x00403905
0x0040390a
0x00403913
0x00403919
0x0040391e
0x00403932
0x0040393d
0x00403955
0x0040395b
0x00403960
0x00403968
0x00403989
0x00403989
0x00403989
0x0040396a
0x0040396c
0x0040396c
0x00403970
0x00403973
0x00403977
0x00403977
0x0040397c
0x00403982
0x00403982
0x00000000
0x0040396c
0x00403920
0x00403925
0x0040392e
0x00403927
0x00403927
0x00403927
0x00403925

APIs

SetWindowTextA.USER32(00000000,Fast! Setup), ref: 00403955

Strings

1033, xrefs: 004038C1, 004038CB, 0040393C
xim, xrefs: 004038DB
"C:\Users\user\Desktop\Setup 2.exe" , xrefs: 004038BE
dkm, xrefs: 00403960
Fast! Setup, xrefs: 00403944

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\Setup 2.exe" $1033$Fast! Setup$dkm$xim
API String ID: 530164218-319837467
Opcode ID: 5c55cf1dc77012d7b49c2afc24761aa4d87cc513fcd06e13f885861062bacd8d
Instruction ID: 93100a74eb761491cad5589d5ba72450eee8ba09b7e289b8bdcf135b4c9a781b
Opcode Fuzzy Hash: 5c55cf1dc77012d7b49c2afc24761aa4d87cc513fcd06e13f885861062bacd8d
Instruction Fuzzy Hash: A611F071B006108BC730EF56DC80A773BACEB85715368813BA801A73A0CA39AD028B9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040475C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040475C(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x0040476a
0x00404777
0x0040477d
0x004047bb
0x004047bb
0x004047ca
0x004047d1
0x00000000
0x004047d3
0x0040477f
0x0040478e
0x00404796
0x00404799
0x004047ab
0x004047b1
0x004047b8
0x00000000
0x004047b8
0x00000000

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404777
GetMessagePos.USER32 ref: 0040477F
ScreenToClient.USER32(?,?), ref: 00404799
SendMessageA.USER32(?,00001111,00000000,?), ref: 004047AB
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004047D1

Strings

f, xrefs: 004047AD

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b999d07b324019c2219c33d3107ce818a81de0efbbfc0766a2ac4245d0efef5f
Instruction ID: 1287270e3ce35f4bc81f554f3193770291cde8f8b01dc106229a8c11fbd36195
Opcode Fuzzy Hash: b999d07b324019c2219c33d3107ce818a81de0efbbfc0766a2ac4245d0efef5f
Instruction Fuzzy Hash: 99014071D00219BADB01DBA4DD85FFEBBFCAB59711F10412BBA10B72C0D7B465018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B51 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B51(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x414c60; // 0x1f606
					_t11 =  *0x428c70; // 0x22cc8
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b5e
0x00402b6c
0x00402b72
0x00402b72
0x00402b80
0x00402b82
0x00402b88
0x00402b8f
0x00402b91
0x00402b91
0x00402ba7
0x00402bb7
0x00402bc9
0x00402bc9
0x00402bd1

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B6C
MulDiv.KERNEL32(0001F606,00000064,00022CC8), ref: 00402B97
wsprintfA.USER32 ref: 00402BA7
SetWindowTextA.USER32(?,?), ref: 00402BB7
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BC9

Strings

verifying installer: %d%%, xrefs: 00402BA1

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: f4b40b60170e557e8e64fd1007bdae5203f411c8eb827d09f08439ceb1717922
Instruction ID: 170251b52dccb1bc1045efc101099eb7df8550efa5a7238432f4f3ca5a85e13a
Opcode Fuzzy Hash: f4b40b60170e557e8e64fd1007bdae5203f411c8eb827d09f08439ceb1717922
Instruction Fuzzy Hash: C501F470644209BBDB209F61DD49EED3779AB44305F008039FA06B52D0D7B599558F95

Uniqueness

Uniqueness Score: -1.00%

Function 00402319 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00402319(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				char _t24;
				int _t27;
				signed int _t30;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402B01(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x18));
				 *(_t37 - 0x34) =  *(_t37 - 0x14);
				 *(_t37 - 0x38) = E00402A0C(2);
				_t18 = E00402A0C(0x11);
				_t30 =  *0x42ecf0; // 0x0
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27, _t30 | 0x00000002, _t27, _t37 + 8, _t27);
				if(_t19 == 0) {
					if(_t35 == 1) {
						E00402A0C(0x23);
						_t19 = lstrlenA(0x40a460) + 1;
					}
					if(_t35 == 4) {
						_t24 = E004029EF(3);
						 *0x40a460 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402E71( *((intOrPtr*)(_t37 - 0x1c)), _t27, 0x40a460, 0xc00);
					}
					if(RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x38), _t27,  *(_t37 - 0x34), 0x40a460, _t19) == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x42ecc8 =  *0x42ecc8 +  *(_t37 - 4);
				return 0;
			}

0x0040231a
0x0040231f
0x00402329
0x00402333
0x00402336
0x00402340
0x00402350
0x00402357
0x0040235f
0x0040236d
0x00402371
0x0040237c
0x0040237c
0x00402380
0x00402384
0x0040238a
0x0040238f
0x0040238f
0x00402393
0x0040239f
0x0040239f
0x004023b8
0x004023ba
0x004023ba
0x004023bd
0x00402493
0x00402493
0x004028a4
0x004028b0

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402357
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsyD27B.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402377
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsyD27B.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004023B0
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsyD27B.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402493

Strings

C:\Users\user\AppData\Local\Temp\nsyD27B.tmp, xrefs: 00402368, 0040238A, 0040239A, 004023A5

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp
API String ID: 1356686001-3699871828
Opcode ID: 61935974622c5da474b5e029e75e3e8e17383666ee19cd5a5b43de79f1f0482f
Instruction ID: 87e3eab27a64c54b83edf31c6fc5fb34a185908cb1e9cfdfcb2c5e910e3a0e9b
Opcode Fuzzy Hash: 61935974622c5da474b5e029e75e3e8e17383666ee19cd5a5b43de79f1f0482f
Instruction Fuzzy Hash: 74116371E00108BEEB10EFB5DE89EAF7A79EB50358F10403AF905B61D1D6B85D019A69

Uniqueness

Uniqueness Score: -1.00%

Function 10001021 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E10001021(void* __eflags, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				char* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char* _v24;
				char* _v28;
				signed int _v32;
				char _v36;
				char _v296;
				char _v556;
				char _v1580;
				char* _t35;
				char* _t36;
				void* _t37;
				char* _t39;

				 *0x100050dc = _a8;
				 *0x100050e0 = _a16;
				 *0x100050e4 = _a12;
				if(E10001DD9( &_v1580, 0x104) != 0 || E10001DD9( &_v556, 0x400) != 0) {
					L3:
					return E10001E27("error");
				} else {
					_v32 = _v32 & 0x00000000;
					_v36 = _a4;
					_v28 =  &_v296;
					_v8 = _v8 & 0x00000000;
					_v24 =  &_v1580;
					_v20 = 0x45;
					_v12 =  &_v556;
					_t35 =  &_v36;
					_v16 = E10001000;
					__imp__SHBrowseForFolderA(_t35);
					_t39 = _t35;
					if(_t39 != 0) {
						_t36 =  &_v296;
						__imp__SHGetPathFromIDListA(_t39, _t36);
						if(_t36 == 0) {
							_push("error");
						} else {
							_push( &_v296);
						}
						_t37 = E10001E27();
						__imp__CoTaskMemFree();
						return _t37;
					}
					goto L3;
				}
			}

0x1000102e
0x10001036
0x1000103e
0x10001056
0x100010b4
0x00000000
0x1000106d
0x10001070
0x10001074
0x1000107d
0x10001086
0x1000108a
0x10001093
0x1000109a
0x1000109d
0x100010a1
0x100010a8
0x100010ae
0x100010b2
0x100010c0
0x100010c8
0x100010d0
0x100010db
0x100010d2
0x100010d8
0x100010d8
0x100010e0
0x100010e6
0x00000000
0x100010e6
0x00000000
0x100010b2

APIs

Part of subcall function 10001DD9: lstrcpynA.KERNEL32(10001054,?,?,?,10001054,?), ref: 10001E06
Part of subcall function 10001DD9: GlobalFree.KERNEL32 ref: 10001E16

SHBrowseForFolderA.SHELL32(?,?,00000400,?,00000104), ref: 100010A8
SHGetPathFromIDListA.SHELL32(00000000,?), ref: 100010C8
CoTaskMemFree.OLE32(00000000,error), ref: 100010E6

Strings

E, xrefs: 10001093
error, xrefs: 100010B4, 100010DB

Memory Dump Source

Source File: 00000001.00000002.2975197977.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2975169750.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975269413.0000000010003000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975296586.0000000010004000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975376888.0000000010007000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Setup 2.jbxd

Similarity

API ID: Free$BrowseFolderFromGlobalListPathTasklstrcpyn
String ID: E$error
API String ID: 1728609016-2359134700
Opcode ID: e1a7eb802c3a0e6178e2f854ce9366eb71ade3bb25b89a52586c1a3f4d4a4e58
Instruction ID: c5b31664aa199b9ded98f2e5680432c5be8bc3db31d95fa12b81e091e202fa71
Opcode Fuzzy Hash: e1a7eb802c3a0e6178e2f854ce9366eb71ade3bb25b89a52586c1a3f4d4a4e58
Instruction Fuzzy Hash: AE214DB58012699BEB11CF91DD85BDE77FCEB083C1F004152EA45E7108EB75EA848F91

Uniqueness

Uniqueness Score: -1.00%

Function 0040534F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040534F(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x407310;
				_v36.Group = 0x407310;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x407300;
				_v16.nLength = 0xc;
				if(CreateDirectoryA(_a4,  &_v16) != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x0040535a
0x0040535e
0x00405361
0x00405367
0x0040536b
0x0040536f
0x00405377
0x0040537e
0x00405384
0x0040538b
0x0040539a
0x0040539c
0x00000000
0x0040539c
0x004053a6
0x004053ad
0x004053c3
0x00000000
0x00000000
0x00000000
0x004053c5
0x004053c9

APIs

CreateDirectoryA.KERNEL32(?,?,00000000), ref: 00405392
GetLastError.KERNEL32 ref: 004053A6
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004053BB
GetLastError.KERNEL32 ref: 004053C5

Strings

C:\Users\user\Desktop, xrefs: 0040534F

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-1050982609
Opcode ID: 1936ad7c03f2b7d8793bf3b54e92df8b677be00562b78ee6b782fceed01fa342
Instruction ID: 0f194ad754f8d2153fe6bade7a67ae4222ab15fc701b17716cfd16251ec2b406
Opcode Fuzzy Hash: 1936ad7c03f2b7d8793bf3b54e92df8b677be00562b78ee6b782fceed01fa342
Instruction Fuzzy Hash: C5010871D04259EBEF119BA0D904BEFBFB8EF04354F00457AE905B6180D3B89614CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D1B() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 8)), 0x5a);
				0x40b064->lfHeight =  ~(MulDiv(E004029EF(2), _t6, 0x48));
				 *0x40b074 = E004029EF(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x18));
				 *0x40b07b = 1;
				 *0x40b078 = _t11 & 0x00000001;
				 *0x40b079 = _t11 & 0x00000002;
				 *0x40b07a = _t11 & 0x00000004;
				E00405BC3(_t18, _t24, _t26, "MS Shell Dlg",  *((intOrPtr*)(_t28 - 0x24)));
				_t14 = CreateFontIndirectA(0x40b064);
				_push(_t14);
				_push(_t26);
				E00405AFF();
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d29
0x00401d42
0x00401d4c
0x00401d51
0x00401d5c
0x00401d63
0x00401d75
0x00401d7b
0x00401d80
0x00401d8a
0x004024ce
0x00401561
0x00402849
0x004028a4
0x004028b0

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(0040B064), ref: 00401D8A

Strings

MS Shell Dlg, xrefs: 00401D70

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID: MS Shell Dlg
API String ID: 3272661963-76309092
Opcode ID: 4aff2da1ecbc0b46b4ebb4a1bc3754d5e437124edce295b0be6ec486ba38634f
Instruction ID: 5e6b0a242ffc9277152ed6cf63edc70abaf129c53bcded44f01e7363494148ce
Opcode Fuzzy Hash: 4aff2da1ecbc0b46b4ebb4a1bc3754d5e437124edce295b0be6ec486ba38634f
Instruction Fuzzy Hash: 0BF04471E89240AEE7016770AF1AB9B7F64D715305F104475F651B62E2C77914048BAE

Uniqueness

Uniqueness Score: -1.00%

Function 02AB1ADF Relevance: 7.7, APIs: 5, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E02AB1ADF(signed int __edx, void* __eflags, void* _a8, void* _a16) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v148;
				void _t46;
				void _t47;
				signed int _t48;
				signed int _t49;
				signed int _t58;
				signed int _t59;
				signed int _t61;
				signed int _t62;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				signed int _t78;
				void* _t82;
				signed int _t86;
				signed int _t88;
				signed int _t91;
				void* _t102;

				_t86 = __edx;
				 *0x2ab4058 = _a8;
				_t78 = 0;
				 *0x2ab405c = _a16;
				_v8 = 0;
				_a16 = E02AB1561();
				_a8 = E02AB1561();
				_t91 = E02AB1641(_a16);
				_t82 = _a8;
				_t88 = _t86;
				_t46 =  *_t82;
				if(_t46 != 0x7e && _t46 != 0x21) {
					_v16 = E02AB1561();
					_t78 = E02AB1641(_t75);
					_v8 = _t86;
					GlobalFree(_v16);
					_t82 = _a8;
				}
				_t47 =  *_t82;
				_t102 = _t47 - 0x2f;
				if(_t102 > 0) {
					_t48 = _t47 - 0x3c;
					__eflags = _t48;
					if(_t48 == 0) {
						__eflags =  *((char*)(_t82 + 1)) - 0x3c;
						if( *((char*)(_t82 + 1)) != 0x3c) {
							__eflags = _t88 - _v8;
							if(__eflags > 0) {
								L54:
								_t49 = 0;
								__eflags = 0;
								L55:
								asm("cdq");
								L56:
								_t91 = _t49;
								_t88 = _t86;
								L57:
								E02AB176C(_t86, _t91, _t88,  &_v148);
								E02AB159E( &_v148);
								GlobalFree(_a16);
								return GlobalFree(_a8);
							}
							if(__eflags < 0) {
								L47:
								__eflags = 0;
								L48:
								_t49 = 1;
								goto L55;
							}
							__eflags = _t91 - _t78;
							if(_t91 < _t78) {
								goto L47;
							}
							goto L54;
						}
						_t86 = _t88;
						_t49 = E02AB2BD0(_t91, _t78, _t86);
						goto L56;
					}
					_t58 = _t48 - 1;
					__eflags = _t58;
					if(_t58 == 0) {
						__eflags = _t91 - _t78;
						if(_t91 != _t78) {
							goto L54;
						}
						__eflags = _t88 - _v8;
						if(_t88 != _v8) {
							goto L54;
						}
						goto L47;
					}
					_t59 = _t58 - 1;
					__eflags = _t59;
					if(_t59 == 0) {
						__eflags =  *((char*)(_t82 + 1)) - 0x3e;
						if( *((char*)(_t82 + 1)) != 0x3e) {
							__eflags = _t88 - _v8;
							if(__eflags < 0) {
								goto L54;
							}
							if(__eflags > 0) {
								goto L47;
							}
							__eflags = _t91 - _t78;
							if(_t91 <= _t78) {
								goto L54;
							}
							goto L47;
						}
						_t86 = _t88;
						_t49 = E02AB2BF0(_t91, _t78, _t86);
						goto L56;
					}
					_t61 = _t59 - 0x20;
					__eflags = _t61;
					if(_t61 == 0) {
						_t91 = _t91 ^ _t78;
						_t88 = _t88 ^ _v8;
						goto L57;
					}
					_t62 = _t61 - 0x1e;
					__eflags = _t62;
					if(_t62 == 0) {
						__eflags =  *((char*)(_t82 + 1)) - 0x7c;
						if( *((char*)(_t82 + 1)) != 0x7c) {
							_t91 = _t91 | _t78;
							_t88 = _t88 | _v8;
							goto L57;
						}
						__eflags = _t91 | _t88;
						if((_t91 | _t88) != 0) {
							goto L47;
						}
						__eflags = _t78 | _v8;
						if((_t78 | _v8) != 0) {
							goto L47;
						}
						goto L54;
					}
					__eflags = _t62 == 0;
					if(_t62 == 0) {
						_t91 =  !_t91;
						_t88 =  !_t88;
					}
					goto L57;
				}
				if(_t102 == 0) {
					L21:
					__eflags = _t78 | _v8;
					if((_t78 | _v8) != 0) {
						_v20 = E02AB2A60(_t91, _t88, _t78, _v8);
						_v16 = _t86;
						_t49 = E02AB2B10(_t91, _t88, _t78, _v8);
						_t82 = _a8;
					} else {
						_v20 = _v20 & 0x00000000;
						_v16 = _v16 & 0x00000000;
						_t49 = _t91;
						_t86 = _t88;
					}
					__eflags =  *_t82 - 0x2f;
					if( *_t82 != 0x2f) {
						goto L56;
					} else {
						_t91 = _v20;
						_t88 = _v16;
						goto L57;
					}
				}
				_t68 = _t47 - 0x21;
				if(_t68 == 0) {
					_t49 = 0;
					__eflags = _t91 | _t88;
					if((_t91 | _t88) != 0) {
						goto L55;
					}
					goto L48;
				}
				_t69 = _t68 - 4;
				if(_t69 == 0) {
					goto L21;
				}
				_t70 = _t69 - 1;
				if(_t70 == 0) {
					__eflags =  *((char*)(_t82 + 1)) - 0x26;
					if( *((char*)(_t82 + 1)) != 0x26) {
						_t91 = _t91 & _t78;
						_t88 = _t88 & _v8;
						goto L57;
					}
					__eflags = _t91 | _t88;
					if((_t91 | _t88) == 0) {
						goto L54;
					}
					__eflags = _t78 | _v8;
					if((_t78 | _v8) == 0) {
						goto L54;
					}
					goto L47;
				}
				_t71 = _t70 - 4;
				if(_t71 == 0) {
					_t49 = E02AB2A20(_t91, _t88, _t78, _v8);
					goto L56;
				} else {
					_t72 = _t71 - 1;
					if(_t72 == 0) {
						_t91 = _t91 + _t78;
						asm("adc edi, [ebp-0x4]");
					} else {
						if(_t72 == 0) {
							_t91 = _t91 - _t78;
							asm("sbb edi, [ebp-0x4]");
						}
					}
					goto L57;
				}
			}

0x02ab1adf
0x02ab1aec
0x02ab1af5
0x02ab1af8
0x02ab1afd
0x02ab1b05
0x02ab1b10
0x02ab1b19
0x02ab1b1b
0x02ab1b1e
0x02ab1b20
0x02ab1b24
0x02ab1b30
0x02ab1b39
0x02ab1b3e
0x02ab1b41
0x02ab1b47
0x02ab1b47
0x02ab1b4a
0x02ab1b4d
0x02ab1b50
0x02ab1c16
0x02ab1c16
0x02ab1c19
0x02ab1c82
0x02ab1c86
0x02ab1c95
0x02ab1c98
0x02ab1ca0
0x02ab1ca0
0x02ab1ca0
0x02ab1ca2
0x02ab1ca2
0x02ab1ca3
0x02ab1ca3
0x02ab1ca5
0x02ab1ca7
0x02ab1cb0
0x02ab1cbc
0x02ab1ccd
0x02ab1cd8
0x02ab1cd8
0x02ab1c9a
0x02ab1c7d
0x02ab1c7d
0x02ab1c7f
0x02ab1c7f
0x00000000
0x02ab1c7f
0x02ab1c9c
0x02ab1c9e
0x00000000
0x00000000
0x00000000
0x02ab1c9e
0x02ab1c8a
0x02ab1c8e
0x00000000
0x02ab1c8e
0x02ab1c1b
0x02ab1c1b
0x02ab1c1c
0x02ab1c74
0x02ab1c76
0x00000000
0x00000000
0x02ab1c78
0x02ab1c7b
0x00000000
0x00000000
0x00000000
0x02ab1c7b
0x02ab1c1e
0x02ab1c1e
0x02ab1c1f
0x02ab1c54
0x02ab1c58
0x02ab1c67
0x02ab1c6a
0x00000000
0x00000000
0x02ab1c6c
0x00000000
0x00000000
0x02ab1c6e
0x02ab1c70
0x00000000
0x00000000
0x00000000
0x02ab1c72
0x02ab1c5c
0x02ab1c60
0x00000000
0x02ab1c60
0x02ab1c21
0x02ab1c21
0x02ab1c24
0x02ab1c4d
0x02ab1c4f
0x00000000
0x02ab1c4f
0x02ab1c26
0x02ab1c26
0x02ab1c29
0x02ab1c35
0x02ab1c39
0x02ab1c46
0x02ab1c48
0x00000000
0x02ab1c48
0x02ab1c3b
0x02ab1c3d
0x00000000
0x00000000
0x02ab1c3f
0x02ab1c42
0x00000000
0x00000000
0x00000000
0x02ab1c44
0x02ab1c2c
0x02ab1c2d
0x02ab1c2f
0x02ab1c31
0x02ab1c31
0x00000000
0x02ab1c2d
0x02ab1b56
0x02ab1bce
0x02ab1bd0
0x02ab1bd3
0x02ab1bf1
0x02ab1bf4
0x02ab1bfa
0x02ab1bff
0x02ab1bd5
0x02ab1bd5
0x02ab1bd9
0x02ab1bdd
0x02ab1bdf
0x02ab1bdf
0x02ab1c02
0x02ab1c05
0x00000000
0x02ab1c0b
0x02ab1c0b
0x02ab1c0e
0x00000000
0x02ab1c0e
0x02ab1c05
0x02ab1b58
0x02ab1b5b
0x02ab1bbf
0x02ab1bc1
0x02ab1bc3
0x00000000
0x00000000
0x00000000
0x02ab1bc9
0x02ab1b5d
0x02ab1b60
0x00000000
0x00000000
0x02ab1b62
0x02ab1b63
0x02ab1b99
0x02ab1b9d
0x02ab1bb5
0x02ab1bb7
0x00000000
0x02ab1bb7
0x02ab1b9f
0x02ab1ba1
0x00000000
0x00000000
0x02ab1ba7
0x02ab1baa
0x00000000
0x00000000
0x00000000
0x02ab1bb0
0x02ab1b65
0x02ab1b68
0x02ab1b8f
0x00000000
0x02ab1b6a
0x02ab1b6a
0x02ab1b6b
0x02ab1b7f
0x02ab1b81
0x02ab1b6d
0x02ab1b6f
0x02ab1b75
0x02ab1b77
0x02ab1b77
0x02ab1b6f
0x00000000
0x02ab1b6b

APIs

Part of subcall function 02AB1561: lstrcpyA.KERNEL32(00000000,?,?,?,02AB1804,?,02AB1017), ref: 02AB157E
Part of subcall function 02AB1561: GlobalFree.KERNEL32 ref: 02AB158F

GlobalFree.KERNEL32(?), ref: 02AB1B41
GlobalFree.KERNEL32(?), ref: 02AB1CCD
GlobalFree.KERNEL32(?), ref: 02AB1CD2

Memory Dump Source

Source File: 00000001.00000002.2972899107.0000000002AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 02AB0000, based on PE: true

Associated: 00000001.00000002.2972852006.0000000002AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2972964416.0000000002AB3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2973006111.0000000002AB5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2ab0000_Setup 2.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: 7ef3a94d5d08a82f515372d832cd8310864f60bae773d685dfe7aa65884625f5
Instruction ID: 2ba26e726fad92fc47ed136d078b489a24b0e178a034126d17a89436dfd75573
Opcode Fuzzy Hash: 7ef3a94d5d08a82f515372d832cd8310864f60bae773d685dfe7aa65884625f5
Instruction Fuzzy Hash: B051DF32D10148AACB239F6885E46FDBBBEEF46346F15416AD40DA3107DF719E01EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00402A4C Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A4C(void* _a4, char* _a8, long _a12) {
				void* _v8;
				char _v272;
				signed char _t16;
				long _t18;
				long _t25;
				intOrPtr* _t27;
				long _t28;

				_t16 =  *0x42ecf0; // 0x0
				_t18 = RegOpenKeyExA(_a4, _a8, 0, _t16 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						__eflags = _a12;
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							__eflags = 1;
							return 1;
						}
						_t25 = E00402A4C(_v8,  &_v272, 0);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00405F2D(4);
					if(_t27 == 0) {
						__eflags =  *0x42ecf0; // 0x0
						if(__eflags != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						__eflags = _t28;
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x42ecf0, 0);
				}
				return _t18;
			}

0x00402a5c
0x00402a6d
0x00402a75
0x00402a9d
0x00402a84
0x00402a87
0x00402ad7
0x00402add
0x00402adf
0x00000000
0x00402adf
0x00402a94
0x00402a99
0x00402a9b
0x00000000
0x00000000
0x00402a9b
0x00402ab2
0x00402aba
0x00402ac1
0x00402ae7
0x00402aed
0x00000000
0x00000000
0x00402af5
0x00402afb
0x00402afd
0x00000000
0x00000000
0x00000000
0x00402afd
0x00000000
0x00402ad0
0x00402ae4

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A6D
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AA9
RegCloseKey.ADVAPI32(?), ref: 00402AB2
RegCloseKey.ADVAPI32(?), ref: 00402AD7
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AF5

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 87ccbfffecd7de7467de5c73c2002d88ab1ef4389744f866cc51cf150fc0b97d
Instruction ID: aab1c47b15b7d7dbd0304e6a384de86cdfdd1b9a1951722987da620561d60ced
Opcode Fuzzy Hash: 87ccbfffecd7de7467de5c73c2002d88ab1ef4389744f866cc51cf150fc0b97d
Instruction Fuzzy Hash: 45117F71A00009FFDF219F91DE49DAF3B69EB14394B004076FA06F00A0DBB49E52AF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CC1(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 8), __edx);
				GetClientRect(_t25, _t27 - 0x50);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E00402A0C(_t21), _t21,  *(_t27 - 0x48) *  *(_t27 - 0x20),  *(_t27 - 0x44) *  *(_t27 - 0x20), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ccb
0x00401cd2
0x00401d01
0x00401d09
0x00401d10
0x00401d10
0x004028a4
0x004028b0

APIs

GetDlgItem.USER32(?), ref: 00401CC5
GetClientRect.USER32(00000000,?), ref: 00401CD2
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CF3
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: def8d1c1479795c1167aff6e03d0c5147865de771fccb6e49a981145c37fb96d
Instruction ID: 0b6a49845d72fa48a9a579b1019c06f6c105053db178aa5042bb0eadc5b1df39
Opcode Fuzzy Hash: def8d1c1479795c1167aff6e03d0c5147865de771fccb6e49a981145c37fb96d
Instruction Fuzzy Hash: 2DF0EC72A04114AFEB00EBA4DD88DAFB77CFB44305B044536F501F6191C678AD419B79

Uniqueness

Uniqueness Score: -1.00%

Function 00404652 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404652(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					_push(0x14);
					_pop(0);
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_t50 = 0x14;
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E00405BC3(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E00405BC3(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E00405BC3(_t41, _t47, 0x42a0c0, 0x42a0c0, _a8);
				wsprintfA(_t32 + lstrlenA(0x42a0c0), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				return SetDlgItemTextA( *0x42e418, _a4, 0x42a0c0);
			}

0x00404658
0x0040465d
0x00404665
0x00404666
0x00404673
0x0040467b
0x0040467c
0x0040467e
0x00404680
0x00404682
0x00404685
0x00404685
0x0040468c
0x00404692
0x00404692
0x00404699
0x004046a0
0x004046a3
0x004046a6
0x004046a6
0x004046aa
0x004046ba
0x004046bc
0x004046bf
0x00404668
0x00404668
0x0040466f
0x0040466f
0x004046c7
0x004046d2
0x004046e8
0x004046f8
0x00404714

APIs

lstrlenA.KERNEL32(0042A0C0,0042A0C0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040456D,000000DF,00000000,00000400,?), ref: 004046F0
wsprintfA.USER32 ref: 004046F8
SetDlgItemTextA.USER32(?,0042A0C0), ref: 0040470B

Strings

%u.%u%s%s, xrefs: 004046DA

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: ec62b53d4e0dbb31f5b6c5a17a5348d37b593b8d10f93b7eb7b316986fd69fdf
Instruction ID: cfc8e6c3a4af003209a53fcdfac8cba24e816d3e629d82a7997265ded69b8fd0
Opcode Fuzzy Hash: ec62b53d4e0dbb31f5b6c5a17a5348d37b593b8d10f93b7eb7b316986fd69fdf
Instruction Fuzzy Hash: A0112773A0412827EB0065699C45EAF3298DB86334F254637FE25F71D1E9799C1285EC

Uniqueness

Uniqueness Score: -1.00%

Function 10001480 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001480(void* __eflags, struct HWND__* _a4, int _a8, int _a12, long _a16) {
				void* _t8;

				_t8 = E100013C6(_a4);
				if(_t8 != 0) {
					if(_a8 != 0x20) {
						return CallWindowProcA( *(_t8 + 0x414), _a4, _a8, _a12, _a16);
					}
					SetCursor(LoadCursorA(0, 0x7f89));
					return 1;
				}
				return _t8;
			}

0x10001486
0x1000148d
0x10001493
0x00000000
0x100014c0
0x100014a3
0x00000000
0x100014ab
0x100014c7

APIs

Part of subcall function 100013C6: GetPropA.USER32(?,NSIS: nsControl pointer property), ref: 100013CF

LoadCursorA.USER32(00000000,00007F89), ref: 1000149C
SetCursor.USER32(00000000,?,?,?), ref: 100014A3
CallWindowProcA.USER32(?,?,00000020,?,?), ref: 100014C0

Strings

, xrefs: 1000148F

Memory Dump Source

Source File: 00000001.00000002.2975197977.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2975169750.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975269413.0000000010003000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975296586.0000000010004000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975376888.0000000010007000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Setup 2.jbxd

Similarity

API ID: Cursor$CallLoadProcPropWindow
String ID:
API String ID: 1635134901-3916222277
Opcode ID: fe86d6a8df8652b6893fe4eca20c39439145fa65284bd5d8d0f77b3d38c966f1
Instruction ID: a66733f9f35406bd33e2d7aa3b75cbab870ac8179c4c27a22f78824fc1d78fcc
Opcode Fuzzy Hash: fe86d6a8df8652b6893fe4eca20c39439145fa65284bd5d8d0f77b3d38c966f1
Instruction Fuzzy Hash: 1FE0ED32545209FFEF529FA1CD059DA3BA9EF083D1F01C420FA1994075C771D560AFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00405694 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405694(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409010);
				}
				return _t7;
			}

0x00405695
0x004056ac
0x004056b4
0x004056b4
0x004056bc

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030FA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 0040569A
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030FA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 004056A3
lstrcatA.KERNEL32(?,00409010), ref: 004056B4

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405694

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-1360682300
Opcode ID: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction ID: 3169b85a74bfaa55460b422d3e3fbca7e168afda588c61a1877893bbaf19970e
Opcode Fuzzy Hash: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction Fuzzy Hash: 25D0A972606A302EE20226158C05F8B3A28CF52301B0448A2F640B22D2C7BC7E818FFE

Uniqueness

Uniqueness Score: -1.00%

Function 10001329 Relevance: 6.1, APIs: 4, Instructions: 62
stringCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E10001329(CHAR* _a4, int _a8, intOrPtr _a12) {
				struct tagRECT _v20;
				char _t31;
				long _t32;
				CHAR* _t33;
				int _t34;

				_t33 = _a4;
				_t31 =  *(CharPrevA(_t33,  &(_t33[lstrlenA(_t33)])));
				_t34 = E10001E6C(_t33);
				if(_t31 != 0x25) {
					if(_t31 != 0x75) {
						if(_t34 >= 0) {
							return _t34;
						}
						return _a8 + _t34;
					}
					_v20.bottom = _v20.bottom & 0x00000000;
					_v20.right = _v20.right & 0x00000000;
					_v20.top = _t34;
					_v20.left = _t34;
					MapDialogRect( *0x100050c4,  &_v20);
					if(_a12 == 0) {
						if(_t34 < 0) {
							_t32 = _v20.left;
							L12:
							return _a8 + _t32;
						}
						return _v20.left;
					}
					if(_t34 < 0) {
						_t32 = _v20.top;
						goto L12;
					}
					return _v20.top;
				}
				_push(0x64);
				if(_t34 < 0) {
					_t34 = _t34 + 0x64;
				}
				return MulDiv(_a8, _t34, ??);
			}

0x10001331
0x10001345
0x10001350
0x10001352
0x1000136c
0x100013b5
0x00000000
0x100013be
0x00000000
0x100013ba
0x1000136e
0x10001372
0x10001379
0x1000137d
0x10001386
0x10001390
0x100013a2
0x100013a9
0x100013ac
0x00000000
0x100013af
0x00000000
0x100013a4
0x10001394
0x1000139b
0x00000000
0x1000139b
0x00000000
0x10001396
0x10001356
0x10001358
0x1000135a
0x1000135a
0x00000000

APIs

lstrlenA.KERNEL32(765E7800,00000400,?,00000400,?,765E7800,00000000), ref: 10001335
CharPrevA.USER32(765E7800,00000000,?,765E7800,00000000), ref: 1000133F
MulDiv.KERNEL32(?,00000000,00000064), ref: 10001361
MapDialogRect.USER32(765E7800,765E7800), ref: 10001386

Memory Dump Source

Source File: 00000001.00000002.2975197977.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2975169750.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975269413.0000000010003000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975296586.0000000010004000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2975376888.0000000010007000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Setup 2.jbxd

Similarity

API ID: CharDialogPrevRectlstrlen
String ID:
API String ID: 3411278111-0
Opcode ID: fd46bfb7a63f61188474650796e42b4e6753ec7b49283bbfb4d4c3f55d544fb3
Instruction ID: 64c0b42e09fc68fe10f5c4e0cdc1b69ed62713d063d26a08fa25ecf94777dca9
Opcode Fuzzy Hash: fd46bfb7a63f61188474650796e42b4e6753ec7b49283bbfb4d4c3f55d544fb3
Instruction Fuzzy Hash: 11113435E02668EBEB25CB44CC48BDF7BB8EF007E5F018450FD15AA65AC330AA008BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00402BD4 Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BD4(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x420c68; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x42ec4c;
						if(_t2 >  *0x42ec4c) {
							_t3 = CreateDialogParamA( *0x42ec40, 0x6f, 0, E00402B51, 0);
							 *0x420c68 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00405F69(0);
					}
				} else {
					_t6 =  *0x420c68; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x420c68 = 0;
					return _t6;
				}
			}

0x00402bdb
0x00402bf5
0x00402bfb
0x00402c05
0x00402c0b
0x00402c11
0x00402c22
0x00402c2b
0x00000000
0x00402c30
0x00402c37
0x00402bfd
0x00402c04
0x00402c04
0x00402bdd
0x00402bdd
0x00402be4
0x00402be7
0x00402be7
0x00402bed
0x00402bf4
0x00402bf4

APIs

DestroyWindow.USER32(00000000,00000000,00402DB4,00000001), ref: 00402BE7
GetTickCount.KERNEL32 ref: 00402C05
CreateDialogParamA.USER32(0000006F,00000000,00402B51,00000000), ref: 00402C22
ShowWindow.USER32(00000000,00000005), ref: 00402C30

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: b254695f6d3024de6991e78bd902d51a9eabd2695cbf76f56ec73d281620ca3d
Instruction ID: fe7f2a60441318f0c2a90f6d59b101c1e11520174a0dcb1e75ef42172c75ba50
Opcode Fuzzy Hash: b254695f6d3024de6991e78bd902d51a9eabd2695cbf76f56ec73d281620ca3d
Instruction Fuzzy Hash: 7FF05470A0D121ABD6746F55FE8CD8B7BA4F744B017540576F000B11A4DA785882CFAD

Uniqueness

Uniqueness Score: -1.00%

Function 00404DDD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404DDD(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x42a0a8 != _t22) {
							 *0x42a0a8 = _t22;
							E00405BA1(0x42a0c0, 0x42f000);
							E00405AFF(0x42f000, _t22);
							E0040140B(6);
							E00405BA1(0x42f000, 0x42a0c0);
						}
						L11:
						return CallWindowProcA( *0x42a0b0, _a4, _a8, _a12, _t22);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E0040475C(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00403EA9(0x413);
				return 0;
			}

0x00404de9
0x00404e0e
0x00404e2e
0x00404e31
0x00404e34
0x00404e4b
0x00404e51
0x00404e58
0x00404e5f
0x00404e66
0x00404e6b
0x00404e71
0x00000000
0x00404e81
0x00404e1b
0x00404e6e
0x00404e6e
0x00000000
0x00404e6e
0x00404e27
0x00404e29
0x00000000
0x00404e29
0x00404def
0x00000000
0x00000000
0x00404df6
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00404E13
CallWindowProcA.USER32(?,00000200,?,?), ref: 00404E81

Part of subcall function 00403EA9: SendMessageA.USER32(000303B4,00000000,00000000,00000000), ref: 00403EBB

Strings

, xrefs: 00404DEB

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 284444f2568d96eb5f499d391233f43a2f88d41ae364e0567807da02f849ec1b
Instruction ID: 765017f4a7fe1763b93213a0743e5224a7b8bf10e0e2635d7465f91e9f3f1348
Opcode Fuzzy Hash: 284444f2568d96eb5f499d391233f43a2f88d41ae364e0567807da02f849ec1b
Instruction Fuzzy Hash: C5116D71500218BFDF215F51DC81E9B7669BB84365F00803AFA08792A1C37C49518BEE

Uniqueness

Uniqueness Score: -1.00%

Function 004024D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004024D4(struct _OVERLAPPED* __ebx, intOrPtr* __esi) {
				int _t5;
				long _t7;
				struct _OVERLAPPED* _t11;
				intOrPtr* _t15;
				void* _t17;
				int _t21;

				_t15 = __esi;
				_t11 = __ebx;
				if( *((intOrPtr*)(_t17 - 0x20)) == __ebx) {
					_t7 = lstrlenA(E00402A0C(0x11));
				} else {
					E004029EF(1);
					 *0x40a060 = __al;
				}
				if( *_t15 == _t11) {
					L8:
					 *((intOrPtr*)(_t17 - 4)) = 1;
				} else {
					_t5 = WriteFile(E00405B18(_t17 + 8, _t15), "C:\Users\alfredo\AppData\Local\Temp\nsyD27B.tmp\System.dll", _t7, _t17 + 8, _t11);
					_t21 = _t5;
					if(_t21 == 0) {
						goto L8;
					}
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x004024d4
0x004024d4
0x004024d7
0x004024f2
0x004024d9
0x004024db
0x004024e0
0x004024e7
0x004024f9
0x00402672
0x00402672
0x004024ff
0x00402511
0x004015a6
0x004015a8
0x00000000
0x004015ae
0x004015a8
0x004028a4
0x004028b0

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024F2
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402511

Strings

C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll, xrefs: 004024E0, 00402505

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsyD27B.tmp\System.dll
API String ID: 427699356-3428213543
Opcode ID: 55d5c31b05b367b2be7d260ca987d3fabb08ce9c2cd564eb144ff7a2d4973d57
Instruction ID: 4d0466e2475190dcbeea98c473c6ee3349c22a30d2c03acad583e8792e536618
Opcode Fuzzy Hash: 55d5c31b05b367b2be7d260ca987d3fabb08ce9c2cd564eb144ff7a2d4973d57
Instruction Fuzzy Hash: FEF0E972A44244BFEB10FBB19E09EAB3668EB50309F14443BF142F51C2D6FC5541966E

Uniqueness

Uniqueness Score: -1.00%

Function 00404F5F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32
comCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00404F5F(signed int __eax) {
				intOrPtr _v0;
				intOrPtr _t8;
				intOrPtr _t10;
				intOrPtr _t11;
				intOrPtr* _t12;

				_t11 =  *0x42ec68; // 0x6d6b64
				_t10 =  *0x42ec6c; // 0x1
				__imp__OleInitialize(0);
				 *0x42ecf8 =  *0x42ecf8 | __eax;
				E00403EA9(0);
				if(_t10 != 0) {
					_t12 = _t11 + 0xc;
					while(1) {
						_t10 = _t10 - 1;
						if(( *(_t12 - 4) & 0x00000001) != 0 && E00401389( *_t12, _v0) != 0) {
							break;
						}
						_t12 = _t12 + 0x418;
						if(_t10 != 0) {
							continue;
						} else {
						}
						goto L7;
					}
					 *0x42eccc =  *0x42eccc + 1;
				}
				L7:
				E00403EA9(0x404);
				__imp__OleUninitialize();
				_t8 =  *0x42eccc; // 0x0
				return _t8;
			}

0x00404f60
0x00404f67
0x00404f6f
0x00404f75
0x00404f7d
0x00404f84
0x00404f86
0x00404f89
0x00404f89
0x00404f8e
0x00000000
0x00000000
0x00404f9f
0x00404fa7
0x00000000
0x00000000
0x00404fa9
0x00000000
0x00404fa7
0x00404fab
0x00404fab
0x00404fb1
0x00404fb6
0x00404fbb
0x00404fc1
0x00404fc8

APIs

OleInitialize.OLE32(00000000), ref: 00404F6F

Part of subcall function 00403EA9: SendMessageA.USER32(000303B4,00000000,00000000,00000000), ref: 00403EBB

OleUninitialize.OLE32(00000404,00000000), ref: 00404FBB

Strings

dkm, xrefs: 00404F60

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID: dkm
API String ID: 2896919175-93656423
Opcode ID: 2a772d6587f0fcfcfaea2d2d281083e1409e9ea27001972d7572fa6ded6cf215
Instruction ID: 0237253cc9c58cf0a7532797d9d30a9164c1a838a7413899888e7e9ddc46429b
Opcode Fuzzy Hash: 2a772d6587f0fcfcfaea2d2d281083e1409e9ea27001972d7572fa6ded6cf215
Instruction Fuzzy Hash: FBF0F0B36082028AE3201B97DD05F62B7A4ABC0301F15003BFF44A33E1CB785802C66D

Uniqueness

Uniqueness Score: -1.00%

Function 00405401 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405401(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x42c0c8->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x42c0c8,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x0040540a
0x00405426
0x0040542e
0x00405433
0x00000000
0x00405439
0x0040543d

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,0042C0C8,Error launching installer), ref: 00405426
CloseHandle.KERNEL32(?), ref: 00405433

Strings

Error launching installer, xrefs: 00405414

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 0925aebfc32c6642fbbb941080814cd4d7ece6f22c8f43fc911f16656fd02ce2
Instruction ID: 8ba2d39aa234bef1b68f753dd4085f5a0355ab0b72bc814b33162f1b9dafcc5c
Opcode Fuzzy Hash: 0925aebfc32c6642fbbb941080814cd4d7ece6f22c8f43fc911f16656fd02ce2
Instruction Fuzzy Hash: 40E0E675A00209ABDB109FA4DC45A6F7B7CFF10305B404521E914F3151D774D5148A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040355F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040355F() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x42907c; // 0x6fd370
				_t3 = E00403544(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x42907c =  *0x42907c & 0x00000000;
				return _t3;
			}

0x00403560
0x00403568
0x0040356f
0x00403572
0x00403572
0x00403574
0x00403579
0x00403580
0x00403586
0x0040358a
0x0040358b
0x00403593

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,00000000,00403537,00403340,00000000), ref: 00403579
GlobalFree.KERNEL32(006FD370), ref: 00403580

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403571

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-1360682300
Opcode ID: 84b733c7cccae0041813714216a38e771799edba4f139ceaa0c0671ece6e2eb2
Instruction ID: bfe74e10b2793f4584c914afcf2a54bd359ebf4cfcfa0dffde5489d6b194198f
Opcode Fuzzy Hash: 84b733c7cccae0041813714216a38e771799edba4f139ceaa0c0671ece6e2eb2
Instruction Fuzzy Hash: CCE08C32901030A7DA211F15BC0475ABB6C6B49B32F01456AE801772B083742D424BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004056DB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056DB(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x004056dc
0x004056e6
0x004056e8
0x004056ef
0x004056f7
0x00000000
0x00000000
0x00000000
0x004056f7
0x004056f9
0x004056fe

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CA4,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Setup 2.exe,C:\Users\user\Desktop\Setup 2.exe,80000000,00000003), ref: 004056E1
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CA4,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Setup 2.exe,C:\Users\user\Desktop\Setup 2.exe,80000000,00000003), ref: 004056EF

Strings

C:\Users\user\Desktop, xrefs: 004056DB

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1050982609
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: 3f11d7040b39dee88ccc87d096f3af91d58a3172f7b65643d8c2c66232cec6f3
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: ADD0A76280ADB01EF30352108C04B8F7A58CF13300F0948A2E040A21D1C6B85C418FFD

Uniqueness

Uniqueness Score: -1.00%

Function 004057ED Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004057ED(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x004057f9
0x004057fb
0x00405823
0x00405808
0x0040580d
0x00405818
0x00000000
0x00405835
0x00405821
0x00405821
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059FB,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057F4
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040580D
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 0040581B
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059FB,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405824

Memory Dump Source

Source File: 00000001.00000002.2967757529.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2967602370.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968022196.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2968175965.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969189558.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969334185.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2969402117.000000000043F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Setup 2.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: b9005c049e247e33e5549b3e141599c62d2a38fed0f6fd2d3c1464f89547bebd
Instruction ID: 9d1965df737bf6a3caf75c2c412474092f11d9bf319c7f7f540ae1764f3f27e9
Opcode Fuzzy Hash: b9005c049e247e33e5549b3e141599c62d2a38fed0f6fd2d3c1464f89547bebd
Instruction Fuzzy Hash: 69F0A737209D51ABD202AB255C04D6B7FA4EF91314B14447AF840F2280D779A925DBBB

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SetupEngine.exePID: 4152, Parent PID: 2852COMMON

Execution Graph

Execution Coverage:	25.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1273
Total number of Limit Nodes:	43

Executed Functions

Function 0040310D Relevance: 84.3, APIs: 25, Strings: 23, Instructions: 313
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				intOrPtr _t40;
				CHAR* _t44;
				char* _t47;
				signed int _t49;
				void* _t53;
				intOrPtr _t55;
				int _t57;
				signed int _t60;
				signed int _t61;
				int _t62;
				signed int _t64;
				signed int _t67;
				intOrPtr _t80;
				int _t84;
				intOrPtr _t86;
				void* _t88;
				void* _t100;
				intOrPtr* _t101;
				void* _t104;
				CHAR* _t109;
				signed int _t110;
				signed int _t111;
				signed int _t112;
				void* _t114;
				signed int _t116;
				char* _t118;
				signed int _t119;
				void* _t121;
				void* _t122;
				intOrPtr _t130;
				char _t139;

				 *(_t122 + 0x1c) = 0;
				 *((intOrPtr*)(_t122 + 0x14)) = "Error writing temporary file. Make sure your temp folder is valid.";
				_t111 = 0;
				 *(_t122 + 0x18) = 0x20;
				SetErrorMode(0x8001); // executed
				if(GetVersion() != 6) {
					_t101 = E00405F2D(0);
					if(_t101 != 0) {
						 *_t101(0xc00);
					}
				}
				E00405EC3("UXTHEME"); // executed
				E00405EC3("USERENV"); // executed
				E00405EC3("SETUPAPI"); // executed
				E00405F2D(0xd);
				_t40 = E00405F2D(0xb);
				 *0x42ec44 = _t40;
				__imp__#17();
				__imp__OleInitialize(0); // executed
				 *0x42ecf8 = _t40;
				SHGetFileInfoA(0x429078, 0, _t122 + 0x34, 0x160, 0); // executed
				E00405BA1("Fast! Setup", "NSIS Error");
				_t44 = GetCommandLineA();
				_t118 = "\"C:\\Users\\alfredo\\AppData\\Local\\Temp\\SetupEngine.exe\" ";
				E00405BA1(_t118, _t44);
				 *0x42ec40 = GetModuleHandleA(0);
				_t47 = _t118;
				if("\"C:\\Users\\alfredo\\AppData\\Local\\Temp\\SetupEngine.exe\" " == 0x22) {
					 *((char*)(_t122 + 0x14)) = 0x22;
					_t47 =  &M00434001;
				}
				_t49 = CharNextA(E004056BF(_t47,  *((intOrPtr*)(_t122 + 0x14))));
				 *(_t122 + 0x1c) = _t49;
				while(1) {
					_t104 =  *_t49;
					_t126 = _t104;
					if(_t104 == 0) {
						break;
					}
					__eflags = _t104 - 0x20;
					if(_t104 != 0x20) {
						L8:
						__eflags =  *_t49 - 0x22;
						 *((char*)(_t122 + 0x14)) = 0x20;
						if( *_t49 == 0x22) {
							_t49 = _t49 + 1;
							__eflags = _t49;
							 *((char*)(_t122 + 0x14)) = 0x22;
						}
						__eflags =  *_t49 - 0x2f;
						if( *_t49 != 0x2f) {
							L18:
							_t49 = E004056BF(_t49,  *((intOrPtr*)(_t122 + 0x14)));
							__eflags =  *_t49 - 0x22;
							if(__eflags == 0) {
								_t49 = _t49 + 1;
								__eflags = _t49;
							}
							continue;
						} else {
							_t49 = _t49 + 1;
							__eflags =  *_t49 - 0x53;
							if( *_t49 == 0x53) {
								__eflags = ( *(_t49 + 1) | 0x00000020) - 0x20;
								if(( *(_t49 + 1) | 0x00000020) == 0x20) {
									_t111 = _t111 | 0x00000002;
									__eflags = _t111;
								}
							}
							__eflags =  *_t49 - 0x4352434e;
							if( *_t49 == 0x4352434e) {
								__eflags = ( *(_t49 + 4) | 0x00000020) - 0x20;
								if(( *(_t49 + 4) | 0x00000020) == 0x20) {
									_t111 = _t111 | 0x00000004;
									__eflags = _t111;
								}
							}
							__eflags =  *((intOrPtr*)(_t49 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t49 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t49 - 2)) = 0;
								_t50 = _t49 + 2;
								__eflags = _t49 + 2;
								E00405BA1("C:\\Program Files (x86)\\Fast!", _t50);
								L23:
								_t109 = "C:\\Users\\alfredo\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t109);
								_t53 = E004030DC(_t126);
								_t127 = _t53;
								if(_t53 != 0) {
									L25:
									DeleteFileA("1033"); // executed
									_t55 = E00402C38(_t128, _t111); // executed
									 *((intOrPtr*)(_t122 + 0x10)) = _t55;
									if(_t55 != 0) {
										L35:
										E0040351A();
										__imp__OleUninitialize();
										_t135 =  *((intOrPtr*)(_t122 + 0x10));
										if( *((intOrPtr*)(_t122 + 0x10)) == 0) {
											__eflags =  *0x42ecd4; // 0x0
											if(__eflags == 0) {
												L62:
												_t57 =  *0x42ecec; // 0xffffffff
												__eflags = _t57 - 0xffffffff;
												if(_t57 != 0xffffffff) {
													 *(_t122 + 0x18) = _t57;
												}
												ExitProcess( *(_t122 + 0x18));
											}
											_t119 = E00405F2D(5);
											_t112 = E00405F2D(6);
											_t60 = E00405F2D(7);
											__eflags = _t119;
											_t110 = _t60;
											if(_t119 != 0) {
												__eflags = _t112;
												if(_t112 != 0) {
													__eflags = _t110;
													if(_t110 != 0) {
														_t67 =  *_t119(GetCurrentProcess(), 0x28, _t122 + 0x1c);
														__eflags = _t67;
														if(_t67 != 0) {
															 *_t112(0, "SeShutdownPrivilege", _t122 + 0x24);
															 *(_t122 + 0x38) = 1;
															 *(_t122 + 0x44) = 2;
															 *_t110( *((intOrPtr*)(_t122 + 0x30)), 0, _t122 + 0x28, 0, 0, 0);
														}
													}
												}
											}
											_t61 = E00405F2D(8);
											__eflags = _t61;
											if(_t61 == 0) {
												L60:
												_t62 = ExitWindowsEx(2, 0x80040002);
												__eflags = _t62;
												if(_t62 != 0) {
													goto L62;
												}
												goto L61;
											} else {
												_t64 =  *_t61(0, 0, 0, 0x25, 0x80040002);
												__eflags = _t64;
												if(_t64 == 0) {
													L61:
													E0040140B(9);
													goto L62;
												}
												goto L60;
											}
										}
										E00405462( *((intOrPtr*)(_t122 + 0x14)), 0x200010);
										ExitProcess(2);
									}
									_t130 =  *0x42ec5c; // 0x0
									if(_t130 == 0) {
										L34:
										 *0x42ecec =  *0x42ecec | 0xffffffff;
										 *(_t122 + 0x18) = E004035F4( *0x42ecec);
										goto L35;
									}
									_t116 = E004056BF(_t118, 0);
									while(_t116 >= _t118) {
										__eflags =  *_t116 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t116 = _t116 - 1;
										__eflags = _t116;
									}
									_t132 = _t116 - _t118;
									 *((intOrPtr*)(_t122 + 0x10)) = "Error launching installer";
									if(_t116 < _t118) {
										_t114 = E004053E9(_t135);
										lstrcatA(_t109, "~nsu");
										if(_t114 != 0) {
											lstrcatA(_t109, "A");
										}
										lstrcatA(_t109, ".tmp");
										_t120 = "C:\\Users\\alfredo\\AppData\\Local\\Temp";
										if(lstrcmpiA(_t109, "C:\\Users\\alfredo\\AppData\\Local\\Temp") != 0) {
											_push(_t109);
											if(_t114 == 0) {
												E004053CC();
											} else {
												E0040534F();
											}
											SetCurrentDirectoryA(_t109);
											_t139 = "C:\\Program Files (x86)\\Fast!"; // 0x43
											if(_t139 == 0) {
												E00405BA1("C:\\Program Files (x86)\\Fast!", _t120);
											}
											E00405BA1("55410880",  *(_t122 + 0x1c));
											 *0x42f400 = 0x41;
											_t121 = 0x1a;
											do {
												_t80 =  *0x42ec50; // 0x5d9b30
												E00405BC3(0, _t109, 0x428c78, 0x428c78,  *((intOrPtr*)(_t80 + 0x120)));
												DeleteFileA(0x428c78);
												if( *((intOrPtr*)(_t122 + 0x10)) != 0) {
													_t84 = CopyFileA("C:\\Users\\alfredo\\AppData\\Local\\Temp\\SetupEngine.exe", 0x428c78, 1);
													_t141 = _t84;
													if(_t84 != 0) {
														_push(0);
														_push(0x428c78);
														E004058EF(_t141);
														_t86 =  *0x42ec50; // 0x5d9b30
														E00405BC3(0, _t109, 0x428c78, 0x428c78,  *((intOrPtr*)(_t86 + 0x124)));
														_t88 = E00405401(0x428c78);
														if(_t88 != 0) {
															CloseHandle(_t88);
															 *((intOrPtr*)(_t122 + 0x10)) = 0;
														}
													}
												}
												 *0x42f400 =  *0x42f400 + 1;
												_t121 = _t121 - 1;
												_t143 = _t121;
											} while (_t121 != 0);
											_push(0);
											_push(_t109);
											E004058EF(_t143);
										}
										goto L35;
									}
									 *_t116 = 0;
									_t117 = _t116 + 4;
									if(E00405775(_t132, _t116 + 4) == 0) {
										goto L35;
									}
									E00405BA1("C:\\Program Files (x86)\\Fast!", _t117);
									E00405BA1("C:\\Program Files (x86)\\Fast!", _t117);
									 *((intOrPtr*)(_t122 + 0x10)) = 0;
									goto L34;
								}
								GetWindowsDirectoryA(_t109, 0x3fb);
								lstrcatA(_t109, "\\Temp");
								_t100 = E004030DC(_t127);
								_t128 = _t100;
								if(_t100 == 0) {
									goto L35;
								}
								goto L25;
							} else {
								goto L18;
							}
						}
					} else {
						goto L7;
					}
					do {
						L7:
						_t49 = _t49 + 1;
						__eflags =  *_t49 - 0x20;
					} while ( *_t49 == 0x20);
					goto L8;
				}
				goto L23;
			}

APIs

SetErrorMode.KERNEL32 ref: 00403131
GetVersion.KERNEL32 ref: 00403137
#17.COMCTL32(0000000B,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00403185
OleInitialize.OLE32(00000000), ref: 0040318C
SHGetFileInfoA.SHELL32(00429078,00000000,?,00000160,00000000), ref: 004031A8
GetCommandLineA.KERNEL32(Fast! Setup,NSIS Error), ref: 004031BD
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" ,00000000), ref: 004031D0
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" ,00409188), ref: 004031FB
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040328E
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004032A3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032AF
DeleteFileA.KERNEL32(1033), ref: 004032C2

Part of subcall function 00405F2D: GetModuleHandleA.KERNEL32(?,?,00000000,00403179,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00405F3F
Part of subcall function 00405F2D: GetProcAddress.KERNEL32(00000000,?), ref: 00405F5A

OleUninitialize.OLE32(00000000), ref: 00403340
ExitProcess.KERNEL32 ref: 00403360
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" ,00000000,00000000), ref: 00403373
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00409148,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" ,00000000,00000000), ref: 00403382
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" ,00000000,00000000), ref: 0040338D
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp), ref: 00403399
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 004033B5
DeleteFileA.KERNEL32(00428C78,00428C78,?,55410880,?), ref: 004033FF
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\SetupEngine.exe,00428C78,00000001), ref: 00403413
CloseHandle.KERNEL32(00000000,00428C78,00428C78,?,00428C78,00000000), ref: 00403440
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000006,00000005), ref: 00403499
ExitWindowsEx.USER32(00000002,80040002), ref: 004034F1
ExitProcess.KERNEL32 ref: 00403514

Strings

SeShutdownPrivilege, xrefs: 004034AB
\Temp, xrefs: 004032A9
NCRC, xrefs: 0040323B
USERENV, xrefs: 0040315E
Fast! Setup, xrefs: 004031B3
C:\Users\user\AppData\Local\Temp\SetupEngine.exe, xrefs: 0040340E
/D=, xrefs: 00403251
UXTHEME, xrefs: 00403154
", xrefs: 0040321D
C:\Users\user\AppData\Local\Temp\, xrefs: 00403283, 00403288, 004032A2, 004032AE, 00403370, 00403381, 0040338C, 00403398, 004033A5, 004033B4, 00403454
Error launching installer, xrefs: 004032F8
NSIS Error, xrefs: 004031AE
55410880, xrefs: 004033D2
SETUPAPI, xrefs: 00403168
, xrefs: 0040312C
.tmp, xrefs: 00403387
C:\Users\user\AppData\Local\Temp, xrefs: 00403392, 00403397, 004033C3
"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" , xrefs: 004031C3, 004031C9, 004032DF
C:\Program Files (x86)\Fast!, xrefs: 00403279, 00403312, 004033BB, 004033C4
C:\Program Files (x86)\Fast!, xrefs: 0040331D
~nsu, xrefs: 0040336B
1033, xrefs: 004032BD
_?=, xrefs: 004032E9

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Filelstrcat$ExitHandleProcess$CurrentDeleteDirectoryModuleWindows$AddressCharCloseCommandCopyErrorInfoInitializeLineModeNextPathProcTempUninitializeVersionlstrcmpi
String ID: $ /D=$ _?=$"$"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" $.tmp$1033$55410880$C:\Program Files (x86)\Fast!$C:\Program Files (x86)\Fast!$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\SetupEngine.exe$Error launching installer$Fast! Setup$NCRC$NSIS Error$SETUPAPI$SeShutdownPrivilege$USERENV$UXTHEME$\Temp$~nsu
API String ID: 728943206-1905642284
Opcode ID: 41f9bc2d16e618bae71c4cf800078db09f4ca73da24daa7a7add790fb46358f2
Instruction ID: 451575da7f46b68c591153a14feb1e54add6b468c03afba2ffefeba693a227d9
Opcode Fuzzy Hash: 41f9bc2d16e618bae71c4cf800078db09f4ca73da24daa7a7add790fb46358f2
Instruction Fuzzy Hash: 55A1E3705083416AE7216F629C4AF6B7EACEB4570AF04047FF541B61D2CB7C9A058A6F

Uniqueness

Uniqueness Score: -1.00%

Function 004054C6 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 156
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E004054C6(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E00405775(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72); // executed
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x42ecc8 =  *0x42ecc8 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E00405BA1(0x42b0c8, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E004056DB(_t72);
					} else {
						lstrcatA(0x42b0c8, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x409010);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]); // executed
						_t37 = FindFirstFileA(0x42b0c8,  &_v332); // executed
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E004056BF( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E00405BA1(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E00405859(_t72);
									_t52 = DeleteFileA(_t72); // executed
									__eflags = _t52;
									if(_t52 != 0) {
										E00404E8D(0xfffffff2, _t72); // executed
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x42ecc8 =  *0x42ecc8 + 1;
										} else {
											E00404E8D(0xfffffff1, _t72);
											_push(0);
											_push(_t72);
											E004058EF(__eflags);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E004054C6(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332); // executed
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4);
						goto L29;
					}
					__eflags =  *0x42b0c8 - 0x5c;
					if( *0x42b0c8 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405E9C(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E00405694(_t72);
							E00405859(_t72);
							_t37 = RemoveDirectoryA(_t72);
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404E8D(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404E8D(0xfffffff1, _t72);
							_push(0);
							_push(_t72);
							return E004058EF(__eflags);
						}
						L33:
						 *0x42ecc8 =  *0x42ecc8 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x004054d1
0x004054d5
0x004054de
0x004054e1
0x004054e4
0x004054ec
0x004054ee
0x004054ef
0x00000000
0x004054ef
0x004054fe
0x004054fe
0x00405501
0x00405504
0x00405518
0x0040551f
0x00405524
0x00405526
0x00405536
0x00405528
0x0040552e
0x0040552e
0x0040553b
0x0040553e
0x00405549
0x0040554f
0x00405554
0x00405564
0x00405566
0x0040556c
0x0040556f
0x00405572
0x0040562f
0x0040562f
0x00405633
0x00405635
0x00405635
0x00405635
0x00405635
0x00000000
0x00000000
0x00000000
0x00000000
0x00405578
0x00405578
0x00405581
0x00405587
0x0040558c
0x0040558f
0x00405591
0x00405595
0x00405597
0x00405597
0x00405595
0x0040559a
0x0040559d
0x004055b0
0x004055b2
0x004055b7
0x004055be
0x004055d6
0x004055dc
0x004055e2
0x004055e4
0x00405609
0x004055e6
0x004055e6
0x004055ea
0x004055fe
0x004055ec
0x004055ef
0x004055f4
0x004055f6
0x004055f7
0x004055f7
0x004055ea
0x004055c0
0x004055c6
0x004055c8
0x004055ce
0x004055ce
0x004055c8
0x00000000
0x004055be
0x0040559f
0x004055a2
0x004055a4
0x00000000
0x00000000
0x004055a6
0x004055a8
0x00000000
0x00000000
0x004055aa
0x004055ae
0x00000000
0x00000000
0x00000000
0x0040560e
0x00405618
0x0040561e
0x0040561e
0x00405629
0x00000000
0x00405629
0x00405540
0x00405547
0x00000000
0x00000000
0x00000000
0x00405506
0x00405506
0x00405508
0x00405639
0x0040563c
0x0040563f
0x00405691
0x00405691
0x00405691
0x00405641
0x00405644
0x0040564f
0x00405654
0x00405656
0x00000000
0x00000000
0x00405659
0x0040565f
0x00405665
0x0040566b
0x0040566d
0x00000000
0x00405689
0x0040566f
0x00405673
0x00000000
0x00000000
0x00405678
0x0040567d
0x0040567e
0x00000000
0x0040567f
0x00405646
0x00405646
0x00000000
0x00405646
0x0040550e
0x00405512
0x00000000
0x00000000
0x00000000
0x00405512

APIs

DeleteFileA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004054E4
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\testfile.temp,\*.*,C:\Users\user\AppData\Local\Temp\testfile.temp,?,00000000,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040552E
lstrcatA.KERNEL32(?,00409010,?,C:\Users\user\AppData\Local\Temp\testfile.temp,?,00000000,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040554F
lstrlenA.KERNEL32(?,?,00409010,?,C:\Users\user\AppData\Local\Temp\testfile.temp,?,00000000,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405555
FindFirstFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\testfile.temp,?,?,?,00409010,?,C:\Users\user\AppData\Local\Temp\testfile.temp,?,00000000,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405566
FindNextFileA.KERNELBASE(?,00000010,000000F2,?), ref: 00405618
FindClose.KERNEL32(?), ref: 00405629

Strings

"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" , xrefs: 004054C6
C:\Users\user\AppData\Local\Temp\testfile.temp, xrefs: 00405518, 0040551E, 0040552D, 00405563
C:\Users\user\AppData\Local\Temp\, xrefs: 004054D0
\*.*, xrefs: 00405528

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\SetupEngine.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\testfile.temp$\*.*
API String ID: 2035342205-201618221
Opcode ID: 68e8693fe866a1313b43b02a39c941ccdd9cef0246e33dddb2a3f008d3e507de
Instruction ID: 7349ebf4964971957ddff473b41d0a41d9b63905a7032000284e6e99f459cf31
Opcode Fuzzy Hash: 68e8693fe866a1313b43b02a39c941ccdd9cef0246e33dddb2a3f008d3e507de
Instruction Fuzzy Hash: 6C51F130404A487ADB226B228C45BBF3A69DF42318F50853BF909711D1DB7D9982DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405E9C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E9C(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x42c110); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x42c110;
			}

0x00405ea7
0x00405eb0
0x00000000
0x00405ebd
0x00405eb3
0x00000000

APIs

FindFirstFileA.KERNEL32(?,0042C110,C:\Users\user\AppData\Local\Temp\testfile.temp,004057B8,C:\Users\user\AppData\Local\Temp\testfile.temp,C:\Users\user\AppData\Local\Temp\testfile.temp,00000000,C:\Users\user\AppData\Local\Temp\testfile.temp,C:\Users\user\AppData\Local\Temp\testfile.temp,?,?,00000000,004054DA,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EA7
FindClose.KERNEL32(00000000), ref: 00405EB3

Strings

C:\Users\user\AppData\Local\Temp\testfile.temp, xrefs: 00405E9C

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\testfile.temp
API String ID: 2295610775-3626374370
Opcode ID: 6aebaf9d7798dbd017b42e649449a55c665c1a78b7402752724ce15f47781116
Instruction ID: c926c128dd9a58e72073d921ff5d887e323c8f6286bbbccf5b0fc9dd9174debe
Opcode Fuzzy Hash: 6aebaf9d7798dbd017b42e649449a55c665c1a78b7402752724ce15f47781116
Instruction Fuzzy Hash: 60D0C931A0A4205BD3011738AD0985B7A589B453713108E32F565F62E1D37899628AED

Uniqueness

Uniqueness Score: -1.00%

Function 00404FCB Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00404FCB(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				unsigned int _t93;
				int _t94;
				int _t95;
				long _t98;
				void* _t101;
				intOrPtr _t112;
				void* _t120;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x42e424; // 0x103f2
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						_t120 = CreateThread(0, 0, E00404F5F, GetDlgItem(_a4, 0x3ec), 0,  &_v12); // executed
						CloseHandle(_t120);
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							__eflags = _a12 - _t154;
							if(_a12 != _t154) {
								goto L20;
							}
							_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
							__eflags = _t87 - _t149;
							_a8 = _t87;
							if(_t87 <= _t149) {
								L37:
								return 0;
							}
							_t160 = CreatePopupMenu();
							AppendMenuA(_t160, _t149, 1, E00405BC3(_t149, _t154, _t160, _t149, 0xffffffe1));
							_t92 = _a16;
							__eflags = _t92 - 0xffffffff;
							if(_t92 != 0xffffffff) {
								_t150 = _t92;
								_t93 = _t92 >> 0x10;
								__eflags = _t93;
								_t94 = _t93;
							} else {
								GetWindowRect(_t154,  &_v28);
								_t150 = _v28.left;
								_t94 = _v28.top;
							}
							_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
							_t162 = 1;
							__eflags = _t95 - 1;
							if(_t95 == 1) {
								_v60 = _t149;
								_v48 = 0x42a0c0;
								_v44 = 0xfff;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t98 = SendMessageA(_v8, 0x102d, _a4,  &_v68);
									__eflags = _a4 - _t149;
									_t162 = _t162 + _t98 + 2;
								} while (_a4 != _t149);
								OpenClipboard(_t149);
								EmptyClipboard();
								_t101 = GlobalAlloc(0x42, _t162);
								_a4 = _t101;
								_t163 = GlobalLock(_t101);
								do {
									_v48 = _t163;
									_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
									 *_t164 = 0xa0d;
									_t163 = _t164 + 2;
									_t149 = _t149 + 1;
									__eflags = _t149 - _a8;
								} while (_t149 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L37;
						}
						__eflags =  *0x42e40c - _t149; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x42ec48, 8);
							__eflags =  *0x42eccc - _t149; // 0x0
							if(__eflags == 0) {
								_t112 =  *0x429890; // 0x5d9c5c
								E00404E8D( *((intOrPtr*)(_t112 + 0x34)), _t149);
							}
							E00403E36(1);
							goto L25;
						}
						 *0x429488 = 2;
						E00403E36(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00403EC4(_a8, _a12, _a16);
						}
						ShowWindow( *0x42e410, _t149);
						ShowWindow(_t154, 8);
						E00403E92(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x42ec50; // 0x5d9b30
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x42e410 = GetDlgItem(_a4, 0x403);
				 *0x42e408 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x42e424 = _t127;
				_v8 = _t127;
				E00403E92( *0x42e410);
				 *0x42e414 = E0040472F(4);
				 *0x42e42c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403E5D(_a4);
				if(( *0x42ec58 & 0x00000003) != 0) {
					ShowWindow( *0x42e410, _t149);
					if(( *0x42ec58 & 0x00000002) != 0) {
						 *0x42e410 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403E92( *0x42e408);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x42ec58 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

APIs

GetDlgItem.USER32(?,00000403), ref: 0040502A
GetDlgItem.USER32(?,000003EE), ref: 00405039
GetClientRect.USER32(?,?), ref: 00405076
GetSystemMetrics.USER32(00000015), ref: 0040507E
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 0040509F
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004050B0
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 004050C3
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 004050D1
SendMessageA.USER32(?,00001024,00000000,?), ref: 004050E4
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405106
ShowWindow.USER32(?,00000008), ref: 0040511A
GetDlgItem.USER32(?,000003EC), ref: 0040513B
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040514B
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405164
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 00405170
GetDlgItem.USER32(?,000003F8), ref: 00405048

Part of subcall function 00403E92: SendMessageA.USER32(00000028,?,00000001,00403CC3), ref: 00403EA0

GetDlgItem.USER32(?,000003EC), ref: 0040518D
CreateThread.KERNEL32(00000000,00000000,Function_00004F5F,00000000), ref: 0040519B
CloseHandle.KERNEL32(00000000), ref: 004051A2
ShowWindow.USER32(00000000), ref: 004051C6
ShowWindow.USER32(000103F2,00000008), ref: 004051CB
ShowWindow.USER32(00000008), ref: 00405212
SendMessageA.USER32(000103F2,00001004,00000000,00000000), ref: 00405244
CreatePopupMenu.USER32 ref: 00405255
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 0040526A
GetWindowRect.USER32(000103F2,?), ref: 0040527D
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004052A1
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004052DC
OpenClipboard.USER32(00000000), ref: 004052EC
EmptyClipboard.USER32 ref: 004052F2
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004052FB
GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405305
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405319
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405331
SetClipboardData.USER32(00000001,00000000), ref: 0040533C
CloseClipboard.USER32 ref: 00405342

Strings

{, xrefs: 00405231

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 81a5edb01f2c481cc91269a3399b72ec91bb31aab1936338fad3c8b3eb1c2df1
Instruction ID: 9773a58430cbfeecb670b401eb949321dafbae4239e93fa01985779c5be3160a
Opcode Fuzzy Hash: 81a5edb01f2c481cc91269a3399b72ec91bb31aab1936338fad3c8b3eb1c2df1
Instruction Fuzzy Hash: ADA14A70900208BFDB11AFA1DC89AAE7F79FB08354F40853AFA04BA1A0C7755A51DF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040398A Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E0040398A(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				intOrPtr _t44;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t141;
				void* _t142;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x42a0a4 = _t35;
					if(_t115 == 0x110) {
						 *0x42ec48 = _t125;
						 *0x42a0b8 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x429080 = _t91;
						E00403E5D(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x42e428);
						 *0x42e40c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x42a0a4 = 1;
					}
					_t122 =  *0x4091cc; // 0x0
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x42ec60;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403EA9(0x40b);
						while(1) {
							_t37 =  *0x42a0a4;
							 *0x4091cc =  *0x4091cc + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091cc; // 0x0
							__eflags = _t39 -  *0x42ec64; // 0x2
							if(__eflags == 0) {
								E0040140B(1);
							}
							__eflags =  *0x42e40c - _t133; // 0x0
							if(__eflags != 0) {
								break;
							}
							_t44 =  *0x42ec64; // 0x2
							__eflags =  *0x4091cc - _t44; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E00405BC3(_t116, _t125, _t130, 0x436800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403E5D(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403E5D(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403E5D(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x42eccc - _t133; // 0x0
							_v32 = _t49;
							if(__eflags != 0) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008); // executed
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100); // executed
							E00403E7F(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x429080, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x42eccc - _t133; // 0x0
							if(__eflags == 0) {
								_push( *0x42a0b8);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x429080);
							}
							E00403E92();
							E00405BA1(0x42a0c0, "Fast! Setup");
							E00405BC3(0x42a0c0, _t125, _t130,  &(0x42a0c0[lstrlenA(0x42a0c0)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x42a0c0); // executed
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x42e418); // executed
									 *0x429890 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x42ec40,  *_t130 +  *0x42e420 & 0x0000ffff, _t125,  *(0x4091d0 +  *(_t130 + 4) * 4), _t130); // executed
									__eflags = _t73 - _t133;
									 *0x42e418 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403E5D(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x42e418, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42e40c - _t133; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x42e418, 8); // executed
									E00403EA9(0x405);
									goto L58;
								}
								__eflags =  *0x42eccc - _t133; // 0x0
								if(__eflags != 0) {
									goto L61;
								}
								__eflags =  *0x42ecc0 - _t133; // 0x0
								if(__eflags != 0) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x42e418);
						 *0x42ec48 = _t133;
						EndDialog(_t125,  *0x429488);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x42e418, 0x40f, 0, 1);
						__eflags =  *0x42e40c - _t133; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x42a098, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x42a098,  ~(_a12 - 1) & _t115); // executed
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403EC4(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x42e418, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x42eccc - _t133; // 0x0
										if(__eflags == 0) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x429488 = 1;
											L21:
											_push(0x78);
											L22:
											E00403E36();
											goto L26;
										}
										E0040140B(_t127);
										 *0x429488 = _t127;
										goto L21;
									}
									__eflags =  *0x4091cc - _t133; // 0x0
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x42e418);
						 *0x42e418 = _a12;
						L58:
						_t141 =  *0x42b0c0 - _t133; // 0x1
						if(_t141 == 0) {
							_t142 =  *0x42e418 - _t133; // 0x503e0
							if(_t142 != 0) {
								ShowWindow(_t125, 0xa); // executed
								 *0x42b0c0 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x00403993
0x0040399c
0x00403add
0x00403ae1
0x00403ae5
0x00403ae7
0x00403aec
0x00403af7
0x00403b02
0x00403b07
0x00403b09
0x00403b0b
0x00403b0e
0x00403b13
0x00403b21
0x00403b2e
0x00403b35
0x00403b35
0x00403b36
0x00403b36
0x00403b3b
0x00403b41
0x00403b48
0x00403b4e
0x00403b50
0x00403b90
0x00403b95
0x00403b9a
0x00403b9a
0x00403b9f
0x00403ba8
0x00403baa
0x00403baf
0x00403bb5
0x00403bb9
0x00403bb9
0x00403bbe
0x00403bc4
0x00000000
0x00000000
0x00403bca
0x00403bcf
0x00403bd5
0x00000000
0x00000000
0x00403bde
0x00403be6
0x00403beb
0x00403bee
0x00403bf4
0x00403bf9
0x00403bfc
0x00403c02
0x00403c07
0x00403c0a
0x00403c10
0x00403c18
0x00403c1e
0x00403c24
0x00403c28
0x00403c2f
0x00403c2f
0x00403c2f
0x00403c39
0x00403c4b
0x00403c57
0x00403c5c
0x00403c66
0x00403c6c
0x00403c6e
0x00403c73
0x00403c70
0x00403c70
0x00403c70
0x00403c83
0x00403c9b
0x00403c9d
0x00403ca3
0x00403cb8
0x00403ca5
0x00403cae
0x00403cb0
0x00403cb0
0x00403cbe
0x00403cce
0x00403cdf
0x00403ce6
0x00403cec
0x00403cf0
0x00403cf5
0x00403cf7
0x00000000
0x00403cfd
0x00403cfd
0x00403cff
0x00000000
0x00000000
0x00403d05
0x00403d09
0x00403d2e
0x00403d34
0x00403d3a
0x00403d3c
0x00000000
0x00000000
0x00403d62
0x00403d68
0x00403d6a
0x00403d6f
0x00000000
0x00000000
0x00403d75
0x00403d78
0x00403d7b
0x00403d92
0x00403d9e
0x00403db7
0x00403dbd
0x00403dc1
0x00403dc6
0x00403dcc
0x00000000
0x00000000
0x00403dd6
0x00403de1
0x00000000
0x00403de1
0x00403d0b
0x00403d11
0x00000000
0x00000000
0x00403d17
0x00403d1d
0x00000000
0x00000000
0x00000000
0x00403d23
0x00403cf7
0x00403dee
0x00403dfa
0x00403e01
0x00000000
0x00403b52
0x00403b52
0x00403b55
0x00403b88
0x00403b88
0x00403b8a
0x00000000
0x00000000
0x00000000
0x00403b8a
0x00403b57
0x00403b5b
0x00403b60
0x00403b62
0x00000000
0x00000000
0x00403b72
0x00403b7a
0x00000000
0x00403b80
0x004039ae
0x004039ae
0x004039b2
0x004039b7
0x004039c6
0x004039c6
0x004039cf
0x004039d8
0x004039e3
0x004039e3
0x004039ef
0x00403a0b
0x00403a0e
0x00403a21
0x00403a27
0x00403aca
0x00000000
0x00403ad3
0x00403a2d
0x00403a3a
0x00403a3c
0x00403a3e
0x00403a5d
0x00403a5d
0x00403a60
0x00403a65
0x00403a68
0x00403a78
0x00403a79
0x00403a7b
0x00403ab1
0x00403ac4
0x00000000
0x00403ac4
0x00403a7d
0x00403a83
0x00403a9c
0x00403aa1
0x00403aa3
0x00000000
0x00000000
0x00403aa5
0x00403a91
0x00403a91
0x00403a93
0x00403a93
0x00000000
0x00403a93
0x00403a86
0x00403a8b
0x00000000
0x00403a8b
0x00403a6a
0x00403a70
0x00000000
0x00000000
0x00403a72
0x00000000
0x00403a72
0x00403a62
0x00000000
0x00403a62
0x00403a48
0x00403a4f
0x00403a55
0x00403a57
0x00000000
0x00000000
0x00000000
0x00403a57
0x00403a13
0x00000000
0x004039f1
0x004039f7
0x00403a01
0x00403e07
0x00403e07
0x00403e0d
0x00403e0f
0x00403e15
0x00403e1a
0x00403e20
0x00403e20
0x00403e15
0x00403e2a
0x00000000
0x00403e2a
0x004039ef

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039C6
ShowWindow.USER32(?), ref: 004039E3
DestroyWindow.USER32 ref: 004039F7
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A13
GetDlgItem.USER32(?,?), ref: 00403A34
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A48
IsWindowEnabled.USER32(00000000), ref: 00403A4F
GetDlgItem.USER32(?,00000001), ref: 00403AFD
GetDlgItem.USER32(?,00000002), ref: 00403B07
SetClassLongA.USER32(?,000000F2,?), ref: 00403B21
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B72
GetDlgItem.USER32(?,00000003), ref: 00403C18
ShowWindow.USER32(00000000,?), ref: 00403C39
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403C4B
EnableWindow.USER32(?,?), ref: 00403C66
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C7C
EnableMenuItem.USER32(00000000), ref: 00403C83
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403C9B
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403CAE
lstrlenA.KERNEL32(0042A0C0,?,0042A0C0,Fast! Setup), ref: 00403CD7
SetWindowTextA.USER32(?,0042A0C0), ref: 00403CE6
ShowWindow.USER32(?,0000000A), ref: 00403E1A

Strings

Fast! Setup, xrefs: 00403CC8

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Fast! Setup
API String ID: 3282139019-3337868355
Opcode ID: f37d912e389ff35b5f2e3d6fe2aeb75ce8efd3987cf1f0c8c2098123954ad298
Instruction ID: 5f76212842cc3a2ea0064beba359403a4e9feef3dd5448b927816276c7a72de1
Opcode Fuzzy Hash: f37d912e389ff35b5f2e3d6fe2aeb75ce8efd3987cf1f0c8c2098123954ad298
Instruction Fuzzy Hash: 1BC1D431604205ABDB216F62ED85D2B3EACFB49706F40053EF541B62E1C739A942DF6E

Uniqueness

Uniqueness Score: -1.00%

Function 004035F4 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E004035F4(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				signed int _t24;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				int _t37;
				int _t38;
				intOrPtr _t39;
				int _t42;
				intOrPtr _t60;
				char _t62;
				CHAR* _t64;
				signed char _t68;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				intOrPtr _t81;
				CHAR* _t85;

				_t81 =  *0x42ec50; // 0x5d9b30
				_t20 = E00405F2D(3);
				_t88 = _t20;
				if(_t20 == 0) {
					_t79 = 0x42a0c0;
					"1033" = 0x7830;
					E00405A88(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x42a0c0, 0);
					__eflags =  *0x42a0c0;
					if(__eflags == 0) {
						E00405A88(0x80000003, ".DEFAULT\\Control Panel\\International",  &M004072F6, 0x42a0c0, 0);
					}
					lstrcatA("1033", _t79);
				} else {
					E00405AFF("1033",  *_t20() & 0x0000ffff);
				}
				E004038BD(_t76, _t88);
				_t24 =  *0x42ec58; // 0x80
				_t84 = "C:\\Program Files (x86)\\Fast!";
				 *0x42ecc0 = _t24 & 0x00000020;
				 *0x42ecdc = 0x10000;
				if(E00405775(_t88, "C:\\Program Files (x86)\\Fast!") != 0) {
					L16:
					if(E00405775(_t96, _t84) == 0) {
						E00405BC3(0, _t79, _t81, _t84,  *((intOrPtr*)(_t81 + 0x118))); // executed
					}
					_t28 = LoadImageA( *0x42ec40, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x42e428 = _t28;
					if( *((intOrPtr*)(_t81 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E004038BD(_t76, __eflags);
							__eflags =  *0x42ece0; // 0x0
							if(__eflags != 0) {
								_t31 = E00404F5F(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42e40c; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x42a098, 5); // executed
							_t37 = E00405EC3("RichEd20"); // executed
							__eflags = _t37;
							if(_t37 == 0) {
								E00405EC3("RichEd32");
							}
							_t85 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t85, 0x42e3e0);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x42e3e0);
								 *0x42e404 = _t85;
								RegisterClassA(0x42e3e0);
							}
							_t39 =  *0x42e420; // 0x0
							_t42 = DialogBoxParamA( *0x42ec40, _t39 + 0x00000069 & 0x0000ffff, 0, E0040398A, 0); // executed
							E00403544(E0040140B(5), 1);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t76 =  *0x42ec40; // 0x400000
						 *0x42e3f4 = _t28;
						_v20 = 0x624e5f;
						 *0x42e3e4 = E00401000;
						 *0x42e3f0 = _t76;
						 *0x42e404 =  &_v20;
						if(RegisterClassA(0x42e3e0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x42a098 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x42ec40, 0);
						goto L21;
					}
				} else {
					_t76 =  *(_t81 + 0x48);
					if(_t76 == 0) {
						goto L16;
					}
					_t60 =  *0x42ec78; // 0x5e0188
					_t79 = 0x42dbe0;
					E00405A88( *((intOrPtr*)(_t81 + 0x44)), _t76,  *((intOrPtr*)(_t81 + 0x4c)) + _t60, 0x42dbe0, 0);
					_t62 =  *0x42dbe0; // 0x45
					if(_t62 == 0) {
						goto L16;
					}
					if(_t62 == 0x22) {
						_t79 = 0x42dbe1;
						 *((char*)(E004056BF(0x42dbe1, 0x22))) = 0;
					}
					_t64 = lstrlenA(_t79) + _t79 - 4;
					if(_t64 <= _t79 || lstrcmpiA(_t64, ?str?) != 0) {
						L15:
						E00405BA1(_t84, E00405694(_t79));
						goto L16;
					} else {
						_t68 = GetFileAttributesA(_t79);
						if(_t68 == 0xffffffff) {
							L14:
							E004056DB(_t79);
							goto L15;
						}
						_t96 = _t68 & 0x00000010;
						if((_t68 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

APIs

Part of subcall function 00405F2D: GetModuleHandleA.KERNEL32(?,?,00000000,00403179,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00405F3F
Part of subcall function 00405F2D: GetProcAddress.KERNEL32(00000000,?), ref: 00405F5A

lstrcatA.KERNEL32(1033,0042A0C0,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A0C0,00000000,00000003,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" ,00000000), ref: 00403665
lstrlenA.KERNEL32(Execute: ,?,?,?,Execute: ,00000000,C:\Program Files (x86)\Fast!,1033,0042A0C0,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A0C0,00000000,00000003,C:\Users\user\AppData\Local\Temp\), ref: 004036DA
lstrcmpiA.KERNEL32(?,.exe), ref: 004036ED
GetFileAttributesA.KERNEL32(Execute: ), ref: 004036F8
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files (x86)\Fast!), ref: 00403741

Part of subcall function 00405AFF: wsprintfA.USER32 ref: 00405B0C

RegisterClassA.USER32 ref: 00403788
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 004037A0
CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 004037D9
ShowWindow.USER32(00000005,00000000), ref: 0040380F
GetClassInfoA.USER32(00000000,RichEdit20A,0042E3E0), ref: 0040383B
GetClassInfoA.USER32(00000000,RichEdit,0042E3E0), ref: 00403848
RegisterClassA.USER32(0042E3E0), ref: 00403851
DialogBoxParamA.USER32(?,00000000,0040398A,00000000), ref: 00403870

Strings

RichEdit20A, xrefs: 00403833, 00403839
RichEd20, xrefs: 00403815
B, xrefs: 00403750
C:\Users\user\AppData\Local\Temp\, xrefs: 00403600
Execute: , xrefs: 004036A8, 004036B0, 004036BD, 00403707, 0040370D
.exe, xrefs: 004036E7
RichEdit, xrefs: 00403842
"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" , xrefs: 004035F8
C:\Program Files (x86)\Fast!, xrefs: 00403674, 0040367C, 00403714, 0040371A, 0040372A
_Nb, xrefs: 00403797, 0040379C
1033, xrefs: 00403614, 00403660
.DEFAULT\Control Panel\International, xrefs: 00403650
RichEd32, xrefs: 00403823
Control Panel\Desktop\ResourceLocale, xrefs: 00403628

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\SetupEngine.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Program Files (x86)\Fast!$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Execute: $RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$B
API String ID: 1975747703-2166606154
Opcode ID: ac045105ea430784d240a2a91794aa78d6c2f3841bae4eef558abf86d16be117
Instruction ID: 069ef0fb9a42e1b4956c000ddcdb280bce5473b1ca4ea0d36e0de5988d82752f
Opcode Fuzzy Hash: ac045105ea430784d240a2a91794aa78d6c2f3841bae4eef558abf86d16be117
Instruction Fuzzy Hash: EE61D8B16442007FD220AFA69C45F273A6CEB44749F44457FF940B32D1CA7DA9018A7E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C38 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00402C38(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				signed int _t54;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\alfredo\\AppData\\Local\\Temp\\SetupEngine.exe";
				 *0x42ec4c = _t43 + 0x3e8; // executed
				GetModuleFileNameA(0, "C:\\Users\\alfredo\\AppData\\Local\\Temp\\SetupEngine.exe", 0x400); // executed
				_t89 = E00405878(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409014 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\alfredo\\AppData\\Local\\Temp";
				E00405BA1("C:\\Users\\alfredo\\AppData\\Local\\Temp", _t91);
				E00405BA1(0x436000, E004056DB(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x428c70 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402BD4(1);
					__eflags =  *0x42ec54 - _t82; // 0x9e00
					if(__eflags == 0) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						_t54 =  *0x42ec54; // 0x9e00
						E004030C5(_t54 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff);
						_t57 = E00402E71();
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x42ec50 = _t94;
							 *0x42ec58 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x42ec5c =  *0x42ec5c + 1;
								__eflags =  *0x42ec5c;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405839(0x42ec60, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E004030C5( *0x414c60);
					_t65 = E00403093( &_a4, 4); // executed
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t67 =  *0x42ec54; // 0x9e00
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~_t67 & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E00403093(0x420c70, _t90); // executed
						__eflags = _t71;
						if(_t71 == 0) {
							E00402BD4(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x42ec54;
						if( *0x42ec54 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402BD4(0);
							}
							goto L20;
						}
						E00405839( &_v44, 0x420c70, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x414c60; // 0x2877bf
						 *0x42ece0 =  *0x42ece0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x42ec54 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t93 = _t80 - 4;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x428c70; // 0x28ac88
						if(__eflags < 0) {
							_v12 = E00405F9C(_v12, 0x420c70, _t90);
						}
						 *0x414c60 =  *0x414c60 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 > 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

APIs

GetTickCount.KERNEL32 ref: 00402C49
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\SetupEngine.exe,00000400), ref: 00402C65

Part of subcall function 00405878: GetFileAttributesA.KERNEL32(00000003,00402C78,C:\Users\user\AppData\Local\Temp\SetupEngine.exe,80000000,00000003), ref: 0040587C
Part of subcall function 00405878: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040589E

GetFileSize.KERNEL32(00000000,00000000,00436000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\SetupEngine.exe,C:\Users\user\AppData\Local\Temp\SetupEngine.exe,80000000,00000003), ref: 00402CB1

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00402C93, 00402C98, 00402C9E
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E10
"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" , xrefs: 00402C38
C:\Users\user\AppData\Local\Temp\SetupEngine.exe, xrefs: 00402C4F, 00402C5E, 00402C72, 00402C92
soft, xrefs: 00402D26
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C42
Inst, xrefs: 00402D1D
Null, xrefs: 00402D2F
Error launching installer, xrefs: 00402C88

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\SetupEngine.exe" $C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\SetupEngine.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-3461503145
Opcode ID: 52dd5125f2beb4c5a01725ee1ecfb7cda6383a0ef784e60b7ebdc9a7c5e8d2b4
Instruction ID: d5d64c7dde767481ec9b836f5bb8cc7fe4476435a14377af370c0b56c56fa9d6
Opcode Fuzzy Hash: 52dd5125f2beb4c5a01725ee1ecfb7cda6383a0ef784e60b7ebdc9a7c5e8d2b4
Instruction Fuzzy Hash: 7B51D971901214ABDB219FA6DE89B9E7BB8FB40354F10413BF900B62D1D7BC9D418B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405BC3 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 197
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00405BC3(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t36;
				CHAR* _t37;
				signed int _t39;
				int _t40;
				char _t50;
				char _t51;
				char _t53;
				char _t55;
				void* _t63;
				signed int _t69;
				intOrPtr _t73;
				signed int _t74;
				signed int _t75;
				intOrPtr _t79;
				char _t83;
				void* _t85;
				CHAR* _t86;
				void* _t88;
				signed int _t95;
				signed int _t97;
				void* _t98;

				_t88 = __esi;
				_t85 = __edi;
				_t63 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t79 =  *0x42e41c; // 0x5e149e
					_t36 =  *(_t79 - 4 + _t36 * 4);
				}
				_t73 =  *0x42ec78; // 0x5e0188
				_t74 = _t73 + _t36;
				_t37 = 0x42dbe0;
				_push(_t63);
				_push(_t88);
				_push(_t85);
				_t86 = 0x42dbe0;
				if(_a4 - 0x42dbe0 < 0x800) {
					_t86 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t83 =  *_t74;
					if(_t83 == 0) {
						break;
					}
					__eflags = _t86 - _t37 - 0x400;
					if(_t86 - _t37 >= 0x400) {
						break;
					}
					_t74 = _t74 + 1;
					__eflags = _t83 - 0xfc;
					_a8 = _t74;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t86 = _t83;
							_t86 =  &(_t86[1]);
							__eflags = _t86;
						} else {
							 *_t86 =  *_t74;
							_t86 =  &(_t86[1]);
							_t74 = _t74 + 1;
						}
						continue;
					}
					_t39 =  *(_t74 + 1);
					_t75 =  *_t74;
					_t95 = (_t39 & 0x0000007f) << 0x00000007 | _t75 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t75 | 0x00000080;
					_t69 = _t75;
					_v24 = _t69;
					__eflags = _t83 - 0xfe;
					_v20 = _t39 | 0x00000080;
					_v16 = _t39;
					if(_t83 != 0xfe) {
						__eflags = _t83 - 0xfd;
						if(_t83 != 0xfd) {
							__eflags = _t83 - 0xff;
							if(_t83 == 0xff) {
								__eflags = (_t39 | 0xffffffff) - _t95;
								E00405BC3(_t69, _t86, _t95, _t86, (_t39 | 0xffffffff) - _t95);
							}
							L41:
							_t40 = lstrlenA(_t86);
							_t74 = _a8;
							_t86 =  &(_t86[_t40]);
							_t37 = 0x42dbe0;
							continue;
						}
						__eflags = _t95 - 0x1d;
						if(_t95 != 0x1d) {
							__eflags = "55410880" + (_t95 << 0xa);
							E00405BA1(_t86, "55410880" + (_t95 << 0xa));
						} else {
							E00405AFF(_t86,  *0x42ec48);
						}
						__eflags = _t95 + 0xffffffeb - 7;
						if(_t95 + 0xffffffeb < 7) {
							L32:
							E00405E03(_t86);
						}
						goto L41;
					}
					_t97 = 2;
					_t50 = GetVersion();
					__eflags = _t50;
					if(_t50 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x42ecc4;
						if( *0x42ecc4 != 0) {
							_t97 = 4;
						}
						__eflags = _t69;
						if(_t69 >= 0) {
							__eflags = _t69 - 0x25;
							if(_t69 != 0x25) {
								__eflags = _t69 - 0x24;
								if(_t69 == 0x24) {
									GetWindowsDirectoryA(_t86, 0x400);
									_t97 = 0;
								}
								while(1) {
									__eflags = _t97;
									if(_t97 == 0) {
										goto L29;
									}
									_t51 =  *0x42ec44; // 0x746d1370
									_t97 = _t97 - 1;
									__eflags = _t51;
									if(_t51 == 0) {
										L25:
										_t53 = SHGetSpecialFolderLocation( *0x42ec48,  *(_t98 + _t97 * 4 - 0x18),  &_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											L27:
											 *_t86 =  *_t86 & 0x00000000;
											__eflags =  *_t86;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t86);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t55 =  *_t51( *0x42ec48,  *(_t98 + _t97 * 4 - 0x18), 0, 0, _t86);
									__eflags = _t55;
									if(_t55 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t86, 0x400);
							goto L29;
						} else {
							_t72 = (_t69 & 0x0000003f) +  *0x42ec78;
							E00405A88(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t69 & 0x0000003f) +  *0x42ec78, _t86, _t69 & 0x00000040); // executed
							__eflags =  *_t86;
							if( *_t86 != 0) {
								L30:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t86, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E00405BC3(_t72, _t86, _t97, _t86, _v16);
							L29:
							__eflags =  *_t86;
							if( *_t86 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t50 - 0x5a04;
					if(_t50 == 0x5a04) {
						goto L12;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L12;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t86 =  *_t86 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E00405BA1(_a4, _t37);
			}

APIs

GetVersion.KERNEL32(00000000,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,00404EC5,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000), ref: 00405C6B
GetSystemDirectoryA.KERNEL32(Execute: ,00000400), ref: 00405CE6
GetWindowsDirectoryA.KERNEL32(Execute: ,00000400), ref: 00405CF9
SHGetSpecialFolderLocation.SHELL32(?,0041D078), ref: 00405D35
SHGetPathFromIDListA.SHELL32(0041D078,Execute: ), ref: 00405D43
CoTaskMemFree.OLE32(0041D078), ref: 00405D4E
lstrcatA.KERNEL32(Execute: ,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D70
lstrlenA.KERNEL32(Execute: ,00000000,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,00404EC5,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000), ref: 00405DC2

Strings

Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 00405BF4
55410880, xrefs: 00405D9A
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405CB5
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D6A
Execute: , xrefs: 00405BEC, 00405CB3, 00405CD0, 00405CE5, 00405CF8, 00405D14, 00405D3F, 00405D6F, 00405D75, 00405D8D, 00405DA0, 00405DBB, 00405DC1, 00405DCC, 00405DF6

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: 55410880$Execute: $Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-2698196443
Opcode ID: 56c6644338f5748cd9e4adb5f2c50b348e185d39bfc66a16460e33acb065d9ec
Instruction ID: fa1e0b9f47c9474f0aa02006464afd466a30f7754b548aa089decd5b8df859b0
Opcode Fuzzy Hash: 56c6644338f5748cd9e4adb5f2c50b348e185d39bfc66a16460e33acb065d9ec
Instruction Fuzzy Hash: B8512531A04A15ABEB205B698C88BBB3B64DF11314F54827BE511BA2D0D37C5942DF4E

Uniqueness

Uniqueness Score: -1.00%

Function 00401734 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E00401734(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402A0C(0x31);
				 *(_t85 - 0xc) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x28) & 0x00000007;
				_t33 = E00405701(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E00405694(E00405BA1(0x409c60, "C:\\Program Files (x86)\\Fast!")), ??);
				} else {
					_push(0x409c60);
					E00405BA1();
				}
				E00405E03(0x409c60);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405E9C(0x409c60);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x1c);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405859(0x409c60);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E00405878(0x409c60, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 8) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404E8D(0xffffffe2,  *(_t85 - 0xc));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x42ecc8;
						goto L32;
					} else {
						E00405BA1(0x40a460, "55410880");
						E00405BA1("55410880", 0x409c60);
						E00405BC3(_t75, 0x40a460, 0x409c60, "C:\Users\alfredo\AppData\Local\Temp\SetupResources.exe",  *((intOrPtr*)(_t85 - 0x14)));
						E00405BA1("55410880", 0x40a460);
						_t62 = E00405462("C:\Users\alfredo\AppData\Local\Temp\SetupResources.exe",  *(_t85 - 0x28) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x42ecc8 =  &( *0x42ecc8->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x409c60);
								_push(0xfffffffa);
								E00404E8D();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404E8D(0xffffffea,  *(_t85 - 0xc)); // executed
				 *0x42ecf4 =  *0x42ecf4 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 8));
				_push( *((intOrPtr*)(_t85 - 0x20)));
				_t43 = E00402E71(); // executed
				 *0x42ecf4 =  *0x42ecf4 - 1;
				__eflags =  *(_t85 - 0x1c) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 8), _t85 - 0x1c, _t75, _t85 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 8)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405BC3(_t75, _t80, 0x409c60, 0x409c60, 0xffffffee);
					} else {
						E00405BC3(_t75, _t80, 0x409c60, 0x409c60, 0xffffffe9);
						lstrcatA(0x409c60,  *(_t85 - 0xc));
					}
					_push(0x200010);
					_push(0x409c60);
					E00405462();
					goto L29;
				}
				goto L33;
			}

0x00401734
0x0040173b
0x00401744
0x00401747
0x0040174a
0x0040174f
0x00401757
0x00401773
0x00401759
0x00401759
0x0040175a
0x0040175a
0x00401779
0x00401783
0x00401783
0x00401787
0x0040178a
0x0040178f
0x00401791
0x00401793
0x00401798
0x00401798
0x004017a3
0x004017a3
0x004017b4
0x004017b6
0x004017b6
0x004017b7
0x004017b7
0x004017ba
0x004017bd
0x004017c0
0x004017c0
0x004017c7
0x004017d6
0x004017db
0x004017de
0x004017e1
0x00000000
0x00000000
0x004017e3
0x004017e6
0x00401840
0x00401845
0x004015a8
0x00402672
0x00402672
0x004028a1
0x004028a4
0x004028a4
0x00000000
0x004017e8
0x004017ee
0x004017f9
0x00401806
0x00401811
0x00401827
0x00401827
0x0040182a
0x00000000
0x00401830
0x00401830
0x00401831
0x0040184e
0x004028aa
0x004028aa
0x004028aa
0x00401833
0x00401833
0x00401834
0x00401492
0x00402224
0x00402224
0x00402224
0x00401831
0x0040182a
0x004028ac
0x004028b0
0x004028b0
0x0040185e
0x00401863
0x00401869
0x0040186a
0x0040186b
0x0040186e
0x00401871
0x00401876
0x0040187c
0x00401880
0x00401882
0x0040188a
0x00401896
0x00401884
0x00401884
0x00401888
0x00000000
0x00000000
0x00401888
0x0040189f
0x004018a5
0x004018a7
0x00000000
0x004018ad
0x004018ad
0x004018b0
0x004018c8
0x004018b2
0x004018b5
0x004018be
0x004018be
0x004018cd
0x004018d2
0x0040221f
0x00000000
0x0040221f
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Local\Temp\SetupResources.exe,C:\Program Files (x86)\Fast!,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\Temp\SetupResources.exe,C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,00000000,C:\Users\user\AppData\Local\Temp\SetupResources.exe,C:\Program Files (x86)\Fast!,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 00405BA1: lstrcpynA.KERNEL32(?,?,00000400,004031BD,Fast! Setup,NSIS Error), ref: 00405BAE

Part of subcall function 00404E8D: lstrlenA.KERNEL32(Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,0041D078,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000,?), ref: 00404EC6
Part of subcall function 00404E8D: lstrlenA.KERNEL32(00402FCC,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,0041D078,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000), ref: 00404ED6
Part of subcall function 00404E8D: lstrcatA.KERNEL32(Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00402FCC,00402FCC,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,0041D078,765F3130), ref: 00404EE9
Part of subcall function 00404E8D: SetWindowTextA.USER32(Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe), ref: 00404EFB
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F21
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F3B
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F49

Strings

55410880, xrefs: 004017E8, 004017F4, 0040180C
C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 00401801, 0040181D
C:\Program Files (x86)\Fast!, xrefs: 00401761
C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 00401750, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2
55410880, xrefs: 0040177E, 004017ED, 0040180B

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: 55410880$55410880$C:\Program Files (x86)\Fast!$C:\Users\user\AppData\Local\Temp\SetupResources.exe$C:\Users\user\AppData\Local\Temp\SetupResources.exe
API String ID: 1941528284-1143603780
Opcode ID: 861f3879c83e28eb07bb09eee35a09ef472ebd3ea5b24dd6fff8f590b62750ba
Instruction ID: e79ae9243306ab86068bc1e71be5748962656d45b0e0834c5e2f96de839f3da3
Opcode Fuzzy Hash: 861f3879c83e28eb07bb09eee35a09ef472ebd3ea5b24dd6fff8f590b62750ba
Instruction Fuzzy Hash: 71419632914514BADF107BB9CC45EAF3679EF01329B20823BF421F11E1D77C9A418A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00402E71 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00402E71(int _a4, void* _a8, long _a12, int _a16, signed char _a19) {
				signed int _v8;
				long _v12;
				void* _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				char _v92;
				void* _t67;
				void* _t68;
				int _t71;
				long _t74;
				intOrPtr _t79;
				long _t80;
				void* _t82;
				int _t84;
				intOrPtr _t95;
				void* _t97;
				void* _t100;
				long _t101;
				signed int _t102;
				long _t103;
				int _t104;
				intOrPtr _t105;
				long _t106;
				void* _t107;

				_t102 = _a16;
				_t97 = _a12;
				_v12 = _t102;
				if(_t97 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_v16 = _t97;
				if(_t97 == 0) {
					_v16 = 0x418c68;
				}
				_t65 = _a4;
				if(_a4 >= 0) {
					_t95 =  *0x42ec98; // 0xb368
					E004030C5(_t95 + _t65);
				}
				_t67 = E00403093( &_a16, 4); // executed
				if(_t67 == 0) {
					L34:
					_push(0xfffffffd);
					goto L35;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t97 == 0) {
							while(_a16 > 0) {
								_t103 = _v12;
								if(_a16 < _t103) {
									_t103 = _a16;
								}
								if(E00403093(0x414c68, _t103) == 0) {
									goto L34;
								} else {
									_t71 = WriteFile(_a8, 0x414c68, _t103,  &_a12, 0); // executed
									if(_t71 == 0 || _t103 != _a12) {
										L29:
										_push(0xfffffffe);
										L35:
										_pop(_t68);
										return _t68;
									} else {
										_v8 = _v8 + _t103;
										_a16 = _a16 - _t103;
										continue;
									}
								}
							}
							L45:
							return _v8;
						}
						if(_a16 < _t102) {
							_t102 = _a16;
						}
						if(E00403093(_t97, _t102) != 0) {
							_v8 = _t102;
							goto L45;
						} else {
							goto L34;
						}
					}
					_t74 = GetTickCount();
					 *0x40b5cc =  *0x40b5cc & 0x00000000;
					 *0x40b5c8 =  *0x40b5c8 & 0x00000000;
					_t14 =  &_a16;
					 *_t14 = _a16 & 0x7fffffff;
					_v20 = _t74;
					 *0x40b0b0 = 8;
					 *0x414c58 = 0x40cc50;
					 *0x414c54 = 0x40cc50;
					 *0x414c50 = 0x414c50;
					_a4 = _a16;
					if( *_t14 <= 0) {
						goto L45;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t104 = 0x4000;
						if(_a16 < 0x4000) {
							_t104 = _a16;
						}
						if(E00403093(0x414c68, _t104) == 0) {
							goto L34;
						}
						_a16 = _a16 - _t104;
						 *0x40b0a0 = 0x414c68;
						 *0x40b0a4 = _t104;
						while(1) {
							_t100 = _v16;
							 *0x40b0a8 = _t100;
							 *0x40b0ac = _v12;
							_t79 = E0040600A(0x40b0a0);
							_v28 = _t79;
							if(_t79 < 0) {
								break;
							}
							_t105 =  *0x40b0a8; // 0x41d078
							_t106 = _t105 - _t100;
							_t80 = GetTickCount();
							_t101 = _t80;
							if(( *0x42ecf4 & 0x00000001) != 0 && (_t80 - _v20 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v92, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t107 = _t107 + 0xc;
								E00404E8D(0,  &_v92); // executed
								_v20 = _t101;
							}
							if(_t106 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L45;
							} else {
								if(_a12 != 0) {
									_t82 =  *0x40b0a8; // 0x41d078
									_v8 = _v8 + _t106;
									_v12 = _v12 - _t106;
									_v16 = _t82;
									L24:
									if(_v28 != 1) {
										continue;
									}
									goto L45;
								}
								_t84 = WriteFile(_a8, _v16, _t106,  &_v24, 0); // executed
								if(_t84 == 0 || _v24 != _t106) {
									goto L29;
								} else {
									_v8 = _v8 + _t106;
									goto L24;
								}
							}
						}
						_push(0xfffffffc);
						goto L35;
					}
					goto L34;
				}
			}

0x00402e79
0x00402e7d
0x00402e80
0x00402e85
0x00402e87
0x00402e87
0x00402e8e
0x00402e92
0x00402e97
0x00402e99
0x00402e99
0x00402ea0
0x00402ea5
0x00402ea7
0x00402eb0
0x00402eb0
0x00402ebb
0x00402ec2
0x0040303e
0x0040303e
0x00000000
0x00402ec8
0x00402ecc
0x00403029
0x0040307e
0x00403043
0x00403049
0x0040304b
0x0040304b
0x0040305c
0x00000000
0x0040305e
0x00403069
0x00403071
0x00403023
0x00403023
0x00403040
0x00403040
0x00000000
0x00403078
0x00403078
0x0040307b
0x00000000
0x0040307b
0x00403071
0x0040305c
0x00403089
0x00000000
0x00403089
0x0040302e
0x00403030
0x00403030
0x0040303c
0x00403086
0x00000000
0x00000000
0x00000000
0x00000000
0x0040303c
0x00402ed8
0x00402eda
0x00402ee1
0x00402ee8
0x00402ee8
0x00402eef
0x00402ef7
0x00402f01
0x00402f06
0x00402f0e
0x00402f18
0x00402f1b
0x00000000
0x00000000
0x00000000
0x00000000
0x00402f21
0x00402f21
0x00402f21
0x00402f29
0x00402f2b
0x00402f2b
0x00402f3c
0x00000000
0x00000000
0x00402f42
0x00402f45
0x00402f4b
0x00402f51
0x00402f51
0x00402f5c
0x00402f62
0x00402f67
0x00402f6e
0x00402f71
0x00000000
0x00000000
0x00402f77
0x00402f7d
0x00402f7f
0x00402f88
0x00402f8a
0x00402fb8
0x00402fbe
0x00402fc7
0x00402fcc
0x00402fcc
0x00402fd3
0x00403017
0x00000000
0x00000000
0x00000000
0x00402fd5
0x00402fd8
0x00402ffa
0x00402fff
0x00403002
0x00403005
0x00403008
0x0040300c
0x00000000
0x00000000
0x00000000
0x00403012
0x00402fe6
0x00402fee
0x00000000
0x00402ff5
0x00402ff5
0x00000000
0x00402ff5
0x00402fee
0x00402fd3
0x0040301f
0x00000000
0x0040301f
0x00000000
0x00402f21

APIs

GetTickCount.KERNEL32 ref: 00402ED8
GetTickCount.KERNEL32 ref: 00402F7F
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402FA8
wsprintfA.USER32 ref: 00402FB8
WriteFile.KERNEL32(00000000,00000000,0041D078,7FFFFFFF,00000000), ref: 00402FE6

Strings

hLA, xrefs: 00402F2E
... %d%%, xrefs: 00402FB2
hLA, xrefs: 0040304E

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%$hLA$hLA
API String ID: 4209647438-3864250065
Opcode ID: addaab61d9762357401ed889a56f94317b04aa9940b264370ab1ae8ac3205c02
Instruction ID: 8a95cf2a137d7550cfd21daf0583010478331d15a29cb338fc351ae0d0d0651f
Opcode Fuzzy Hash: addaab61d9762357401ed889a56f94317b04aa9940b264370ab1ae8ac3205c02
Instruction Fuzzy Hash: D261AE7190221AEBDB10DFA5DA44AAF7BB8EB40355F10417BF910B72C4D7789A40CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 00404E8D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404E8D(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x42e424; // 0x103f2
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x42ecf4; // 0x0
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405BC3(0, _t39, 0x429898, 0x429898, _a4);
					}
					_t26 = lstrlenA(0x429898);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x42e408, 0x429898); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x429898;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52); // executed
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x429898)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x429898, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

APIs

lstrlenA.KERNEL32(Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,0041D078,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000,?), ref: 00404EC6
lstrlenA.KERNEL32(00402FCC,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,0041D078,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000), ref: 00404ED6
lstrcatA.KERNEL32(Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00402FCC,00402FCC,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,0041D078,765F3130), ref: 00404EE9
SetWindowTextA.USER32(Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe), ref: 00404EFB
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F21
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F3B
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F49

Strings

Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 00404EAD, 00404EBF, 00404EC5, 00404EE8, 00404EF4

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe
API String ID: 2531174081-87080208
Opcode ID: b9bd97d855335461d49e39303d4d63c0ba14004c0d3fb8e2a59ec645a9842c76
Instruction ID: d5e3cfdbeb95b60488c6f1e99959168c2d2eab17d02c72d4f5409838ea1ae410
Opcode Fuzzy Hash: b9bd97d855335461d49e39303d4d63c0ba14004c0d3fb8e2a59ec645a9842c76
Instruction Fuzzy Hash: 2C21CF71900119BBDF11AFA5CD849DEBFB9EF45354F04807AF608B6290C779AE408FA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401F67 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E00401F67(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x42ecf8");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x42ecc8 =  *0x42ecc8 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402A0C(0xfffffff0);
				 *(_t34 + 8) = E00402A0C(1);
				if( *((intOrPtr*)(_t34 - 0x18)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404E8D(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x20)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, "55410880", 0x40b060, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x20)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x1c)) == _t27 && E00403594(_t30) != 0) {
						FreeLibrary(_t30); // executed
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F92

Part of subcall function 00404E8D: lstrlenA.KERNEL32(Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,0041D078,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000,?), ref: 00404EC6
Part of subcall function 00404E8D: lstrlenA.KERNEL32(00402FCC,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,0041D078,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000), ref: 00404ED6
Part of subcall function 00404E8D: lstrcatA.KERNEL32(Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00402FCC,00402FCC,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,0041D078,765F3130), ref: 00404EE9
Part of subcall function 00404E8D: SetWindowTextA.USER32(Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe), ref: 00404EFB
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F21
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F3B
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F49

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FA2
GetProcAddress.KERNEL32(00000000,?), ref: 00401FB2
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040201D

Strings

55410880, xrefs: 00401FE7

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: 55410880
API String ID: 2987980305-3135970518
Opcode ID: 801a099b5fd95eb9c77697c86ad587b1857083f2cf9509b898c20fc29b9b9ee6
Instruction ID: c2750792bbdc63a1f1471102f5095df33ec689d5572da80d747626f78b0a8a56
Opcode Fuzzy Hash: 801a099b5fd95eb9c77697c86ad587b1857083f2cf9509b898c20fc29b9b9ee6
Instruction Fuzzy Hash: 86210B32904115BBDF206FA5CE8CA6E3571BF44358F20423BF901B62E1DBBC49419A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00402319 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00402319(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				long _t22;
				char _t24;
				int _t27;
				signed int _t30;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402B01(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x18));
				 *(_t37 - 0x34) =  *(_t37 - 0x14);
				 *(_t37 - 0x38) = E00402A0C(2);
				_t18 = E00402A0C(0x11);
				_t30 =  *0x42ecf0; // 0x0
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27, _t30 | 0x00000002, _t27, _t37 + 8, _t27); // executed
				if(_t19 == 0) {
					if(_t35 == 1) {
						E00402A0C(0x23);
						_t19 = lstrlenA(0x40a460) + 1;
					}
					if(_t35 == 4) {
						_t24 = E004029EF(3);
						 *0x40a460 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402E71( *((intOrPtr*)(_t37 - 0x1c)), _t27, 0x40a460, 0xc00);
					}
					_t22 = RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x38), _t27,  *(_t37 - 0x34), 0x40a460, _t19); // executed
					if(_t22 == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x42ecc8 =  *0x42ecc8 +  *(_t37 - 4);
				return 0;
			}

0x0040231a
0x0040231f
0x00402329
0x00402333
0x00402336
0x00402340
0x00402350
0x00402357
0x0040235f
0x0040236d
0x00402371
0x0040237c
0x0040237c
0x00402380
0x00402384
0x0040238a
0x0040238f
0x0040238f
0x00402393
0x0040239f
0x0040239f
0x004023b0
0x004023b8
0x004023ba
0x004023ba
0x004023bd
0x00402493
0x00402493
0x004028a4
0x004028b0

APIs

RegCreateKeyExA.KERNEL32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402357
lstrlenA.KERNEL32(55410880,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402377
RegSetValueExA.KERNEL32(?,?,?,?,55410880,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004023B0
RegCloseKey.ADVAPI32(?,?,?,55410880,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402493

Strings

55410880, xrefs: 00402368, 0040238A, 0040239A, 004023A5

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: 55410880
API String ID: 1356686001-3135970518
Opcode ID: ac9b5ada296fc24c5c6ea54371084238815788cc5b260dfb5e312a6cfc4d7eb2
Instruction ID: 87e3eab27a64c54b83edf31c6fc5fb34a185908cb1e9cfdfcb2c5e910e3a0e9b
Opcode Fuzzy Hash: ac9b5ada296fc24c5c6ea54371084238815788cc5b260dfb5e312a6cfc4d7eb2
Instruction Fuzzy Hash: 74116371E00108BEEB10EFB5DE89EAF7A79EB50358F10403AF905B61D1D6B85D019A69

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E004015B3(struct _SECURITY_ATTRIBUTES* __ebx) {
				struct _SECURITY_ATTRIBUTES** _t10;
				int _t19;
				struct _SECURITY_ATTRIBUTES* _t20;
				signed char _t22;
				struct _SECURITY_ATTRIBUTES* _t23;
				CHAR* _t25;
				struct _SECURITY_ATTRIBUTES** _t29;
				void* _t30;

				_t23 = __ebx;
				_t25 = E00402A0C(0xfffffff0);
				_t10 = E00405728(_t25);
				_t27 = _t10;
				if(_t10 != __ebx) {
					do {
						_t29 = E004056BF(_t27, 0x5c);
						 *_t29 = _t23;
						 *((char*)(_t30 + 0xb)) =  *_t29;
						_t19 = CreateDirectoryA(_t25, _t23); // executed
						if(_t19 == 0) {
							if(GetLastError() != 0xb7) {
								L4:
								 *((intOrPtr*)(_t30 - 4)) =  *((intOrPtr*)(_t30 - 4)) + 1;
							} else {
								_t22 = GetFileAttributesA(_t25); // executed
								if((_t22 & 0x00000010) == 0) {
									goto L4;
								}
							}
						}
						_t20 =  *((intOrPtr*)(_t30 + 0xb));
						 *_t29 = _t20;
						_t27 =  &(_t29[0]);
					} while (_t20 != _t23);
				}
				if( *((intOrPtr*)(_t30 - 0x24)) == _t23) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405BA1("C:\\Program Files (x86)\\Fast!", _t25);
					SetCurrentDirectoryA(_t25); // executed
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

APIs

Part of subcall function 00405728: CharNextA.USER32(004054DA,?,C:\Users\user\AppData\Local\Temp\testfile.temp,00000000,0040578C,C:\Users\user\AppData\Local\Temp\testfile.temp,C:\Users\user\AppData\Local\Temp\testfile.temp,?,?,00000000,004054DA,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405736
Part of subcall function 00405728: CharNextA.USER32(00000000), ref: 0040573B
Part of subcall function 00405728: CharNextA.USER32(00000000), ref: 0040574A

CreateDirectoryA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNEL32(00000000,C:\Program Files (x86)\Fast!,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Program Files (x86)\Fast!, xrefs: 00401617

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Program Files (x86)\Fast!
API String ID: 3751793516-1788482285
Opcode ID: 597327efe11b8e62e647b590aa7803175c6eea41d15752db83c7af2f52a1ed46
Instruction ID: bb8d1e4e690ad92a523629274e31cd42690718b140f669fc0321f517961e655e
Opcode Fuzzy Hash: 597327efe11b8e62e647b590aa7803175c6eea41d15752db83c7af2f52a1ed46
Instruction Fuzzy Hash: AB010831908140AFDB217B795D44D6F77B49E56365B24063FF491B22E1C53C0941962E

Uniqueness

Uniqueness Score: -1.00%

Function 00405EC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405EC3(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				_t5 = _t16 + 0x409010; // 0x5c
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
				_t14 = LoadLibraryA( &_v292); // executed
				return _t14;
			}

0x00405eda
0x00405ee3
0x00405ee5
0x00405ee5
0x00405ee9
0x00405efb
0x00405ef5
0x00405ef5
0x00405ef5
0x00405eff
0x00405f13
0x00405f23
0x00405f2a

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405EDA
wsprintfA.USER32 ref: 00405F13
LoadLibraryA.KERNEL32(?), ref: 00405F23

Strings

\, xrefs: 00405EEB
%s%s.dll, xrefs: 00405F0D

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$\
API String ID: 2200240437-500877883
Opcode ID: bac9a2fc6f46d7ce26ef8fb07d33782f421afe65be062073a8d3b7340457a89d
Instruction ID: bb15d2e5d25401263bf0b052e26ed8f2ff91206720ea4b5c6b623b775464ebc4
Opcode Fuzzy Hash: bac9a2fc6f46d7ce26ef8fb07d33782f421afe65be062073a8d3b7340457a89d
Instruction Fuzzy Hash: 3FF02B309042095BDB149768DC0DEFB3B5CEB08304F1405BBA1C6E10D2E678ED558FD8

Uniqueness

Uniqueness Score: -1.00%

Function 004058A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004058A7(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

APIs

GetTickCount.KERNEL32 ref: 004058BA
GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 004058D4

Strings

"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" , xrefs: 004058A7
nsa, xrefs: 004058B3
C:\Users\user\AppData\Local\Temp\, xrefs: 004058AA, 004058AE

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\Temp\SetupEngine.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-726354538
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 40dff32a3e5f00750648796d4805ff32b13dc741bded237dc881b6ef32aeca23
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: 91F0A73734820476E7105E55DC04B9B7F6DDF91750F14C027FD449A1C0D6B4995497A5

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BAD() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 8) = E004029EF(3);
				 *(_t55 + 8) = E004029EF(4);
				if(( *(_t55 - 0x14) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 8)) = E00402A0C(0x33);
				}
				__eflags =  *(_t55 - 0x14) & 0x00000002;
				if(( *(_t55 - 0x14) & 0x00000002) != 0) {
					 *(_t55 + 8) = E00402A0C(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x2c)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E00402A0C();
					_t28 = E00402A0C();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 8),  *(_t55 + 8), _t31,  ~( *_t28) & _t28); // executed
					goto L10;
				} else {
					_t52 = E004029EF();
					_t37 = E004029EF();
					_t48 =  *(_t55 - 0x14) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8)); // executed
						L10:
						 *(_t55 - 0xc) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8), _t42, _t48, _t55 - 0xc);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x28)) >= _t42) {
					_push( *(_t55 - 0xc));
					E00405AFF();
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e392da7139347f63c408211002f75456f017542e4151f627b34d3607e76d39d5
Instruction ID: e2d4d96ca7e059e12ef29128c845d67dbcf5a6688523181a8ec59df7cc8b106d
Opcode Fuzzy Hash: e392da7139347f63c408211002f75456f017542e4151f627b34d3607e76d39d5
Instruction Fuzzy Hash: B021A171A44208BFEF01AFB5CD8AAAE7B75EF44344F14407AF501BA1D1D6B88A40DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00405401 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405401(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x42c0c8->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x42c0c8,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x0040540a
0x00405426
0x0040542e
0x00405433
0x00000000
0x00405439
0x0040543d

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,0042C0C8,Error launching installer), ref: 00405426
CloseHandle.KERNEL32(?), ref: 00405433

Strings

Error launching installer, xrefs: 00405414

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 0925aebfc32c6642fbbb941080814cd4d7ece6f22c8f43fc911f16656fd02ce2
Instruction ID: 8ba2d39aa234bef1b68f753dd4085f5a0355ab0b72bc814b33162f1b9dafcc5c
Opcode Fuzzy Hash: 0925aebfc32c6642fbbb941080814cd4d7ece6f22c8f43fc911f16656fd02ce2
Instruction Fuzzy Hash: 40E0E675A00209ABDB109FA4DC45A6F7B7CFF10305B404521E914F3151D774D5148A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00401B06 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B06(void* __ebx, void* __edx) {
				intOrPtr _t7;
				void* _t8;
				void _t11;
				void* _t13;
				void* _t21;
				void* _t24;
				void* _t30;
				void* _t33;
				void* _t34;
				void* _t37;

				_t27 = __ebx;
				_t7 =  *((intOrPtr*)(_t37 - 0x20));
				_t30 =  *0x40b060; // 0x4629f20
				if(_t7 == __ebx) {
					if(__edx == __ebx) {
						_t8 = GlobalAlloc(0x40, 0x404); // executed
						_t34 = _t8;
						_t4 = _t34 + 4; // 0x4
						E00405BC3(__ebx, _t30, _t34, _t4,  *((intOrPtr*)(_t37 - 0x28)));
						_t11 =  *0x40b060; // 0x4629f20
						 *_t34 = _t11;
						 *0x40b060 = _t34;
					} else {
						if(_t30 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t2 = _t30 + 4; // 0x4629f24
							E00405BA1(_t33, _t2);
							_push(_t30);
							 *0x40b060 =  *_t30;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t7 = _t7 - 1;
						if(_t30 == _t27) {
							break;
						}
						_t30 =  *_t30;
						if(_t7 != _t27) {
							continue;
						} else {
							if(_t30 == _t27) {
								break;
							} else {
								_t32 = _t30 + 4;
								E00405BA1(0x409c60, _t30 + 4);
								_t21 =  *0x40b060; // 0x4629f20
								E00405BA1(_t32, _t21 + 4);
								_t24 =  *0x40b060; // 0x4629f20
								_push(0x409c60);
								_push(_t24 + 4);
								E00405BA1();
								L15:
								 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t37 - 4));
								_t13 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E00405BC3(_t27, _t30, _t33, _t27, 0xffffffe8));
					E00405462();
					_t13 = 0x7fffffff;
				}
				L17:
				return _t13;
			}

APIs

GlobalFree.KERNEL32(04629F20), ref: 00401B75
GlobalAlloc.KERNEL32(00000040,00000404), ref: 00401B87

Strings

C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 00401B2D, 00401B33, 00401B4D

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Global$AllocFree
String ID: C:\Users\user\AppData\Local\Temp\SetupResources.exe
API String ID: 3394109436-449369027
Opcode ID: be0f11f5fd79cc286118738d5a4b6be00696a1eaf22e230fcb2a28b3e6b5f6d9
Instruction ID: cc00a111a875a158010fb0437ff6a2ad2fcab022a3b836d45fe26aacbc009528
Opcode Fuzzy Hash: be0f11f5fd79cc286118738d5a4b6be00696a1eaf22e230fcb2a28b3e6b5f6d9
Instruction Fuzzy Hash: 67219376604104ABD710ABA8DEC9E5B72B9FB84314B24453BF611F32D1EB7CB8018B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1B Relevance: 4.5, APIs: 3, Instructions: 48
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00401E1B() {
				void* _t15;
				void* _t24;
				void* _t26;
				void* _t31;

				_t28 = E00402A0C(_t24);
				E00404E8D(0xffffffeb, _t13); // executed
				_t15 = E00405401(_t28); // executed
				 *(_t31 + 8) = _t15;
				if(_t15 == _t24) {
					 *((intOrPtr*)(_t31 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t31 - 0x20)) != _t24) {
						while(WaitForSingleObject( *(_t31 + 8), 0x64) == 0x102) {
							E00405F69(0xf);
						}
						GetExitCodeProcess( *(_t31 + 8), _t31 - 0xc);
						if( *((intOrPtr*)(_t31 - 0x24)) < _t24) {
							if( *(_t31 - 0xc) != _t24) {
								 *((intOrPtr*)(_t31 - 4)) = 1;
							}
						} else {
							E00405AFF(_t26,  *(_t31 - 0xc));
						}
					}
					_push( *(_t31 + 8));
					CloseHandle();
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t31 - 4));
				return 0;
			}

APIs

Part of subcall function 00404E8D: lstrlenA.KERNEL32(Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,0041D078,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000,?), ref: 00404EC6
Part of subcall function 00404E8D: lstrlenA.KERNEL32(00402FCC,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,0041D078,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000), ref: 00404ED6
Part of subcall function 00404E8D: lstrcatA.KERNEL32(Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00402FCC,00402FCC,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,0041D078,765F3130), ref: 00404EE9
Part of subcall function 00404E8D: SetWindowTextA.USER32(Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe,Execute: C:\Users\user\AppData\Local\Temp\SetupResources.exe), ref: 00404EFB
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F21
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F3B
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F49

Part of subcall function 00405401: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,0042C0C8,Error launching installer), ref: 00405426
Part of subcall function 00405401: CloseHandle.KERNEL32(?), ref: 00405433

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E55
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E65
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401E8A

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: f4deba2ecf4bbcd7bc66a64d1ece4e36979947451aa6e29c67bd88023c1df008
Instruction ID: 2a50f7c186f8d6ad55db8ec4cc548a4808b9981e8607132828513abc09ff4306
Opcode Fuzzy Hash: f4deba2ecf4bbcd7bc66a64d1ece4e36979947451aa6e29c67bd88023c1df008
Instruction Fuzzy Hash: 2A016931D04114EBDF21AFA1CD85A9E7B71EF00358F24813BF905B61E1C7B94A81DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00405A88 Relevance: 4.5, APIs: 3, Instructions: 45
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00405A88(void* _a4, int _a8, char* _a12, int _a16, void* _a20) {
				long _t20;
				long _t23;
				long _t24;
				char* _t26;

				asm("sbb eax, eax");
				_t26 = _a16;
				 *_t26 = 0;
				_t20 = RegOpenKeyExA(_a4, _a8, 0,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				if(_t20 == 0) {
					_a8 = 0x400;
					_t23 = RegQueryValueExA(_a20, _a12, 0,  &_a16, _t26,  &_a8); // executed
					if(_t23 != 0 || _a16 != 1 && _a16 != 2) {
						 *_t26 = 0;
					}
					_t26[0x3ff] = 0;
					_t24 = RegCloseKey(_a20); // executed
					return _t24;
				}
				return _t20;
			}

0x00405a98
0x00405a9a
0x00405aa7
0x00405ab1
0x00405ab9
0x00405abe
0x00405ad2
0x00405ada
0x00405ae8
0x00405ae8
0x00405aed
0x00405af3
0x00000000
0x00405af3
0x00405afc

APIs

RegOpenKeyExA.KERNEL32(80000002,00405CC4,00000000,00000002,?,00000002,001B1511,?,00405CC4,80000002,Software\Microsoft\Windows\CurrentVersion,001B1511,Execute: ,005E0189), ref: 00405AB1
RegQueryValueExA.KERNEL32(001B1511,?,00000000,00405CC4,001B1511,00405CC4), ref: 00405AD2
RegCloseKey.KERNEL32(?), ref: 00405AF3

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 67b3e0d3ded8972df4b5bccd868b78f6ad8d4f27bd32828d0c76414c952c029f
Instruction ID: 73a274855f42cec9a7ce3e58aeff3d3433a4445e8632c2ebf8a036d33102cd28
Opcode Fuzzy Hash: 67b3e0d3ded8972df4b5bccd868b78f6ad8d4f27bd32828d0c76414c952c029f
Instruction Fuzzy Hash: 8701487114020AEFDF128F64EC88AEB3FACEF14358F004126F904A6160D235D964DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040251C Relevance: 3.1, APIs: 2, Instructions: 79
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040251C(intOrPtr __ebx, void* __edi, void* __esi) {
				intOrPtr _t28;
				void* _t37;
				void* _t40;

				 *((intOrPtr*)(_t37 - 0x30)) = __ebx;
				_t28 = E004029EF(2);
				_t40 = _t28 - 1;
				 *((intOrPtr*)(_t37 - 8)) = _t28;
				if(_t40 < 0) {
					L25:
					 *0x42ecc8 =  *0x42ecc8 +  *(_t37 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *((intOrPtr*)(__ebp - 8)) = 0x3ff;
					}
					if( *__esi == __bl) {
						L22:
						__esi =  *((intOrPtr*)(__ebp - 0x30));
						goto L23;
					} else {
						 *((char*)(__ebp + 0xb)) = __bl;
						 *(__ebp - 0xc) = E00405B18(__ecx, __esi);
						if( *((intOrPtr*)(__ebp - 8)) <= __ebx) {
							goto L22;
						} else {
							__esi =  *((intOrPtr*)(__ebp - 0x30));
							while(1) {
								__ebp - 0x34 = __ebp - 0xd;
								__eax = ReadFile( *(__ebp - 0xc), __ebp - 0xd, 1, __ebp - 0x34, __ebx); // executed
								if(__eax == 0 ||  *(__ebp - 0x34) != 1) {
									break;
								}
								if( *((intOrPtr*)(__ebp - 0x1c)) != __ebx) {
									 *(__ebp - 0xd) & 0x000000ff = E00405AFF(__edi,  *(__ebp - 0xd) & 0x000000ff);
								} else {
									if( *((char*)(__ebp + 0xb)) == 0xd ||  *((char*)(__ebp + 0xb)) == 0xa) {
										__al =  *(__ebp - 0xd);
										if( *((intOrPtr*)(__ebp + 0xb)) == __al || __al != 0xd && __al != 0xa) {
											__eax = SetFilePointer( *(__ebp - 0xc), 0xffffffff, __ebx, 1);
										} else {
											 *((char*)(__esi + __edi)) = __al;
											__esi = __esi + 1;
										}
										break;
									} else {
										__al =  *(__ebp - 0xd);
										 *((char*)(__esi + __edi)) = __al;
										__esi = __esi + 1;
										 *((char*)(__ebp + 0xb)) = __al;
										if(__al == __bl) {
											break;
										} else {
											if(__esi <  *((intOrPtr*)(__ebp - 8))) {
												continue;
											} else {
												break;
											}
										}
									}
								}
								goto L26;
							}
							L23:
							 *((char*)(__esi + __edi)) = __bl;
							if(_t40 == 0) {
								 *(_t37 - 4) = 1;
							}
							goto L25;
						}
					}
				}
				L26:
				return 0;
			}

APIs

ReadFile.KERNEL32(?,?,00000001,?,?,?,00000002), ref: 00402568

Part of subcall function 00405AFF: wsprintfA.USER32 ref: 00405B0C

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: FileReadwsprintf
String ID:
API String ID: 3326442220-0
Opcode ID: b477d60ff94f73c1c0bb044503b76951384e81d4576d319d4125a1203f1dc534
Instruction ID: 19eab3b86d9b75e5e7be3b308233c29603b61c08bd2d52ff7fc178e77211348e
Opcode Fuzzy Hash: b477d60ff94f73c1c0bb044503b76951384e81d4576d319d4125a1203f1dc534
Instruction Fuzzy Hash: D821F871C04199BFDF318B988E596AEBB749F01304F14417BE581B62D1C6BC8A81CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				intOrPtr _t15;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t15 =  *0x42ec70; // 0x5da0f4
					_t6 = _t17 * 0x1c + _t15;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42e42c =  *0x42e42c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42e42c, 0x7530,  *0x42e414), 0); // executed
					}
				}
				return 0;
			}

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(00000020,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 42849ed48d919fde42c0d44f840d19e9f7e342482cf35ba8d4f2414d886d90f9
Instruction ID: 86a6a9173f7d20567c8ae2bb249fddc303668c970c82e3d032b9735ebafba260
Opcode Fuzzy Hash: 42849ed48d919fde42c0d44f840d19e9f7e342482cf35ba8d4f2414d886d90f9
Instruction Fuzzy Hash: B30128317242209BE7195B399C05B6A369CE714328F50853BF851F72F2DA78DC039B8D

Uniqueness

Uniqueness Score: -1.00%

Function 00405F2D Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F2D(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x409228);
				_t5 = GetModuleHandleA( *(_t10 + 0x409228));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40922c));
				}
				_t5 = E00405EC3(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00405f35
0x00405f38
0x00405f3f
0x00405f47
0x00405f53
0x00000000
0x00405f5a
0x00405f4a
0x00405f51
0x00000000
0x00405f62
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,00403179,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00405F3F
GetProcAddress.KERNEL32(00000000,?), ref: 00405F5A

Part of subcall function 00405EC3: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405EDA
Part of subcall function 00405EC3: wsprintfA.USER32 ref: 00405F13
Part of subcall function 00405EC3: LoadLibraryA.KERNEL32(?), ref: 00405F23

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 1ff86fa5640f02b1d9e100387d52f784ab4969e574a7c6b0b5bb7fb3ea5c422e
Instruction ID: 5a94b1a02772503a3f00306f9b3f9683cc322e661ee482fd999d4dc3ca30496d
Opcode Fuzzy Hash: 1ff86fa5640f02b1d9e100387d52f784ab4969e574a7c6b0b5bb7fb3ea5c422e
Instruction Fuzzy Hash: 3AE0863260861176D6105B74AD0496B72A8DE8C7503054C7EF945F6190D738DC119AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401D95 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DAB
EnableWindow.USER32(00000000,00000000), ref: 00401DB6

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: ae616deb1d91a9ee62849baea6a1aef614bcf9fb8b17366007d34e2a1c71782b
Instruction ID: 984ebb461e7b3d17f7d90f3cfa72f58d5920c2121cea36e24e5a662f071b7263
Opcode Fuzzy Hash: ae616deb1d91a9ee62849baea6a1aef614bcf9fb8b17366007d34e2a1c71782b
Instruction Fuzzy Hash: 4BE08672A04100DBD750A7B59D4D95E3264AF00369B104037E402F11C1C97C5C018659

Uniqueness

Uniqueness Score: -1.00%

Function 00405878 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405878(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x0040587c
0x00405889
0x0040589e
0x004058a4

APIs

GetFileAttributesA.KERNEL32(00000003,00402C78,C:\Users\user\AppData\Local\Temp\SetupEngine.exe,80000000,00000003), ref: 0040587C
CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040589E

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction ID: 518821d5ca0a74227a37217cadb520a33af9faec79942caa6648154b48e23ab6
Opcode Fuzzy Hash: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction Fuzzy Hash: DDD09E71658301AFEF098F20DE1AF2E7AA2EB84B01F10962CB646940E0D6715C15DB16

Uniqueness

Uniqueness Score: -1.00%

Function 00405859 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405859(CHAR* _a4) {
				signed char _t3;
				int _t5;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					_t5 = SetFileAttributesA(_a4, _t3 & 0x000000fe); // executed
					return _t5;
				}
				return _t3;
			}

0x0040585d
0x00405866
0x0040586f
0x00000000
0x0040586f
0x00405875

APIs

GetFileAttributesA.KERNEL32(?,00405664,?,?,?), ref: 0040585D
SetFileAttributesA.KERNEL32(?,00000000), ref: 0040586F

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 074f941138e9f1df105fff9ec0b177d36ae7deb3ea45ba36f2ce8c3e98632dd9
Instruction ID: 15299d6900fb3f0dcfcb805ba40550cd3d393431f2dda1ea0104ff8e742be84e
Opcode Fuzzy Hash: 074f941138e9f1df105fff9ec0b177d36ae7deb3ea45ba36f2ce8c3e98632dd9
Instruction Fuzzy Hash: 8AC04CB1808505BBD6016B35DF4DC1F7B66EB50321B108B35F569A01F0CB319C66DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 004053CC Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004053CC(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x004053d2
0x004053da
0x00000000
0x004053e0
0x00000000

APIs

CreateDirectoryA.KERNEL32(?,00000000,00403100,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 004053D2
GetLastError.KERNEL32 ref: 004053E0

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 62594c709cce2f5b8fb8ca5d54e7f3286412bfa0f130784d9dc04a2d264f0cc1
Instruction ID: 0a32bba0594ce4c50c7d18531d00583a5fdebb7a5bad339d624f0ac39b1a71a3
Opcode Fuzzy Hash: 62594c709cce2f5b8fb8ca5d54e7f3286412bfa0f130784d9dc04a2d264f0cc1
Instruction Fuzzy Hash: B0C04C30A08501EBD6105B31AE49B177AE49B547C1F1045366506E41E0D7B49411D93E

Uniqueness

Uniqueness Score: -1.00%

Function 004025E2 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E004025E2(void* __eflags) {
				long _t6;
				long _t8;
				LONG* _t10;
				void* _t12;
				void* _t15;
				void* _t17;

				_push(ds);
				if(__eflags != 0) {
					_t6 = E004029EF(2);
					_t8 = SetFilePointer(E00405B18(_t12, _t15), _t6, _t10,  *(_t17 - 0x1c)); // executed
					if( *((intOrPtr*)(_t17 - 0x24)) >= _t10) {
						_push(_t8);
						E00405AFF();
					}
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x004025e2
0x004025e3
0x004025ef
0x004025fc
0x00402605
0x00402847
0x00402849
0x00402849
0x00402605
0x004028a4
0x004028b0

APIs

SetFilePointer.KERNEL32(00000000,?,00000000,00000002,?,?), ref: 004025FC

Part of subcall function 00405AFF: wsprintfA.USER32 ref: 00405B0C

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 7802b7b00399cfaf2990ab86e23f61d39cfe8f9262743632c11858e8c721a55f
Instruction ID: af763d8a78a761db22c42ff553d5b38efdf029ab42d771ce7adfc9ea42a260e9
Opcode Fuzzy Hash: 7802b7b00399cfaf2990ab86e23f61d39cfe8f9262743632c11858e8c721a55f
Instruction Fuzzy Hash: 8BE01A77A04100ABE741B7A69E8A8BF7269EF40309B10413BF501B10D1CABD5C025A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403093 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403093(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409014, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x00403097
0x004030aa
0x004030b2
0x00000000
0x004030b9
0x00000000
0x004030bb

APIs

ReadFile.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,00402EC0,000000FF,00000004,00000000,00000000,00000000), ref: 004030AA

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0be395bbe571093c8e78859d05ee89954336de5599fe3087c5eab9dc4054fae4
Instruction ID: fff8dc69d300bf088447089d7068fb6aaa903b2c1760e3ba56c5ad9840b64b03
Opcode Fuzzy Hash: 0be395bbe571093c8e78859d05ee89954336de5599fe3087c5eab9dc4054fae4
Instruction Fuzzy Hash: BAE08C32161118BBCF215E52EC00EE73B5CEB047A2F008033BA14E62A0D670EA14DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00403E5D Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E5D(intOrPtr _a12) {
				intOrPtr _v0;
				struct HWND__* _v4;
				int _t7;
				void* _t8;
				void* _t9;
				void* _t10;

				_t7 = SetDlgItemTextA(_v4, _v0 + 0x3e8, E00405BC3(_t8, _t9, _t10, 0, _a12)); // executed
				return _t7;
			}

0x00403e77
0x00403e7c

APIs

SetDlgItemTextA.USER32(?,?,00000000), ref: 00403E77

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: bd088f7f00d811be993cb0fa1566991d2d73bb63516f205f68802a77c6a304db
Instruction ID: ef3ffff1d02dc7de7135e56bd9a3da932b159402b42e9e0b37d7e7a6cf7c8a2a
Opcode Fuzzy Hash: bd088f7f00d811be993cb0fa1566991d2d73bb63516f205f68802a77c6a304db
Instruction Fuzzy Hash: 15C08C31048300BFD281A704CC02F0FB7E8EF9031AF40C82EB16CA40D1C634D4208E2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403EA9 Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403EA9(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x42e418; // 0x503e0
				if(_t2 != 0) {
					_t3 = SendMessageA(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x00403ea9
0x00403eb0
0x00403ebb
0x00000000
0x00403ebb
0x00403ec1

APIs

SendMessageA.USER32(000503E0,00000000,00000000,00000000), ref: 00403EBB

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 43c32328bbefc1a3920a48ff71181bee35ee5e1fabb1ba4cd28715ef016f3240
Instruction ID: 754643320ca30f69397f413a8b8db00d71b0532af1d09d8a00dcaf1ba171179f
Opcode Fuzzy Hash: 43c32328bbefc1a3920a48ff71181bee35ee5e1fabb1ba4cd28715ef016f3240
Instruction Fuzzy Hash: B0C09B717543017BEE20DF65DD45F0B7B586754B01F148435B200FB1D1C675E411DA6D

Uniqueness

Uniqueness Score: -1.00%

Function 004030C5 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030C5(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409014, _a4, 0, 0); // executed
				return _t2;
			}

0x004030d3
0x004030d9

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00402DFF,00009DE4), ref: 004030D3

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1fe8ad6970e23be315a08abdb90e0b058f57890677f29add635e0ec7003afc6f
Instruction ID: 89776e93a0172b97a38fb7948c015c90ed7fb14eba3da05579cbd58eb2c2bcc6
Opcode Fuzzy Hash: 1fe8ad6970e23be315a08abdb90e0b058f57890677f29add635e0ec7003afc6f
Instruction Fuzzy Hash: 87B01271644200BFDB214F00DF06F057B61A794701F108030B744380F082712830EB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00403E92 Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E92(int _a4) {
				long _t2;

				_t2 = SendMessageA( *0x42ec48, 0x28, _a4, 1); // executed
				return _t2;
			}

0x00403ea0
0x00403ea6

APIs

SendMessageA.USER32(00000028,?,00000001,00403CC3), ref: 00403EA0

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4bd8982626c92abb2357f82476bd4d99c5d7f29670624c06be2de6c5191f01be
Instruction ID: 44392e581bbb4aa9116d087c90e7fb2cdd31efd5ead07ebe883a28bd9b35942d
Opcode Fuzzy Hash: 4bd8982626c92abb2357f82476bd4d99c5d7f29670624c06be2de6c5191f01be
Instruction Fuzzy Hash: DAB01236688202BBEE214B41DD09F457E62F768701F008030F300280F4CAB200A1EF09

Uniqueness

Uniqueness Score: -1.00%

Function 00403E7F Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E7F(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x42a0b8, _a4); // executed
				return _t2;
			}

0x00403e89
0x00403e8f

APIs

KiUserCallbackDispatcher.NTDLL(?,00403C5C), ref: 00403E89

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 8c5842e903119d4e54e6dca0c52f7b0b198653f2e5d8341527d4c31334f50caf
Instruction ID: 95dc7da4476d59103c26fcc6ae799d7f945830a776bf5e17fb181abdd4047406
Opcode Fuzzy Hash: 8c5842e903119d4e54e6dca0c52f7b0b198653f2e5d8341527d4c31334f50caf
Instruction Fuzzy Hash: EDA002755041009BCB555F50DF04D057B62A7547017415435A5455417486315579EB1F

Uniqueness

Uniqueness Score: -1.00%

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 17
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004014D6() {
				long _t2;
				void* _t6;
				void* _t10;

				_t2 = E004029EF(_t6);
				if(_t2 <= 1) {
					_t2 = 1;
				}
				Sleep(_t2); // executed
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t10 - 4));
				return 0;
			}

0x004014d7
0x004014df
0x004014e3
0x004014e3
0x004014e5
0x004028a4
0x004028b0

APIs

Sleep.KERNEL32(00000000), ref: 004014E5

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7e2d3c9da8ec6a78321f4ae076fb829d069b97fddca15ccf4575fb6a68b65752
Instruction ID: 2279a1eb59868a7384db17342a960448875f3c9b0d9377e09ad035f05ac00328
Opcode Fuzzy Hash: 7e2d3c9da8ec6a78321f4ae076fb829d069b97fddca15ccf4575fb6a68b65752
Instruction Fuzzy Hash: A9D0A973B241008BE790E7BEAE8945B23A8FB4032A3204833D802E2092D93CC8028218

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004047DC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E004047DC(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				intOrPtr _t183;
				int _t189;
				int _t196;
				intOrPtr _t198;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				intOrPtr _t231;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				signed int _t242;
				signed int _t245;
				signed int _t247;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t274;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				signed int* _t284;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				int _t294;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				intOrPtr _t309;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;
				void* _t328;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x42ec68; // 0x5d9cdc
				_t320 = SendMessageA;
				_v8 = _t182;
				_t183 =  *0x42ec50; // 0x5d9b30
				_t315 = 0;
				_v32 = _t280;
				_v20 = _t183 + 0x94;
				if(_a8 != 0x110) {
					L23:
					__eflags = _a8 - 0x405;
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					__eflags = _a8 - 0x4e;
					if(_a8 == 0x4e) {
						L28:
						__eflags = _a8 - 0x413;
						_v16 = _t289;
						if(_a8 == 0x413) {
							L30:
							__eflags =  *0x42ec59 & 0x00000002;
							if(( *0x42ec59 & 0x00000002) != 0) {
								L41:
								__eflags = _v16 - _t315;
								if(_v16 != _t315) {
									_t232 = _v16;
									__eflags =  *((intOrPtr*)(_t232 + 8)) - 0xfffffe6e;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									__eflags =  *((intOrPtr*)(_t233 + 8)) - 0xfffffe6a;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										__eflags =  *((intOrPtr*)(_t233 + 0xc)) - 2;
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											_t284 =  *(_t233 + 0x5c) * 0x418 + _t280 + 8;
											 *_t284 =  *_t284 & 0xffffffdf;
											__eflags =  *_t284;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							__eflags = _a8 - 0x413;
							if(_a8 == 0x413) {
								L33:
								__eflags = _a8 - 0x413;
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E0040475C(_v8, _a8 != 0x413);
								__eflags = _t240 - _t315;
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									__eflags = _t289 & 0x00000010;
									if((_t289 & 0x00000010) == 0) {
										__eflags = _t289 & 0x00000040;
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
											__eflags = _t298;
										} else {
											_t300 = _t289 ^ 0x00000080;
											__eflags = _t300;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t242 =  *0x42ec58; // 0x80
										_t289 = 1;
										_a8 = 0x40f;
										_t245 =  !_t242 >> 0x00000008 & 1;
										__eflags = _t245;
										_a12 = 1;
										_a16 = _t245;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							__eflags =  *((intOrPtr*)(_t289 + 8)) - 0xfffffffe;
							if( *((intOrPtr*)(_t289 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						}
						__eflags =  *((intOrPtr*)(_t289 + 4)) - 0x408;
						if( *((intOrPtr*)(_t289 + 4)) != 0x408) {
							goto L48;
						}
						goto L30;
					} else {
						__eflags = _a8 - 0x413;
						if(_a8 != 0x413) {
							L48:
							__eflags = _a8 - 0x111;
							if(_a8 != 0x111) {
								L56:
								__eflags = _a8 - 0x200;
								if(_a8 == 0x200) {
									SendMessageA(_v8, 0x200, _t315, _t315);
								}
								__eflags = _a8 - 0x40b;
								if(_a8 == 0x40b) {
									_t220 =  *0x42a09c;
									__eflags = _t220 - _t315;
									if(_t220 != _t315) {
										ImageList_Destroy(_t220);
									}
									_t221 =  *0x42a0b4;
									__eflags = _t221 - _t315;
									if(_t221 != _t315) {
										GlobalFree(_t221);
									}
									 *0x42a09c = _t315;
									 *0x42a0b4 = _t315;
									 *0x42eca0 = _t315;
								}
								__eflags = _a8 - 0x40f;
								if(_a8 != 0x40f) {
									L86:
									__eflags = _a8 - 0x420;
									if(_a8 == 0x420) {
										__eflags =  *0x42ec59 & 0x00000001;
										if(( *0x42ec59 & 0x00000001) != 0) {
											__eflags = _a16 - 0x20;
											_t189 = (0 | _a16 == 0x00000020) << 3;
											__eflags = _t189;
											_t316 = _t189;
											ShowWindow(_v8, _t316);
											ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
										}
									}
									goto L89;
								} else {
									E004011EF(_t289, _t315, _t315);
									__eflags = _a12 - _t315;
									if(_a12 != _t315) {
										E0040140B(8);
									}
									__eflags = _a16 - _t315;
									if(_a16 == _t315) {
										L73:
										E004011EF(_t289, _t315, _t315);
										__eflags =  *0x42ec6c - _t315; // 0x1
										_v32 =  *0x42a0b4;
										_t196 =  *0x42ec68; // 0x5d9cdc
										_v60 = 0xf030;
										_v16 = _t315;
										if(__eflags <= 0) {
											L84:
											InvalidateRect(_v8, _t315, 1);
											_t198 =  *0x42e41c; // 0x5e149e
											__eflags =  *((intOrPtr*)(_t198 + 0x10)) - _t315;
											if( *((intOrPtr*)(_t198 + 0x10)) != _t315) {
												E00404717(0x3ff, 0xfffffffb, E0040472F(5));
											}
											goto L86;
										} else {
											_t142 = _t196 + 8; // 0x5d9ce4
											_t281 = _t142;
											do {
												_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
												__eflags = _t202 - _t315;
												if(_t202 != _t315) {
													_t291 =  *_t281;
													_v68 = _t202;
													__eflags = _t291 & 0x00000001;
													_v72 = 8;
													if((_t291 & 0x00000001) != 0) {
														_t151 =  &(_t281[4]); // 0x5d9cf4
														_v72 = 9;
														_v56 = _t151;
														_t154 =  &(_t281[0]);
														 *_t154 = _t281[0] & 0x000000fe;
														__eflags =  *_t154;
													}
													__eflags = _t291 & 0x00000040;
													if((_t291 & 0x00000040) == 0) {
														_t206 = (_t291 & 0x00000001) + 1;
														__eflags = _t291 & 0x00000010;
														if((_t291 & 0x00000010) != 0) {
															_t206 = _t206 + 3;
															__eflags = _t206;
														}
													} else {
														_t206 = 3;
													}
													_t294 = (_t291 >> 0x00000005 & 0x00000001) + 1;
													__eflags = _t294;
													_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
													SendMessageA(_v8, 0x1102, _t294, _v68);
													SendMessageA(_v8, 0x110d, _t315,  &_v72);
												}
												_v16 = _v16 + 1;
												_t281 =  &(_t281[0x106]);
												__eflags = _v16 -  *0x42ec6c; // 0x1
											} while (__eflags < 0);
											goto L84;
										}
									} else {
										_t282 = E004012E2( *0x42a0b4);
										E00401299(_t282);
										_t217 = 0;
										_t289 = 0;
										__eflags = _t282 - _t315;
										if(_t282 <= _t315) {
											L72:
											SendMessageA(_v12, 0x14e, _t289, _t315);
											_a16 = _t282;
											_a8 = 0x420;
											goto L73;
										} else {
											goto L69;
										}
										do {
											L69:
											_t309 = _v20;
											__eflags =  *((intOrPtr*)(_t309 + _t217 * 4)) - _t315;
											if( *((intOrPtr*)(_t309 + _t217 * 4)) != _t315) {
												_t289 = _t289 + 1;
												__eflags = _t289;
											}
											_t217 = _t217 + 1;
											__eflags = _t217 - _t282;
										} while (_t217 < _t282);
										goto L72;
									}
								}
							}
							__eflags = _a12 - 0x3f9;
							if(_a12 != 0x3f9) {
								goto L89;
							}
							__eflags = _a12 >> 0x10 - 1;
							if(_a12 >> 0x10 != 1) {
								goto L89;
							}
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							__eflags = _t227 - 0xffffffff;
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							__eflags = _t283 - 0xffffffff;
							if(_t283 == 0xffffffff) {
								L54:
								_t283 = 0x20;
								L55:
								E00401299(_t283);
								SendMessageA(_a4, 0x420, _t315, _t283);
								_a12 = 1;
								_a16 = _t315;
								_a8 = 0x40f;
								goto L56;
							}
							_t231 = _v20;
							__eflags =  *((intOrPtr*)(_t231 + _t283 * 4)) - _t315;
							if( *((intOrPtr*)(_t231 + _t283 * 4)) != _t315) {
								goto L55;
							}
							goto L54;
						}
						goto L28;
					}
				} else {
					 *0x42eca0 = _a4;
					_t247 =  *0x42ec6c; // 0x1
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x42a0b4 = GlobalAlloc(0x40, _t247 << 2);
					_t250 = LoadBitmapA( *0x42ec40, 0x6e);
					 *0x42a0a8 =  *0x42a0a8 | 0xffffffff;
					_v24 = _t250;
					 *0x42a0b0 = SetWindowLongA(_v8, 0xfffffffc, E00404DDD);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x42a09c = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x42a09c);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t315, E00405BC3(_t286, _t315, _t320, _t315, _t258)), _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403E5D(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403E5D(_a4);
					_t318 = 0;
					_t288 = 0;
					_t328 =  *0x42ec6c - _t318; // 0x1
					if(_t328 <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									__eflags = _t269 & 0x00000004;
									if((_t269 & 0x00000004) == 0) {
										 *( *0x42a0b4 + _t318 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v84);
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_v28 = 1;
									 *( *0x42a0b4 + _t318 * 4) = _t274;
									_t288 =  *( *0x42a0b4 + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_t331 = _t318 -  *0x42ec6c; // 0x1
							_v24 = _t311;
						} while (_t331 < 0);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403E92(_v8);
								_t280 = _v32;
								_t315 = 0;
								__eflags = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403E92(_v12);
								L89:
								return E00403EC4(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

APIs

GetDlgItem.USER32(?,000003F9), ref: 004047F3
GetDlgItem.USER32(?,00000408), ref: 00404800
GlobalAlloc.KERNEL32(00000040,00000001), ref: 0040484C
LoadBitmapA.USER32(0000006E), ref: 0040485F
SetWindowLongA.USER32(?,000000FC,00404DDD), ref: 00404879
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040488D
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 004048A1
SendMessageA.USER32(?,00001109,00000002), ref: 004048B6
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004048C2
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004048D4
DeleteObject.GDI32(?), ref: 004048D9
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404904
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404910
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049A5
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 004049D0
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049E4
GetWindowLongA.USER32(?,000000F0), ref: 00404A13
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A21
ShowWindow.USER32(?,00000005), ref: 00404A32
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404B35
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404B9A
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404BAF
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404BD3
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404BF9
ImageList_Destroy.COMCTL32(?), ref: 00404C0E
GlobalFree.KERNEL32(?), ref: 00404C1E
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404C8E
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404D37
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404D46
InvalidateRect.USER32(?,00000000,00000001), ref: 00404D66
ShowWindow.USER32(?,00000000), ref: 00404DB4
GetDlgItem.USER32(?,000003FE), ref: 00404DBF
ShowWindow.USER32(00000000), ref: 00404DC6

Strings

N, xrefs: 00404A70
M, xrefs: 0040498C
, xrefs: 00404D9E

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 4e63ca6e9464e87f5d4ab94560d5c99c95fe02dad02888ea5b3d52ac9d8c04b8
Instruction ID: 458a4472cc575749f24c7bcde6f1b2e9246033a2a8d3a9469834700d3721ba37
Opcode Fuzzy Hash: 4e63ca6e9464e87f5d4ab94560d5c99c95fe02dad02888ea5b3d52ac9d8c04b8
Instruction Fuzzy Hash: E7028EB0A00209EFDB21DF55DD85AAE7BB5FB84314F10813AF610BA2E1C7799A41DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00403FA5 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00403FA5(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char* _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				intOrPtr _t71;
				intOrPtr _t85;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t103;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x42a0a0 =  *0x42a0a0 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403EC4(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x42dbe0;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								ShellExecuteA(_a4, "open", _v8, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x42ec48, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x42ec48, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x42a0a0 != 0) {
						goto L25;
					} else {
						_t103 =  *0x429890; // 0x5d9c5c
						_t25 = _t103 + 0x14; // 0x5d9c70
						_t112 = _t25;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403E7F(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404230();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t107 =  *0x42e41c; // 0x5e149e
					_t113 =  *(_t107 - 4 + _t113 * 4);
				}
				_t71 =  *0x42ec78; // 0x5e0188
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 + _t71;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E00403F71;
				E00403E5D(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403E5D(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403E7F( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403E92(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t85 =  *0x42ec50; // 0x5d9b30
				_t86 =  *(_t85 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x429084 =  *0x429084 & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16);
				 *0x42a0a0 =  *0x42a0a0 & 0x00000000;
				return 0;
			}

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404030
GetDlgItem.USER32(00000000,000003E8), ref: 00404044
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00404062
GetSysColor.USER32(?), ref: 00404073
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404082
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404091
lstrlenA.KERNEL32(?), ref: 0040409B
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004040A9
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004040B8
GetDlgItem.USER32(?,0000040A), ref: 0040411B
SendMessageA.USER32(00000000), ref: 0040411E
GetDlgItem.USER32(?,000003E8), ref: 00404149
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404189
LoadCursorA.USER32(00000000,00007F02), ref: 00404198
SetCursor.USER32(00000000), ref: 004041A1
ShellExecuteA.SHELL32(0000070B,open,0042DBE0,00000000,00000000,00000001), ref: 004041B4
LoadCursorA.USER32(00000000,00007F00), ref: 004041C1
SetCursor.USER32(00000000), ref: 004041C4
SendMessageA.USER32(00000111,00000001,00000000), ref: 004041F0
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404204

Strings

open, xrefs: 004041AC
q?@, xrefs: 004041A9
N, xrefs: 00404137
Execute: , xrefs: 00404174

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Execute: $N$open$q?@
API String ID: 3615053054-3777162957
Opcode ID: 43e4b1bebc352cc37ab134c8e21d344cf3974b6da0146347b86895c6f7b453af
Instruction ID: 8cc316ab489d754ba064ab1d5a66df449127ca6112c148b2bdc2fdd16cb80ba7
Opcode Fuzzy Hash: 43e4b1bebc352cc37ab134c8e21d344cf3974b6da0146347b86895c6f7b453af
Instruction Fuzzy Hash: 9361DFB1A40209BFEB109F60CC45F6A3B68FB54745F10853AFB04BA2D1C7B8A951CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				intOrPtr _t115;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x42ec50; // 0x5d9b30
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, "Fast! Setup", 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					_t115 =  *0x42ec48; // 0x503e4
					 *((intOrPtr*)(_t102 + 4)) = _t115;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Fast! Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

Fast! Setup, xrefs: 00401150
F, xrefs: 0040100C

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Fast! Setup
API String ID: 941294808-2757725660
Opcode ID: 9ef4e76bf49e76a01cd413a5d017736c2cab636d92d5aa9aaf47e7e990c9ee05
Instruction ID: 7d427dbe4d4bacd88da03279d54ab8fa369b0c74db3328ba00a5b4b95e7f032c
Opcode Fuzzy Hash: 9ef4e76bf49e76a01cd413a5d017736c2cab636d92d5aa9aaf47e7e990c9ee05
Instruction Fuzzy Hash: 0B41AC71804249AFCB058F95CD459BFBFB9FF44314F00802AF961AA2A0C738EA50DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040429B Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 273
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040429B(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr _t124;
				intOrPtr* _t138;
				CHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				struct HWND__* _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x429890; // 0x5d9c5c
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xa) + "55410880";
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405446(0x3fb, _t146);
					E00405E03(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405446(0x3fb, _t146);
							if(E00405775(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E00405BA1(0x429088, _t146);
							_t87 = E00405F2D(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00405BA1(0x429088, _t146);
								_t89 = E00405728(0x429088);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x429088,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x429088) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x429088,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t159 = E004056DB(0x429088) - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x429088) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E0040472F(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x42e41c; // 0x5e149e
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E00404717(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x429078);
									} else {
										E00404652(_t168, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x42ece4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E00403E7F(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x42a0ac == _t158) {
									E00404230();
								}
								 *0x42a0ac = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x42a0c0;
							_v60 = E004045EC;
							_v56 = _t146;
							_v68 = E00405BC3(_t146, 0x42a0c0, _t166, 0x429490, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405694(_t146);
								_t124 =  *0x42ec50; // 0x5d9b30
								_t125 =  *((intOrPtr*)(_t124 + 0x11c));
								if( *((intOrPtr*)(_t124 + 0x11c)) != 0 && _t146 == "C:\\Program Files (x86)\\Fast!") {
									E00405BC3(_t146, 0x42a0c0, _t166, 0, _t125);
									if(lstrcmpiA(0x42dbe0, 0x42a0c0) != 0) {
										lstrcatA(_t146, 0x42dbe0);
									}
								}
								 *0x42a0ac =  *0x42a0ac + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E00405701(_t146) != 0 && E00405728(_t146) == 0) {
						E00405694(_t146);
					}
					 *0x42e418 = _t166;
					SetWindowTextA(_t165, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403E5D(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403E5D(_t166);
					E00403E92(_t165);
					_t138 = E00405F2D(0xa);
					if(_t138 == 0) {
						L53:
						return E00403EC4(_a8, _a12, _a16);
					} else {
						 *_t138(_t165, 1);
						goto L8;
					}
				}
			}

APIs

GetDlgItem.USER32(?,000003FB), ref: 004042EA
SetWindowTextA.USER32(00000000,?), ref: 00404314
SHBrowseForFolderA.SHELL32(?,00429490,?), ref: 004043C5
CoTaskMemFree.OLE32(00000000), ref: 004043D0
lstrcmpiA.KERNEL32(Execute: ,0042A0C0), ref: 00404402
lstrcatA.KERNEL32(?,Execute: ), ref: 0040440E
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404420

Part of subcall function 00405446: GetDlgItemTextA.USER32(?,?,00000400,00404457), ref: 00405459

Part of subcall function 00405E03: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E5B
Part of subcall function 00405E03: CharNextA.USER32(?,?,?,00000000), ref: 00405E68
Part of subcall function 00405E03: CharNextA.USER32(?,"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E6D
Part of subcall function 00405E03: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E7D

GetDiskFreeSpaceA.KERNEL32(00429088,?,?,0000040F,?,00429088,00429088,?,00000001,00429088,?,?,000003FB,?), ref: 004044DE
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004044F9

Part of subcall function 00404652: lstrlenA.KERNEL32(0042A0C0,0042A0C0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040456D,000000DF,00000000,00000400,?), ref: 004046F0
Part of subcall function 00404652: wsprintfA.USER32 ref: 004046F8
Part of subcall function 00404652: SetDlgItemTextA.USER32(?,0042A0C0), ref: 0040470B

Strings

55410880, xrefs: 004042B4
C:\Program Files (x86)\Fast!, xrefs: 004043EB
A, xrefs: 004043BE
Execute: , xrefs: 004043FC, 00404401, 0040440C

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: 55410880$A$C:\Program Files (x86)\Fast!$Execute:
API String ID: 2624150263-3182416936
Opcode ID: 651704e9fdbceafa19cbcaa3072621ff73f1ed0c40465ee915921c67da8dd18a
Instruction ID: 25cf576a769d2d8a049a3aeadb65d5b4cdf4f75aeaeb5f9dd55cec19ee375662
Opcode Fuzzy Hash: 651704e9fdbceafa19cbcaa3072621ff73f1ed0c40465ee915921c67da8dd18a
Instruction Fuzzy Hash: A6A170B1900218ABDB11AFA5DC41BAF77B8EF84315F10843BF611B62D1D77C9A418F69

Uniqueness

Uniqueness Score: -1.00%

Function 004058EF Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004058EF(void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				intOrPtr _t18;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00405F2D(2);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x42ecd0 =  *0x42ecd0 + 1;
						return _t20;
					}
				}
				 *0x42c250 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x42bcc8, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x42b8c8, "%s=%s\r\n", 0x42c250, 0x42bcc8);
						_t18 =  *0x42ec50; // 0x5d9b30
						_t56 = _t55 + 0x10;
						E00405BC3(_t43, 0x400, 0x42bcc8, 0x42bcc8,  *((intOrPtr*)(_t18 + 0x128)));
						_t20 = E00405878(0x42bcc8, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E004057ED(_t51, "[Rename]\r\n") != 0) {
								_t28 = E004057ED(_t26 + 0xa, 0x409404);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E00405839(_t51 + _t29, 0x42b8c8, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E00405BA1(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E00405878(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x42c250, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

APIs

Part of subcall function 00405F2D: GetModuleHandleA.KERNEL32(?,?,00000000,00403179,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00405F3F
Part of subcall function 00405F2D: GetProcAddress.KERNEL32(00000000,?), ref: 00405F5A

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000002,?,00000000,?,?,00405684,?,00000000,000000F1,?), ref: 0040593C
GetShortPathNameA.KERNEL32(?,0042C250,00000400), ref: 00405945
GetShortPathNameA.KERNEL32(00000000,0042BCC8,00000400), ref: 00405962
wsprintfA.USER32 ref: 00405980
GetFileSize.KERNEL32(00000000,00000000,0042BCC8,C0000000,00000004,0042BCC8,?,?,?,00000000,000000F1,?), ref: 004059BB
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 004059CA
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 004059E0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,0042B8C8,00000000,-0000000A,00409404,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405A26
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 00405A38
GlobalFree.KERNEL32(00000000), ref: 00405A3F
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405A46

Part of subcall function 004057ED: lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059FB,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057F4
Part of subcall function 004057ED: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059FB,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405824

Strings

%s=%s, xrefs: 00405976
[Rename], xrefs: 004059F0, 00405A02

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$[Rename]
API String ID: 3445103937-1727408572
Opcode ID: 93dbfb435071f571f0ab808dd2be6fd4af636485bab0aeb09ba325dd39622752
Instruction ID: f45ed1bdfbf8c4b03de67142e423a5701368854c8b403738f0f2c648216b24c4
Opcode Fuzzy Hash: 93dbfb435071f571f0ab808dd2be6fd4af636485bab0aeb09ba325dd39622752
Instruction Fuzzy Hash: D741D471B05B157BD7206B619C89F6B3B5CDF85754F040136F905F62D2EA38E8018EAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405E03 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E03(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E00405701(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E004056BF("*?|<>/\":", _t5))) == 0) {
							E00405839(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E5B
CharNextA.USER32(?,?,?,00000000), ref: 00405E68
CharNextA.USER32(?,"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E6D
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E7D

Strings

"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" , xrefs: 00405E3F
*?|<>/":, xrefs: 00405E4B
C:\Users\user\AppData\Local\Temp\, xrefs: 00405E04, 00405E09

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\SetupEngine.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1001797428
Opcode ID: 3b5f3268fa1fae19e58d0ad2ced72642c676bfd811e2c7a6988a98807c9a22ca
Instruction ID: 8c0debaa59703488c7458a94fa91a8896e4240cf3d31b331365b77cfd974a1c9
Opcode Fuzzy Hash: 3b5f3268fa1fae19e58d0ad2ced72642c676bfd811e2c7a6988a98807c9a22ca
Instruction Fuzzy Hash: 4E11B671804A912DEB3217289C44B777FC8CB66790F18447BD4D5723C2D67C5D428AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00403EC4 Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403EC4(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403EE1
GetSysColor.USER32(00000000), ref: 00403EFD
SetTextColor.GDI32(?,00000000), ref: 00403F09
SetBkMode.GDI32(?,?), ref: 00403F15
GetSysColor.USER32(?), ref: 00403F28
SetBkColor.GDI32(?,?), ref: 00403F38
DeleteObject.GDI32(?), ref: 00403F52
CreateBrushIndirect.GDI32(?), ref: 00403F5C

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 244050047767258f024cc5d970fbc24e44c9485df9f09a7a1d92820c249c5868
Instruction ID: 0d89a351d513fb24bb3d4bb4099581c898fc75933690e96f4850fc1bb23eeaf2
Opcode Fuzzy Hash: 244050047767258f024cc5d970fbc24e44c9485df9f09a7a1d92820c249c5868
Instruction Fuzzy Hash: 91214271904745ABCB219F78DD08B4B7FF8AF05715B048629F995A22E0D734E9048B65

Uniqueness

Uniqueness Score: -1.00%

Function 00402692 Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00402692(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *((intOrPtr*)(_t58 - 0xc)) = 0xfffffd66;
				_t52 = E00402A0C(0xfffffff0);
				 *(_t58 - 0x38) = _t24;
				if(E00405701(_t52) == 0) {
					E00402A0C(0xffffffed);
				}
				E00405859(_t52);
				_t27 = E00405878(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x42ec54; // 0x9e00
					 *(_t58 - 0x30) = _t32;
					_t51 = GlobalAlloc(0x40, _t32);
					if(_t51 != _t47) {
						E004030C5(_t47);
						E00403093(_t51,  *(_t58 - 0x30));
						_t56 = GlobalAlloc(0x40,  *(_t58 - 0x20));
						 *(_t58 - 0x34) = _t56;
						if(_t56 != _t47) {
							E00402E71( *((intOrPtr*)(_t58 - 0x24)), _t47, _t56,  *(_t58 - 0x20));
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x48) =  *_t56;
								E00405839( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x48);
							}
							GlobalFree( *(_t58 - 0x34));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x30), _t58 - 0x3c, _t47);
						GlobalFree(_t51);
						 *((intOrPtr*)(_t58 - 0xc)) = E00402E71(0xffffffff,  *(_t58 + 8), _t47, _t47);
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *((intOrPtr*)(_t58 - 0xc)) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x38));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

APIs

GlobalAlloc.KERNEL32(00000040,00009E00,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004026E6
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402702
GlobalFree.KERNEL32(?), ref: 0040273B
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,000000F0), ref: 0040274D
GlobalFree.KERNEL32(00000000), ref: 00402754
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040276C
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402780

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 9c2b519bab710da34c4f93b0ba9d6d86cd7c01b4cb3bb32b5413ac78432567f7
Instruction ID: 5b53ae4c2b613e87b8af51cb2b1d5881ebc53a54f05e9f53cd44442d287e2222
Opcode Fuzzy Hash: 9c2b519bab710da34c4f93b0ba9d6d86cd7c01b4cb3bb32b5413ac78432567f7
Instruction Fuzzy Hash: 3131A971C00128BBCF216FA5CE88DAE7F79EF05364F10423AF920762E1C67949408FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040475C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040475C(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404777
GetMessagePos.USER32 ref: 0040477F
ScreenToClient.USER32(?,?), ref: 00404799
SendMessageA.USER32(?,00001111,00000000,?), ref: 004047AB
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004047D1

Strings

f, xrefs: 004047AD

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b999d07b324019c2219c33d3107ce818a81de0efbbfc0766a2ac4245d0efef5f
Instruction ID: 1287270e3ce35f4bc81f554f3193770291cde8f8b01dc106229a8c11fbd36195
Opcode Fuzzy Hash: b999d07b324019c2219c33d3107ce818a81de0efbbfc0766a2ac4245d0efef5f
Instruction Fuzzy Hash: 99014071D00219BADB01DBA4DD85FFEBBFCAB59711F10412BBA10B72C0D7B465018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B51 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B51(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x414c60; // 0x2877bf
					_t11 =  *0x428c70; // 0x28ac88
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b5e
0x00402b6c
0x00402b72
0x00402b72
0x00402b80
0x00402b82
0x00402b88
0x00402b8f
0x00402b91
0x00402b91
0x00402ba7
0x00402bb7
0x00402bc9
0x00402bc9
0x00402bd1

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B6C
MulDiv.KERNEL32(002877BF,00000064,0028AC88), ref: 00402B97
wsprintfA.USER32 ref: 00402BA7
SetWindowTextA.USER32(?,?), ref: 00402BB7
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BC9

Strings

verifying installer: %d%%, xrefs: 00402BA1

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: f4b40b60170e557e8e64fd1007bdae5203f411c8eb827d09f08439ceb1717922
Instruction ID: 170251b52dccb1bc1045efc101099eb7df8550efa5a7238432f4f3ca5a85e13a
Opcode Fuzzy Hash: f4b40b60170e557e8e64fd1007bdae5203f411c8eb827d09f08439ceb1717922
Instruction Fuzzy Hash: C501F470644209BBDB209F61DD49EED3779AB44305F008039FA06B52D0D7B599558F95

Uniqueness

Uniqueness Score: -1.00%

Function 0040534F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040534F(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x407310;
				_v36.Group = 0x407310;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x407300;
				_v16.nLength = 0xc;
				if(CreateDirectoryA(_a4,  &_v16) != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

APIs

CreateDirectoryA.KERNEL32(?,?,00000000), ref: 00405392
GetLastError.KERNEL32 ref: 004053A6
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004053BB
GetLastError.KERNEL32 ref: 004053C5

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 0040534F

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 3449924974-3409409611
Opcode ID: 1936ad7c03f2b7d8793bf3b54e92df8b677be00562b78ee6b782fceed01fa342
Instruction ID: 0f194ad754f8d2153fe6bade7a67ae4222ab15fc701b17716cfd16251ec2b406
Opcode Fuzzy Hash: 1936ad7c03f2b7d8793bf3b54e92df8b677be00562b78ee6b782fceed01fa342
Instruction Fuzzy Hash: C5010871D04259EBEF119BA0D904BEFBFB8EF04354F00457AE905B6180D3B89614CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D1B() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 8)), 0x5a);
				0x40b064->lfHeight =  ~(MulDiv(E004029EF(2), _t6, 0x48));
				 *0x40b074 = E004029EF(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x18));
				 *0x40b07b = 1;
				 *0x40b078 = _t11 & 0x00000001;
				 *0x40b079 = _t11 & 0x00000002;
				 *0x40b07a = _t11 & 0x00000004;
				E00405BC3(_t18, _t24, _t26, "MS Shell Dlg",  *((intOrPtr*)(_t28 - 0x24)));
				_t14 = CreateFontIndirectA(0x40b064);
				_push(_t14);
				_push(_t26);
				E00405AFF();
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d29
0x00401d42
0x00401d4c
0x00401d51
0x00401d5c
0x00401d63
0x00401d75
0x00401d7b
0x00401d80
0x00401d8a
0x004024ce
0x00401561
0x00402849
0x004028a4
0x004028b0

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(0040B064), ref: 00401D8A

Strings

MS Shell Dlg, xrefs: 00401D70

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID: MS Shell Dlg
API String ID: 3272661963-76309092
Opcode ID: 4aff2da1ecbc0b46b4ebb4a1bc3754d5e437124edce295b0be6ec486ba38634f
Instruction ID: 5e6b0a242ffc9277152ed6cf63edc70abaf129c53bcded44f01e7363494148ce
Opcode Fuzzy Hash: 4aff2da1ecbc0b46b4ebb4a1bc3754d5e437124edce295b0be6ec486ba38634f
Instruction Fuzzy Hash: 0BF04471E89240AEE7016770AF1AB9B7F64D715305F104475F651B62E2C77914048BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00402A4C Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A4C(void* _a4, char* _a8, long _a12) {
				void* _v8;
				char _v272;
				signed char _t16;
				long _t18;
				long _t25;
				intOrPtr* _t27;
				long _t28;

				_t16 =  *0x42ecf0; // 0x0
				_t18 = RegOpenKeyExA(_a4, _a8, 0, _t16 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						__eflags = _a12;
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							__eflags = 1;
							return 1;
						}
						_t25 = E00402A4C(_v8,  &_v272, 0);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00405F2D(4);
					if(_t27 == 0) {
						__eflags =  *0x42ecf0; // 0x0
						if(__eflags != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						__eflags = _t28;
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x42ecf0, 0);
				}
				return _t18;
			}

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A6D
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AA9
RegCloseKey.ADVAPI32(?), ref: 00402AB2
RegCloseKey.ADVAPI32(?), ref: 00402AD7
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AF5

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 87ccbfffecd7de7467de5c73c2002d88ab1ef4389744f866cc51cf150fc0b97d
Instruction ID: aab1c47b15b7d7dbd0304e6a384de86cdfdd1b9a1951722987da620561d60ced
Opcode Fuzzy Hash: 87ccbfffecd7de7467de5c73c2002d88ab1ef4389744f866cc51cf150fc0b97d
Instruction Fuzzy Hash: 45117F71A00009FFDF219F91DE49DAF3B69EB14394B004076FA06F00A0DBB49E52AF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CC1(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 8), __edx);
				GetClientRect(_t25, _t27 - 0x50);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E00402A0C(_t21), _t21,  *(_t27 - 0x48) *  *(_t27 - 0x20),  *(_t27 - 0x44) *  *(_t27 - 0x20), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ccb
0x00401cd2
0x00401d01
0x00401d09
0x00401d10
0x00401d10
0x004028a4
0x004028b0

APIs

GetDlgItem.USER32(?), ref: 00401CC5
GetClientRect.USER32(00000000,?), ref: 00401CD2
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CF3
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 820db05736504264d483f74177373403e5a617ae67568462a5a6784605b20d06
Instruction ID: 0b6a49845d72fa48a9a579b1019c06f6c105053db178aa5042bb0eadc5b1df39
Opcode Fuzzy Hash: 820db05736504264d483f74177373403e5a617ae67568462a5a6784605b20d06
Instruction Fuzzy Hash: 2DF0EC72A04114AFEB00EBA4DD88DAFB77CFB44305B044536F501F6191C678AD419B79

Uniqueness

Uniqueness Score: -1.00%

Function 00404652 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404652(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					_push(0x14);
					_pop(0);
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_t50 = 0x14;
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E00405BC3(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E00405BC3(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E00405BC3(_t41, _t47, 0x42a0c0, 0x42a0c0, _a8);
				wsprintfA(_t32 + lstrlenA(0x42a0c0), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				return SetDlgItemTextA( *0x42e418, _a4, 0x42a0c0);
			}

APIs

lstrlenA.KERNEL32(0042A0C0,0042A0C0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040456D,000000DF,00000000,00000400,?), ref: 004046F0
wsprintfA.USER32 ref: 004046F8
SetDlgItemTextA.USER32(?,0042A0C0), ref: 0040470B

Strings

%u.%u%s%s, xrefs: 004046DA

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: ec62b53d4e0dbb31f5b6c5a17a5348d37b593b8d10f93b7eb7b316986fd69fdf
Instruction ID: cfc8e6c3a4af003209a53fcdfac8cba24e816d3e629d82a7997265ded69b8fd0
Opcode Fuzzy Hash: ec62b53d4e0dbb31f5b6c5a17a5348d37b593b8d10f93b7eb7b316986fd69fdf
Instruction Fuzzy Hash: A0112773A0412827EB0065699C45EAF3298DB86334F254637FE25F71D1E9799C1285EC

Uniqueness

Uniqueness Score: -1.00%

Function 004038BD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038BD(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				intOrPtr _t15;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405B18(__ecx, "1033");
				while(1) {
					_t26 =  *0x42ec84; // 0x1
					if(_t26 == 0) {
						goto L7;
					}
					_t15 =  *0x42ec50; // 0x5d9b30
					_t16 =  *(_t15 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x42ec80;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x42e420 = _t18[1];
					 *0x42ece8 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42e41c = _t23;
						E00405AFF(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x42a098, E00405BC3(_t13, _t24, _t26, "Fast! Setup", 0xfffffffe));
						_t11 =  *0x42ec6c; // 0x1
						_t27 =  *0x42ec68; // 0x5d9cdc
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t5 = _t27 + 0x18; // 0x5d9cf4
								_t11 = E00405BC3(_t13, _t25, _t27, _t5, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

APIs

SetWindowTextA.USER32(00000000,Fast! Setup), ref: 00403955

Strings

"C:\Users\user\AppData\Local\Temp\SetupEngine.exe" , xrefs: 004038BE
Fast! Setup, xrefs: 00403944
1033, xrefs: 004038C1, 004038CB, 0040393C

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\AppData\Local\Temp\SetupEngine.exe" $1033$Fast! Setup
API String ID: 530164218-2820873697
Opcode ID: 5c55cf1dc77012d7b49c2afc24761aa4d87cc513fcd06e13f885861062bacd8d
Instruction ID: 93100a74eb761491cad5589d5ba72450eee8ba09b7e289b8bdcf135b4c9a781b
Opcode Fuzzy Hash: 5c55cf1dc77012d7b49c2afc24761aa4d87cc513fcd06e13f885861062bacd8d
Instruction Fuzzy Hash: A611F071B006108BC730EF56DC80A773BACEB85715368813BA801A73A0CA39AD028B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00404DDD Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404DDD(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x42a0a8 != _t22) {
							_t27 = "55410880";
							 *0x42a0a8 = _t22;
							E00405BA1(0x42a0c0, "55410880");
							E00405AFF(_t27, _t22);
							E0040140B(6);
							E00405BA1(_t27, 0x42a0c0);
						}
						L11:
						return CallWindowProcA( *0x42a0b0, _a4, _a8, _a12, _t22);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E0040475C(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00403EA9(0x413);
				return 0;
			}

0x00404de9
0x00404e0e
0x00404e2e
0x00404e31
0x00404e34
0x00404e3f
0x00404e4b
0x00404e51
0x00404e58
0x00404e5f
0x00404e66
0x00404e6b
0x00404e71
0x00000000
0x00404e81
0x00404e1b
0x00404e6e
0x00404e6e
0x00000000
0x00404e6e
0x00404e27
0x00404e29
0x00000000
0x00404e29
0x00404def
0x00000000
0x00000000
0x00404df6
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00404E13
CallWindowProcA.USER32(?,00000200,?,?), ref: 00404E81

Part of subcall function 00403EA9: SendMessageA.USER32(000503E0,00000000,00000000,00000000), ref: 00403EBB

Strings

55410880, xrefs: 00404E3F, 00404E49, 00404E57, 00404E65
, xrefs: 00404DEB

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $55410880
API String ID: 3748168415-2885909430
Opcode ID: 284444f2568d96eb5f499d391233f43a2f88d41ae364e0567807da02f849ec1b
Instruction ID: 765017f4a7fe1763b93213a0743e5224a7b8bf10e0e2635d7465f91e9f3f1348
Opcode Fuzzy Hash: 284444f2568d96eb5f499d391233f43a2f88d41ae364e0567807da02f849ec1b
Instruction Fuzzy Hash: C5116D71500218BFDF215F51DC81E9B7669BB84365F00803AFA08792A1C37C49518BEE

Uniqueness

Uniqueness Score: -1.00%

Function 00405694 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405694(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409010);
				}
				return _t7;
			}

0x00405695
0x004056ac
0x004056b4
0x004056b4
0x004056bc

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030FA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 0040569A
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030FA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 004056A3
lstrcatA.KERNEL32(?,00409010), ref: 004056B4

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405694

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-1360682300
Opcode ID: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction ID: 3169b85a74bfaa55460b422d3e3fbca7e168afda588c61a1877893bbaf19970e
Opcode Fuzzy Hash: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction Fuzzy Hash: 25D0A972606A302EE20226158C05F8B3A28CF52301B0448A2F640B22D2C7BC7E818FFE

Uniqueness

Uniqueness Score: -1.00%

Function 00405728 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405728(CHAR* _a4) {
				CHAR* _t3;
				char* _t5;
				CHAR* _t7;
				CHAR* _t8;
				void* _t10;

				_t8 = _a4;
				_t7 = CharNextA(_t8);
				_t3 = CharNextA(_t7);
				if( *_t8 == 0 ||  *_t7 != 0x5c3a) {
					if( *_t8 != 0x5c5c) {
						L8:
						return 0;
					}
					_t10 = 2;
					while(1) {
						_t10 = _t10 - 1;
						_t5 = E004056BF(_t3, 0x5c);
						if( *_t5 == 0) {
							goto L8;
						}
						_t3 = _t5 + 1;
						if(_t10 != 0) {
							continue;
						}
						return _t3;
					}
					goto L8;
				} else {
					return CharNextA(_t3);
				}
			}

0x00405731
0x00405738
0x0040573b
0x00405740
0x00405753
0x0040576d
0x00000000
0x0040576d
0x00405757
0x00405758
0x0040575b
0x0040575c
0x00405764
0x00000000
0x00000000
0x00405766
0x00405769
0x00000000
0x00000000
0x00000000
0x00405769
0x00000000
0x00405749
0x00000000
0x0040574a

APIs

CharNextA.USER32(004054DA,?,C:\Users\user\AppData\Local\Temp\testfile.temp,00000000,0040578C,C:\Users\user\AppData\Local\Temp\testfile.temp,C:\Users\user\AppData\Local\Temp\testfile.temp,?,?,00000000,004054DA,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405736
CharNextA.USER32(00000000), ref: 0040573B
CharNextA.USER32(00000000), ref: 0040574A

Strings

C:\Users\user\AppData\Local\Temp\testfile.temp, xrefs: 00405729

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\testfile.temp
API String ID: 3213498283-3626374370
Opcode ID: 2a9caa78ea5ad24ed31709241e3ad5854e0d2865484118cf7a19592bf420cc00
Instruction ID: a054648e037d2dc9b414c06332908f1e3c0a092ae6d4a81e5674b26f1e0c7c07
Opcode Fuzzy Hash: 2a9caa78ea5ad24ed31709241e3ad5854e0d2865484118cf7a19592bf420cc00
Instruction Fuzzy Hash: B2F02751E00B609AE73232740C44B2B579CEB54720F184433E101B71D087BC4C82AFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00402BD4 Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BD4(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x420c68; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x42ec4c;
						if(_t2 >  *0x42ec4c) {
							_t3 = CreateDialogParamA( *0x42ec40, 0x6f, 0, E00402B51, 0);
							 *0x420c68 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00405F69(0);
					}
				} else {
					_t6 =  *0x420c68; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x420c68 = 0;
					return _t6;
				}
			}

APIs

DestroyWindow.USER32(00000000,00000000,00402DB4,00000001), ref: 00402BE7
GetTickCount.KERNEL32 ref: 00402C05
CreateDialogParamA.USER32(0000006F,00000000,00402B51,00000000), ref: 00402C22
ShowWindow.USER32(00000000,00000005), ref: 00402C30

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: b254695f6d3024de6991e78bd902d51a9eabd2695cbf76f56ec73d281620ca3d
Instruction ID: fe7f2a60441318f0c2a90f6d59b101c1e11520174a0dcb1e75ef42172c75ba50
Opcode Fuzzy Hash: b254695f6d3024de6991e78bd902d51a9eabd2695cbf76f56ec73d281620ca3d
Instruction Fuzzy Hash: 7FF05470A0D121ABD6746F55FE8CD8B7BA4F744B017540576F000B11A4DA785882CFAD

Uniqueness

Uniqueness Score: -1.00%

Function 00402036 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402036() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E00402A0C(0xfffffff0);
				_t96 = E00402A0C(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x34)) = E00402A0C(2);
				 *((intOrPtr*)(_t100 - 0xc)) = E00402A0C(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x38)) = E00402A0C(0x45);
				if(E00405701(_t96) == 0) {
					E00402A0C(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x4074b8, _t75, 1, 0x4074a8, _t44);
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x4074c8, _t100 - 8);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, "C:\\Program Files (x86)\\Fast!");
						_t81 =  *(_t100 - 0x18);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x18);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 0xc)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 0xc)),  *(_t100 - 0x18) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x34)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x38)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x409458, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 8));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x409458, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 8));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

APIs

CoCreateInstance.OLE32(004074B8,?,00000001,004074A8,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402089
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409458,00000400,?,00000001,004074A8,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402143

Strings

C:\Program Files (x86)\Fast!, xrefs: 004020C1

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Program Files (x86)\Fast!
API String ID: 123533781-1788482285
Opcode ID: 86c550a425222d4cb3f63134b91ddc776a906a3d7fbb34612ba57dfba7089740
Instruction ID: 191a2b8eefbfb1bddfad8f8f84b6cbb7561eb223b9fb57f38d09f1a7a57a31e1
Opcode Fuzzy Hash: 86c550a425222d4cb3f63134b91ddc776a906a3d7fbb34612ba57dfba7089740
Instruction Fuzzy Hash: 39413075A00104BFDB00EFA4CD89E9E7BBAEF49364B20426AF505EB2D1CA799D41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00405775 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405775(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				void* _t22;

				E00405BA1(0x42b4c8, _a4);
				_t21 = E00405728(0x42b4c8);
				if(_t21 != 0) {
					E00405E03(_t21);
					if(( *0x42ec58 & 0x00000080) == 0) {
						L5:
						_t22 = _t21 - 0x42b4c8;
						while(1) {
							_t11 = lstrlenA(0x42b4c8);
							_push(0x42b4c8);
							if(_t11 <= _t22) {
								break;
							}
							_t12 = E00405E9C();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E004056DB(0x42b4c8);
								continue;
							} else {
								goto L1;
							}
						}
						E00405694();
						return 0 | GetFileAttributesA(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405781
0x0040578c
0x00405790
0x00405797
0x004057a3
0x004057af
0x004057af
0x004057c7
0x004057c8
0x004057cf
0x004057d0
0x00000000
0x00000000
0x004057b3
0x004057ba
0x004057c2
0x00000000
0x00000000
0x00000000
0x00000000
0x004057ba
0x004057d2
0x00000000
0x004057e6
0x004057a5
0x004057a9
0x00000000
0x00000000
0x00000000
0x00000000
0x004057a9
0x00405792
0x00000000

APIs

Part of subcall function 00405BA1: lstrcpynA.KERNEL32(?,?,00000400,004031BD,Fast! Setup,NSIS Error), ref: 00405BAE

Part of subcall function 00405728: CharNextA.USER32(004054DA,?,C:\Users\user\AppData\Local\Temp\testfile.temp,00000000,0040578C,C:\Users\user\AppData\Local\Temp\testfile.temp,C:\Users\user\AppData\Local\Temp\testfile.temp,?,?,00000000,004054DA,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405736
Part of subcall function 00405728: CharNextA.USER32(00000000), ref: 0040573B
Part of subcall function 00405728: CharNextA.USER32(00000000), ref: 0040574A

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\testfile.temp,00000000,C:\Users\user\AppData\Local\Temp\testfile.temp,C:\Users\user\AppData\Local\Temp\testfile.temp,?,?,00000000,004054DA,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057C8
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\testfile.temp,C:\Users\user\AppData\Local\Temp\testfile.temp,C:\Users\user\AppData\Local\Temp\testfile.temp,C:\Users\user\AppData\Local\Temp\testfile.temp,C:\Users\user\AppData\Local\Temp\testfile.temp,C:\Users\user\AppData\Local\Temp\testfile.temp,00000000,C:\Users\user\AppData\Local\Temp\testfile.temp,C:\Users\user\AppData\Local\Temp\testfile.temp,?,?,00000000,004054DA,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057D8

Strings

C:\Users\user\AppData\Local\Temp\testfile.temp, xrefs: 0040577B, 00405780, 00405786, 004057C1, 004057C7, 004057CF, 004057D7

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\testfile.temp
API String ID: 3248276644-3626374370
Opcode ID: 0125b7c87d70c91a3d1bb05a748c96933fea46ebfbf371231d4dae2570234416
Instruction ID: ab519aa84a01e62adc0720e4bc647a0d22f88b68ea54c21d3d29417989d01369
Opcode Fuzzy Hash: 0125b7c87d70c91a3d1bb05a748c96933fea46ebfbf371231d4dae2570234416
Instruction Fuzzy Hash: 5BF02D29105E5056D622333A1C05A9F1B54CE83364F58453FF854B32D2CB3C8943EDBE

Uniqueness

Uniqueness Score: -1.00%

Function 004024D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004024D4(struct _OVERLAPPED* __ebx, intOrPtr* __esi) {
				int _t5;
				long _t7;
				struct _OVERLAPPED* _t11;
				intOrPtr* _t15;
				void* _t17;
				int _t21;

				_t15 = __esi;
				_t11 = __ebx;
				if( *((intOrPtr*)(_t17 - 0x20)) == __ebx) {
					_t7 = lstrlenA(E00402A0C(0x11));
				} else {
					E004029EF(1);
					 *0x40a060 = __al;
				}
				if( *_t15 == _t11) {
					L8:
					 *((intOrPtr*)(_t17 - 4)) = 1;
				} else {
					_t5 = WriteFile(E00405B18(_t17 + 8, _t15), "C:\Users\alfredo\AppData\Local\Temp\SetupResources.exe", _t7, _t17 + 8, _t11);
					_t21 = _t5;
					if(_t21 == 0) {
						goto L8;
					}
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024F2
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,?,?,00000000,00000011), ref: 00402511

Strings

C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 004024E0, 00402505

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\SetupResources.exe
API String ID: 427699356-449369027
Opcode ID: 1d1938849d501b6bb1bd83c6ec6d8d354b04ff3601915247876d696708e4852f
Instruction ID: 4d0466e2475190dcbeea98c473c6ee3349c22a30d2c03acad583e8792e536618
Opcode Fuzzy Hash: 1d1938849d501b6bb1bd83c6ec6d8d354b04ff3601915247876d696708e4852f
Instruction Fuzzy Hash: FEF0E972A44244BFEB10FBB19E09EAB3668EB50309F14443BF142F51C2D6FC5541966E

Uniqueness

Uniqueness Score: -1.00%

Function 0040355F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040355F() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x42907c; // 0x0
				_t3 = E00403544(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x42907c =  *0x42907c & 0x00000000;
				return _t3;
			}

0x00403560
0x00403568
0x0040356f
0x00403572
0x00403572
0x00403574
0x00403579
0x00403580
0x00403586
0x0040358a
0x0040358b
0x00403593

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,00000000,00403537,00403340,00000000), ref: 00403579
GlobalFree.KERNEL32(00000000), ref: 00403580

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403571

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-1360682300
Opcode ID: 84b733c7cccae0041813714216a38e771799edba4f139ceaa0c0671ece6e2eb2
Instruction ID: bfe74e10b2793f4584c914afcf2a54bd359ebf4cfcfa0dffde5489d6b194198f
Opcode Fuzzy Hash: 84b733c7cccae0041813714216a38e771799edba4f139ceaa0c0671ece6e2eb2
Instruction Fuzzy Hash: CCE08C32901030A7DA211F15BC0475ABB6C6B49B32F01456AE801772B083742D424BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004056DB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056DB(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x004056dc
0x004056e6
0x004056e8
0x004056ef
0x004056f7
0x00000000
0x00000000
0x00000000
0x004056f7
0x004056f9
0x004056fe

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00402CA4,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\SetupEngine.exe,C:\Users\user\AppData\Local\Temp\SetupEngine.exe,80000000,00000003), ref: 004056E1
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,00402CA4,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\SetupEngine.exe,C:\Users\user\AppData\Local\Temp\SetupEngine.exe,80000000,00000003), ref: 004056EF

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004056DB

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-3409409611
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: 3f11d7040b39dee88ccc87d096f3af91d58a3172f7b65643d8c2c66232cec6f3
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: ADD0A76280ADB01EF30352108C04B8F7A58CF13300F0948A2E040A21D1C6B85C418FFD

Uniqueness

Uniqueness Score: -1.00%

Function 004057ED Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004057ED(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x004057f9
0x004057fb
0x00405823
0x00405808
0x0040580d
0x00405818
0x00000000
0x00405835
0x00405821
0x00405821
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059FB,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057F4
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040580D
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 0040581B
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059FB,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405824

Memory Dump Source

Source File: 0000000B.00000002.2968675753.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2968630136.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968766748.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2968834032.0000000000409000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969043990.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969116837.0000000000431000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969149466.0000000000434000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000B.00000002.2969200418.000000000043F000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_SetupEngine.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: b9005c049e247e33e5549b3e141599c62d2a38fed0f6fd2d3c1464f89547bebd
Instruction ID: 9d1965df737bf6a3caf75c2c412474092f11d9bf319c7f7f540ae1764f3f27e9
Opcode Fuzzy Hash: b9005c049e247e33e5549b3e141599c62d2a38fed0f6fd2d3c1464f89547bebd
Instruction Fuzzy Hash: 69F0A737209D51ABD202AB255C04D6B7FA4EF91314B14447AF840F2280D779A925DBBB

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: diskspd.exePID: 3924, Parent PID: 5304COMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.9%
Total number of Nodes:	1760
Total number of Limit Nodes:	15

Executed Functions

Function 00B51F60 Relevance: 116.5, APIs: 35, Strings: 31, Instructions: 1033
filesynchronizationthreadCOMMONCrypto

Download Yara Rule

C-Code - Quality: 74%

			E00B51F60(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, long long __fp0) {
				char _t457;
				void* _t460;
				void* _t463;
				signed char _t474;
				long _t482;
				void* _t483;
				void* _t486;
				intOrPtr _t487;
				long _t490;
				intOrPtr* _t495;
				void* _t503;
				long _t506;
				signed int _t531;
				void* _t532;
				long _t533;
				signed int _t542;
				long _t547;
				long _t554;
				signed int _t559;
				union _LARGE_INTEGER _t561;
				void* _t564;
				void* _t565;
				void* _t567;
				signed int _t575;
				long _t578;
				signed int _t581;
				void* _t585;
				long _t590;
				long _t594;
				signed int _t599;
				signed int _t600;
				long _t601;
				intOrPtr _t602;
				long _t605;
				long _t608;
				void* _t610;
				void* _t613;
				signed int _t647;
				long _t650;
				void* _t651;
				long _t652;
				void* _t654;
				signed int _t657;
				long _t659;
				signed int _t662;
				long _t664;
				void* _t677;
				void** _t684;
				void* _t687;
				long _t695;
				void* _t696;
				long _t697;
				void* _t702;
				void* _t704;
				long _t705;
				void* _t706;
				void** _t716;
				union _LARGE_INTEGER* _t719;
				signed int _t724;
				long _t730;
				intOrPtr* _t745;
				char* _t754;
				intOrPtr _t756;
				intOrPtr _t758;
				long _t759;
				long _t760;
				union _LARGE_INTEGER* _t761;
				void* _t762;
				signed int _t768;
				signed int _t770;
				void _t777;
				void* _t784;
				void* _t785;
				void** _t786;
				signed int _t787;
				long _t789;
				long _t791;
				long _t792;
				long _t793;
				void _t794;
				intOrPtr* _t795;
				void _t796;
				void* _t797;
				signed int _t798;
				union _LARGE_INTEGER* _t799;
				signed int _t800;
				union _LARGE_INTEGER _t801;
				char* _t803;
				void* _t804;
				signed int _t805;
				void* _t806;
				long long* _t807;
				void* _t811;
				void* _t814;
				void* _t815;
				void* _t816;

				_t829 = __fp0;
				_t756 = __edx;
				_push(0x16c);
				E00B5D14C(0xb5e46f, __ebx, __edi, __esi);
				_t684 =  *(_t806 + 8);
				 *(_t806 - 0x124) = _t684;
				 *((char*)(_t806 - 0xcd)) = 1;
				 *(_t806 - 0x100) = 0;
				_t784 = _t684[1];
				 *(_t806 - 0xe4) = 0;
				 *((intOrPtr*)(_t806 - 0xec)) = 0;
				 *(_t806 - 0x104) = 0;
				 *((char*)(_t806 - 0x110)) =  *((intOrPtr*)(_t784 + 0x31));
				_t457 =  *((intOrPtr*)(_t784 + 0x32));
				 *((char*)(_t806 - 0x10c)) = _t457;
				if(_t457 == 0) {
					L4:
					srand(_t684[0x21]);
					_pop(_t687);
					if( *((intOrPtr*)(_t684[1] + 0x20)) != 0) {
						L8:
						_t460 = _t684[2];
						_t785 = 0xb8;
						 *(_t806 - 0x134) = 0xb8;
						while(1) {
							__eflags = _t460 - _t684[3];
							if(_t460 == _t684[3]) {
								break;
							}
							__eflags =  *(_t460 + 0x8b);
							if( *(_t460 + 0x8b) != 0) {
								_t689 = "SeLockMemoryPrivilege";
								__eflags = E00B51175("SeLockMemoryPrivilege", "ERROR:");
								if(__eflags == 0) {
									L190:
									 *((char*)(_t806 - 0xcd)) = 0;
									L191:
									 *0xb61640 = 1;
									L192:
									_t791 = _t684[0xb];
									while(_t791 != _t684[0xc]) {
										__eflags =  *_t791;
										if( *_t791 != 0) {
											VirtualFree( *_t791, 0, 0x8000); // executed
										}
										_t791 = _t791 + 4;
										__eflags = _t791;
									}
									_t792 = _t684[5];
									while(_t792 != _t684[6]) {
										FindCloseChangeNotification( *_t792); // executed
										_t792 = _t792 + 4;
										__eflags = _t792;
									}
									_t463 =  *(_t806 - 0x100);
									_t826 = _t463;
									if(_t463 != 0) {
										CloseHandle(_t463);
									}
									E00B52DF7(_t684, _t826);
									__imp__??3@YAXPAX@Z(_t684);
									asm("lock dec dword [0xb614b4]");
									return E00B5D100(_t684, _t785, _t792);
								}
								L14:
								 *(_t806 - 0xd4) =  *(_t806 - 0xd4) & 0x00000000;
								_t793 = _t684[2];
								while(1) {
									__eflags = _t793 - _t684[3];
									if(_t793 == _t684[3]) {
										break;
									}
									 *((char*)(_t806 - 0xdd)) = 0;
									_t692 = _t793;
									 *((char*)(_t806 - 0xde)) = 0;
									E00B4A786(_t793, _t806 - 0x48);
									 *(_t806 - 4) =  *(_t806 - 4) & 0x00000000;
									_t758 =  *((intOrPtr*)(_t806 - 0x34));
									_t785 =  *(_t806 - 0x48);
									 *(_t806 - 0xd8) = _t785;
									__eflags = _t758 - 0x10;
									if(_t758 < 0x10) {
										_t785 = _t806 - 0x48;
									}
									__eflags = _t785;
									if(_t785 == 0) {
										L129:
										_push("FATAL ERROR: invalid filename\n");
										goto L115;
									} else {
										_t474 =  *_t785;
										__eflags = _t474;
										if(_t474 == 0) {
											goto L129;
										}
										__eflags = _t474 - 0x23;
										if(_t474 != 0x23) {
											L22:
											__eflags =  *(_t785 + 1);
											if( *(_t785 + 1) == 0) {
												L29:
												_t785 =  *(_t806 - 0xd8);
												L30:
												__eflags = _t758 - 0x10;
												if(_t758 < 0x10) {
													_t785 = _t806 - 0x48;
												}
												L32:
												_t695 = 0x80;
												__eflags =  *(_t793 + 0x88);
												if( *(_t793 + 0x88) != 0) {
													_t695 = 0x8000080;
												}
												__eflags =  *(_t793 + 0x89);
												if( *(_t793 + 0x89) != 0) {
													_t695 = _t695 | 0x10000000;
													__eflags = _t695;
												}
												__eflags =  *(_t793 + 0x8a);
												if( *(_t793 + 0x8a) != 0) {
													_t695 = _t695 | 0x00000100;
													__eflags = _t695;
												}
												__eflags =  *((intOrPtr*)(_t793 + 0x1c)) - 1;
												if( *((intOrPtr*)(_t793 + 0x1c)) > 1) {
													L40:
													_t695 = _t695 | 0x40000000;
													__eflags = _t695;
													goto L41;
												} else {
													_t662 = _t684[3] - _t684[2];
													asm("cdq");
													__eflags = _t662 /  *(_t806 - 0x134) - 1;
													if(_t662 /  *(_t806 - 0x134) <= 1) {
														L41:
														__eflags =  *((intOrPtr*)(_t793 + 0x3c)) - 2;
														if( *((intOrPtr*)(_t793 + 0x3c)) == 2) {
															_t695 = _t695 | 0x20000000;
															__eflags = _t695;
														}
														__eflags =  *((intOrPtr*)(_t793 + 0x40)) - 2;
														_t759 = 0x80000000;
														if( *((intOrPtr*)(_t793 + 0x40)) == 2) {
															_t695 = _t695 | 0x80000000;
															__eflags = _t695;
														}
														__eflags =  *(_t793 + 0x70);
														if( *(_t793 + 0x70) != 0) {
															__eflags =  *(_t793 + 0x70) - 0x64;
															_t482 = ((0 |  *(_t793 + 0x70) != 0x00000064) - 0x00000001 & _t759) + 0xc0000000;
															__eflags = _t482;
														} else {
															_t482 = _t759;
														}
														_t483 = CreateFileA(_t785, _t482, 3, 0, 3, _t695, 0); // executed
														 *(_t806 - 0xe8) = _t483;
														__eflags = _t483 - 0xffffffff;
														if(_t483 == 0xffffffff) {
															__eflags =  *((intOrPtr*)(_t806 - 0x34)) - 0x10;
															_t794 =  *(_t806 - 0x48);
															if( *((intOrPtr*)(_t806 - 0x34)) < 0x10) {
																_t794 = _t806 - 0x48;
															}
															_push(GetLastError());
															_push(_t794);
															_push("Error opening file: %s [%u]\n");
															goto L127;
														} else {
															__eflags =  *((intOrPtr*)(_t793 + 0x3c)) - 3;
															if( *((intOrPtr*)(_t793 + 0x3c)) != 3) {
																L51:
																_t786 =  &(_t684[5]);
																_t696 = _t786[1];
																_t486 = _t806 - 0xe8;
																__eflags = _t486 - _t696;
																if(_t486 >= _t696) {
																	L57:
																	__eflags = _t696 - _t786[2];
																	if(_t696 == _t786[2]) {
																		E00B54FAC(_t786, 1);
																	}
																	_t692 = _t786[1];
																	__eflags = _t692;
																	if(_t692 == 0) {
																		L62:
																		_t786[1] = _t786[1] + 4;
																		_t487 =  *((intOrPtr*)(_t793 + 0xb4));
																		_t785 =  *(_t806 - 0xe8);
																		__eflags = _t487 - 2;
																		if(_t487 == 2) {
																			L64:
																			 *(_t806 - 0xf4) =  *(_t806 - 0xf4) & 0x00000000;
																			 *(_t806 - 0xf0) =  *(_t806 - 0xf0) & 0x00000000;
																			__eflags =  *((char*)(_t806 - 0xdd));
																			if( *((char*)(_t806 - 0xdd)) == 0) {
																				__eflags =  *((char*)(_t806 - 0xde));
																				if( *((char*)(_t806 - 0xde)) == 0) {
																					_t785 = GetFileSize(_t785, _t806 - 0x128);
																					 *(_t806 - 0x12c) = _t785;
																					__eflags = _t785 - 0xffffffff;
																					if(_t785 != 0xffffffff) {
																						L72:
																						_t490 =  *(_t806 - 0x128);
																						L73:
																						 *(_t806 - 0xf4) = _t785;
																						 *(_t806 - 0xf0) = _t490;
																						__eflags = _t785;
																						if(_t785 != 0) {
																							L75:
																							__eflags = _t490 -  *(_t793 + 0x6c);
																							if(__eflags > 0) {
																								L79:
																								_t760 =  *(_t793 + 0x6c);
																								_t697 =  *(_t793 + 0x68);
																								__eflags = _t760;
																								if(_t760 != 0) {
																									L82:
																									__eflags = _t760 - _t490;
																									if(__eflags < 0) {
																										L86:
																										 *(_t806 - 0x140) = _t697;
																										 *(_t806 - 0x13c) = _t760;
																										E00B54738( &(_t684[8]), _t760, _t806 - 0x140);
																										L87:
																										_t761 =  *(_t806 - 0xd4);
																										 *(_t806 - 0xdc) = E00B51640(_t684, _t761);
																										_t702 =  *((intOrPtr*)(_t793 + 0x18)) +  *(_t806 - 0xdc);
																										 *(_t806 - 0xd8) = _t761;
																										_t762 = _t684[8];
																										asm("adc eax, [ebp-0xd8]");
																										__eflags = 0 -  *((intOrPtr*)(_t762 + 4 +  *(_t806 - 0xd4) * 8));
																										_t684 =  *(_t806 - 0x124);
																										if(__eflags > 0) {
																											L120:
																											_t703 = _t793;
																											_t495 = E00B4A786(_t793, _t806 - 0xb4);
																											 *(_t806 - 4) = 1;
																											__eflags =  *((intOrPtr*)(_t495 + 0x14)) - 0x10;
																											if( *((intOrPtr*)(_t495 + 0x14)) >= 0x10) {
																												_t495 =  *_t495;
																											}
																											_push( *((intOrPtr*)(_t793 + 0x18)));
																											_push( *((intOrPtr*)(_t793 + 0x34)));
																											_push( *((intOrPtr*)(_t793 + 0x30)));
																											_push( *(_t806 - 0xf0));
																											_push(_t785);
																											_push(_t684[0x23]);
																											E00B51330(_t703, "The file is too small. File: \'%s\' relative thread %u size: %I64u, base offset: %I64u block size: %u\n", _t495);
																											_t704 = _t806 - 0xb4;
																											L123:
																											E00B4A1B9(_t704, 1, 0);
																											L128:
																											 *((char*)(_t806 - 0xcd)) = 0;
																											E00B4A1B9(_t806 - 0x48, 1, 0);
																											goto L191;
																										}
																										if(__eflags < 0) {
																											L90:
																											_t705 = _t793;
																											__eflags =  *(_t793 + 0x29);
																											if( *(_t793 + 0x29) == 0) {
																												_t785 = E00B4A786(_t705, _t806 - 0x84);
																												 *(_t806 - 4) = 3;
																												__eflags =  *((intOrPtr*)(_t785 + 0x14)) - 0x10;
																												if( *((intOrPtr*)(_t785 + 0x14)) >= 0x10) {
																													_t785 =  *_t785;
																												}
																												 *((char*)(_t806 - 0x114)) =  *( *_t684 + 0xc);
																												_t503 = E00B5DA40( *(_t806 - 0xdc),  *(_t806 - 0xd8),  *((intOrPtr*)(_t793 + 0x18)), 0);
																												_push(_t762);
																												_push(_t503);
																												_push( *(_t806 - 0xd8));
																												_push( *(_t806 - 0xdc));
																												_push(_t684[0x23]);
																												_push(_t785);
																												E00B51370(_t705,  *((intOrPtr*)(_t806 - 0x114)), "thread %u starting: file \'%s\' relative thread %u file offset: %I64u (starting in block: %I64u)\n", _t684[0x22]);
																												_t807 = _t807 + 0x24;
																												_t706 = _t806 - 0x84;
																											} else {
																												_t745 = E00B4A786(_t705, _t806 - 0x6c);
																												 *(_t806 - 4) = 2;
																												__eflags =  *((intOrPtr*)(_t745 + 0x14)) - 0x10;
																												if( *((intOrPtr*)(_t745 + 0x14)) >= 0x10) {
																													_t745 =  *_t745;
																												}
																												_push(_t684[0x23]);
																												_push(_t745);
																												 *((char*)(_t806 - 0x130)) =  *( *_t684 + 0xc);
																												E00B51370(_t745,  *((intOrPtr*)(_t806 - 0x130)), "thread %u starting: file \'%s\' relative thread %u random pattern\n", _t684[0x22]);
																												_t807 = _t807 + 0x14;
																												_t706 = _t806 - 0x6c;
																											}
																											 *(_t806 - 4) = 0;
																											_t506 = E00B4BFD5(E00B4A1B9(_t706, 1, 0), _t684, _t793); // executed
																											__eflags = _t506;
																											if(_t506 == 0) {
																												_t708 = _t793;
																												_t795 = E00B4A786(_t793, _t806 - 0x9c);
																												 *(_t806 - 4) = 4;
																												__eflags =  *((intOrPtr*)(_t795 + 0x14)) - 0x10;
																												if( *((intOrPtr*)(_t795 + 0x14)) >= 0x10) {
																													_t795 =  *_t795;
																												}
																												_push(GetLastError());
																												E00B51330(_t708, "FATAL ERROR: Could not allocate a buffer bytes for target \'%s\'. Error code: 0x%x\n", _t795);
																												_t704 = _t806 - 0x9c;
																												goto L123;
																											} else {
																												 *(_t806 - 0xd4) =  &( *(_t806 - 0xd4)->LowPart.LowPart);
																												_t689 = _t806 - 0x48;
																												 *(_t806 - 4) =  *(_t806 - 4) | 0xffffffff;
																												E00B4A1B9(_t806 - 0x48, 1, 0);
																												_t785 = 0xb8;
																												_t793 = 0xb8 + _t793;
																												__eflags = _t793;
																												continue;
																											}
																										}
																										_t647 =  *(_t806 - 0xd4);
																										__eflags = _t702 -  *((intOrPtr*)(_t762 + _t647 * 8));
																										if(_t702 >=  *((intOrPtr*)(_t762 + _t647 * 8))) {
																											goto L120;
																										}
																										goto L90;
																									}
																									if(__eflags > 0) {
																										L85:
																										_t697 = _t785;
																										_t760 = _t490;
																										goto L86;
																									}
																									__eflags = _t697 - _t785;
																									if(_t697 <= _t785) {
																										goto L86;
																									}
																									goto L85;
																								}
																								__eflags = _t697;
																								if(_t697 != 0) {
																									goto L82;
																								}
																								E00B54738( &(_t684[8]), _t760, _t806 - 0xf4);
																								_t785 =  *(_t806 - 0xf4);
																								goto L87;
																							}
																							if(__eflags < 0) {
																								L78:
																								_push("Warning - file size is less than MaxFileSize\n");
																								E00B51330(_t692);
																								_t490 =  *(_t806 - 0xf0);
																								goto L79;
																							}
																							__eflags = _t785 -  *(_t793 + 0x68);
																							if(_t785 >=  *(_t793 + 0x68)) {
																								goto L79;
																							}
																							goto L78;
																						}
																						__eflags = _t490;
																						if(_t490 == 0) {
																							_push("The file is too small or there has been an error during getting file size\n");
																							L115:
																							E00B51330(_t692);
																							L110:
																							goto L128;
																						}
																						goto L75;
																					}
																					_t650 = GetLastError();
																					__eflags = _t650;
																					if(_t650 != 0) {
																						_push("Error getting file size\n");
																						goto L115;
																					}
																					_t785 =  *(_t806 - 0x12c);
																					goto L72;
																				}
																				_t692 = _t785;
																				_t651 = E00B50FB0(_t684, _t785);
																				L66:
																				_t785 = _t651;
																				_t490 = _t759;
																				goto L73;
																			}
																			_t692 = _t785;
																			_t651 = E00B51085(_t684, _t785);
																			goto L66;
																		}
																		 *(_t806 - 0x138) = _t487;
																		_t652 = _t806 - 0x138;
																		__imp__SetFileInformationByHandle(_t785, 0xc, _t652, 4);
																		__eflags = _t652;
																		if(_t652 == 0) {
																			__eflags =  *((intOrPtr*)(_t806 - 0x34)) - 0x10;
																			_t796 =  *(_t806 - 0x48);
																			if( *((intOrPtr*)(_t806 - 0x34)) < 0x10) {
																				_t796 = _t806 - 0x48;
																			}
																			_push(GetLastError());
																			_push(_t796);
																			_push("Error setting IO priority for file: %s [%u]\n");
																			L127:
																			E00B51330(_t695);
																			goto L128;
																		}
																		goto L64;
																	} else {
																		_t654 =  *(_t806 - 0xe8);
																		L61:
																		 *_t692 = _t654;
																		goto L62;
																	}
																}
																__eflags =  *_t786 - _t486;
																if( *_t786 > _t486) {
																	goto L57;
																}
																_t657 = _t486 -  *_t786 >> 2;
																 *(_t806 - 0xd8) = _t657;
																__eflags = _t696 - _t786[2];
																if(_t696 == _t786[2]) {
																	E00B54FAC(_t786, 1);
																	_t657 =  *(_t806 - 0xd8);
																}
																_t692 = _t786[1];
																_t759 =  *_t786;
																__eflags = _t692;
																if(_t692 == 0) {
																	goto L62;
																} else {
																	_t654 =  *(_t759 + _t657 * 4);
																	goto L61;
																}
															}
															_t751 = _t483;
															_t659 = E00B51250(_t483);
															__eflags = _t659;
															if(_t659 != 0) {
																E00B51330(_t751, "Failed to disable local caching (error %u). NOTE: only supported on remote filesystems with Windows 8 or newer.\n", _t659);
																goto L110;
															}
															goto L51;
														}
													}
													goto L40;
												}
											}
											__eflags =  *((char*)(_t785 + 2));
											if( *((char*)(_t785 + 2)) != 0) {
												goto L29;
											}
											_t664 = _t474 & 0x000000ff;
											__imp__isalpha(_t664);
											__eflags = _t664;
											if(_t664 == 0) {
												L28:
												_t758 =  *((intOrPtr*)(_t806 - 0x34));
												_t785 =  *(_t806 - 0x48);
												goto L30;
											}
											__eflags =  *(_t785 + 1) - 0x3a;
											if( *(_t785 + 1) != 0x3a) {
												goto L28;
											}
											 *((char*)(_t806 - 0xde)) = 1;
											__imp__sprintf_s(_t806 - 0x30, 0x20, "\\\\.\\%c:",  *_t785);
											_t807 = _t807 + 0x10;
											L27:
											_t785 = _t806 - 0x30;
											goto L32;
										}
										_t754 = _t785 + 1;
										__eflags =  *_t754;
										if( *_t754 == 0) {
											goto L22;
										}
										 *((char*)(_t806 - 0xdd)) = 1;
										__imp__sprintf_s(_t806 - 0x30, 0x20, "\\\\.\\PhysicalDrive%u", atoi(_t754));
										_t807 = _t807 + 0x14;
										goto L27;
									}
								}
								_push(_t684[0x21]);
								E00B51370(_t689,  *( *_t684 + 0xc) & 0x000000ff, "thread %u started (random seed: %u)\n", _t684[0x22]);
								 *(_t806 - 0xd8) = 0;
								_t811 = _t807 + 0x10;
								_t684[0x1e] = _t684[0x1d];
								asm("cdq");
								E00B547A3( &(_t684[0x1d]), (_t684[3] - _t684[2]) / _t785);
								E00B54B56(_t684[0x26]);
								asm("cdq");
								_t711 = _t684[0x26];
								_push((_t684[3] - _t684[2]) / _t785);
								E00B54B83(_t684, _t684[0x26], _t785, _t793, __eflags, _t829);
								_t787 = 0;
								__eflags = _t684[9] - _t684[8] >> 3;
								if(_t684[9] - _t684[8] >> 3 == 0) {
									L105:
									_t785 = 0xb8;
									asm("cdq");
									_t531 = (_t684[3] - _t684[2]) / 0xb8;
									__eflags = _t531 - 1;
									if(_t531 != 1) {
										L164:
										_t532 = _t684[1];
										__eflags =  *((char*)(_t532 + 0x30));
										if( *((char*)(_t532 + 0x30)) != 0) {
											L168:
											_t533 = _t684[2];
											_t797 = 0;
											while(1) {
												__eflags = _t533 - _t684[3];
												if(_t533 == _t684[3]) {
													break;
												}
												_t797 = _t797 +  *((intOrPtr*)(_t533 + 0x1c));
												_t533 = _t785 + _t533;
												__eflags = _t533;
											}
											_t684[0xf] = _t684[0xe];
											E00B546BF( &(_t684[0xe]), _t797);
											_t684[0x18] = _t684[0x17];
											E00B5463A( &(_t684[0x17]), _t797);
											_t711 =  &(_t684[0x1a]);
											_t684[0x1b] = _t684[0x1a];
											E00B547A3( &(_t684[0x1a]), _t797);
											_t798 = 0;
											_t684[0x15] = _t684[0x14];
											_t542 = _t684[3] - _t684[2];
											asm("cdq");
											 *(_t806 - 0xfc) =  *(_t806 - 0xfc) & 0x00000000;
											 *(_t806 - 0x108) = 0;
											__eflags = _t542 / _t785;
											if(_t542 / _t785 == 0) {
												L184:
												E00B51370(_t711,  *( *_t684 + 0xc) & 0x000000ff, "thread %u: waiting for a signal to start\n", _t684[0x22]);
												_t547 = WaitForSingleObject(_t684[0x29], 0xffffffff);
												__eflags = _t547 - 0xffffffff;
												if(_t547 == 0xffffffff) {
													L131:
													_push(GetLastError());
													_push("Waiting for a signal to start failed (error code: %u)\n");
													L7:
													E00B51330(_t711);
													goto L190;
												}
												E00B51370(_t711,  *( *_t684 + 0xc) & 0x000000ff, "thread %u: received signal to start\n", _t684[0x22]);
												__eflags =  *0xb614b8;
												if(__eflags != 0) {
													goto L190;
												}
												_t716 = _t684;
												__eflags =  *((char*)(_t684[1] + 0x30));
												if(__eflags != 0) {
													_t554 = E00B51DA7(_t716);
												} else {
													_t554 = E00B51733(_t684, _t716,  *(_t806 - 0x100), _t785, _t798, __eflags, _t829); // executed
												}
												__eflags = _t554;
												if(__eflags != 0) {
													goto L192;
												} else {
													goto L190;
												}
											} else {
												goto L173;
											}
											do {
												L173:
												_t768 = _t798;
												_t785 = _t684[2] + _t798 * 0xb8;
												 *(_t806 - 0xe4) = _t785;
												 *(_t806 - 0xd4) = E00B51681(_t684, _t768);
												 *(_t806 - 0xdc) = _t768;
												E00B54C97( &(_t684[0x14]), _t806 - 0xfc); // executed
												 *(_t806 - 0xd8) =  *(_t806 - 0xd8) & 0x00000000;
												__eflags =  *(_t785 + 0x1c);
												if( *(_t785 + 0x1c) <= 0) {
													goto L183;
												}
												_t789 =  *(_t806 - 0xfc) * 0x14;
												__eflags = _t789;
												_t561 =  *(_t806 - 0xe4);
												_t770 =  *(_t806 - 0xdc);
												do {
													__eflags =  *(_t806 - 0xd8);
													_t719 =  *(_t806 - 0xd4);
													if( *(_t806 - 0xd8) == 0) {
														L178:
														_t799 =  *(_t806 - 0xd4);
														goto L179;
													}
													__eflags =  *((char*)(_t561 + 0x38));
													if( *((char*)(_t561 + 0x38)) != 0) {
														goto L178;
													}
													_push(_t770);
													_t770 = _t798;
													_t799 = E00B51490(_t684, _t770, _t719);
													 *(_t806 - 0xdc) = _t770;
													 *(_t806 - 0xd4) = _t799;
													L179:
													_t720 =  &(_t684[0x11]);
													E00B54C97( &(_t684[0x11]), _t806 - 0x108);
													_t564 = _t684[1];
													__eflags =  *((char*)(_t564 + 0x30));
													_t565 = _t684[0xe];
													if( *((char*)(_t564 + 0x30)) != 0) {
														 *(_t789 + _t565 + 0x10) = _t684;
													} else {
														 *(_t789 + _t565 + 0x10) =  *(_t789 + _t565 + 0x10) & 0x00000000;
													}
													_t567 = E00B5D910(_t799,  *(_t806 - 0xdc),  *((intOrPtr*)( *(_t806 - 0xe4) + 0x18)), 0);
													_push(_t770);
													_push(_t567);
													_push( *(_t806 - 0xdc));
													_push(_t799);
													_t798 =  *(_t806 - 0x108);
													_push(_t798);
													E00B51370(_t720,  *( *_t684 + 0xc) & 0x000000ff, "t[%u:%u] initial I/O op at %I64u (starting in block: %I64u)\n", _t684[0x22]);
													_t811 = _t811 + 0x20;
													_t770 =  *(_t806 - 0xdc);
													 *(_t806 - 0xfc) =  *(_t806 - 0xfc) + 1;
													 *(_t789 + _t684[0xe] + 8) =  *(_t806 - 0xd4);
													 *(_t789 + _t684[0xe] + 0xc) = _t770;
													_t789 = _t789 + 0x14;
													_t561 =  *(_t806 - 0xe4);
													 *(_t806 - 0xd8) =  *(_t806 - 0xd8) + 1;
													__eflags =  *(_t806 - 0xd8) -  *((intOrPtr*)(_t561 + 0x1c));
												} while ( *(_t806 - 0xd8) <  *((intOrPtr*)(_t561 + 0x1c)));
												L183:
												_t711 = 0xb8;
												_t559 = _t684[3] - _t684[2];
												_t798 = _t798 + 1;
												asm("cdq");
												 *(_t806 - 0x108) = _t798;
												__eflags = _t798 - _t559 / 0xb8;
											} while (_t798 < _t559 / 0xb8);
											goto L184;
										}
										_t800 = 0;
										_t575 = _t684[3] - _t684[2];
										asm("cdq");
										__eflags = _t575 / _t785;
										if(_t575 / _t785 == 0) {
											goto L168;
										} else {
											goto L166;
										}
										while(1) {
											L166:
											_t578 = CreateIoCompletionPort( *(_t684[5] + _t800 * 4),  *(_t806 - 0x100), 0, 1); // executed
											 *(_t806 - 0x100) = _t578;
											__eflags = _t578;
											if(_t578 == 0) {
												break;
											}
											_t800 = _t800 + 1;
											_t581 = _t684[3] - _t684[2];
											asm("cdq");
											__eflags = _t800 - _t581 / _t785;
											if(_t800 < _t581 / _t785) {
												continue;
											}
											goto L168;
										}
										_push(GetLastError());
										_push("unable to create IO completion port (error code: %u)\n");
										goto L7;
									}
									_t785 = _t684[2];
									__eflags =  *(_t785 + 0x1c) - _t531;
									if( *(_t785 + 0x1c) != _t531) {
										_t785 = 0xb8;
										goto L164;
									}
									 *(_t806 - 0xf8) =  *(_t806 - 0xf8) & 0x00000000;
									_t711 = _t684;
									_t801 = E00B51681(_t684, 0);
									 *(_t806 - 0xe4) = _t801;
									 *(_t806 - 0xd4) = 0;
									_t585 = E00B5D910(_t801, 0,  *(_t785 + 0x18), 0);
									_push(0);
									_push(_t585);
									_push( *(_t806 - 0xd4));
									_push(_t801);
									E00B51370(_t684,  *( *_t684 + 0xc) & 0x000000ff, "t[%u] initial I/O op at %I64u (starting in block: %I64u)\n", _t684[0x22]);
									_t814 = _t811 + 0x1c;
									_push(0);
									_t590 = SetFilePointerEx( *(_t684[5]), _t801,  *(_t806 - 0xd4), 0);
									__eflags = _t590;
									if(_t590 != 0) {
										E00B51370(_t711,  *( *_t684 + 0xc) & 0x000000ff, "thread %u: waiting for a signal to start\n", _t684[0x22]);
										_t815 = _t814 + 0xc;
										_t594 = WaitForSingleObject(_t684[0x29], 0xffffffff);
										__eflags = _t594 - 0xffffffff;
										if(_t594 != 0xffffffff) {
											E00B51370(_t711,  *( *_t684 + 0xc) & 0x000000ff, "thread %u: received signal to start\n", _t684[0x22]);
											_t816 = _t815 + 0xc;
											__eflags =  *0xb614b8;
											if(__eflags != 0) {
												goto L190;
											}
											 *(_t806 - 0x178) = 0;
											_t724 =  *(_t684[1] + 0x1c);
											_t599 =  *(_t785 + 0x78);
											__eflags = _t724;
											if(_t724 == 0) {
												_t281 = _t599 %  *(_t785 + 0x48);
												__eflags = _t281;
												_t600 = _t599 /  *(_t785 + 0x48);
												_t775 = _t281;
											} else {
												_t600 = _t599 / _t724;
												_t775 = _t599 % _t724;
											}
											_t601 = E00B580D1(_t806 - 0x178, _t775,  *((intOrPtr*)(_t785 + 0x84)),  *(_t785 + 0x18),  *((intOrPtr*)(_t785 + 0x7c)), _t600);
											while(1) {
												__eflags =  *0xb61634;
												if(__eflags == 0) {
													break;
												}
												__eflags =  *0xb61640;
												if(__eflags != 0) {
													goto L192;
												}
												__eflags =  *(_t806 - 0x178);
												if( *(_t806 - 0x178) == 0) {
													L141:
													 *(_t806 - 0x120) =  *(_t806 - 0x120) & 0x00000000;
													 *(_t806 - 0x11c) =  *(_t806 - 0x11c) & 0x00000000;
													__eflags =  *((char*)(_t806 - 0x110));
													if( *((char*)(_t806 - 0x110)) != 0) {
														 *(_t806 - 0x120) = E00B4A975(_t711);
														 *(_t806 - 0x11c) = _t775;
													}
													_t602 = E00B5170C( *((intOrPtr*)(_t785 + 0x70)));
													 *((intOrPtr*)(_t806 - 0xec)) = _t602;
													__eflags = _t602 - 1;
													if(_t602 != 1) {
														__eflags = 0;
														_t728 = _t684;
														_t605 = WriteFile( *(_t684[5]), E00B4C075(_t684, 0, 0),  *(_t785 + 0x18), _t806 - 0xf8, 0);
														_t801 =  *(_t806 - 0xe4);
													} else {
														_t775 = _t806 - 0xf8;
														_t728 = _t684[5];
														_t605 = ReadFile( *(_t684[5]),  *(_t684[0xb]),  *(_t785 + 0x18), _t806 - 0xf8, 0);
													}
													__eflags = _t605;
													if(_t605 == 0) {
														__eflags =  *((intOrPtr*)(_t806 - 0xec)) - 1;
														_t803 = "read";
														if( *((intOrPtr*)(_t806 - 0xec)) != 1) {
															_t803 = "write";
														}
														_push(GetLastError());
														_push(_t803);
														_push(0);
														E00B51330(_t728, "t[%u:%u] error during %s error code: %u)\n", _t684[0x22]);
														goto L190;
													} else {
														_t608 =  *(_t806 - 0xf8);
														__eflags = _t608 -  *(_t785 + 0x18);
														if(_t608 !=  *(_t785 + 0x18)) {
															_push( *(_t785 + 0x18));
															_push(_t608);
															E00B51330(_t728, "Warning: thread %u transfered %u bytes instead of %u bytes\n", _t684[0x22]);
															_t816 = _t816 + 0x10;
														}
														__eflags =  *(_t806 - 0x178);
														if( *(_t806 - 0x178) != 0) {
															E00B581C5(_t806 - 0x178, _t775,  *(_t785 + 0x18));
														}
														__eflags =  *(_t684[0x24]);
														if( *(_t684[0x24]) != 0) {
															E00B50D77( *(_t684[0x26]), _t775, _t829,  *(_t806 - 0xf8),  *((intOrPtr*)(_t806 - 0xec)), _t806 - 0x120, _t684[0x25],  *((intOrPtr*)(_t806 - 0x110)),  *((intOrPtr*)(_t806 - 0x10c)));
														}
														_t610 =  *_t684;
														__eflags =  *(_t610 + 0x10);
														if( *(_t610 + 0x10) > 0) {
															_t730 =  *(_t806 - 0xd8) + 1;
															 *(_t806 - 0xd8) = _t730;
															__eflags = _t730 -  *(_t610 + 0x10);
															if(_t730 ==  *(_t610 + 0x10)) {
																_push(".");
																E00B512F0(_t730);
																__eflags = 0;
																 *(_t806 - 0xd8) = 0;
															}
														}
														_push( *(_t806 - 0xd4));
														_t775 = 0;
														_t711 = _t684;
														_t801 = E00B51490(_t684, 0, _t801);
														 *(_t806 - 0xe4) = _t801;
														 *(_t806 - 0xd4) = 0;
														_t613 = E00B5D910(_t801, 0,  *(_t785 + 0x18), 0);
														_push(0);
														_push(_t613);
														_push( *(_t806 - 0xd4));
														_push(_t801);
														E00B51370(_t684,  *( *_t684 + 0xc) & 0x000000ff, "t[%u] new I/O op at %I64u (starting in block: %I64u)\n", _t684[0x22]);
														_t816 = _t816 + 0x1c;
														_push(0);
														_t601 = SetFilePointerEx( *(_t684[5]), _t801,  *(_t806 - 0xd4), 0);
														__eflags = _t601;
														if(_t601 == 0) {
															_push(_t684[0x22]);
															_push("thread %u: Error setting file pointer\n");
															goto L7;
														} else {
															continue;
														}
													}
												}
												_t711 = _t806 - 0x178;
												_t601 = E00B5813D(_t601, _t806 - 0x178, _t775);
												__eflags = _t601;
												if(_t601 == 0) {
													goto L141;
												}
												Sleep(_t601);
											}
											goto L192;
										}
										goto L131;
									}
									_push(GetLastError());
									_push("Error setting file pointer. Error code: %d.\n");
									goto L7;
								}
								_t804 = 0;
								_t776 = 0;
								__eflags = 0;
								 *(_t806 - 0xdc) = 0;
								do {
									E00B4EA01( *(_t684[0x26]) + _t804, E00B4A786(_t684[2] + _t776, _t806 - 0xcc));
									E00B4A1B9(_t806 - 0xcc, 1, 0);
									__eflags =  *((char*)(_t806 - 0x10c));
									_t711 = _t684[8];
									_t777 =  *(_t684[0x26]);
									 *((intOrPtr*)(_t777 + _t804 + 0x18)) =  *((intOrPtr*)(_t711 + _t787 * 8));
									 *((intOrPtr*)(_t777 + _t804 + 0x1c)) =  *((intOrPtr*)(_t711 + 4 + _t787 * 8));
									if( *((char*)(_t806 - 0x10c)) != 0) {
										_push( *(_t806 - 0x104));
										E00B5C74E(_t684,  *(_t684[0x26]) + 0x98 + _t804, _t787, _t804,  *(_t806 - 0xe4),  *((intOrPtr*)(_t806 - 0xec)));
										_push( *(_t806 - 0x104));
										_t711 =  *(_t684[0x26]) + 0xb0 + _t804;
										__eflags =  *(_t684[0x26]) + 0xb0 + _t804;
										E00B5C74E(_t684,  *(_t684[0x26]) + 0xb0 + _t804, _t787, _t804,  *(_t806 - 0xe4),  *((intOrPtr*)(_t806 - 0xec)));
									}
									_t787 = _t787 + 1;
									_t804 = _t804 + 0xc8;
									_t776 = 0xb8 +  *(_t806 - 0xdc);
									 *(_t806 - 0xdc) = 0xb8 +  *(_t806 - 0xdc);
									__eflags = _t787 - _t684[9] - _t684[8] >> 3;
								} while (_t787 < _t684[9] - _t684[8] >> 3);
								goto L105;
							}
							_t460 = _t460 + _t785;
							__eflags = _t460;
						}
						goto L14;
					}
					 *(_t806 - 0xd8) =  *( *_t684 + 0xc);
					E00B51370(_t687,  *(_t806 - 0xd8), "affinitizing thread %u to Group %u / CPU %u\n", _t684[0x22]);
					_t785 = _t806 - 0x54;
					asm("stosd");
					_t807 = _t807 + 0x14;
					asm("stosd");
					asm("stosd");
					 *((short*)(_t806 - 0x50)) = _t684[0x27] & 0x0000ffff;
					 *(_t806 - 0x54) = 1 << _t684[0x28];
					_t677 = GetCurrentThread();
					_t689 = _t806 - 0x54;
					__imp__SetThreadGroupAffinity(_t677, _t806 - 0x54, 0, _t684[0x27] & 0x0000ffff, _t684[0x28]); // executed
					if(_t677 != 0) {
						goto L8;
					}
					_push(_t684[0x22]);
					_push("Error setting affinity mask in thread %u\n");
					goto L7;
				}
				_t805 =  *(_t784 + 0x34);
				asm("fild dword [edi+0x34]");
				if(_t805 < 0) {
					_t829 = __fp0 +  *0xb49560;
				}
				 *((long long*)(_t806 - 0x118)) = _t829;
				_t829 =  *((long long*)(_t806 - 0x118));
				_push(0);
				 *_t807 =  *((long long*)(_t806 - 0x118));
				 *(_t806 - 0xe4) = E00B4AA3B(0,  *((long long*)(_t806 - 0x118)), 0);
				 *((intOrPtr*)(_t806 - 0xec)) = _t756;
				 *(_t806 - 0x104) = ( *(_t784 + 0xc) * 0x3e8 - 1 + _t805) / _t805;
				goto L4;
			}

0x00b51f60
0x00b51f60
0x00b51f60
0x00b51f6a
0x00b51f6f
0x00b51f74
0x00b51f7a
0x00b51f81
0x00b51f87
0x00b51f8a
0x00b51f90
0x00b51f96
0x00b51f9f
0x00b51fa5
0x00b51fa8
0x00b51fb0
0x00b51ff8
0x00b51ffe
0x00b52007
0x00b5200d
0x00b52094
0x00b52094
0x00b52097
0x00b5209c
0x00b520b0
0x00b520b0
0x00b520b3
0x00000000
0x00000000
0x00b520aa
0x00b520ac
0x00b520bc
0x00b520c6
0x00b520c8
0x00b52d71
0x00b52d71
0x00b52d78
0x00b52d78
0x00b52d82
0x00b52d82
0x00b52d9e
0x00b52d87
0x00b52d8a
0x00b52d95
0x00b52d95
0x00b52d9b
0x00b52d9b
0x00b52d9b
0x00b52da3
0x00b52db3
0x00b52daa
0x00b52db0
0x00b52db0
0x00b52db0
0x00b52db8
0x00b52dbe
0x00b52dc0
0x00b52dc3
0x00b52dc3
0x00b52dcb
0x00b52dd1
0x00b52dd8
0x00b52def
0x00b52def
0x00b520ce
0x00b520ce
0x00b520d5
0x00b52535
0x00b52535
0x00b52538
0x00000000
0x00000000
0x00b520e0
0x00b520e8
0x00b520ea
0x00b520f1
0x00b520f6
0x00b520fa
0x00b520fd
0x00b52100
0x00b52106
0x00b52109
0x00b5210b
0x00b5210b
0x00b5210e
0x00b52110
0x00b5282a
0x00b5282a
0x00000000
0x00b52116
0x00b52116
0x00b52118
0x00b5211a
0x00000000
0x00000000
0x00b52120
0x00b52122
0x00b52151
0x00b52151
0x00b52155
0x00b5219e
0x00b5219e
0x00b521a4
0x00b521a4
0x00b521a7
0x00b521a9
0x00b521a9
0x00b521ac
0x00b521b2
0x00b521b7
0x00b521b9
0x00b521bb
0x00b521bb
0x00b521c6
0x00b521c8
0x00b521ca
0x00b521ca
0x00b521ca
0x00b521d6
0x00b521d8
0x00b521da
0x00b521da
0x00b521da
0x00b521e0
0x00b521e4
0x00b521f8
0x00b521f8
0x00b521f8
0x00000000
0x00b521e6
0x00b521e9
0x00b521ec
0x00b521f3
0x00b521f6
0x00b521fe
0x00b521fe
0x00b52202
0x00b52204
0x00b52204
0x00b52204
0x00b5220a
0x00b5220e
0x00b52213
0x00b52215
0x00b52215
0x00b52215
0x00b52217
0x00b5221b
0x00b52223
0x00b5222d
0x00b5222d
0x00b5221d
0x00b5221d
0x00b5221d
0x00b5223d
0x00b52243
0x00b52249
0x00b5224c
0x00b527f1
0x00b527f5
0x00b527f8
0x00b527fa
0x00b527fa
0x00b52803
0x00b52804
0x00b52805
0x00000000
0x00b52252
0x00b52252
0x00b52256
0x00b52267
0x00b52267
0x00b5226a
0x00b5226d
0x00b52273
0x00b52275
0x00b522a8
0x00b522a8
0x00b522ab
0x00b522b1
0x00b522b1
0x00b522b6
0x00b522b9
0x00b522bb
0x00b522c5
0x00b522c5
0x00b522c9
0x00b522cf
0x00b522d5
0x00b522d8
0x00b522fa
0x00b522fa
0x00b52301
0x00b52308
0x00b5230f
0x00b5231e
0x00b52325
0x00b5233e
0x00b52340
0x00b52346
0x00b52349
0x00b5235f
0x00b5235f
0x00b52365
0x00b52365
0x00b5236b
0x00b52371
0x00b52373
0x00b5237d
0x00b5237d
0x00b52380
0x00b5239a
0x00b5239a
0x00b5239d
0x00b523a0
0x00b523a2
0x00b523bf
0x00b523bf
0x00b523c1
0x00b523cd
0x00b523cd
0x00b523dd
0x00b523e3
0x00b523e8
0x00b523e8
0x00b523f8
0x00b52400
0x00b52406
0x00b5240c
0x00b52415
0x00b5241b
0x00b5241f
0x00b52425
0x00b527a2
0x00b527a8
0x00b527ab
0x00b527b0
0x00b527b4
0x00b527b8
0x00b527ba
0x00b527ba
0x00b527bc
0x00b527bf
0x00b527c2
0x00b527c5
0x00b527cb
0x00b527cc
0x00b527d8
0x00b527e0
0x00b527e6
0x00b527ea
0x00b52812
0x00b52819
0x00b52820
0x00000000
0x00b52820
0x00b5242b
0x00b5243c
0x00b5243f
0x00b52441
0x00b52443
0x00b52498
0x00b5249a
0x00b5249e
0x00b524a2
0x00b524a4
0x00b524a4
0x00b524bc
0x00b524c2
0x00b524c7
0x00b524c8
0x00b524c9
0x00b524cf
0x00b524d5
0x00b524db
0x00b524ed
0x00b524f2
0x00b524f5
0x00b52445
0x00b5244e
0x00b52450
0x00b52454
0x00b52458
0x00b5245a
0x00b5245a
0x00b5245c
0x00b52464
0x00b5246e
0x00b5247f
0x00b52484
0x00b52487
0x00b52487
0x00b524ff
0x00b5250b
0x00b52510
0x00b52512
0x00b5276f
0x00b52777
0x00b52779
0x00b5277d
0x00b52781
0x00b52783
0x00b52783
0x00b5278b
0x00b52792
0x00b5279a
0x00000000
0x00b52518
0x00b52518
0x00b5251e
0x00b52521
0x00b52529
0x00b5252e
0x00b52533
0x00b52533
0x00000000
0x00b52533
0x00b52512
0x00b5242d
0x00b52433
0x00b52436
0x00000000
0x00000000
0x00000000
0x00b52436
0x00b523c3
0x00b523c9
0x00b523c9
0x00b523cb
0x00000000
0x00b523cb
0x00b523c5
0x00b523c7
0x00000000
0x00000000
0x00000000
0x00b523c7
0x00b523a4
0x00b523a6
0x00000000
0x00000000
0x00b523b2
0x00b523b7
0x00000000
0x00b523b7
0x00b52382
0x00b52389
0x00b52389
0x00b5238e
0x00b52393
0x00000000
0x00b52399
0x00b52384
0x00b52387
0x00000000
0x00000000
0x00000000
0x00b52387
0x00b52375
0x00b52377
0x00b52762
0x00b5275b
0x00b5275b
0x00b52732
0x00000000
0x00b52732
0x00000000
0x00b52377
0x00b5234b
0x00b52351
0x00b52353
0x00b52756
0x00000000
0x00b52756
0x00b52359
0x00000000
0x00b52359
0x00b52327
0x00b52329
0x00b52318
0x00b52318
0x00b5231a
0x00000000
0x00b5231a
0x00b52311
0x00b52313
0x00000000
0x00b52313
0x00b522dc
0x00b522e2
0x00b522ec
0x00b522f2
0x00b522f4
0x00b52738
0x00b5273c
0x00b5273f
0x00b52741
0x00b52741
0x00b5274a
0x00b5274b
0x00b5274c
0x00b5280a
0x00b5280a
0x00000000
0x00b5280f
0x00000000
0x00b522bd
0x00b522bd
0x00b522c3
0x00b522c3
0x00000000
0x00b522c3
0x00b522bb
0x00b52277
0x00b52279
0x00000000
0x00000000
0x00b5227d
0x00b52280
0x00b52286
0x00b52289
0x00b5228f
0x00b52294
0x00b52294
0x00b5229a
0x00b5229d
0x00b5229f
0x00b522a1
0x00000000
0x00b522a3
0x00b522a3
0x00000000
0x00b522a3
0x00b522a1
0x00b52258
0x00b5225a
0x00b5225f
0x00b52261
0x00b5272c
0x00000000
0x00b52731
0x00000000
0x00b52261
0x00b5224c
0x00000000
0x00b521f6
0x00b521e4
0x00b52157
0x00b5215b
0x00000000
0x00000000
0x00b5215d
0x00b52161
0x00b52168
0x00b5216a
0x00b52196
0x00b52196
0x00b52199
0x00000000
0x00b52199
0x00b5216c
0x00b52170
0x00000000
0x00000000
0x00b5217e
0x00b52188
0x00b5218e
0x00b52191
0x00b52191
0x00000000
0x00b52191
0x00b52124
0x00b52127
0x00b5212a
0x00000000
0x00000000
0x00b5213c
0x00b52146
0x00b5214c
0x00000000
0x00b5214c
0x00b52110
0x00b5253e
0x00b52556
0x00b52560
0x00b52566
0x00b5256b
0x00b52574
0x00b52578
0x00b52583
0x00b5258e
0x00b52591
0x00b52597
0x00b52598
0x00b525a0
0x00b525a8
0x00b525aa
0x00b52685
0x00b52688
0x00b52690
0x00b52691
0x00b52693
0x00b52696
0x00b52af5
0x00b52af5
0x00b52af8
0x00b52afc
0x00b52b3b
0x00b52b3b
0x00b52b3e
0x00b52b58
0x00b52b58
0x00b52b5b
0x00000000
0x00000000
0x00b52b53
0x00b52b56
0x00b52b56
0x00b52b56
0x00b52b63
0x00b52b66
0x00b52b71
0x00b52b74
0x00b52b79
0x00b52b7f
0x00b52b82
0x00b52b8a
0x00b52b8c
0x00b52b92
0x00b52b95
0x00b52b98
0x00b52b9f
0x00b52ba5
0x00b52ba7
0x00b52cfc
0x00b52d0e
0x00b52d1e
0x00b52d24
0x00b52d27
0x00b52861
0x00b52867
0x00b52868
0x00b52088
0x00b52088
0x00000000
0x00b5208e
0x00b52d3f
0x00b52d47
0x00b52d4e
0x00000000
0x00000000
0x00b52d53
0x00b52d55
0x00b52d59
0x00b52d68
0x00b52d5b
0x00b52d61
0x00b52d61
0x00b52d6d
0x00b52d6f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00b52bad
0x00b52bad
0x00b52bb3
0x00b52bb7
0x00b52bba
0x00b52bc5
0x00b52bd4
0x00b52bdb
0x00b52be0
0x00b52be7
0x00b52beb
0x00000000
0x00000000
0x00b52bf1
0x00b52bf1
0x00b52bf8
0x00b52bfe
0x00b52c04
0x00b52c04
0x00b52c0b
0x00b52c11
0x00b52c34
0x00b52c34
0x00000000
0x00b52c34
0x00b52c13
0x00b52c17
0x00000000
0x00000000
0x00b52c19
0x00b52c1b
0x00b52c24
0x00b52c26
0x00b52c2c
0x00b52c3a
0x00b52c41
0x00b52c44
0x00b52c49
0x00b52c4c
0x00b52c50
0x00b52c53
0x00b52c5c
0x00b52c55
0x00b52c55
0x00b52c55
0x00b52c72
0x00b52c77
0x00b52c78
0x00b52c79
0x00b52c81
0x00b52c82
0x00b52c88
0x00b52c99
0x00b52ca1
0x00b52caa
0x00b52cb0
0x00b52cb6
0x00b52cbd
0x00b52cc1
0x00b52cc4
0x00b52cca
0x00b52cd6
0x00b52cd6
0x00b52cdf
0x00b52ce2
0x00b52ce7
0x00b52cea
0x00b52ceb
0x00b52cee
0x00b52cf4
0x00b52cf4
0x00000000
0x00b52bad
0x00b52b01
0x00b52b03
0x00b52b06
0x00b52b09
0x00b52b0b
0x00000000
0x00000000
0x00000000
0x00000000
0x00b52b0d
0x00b52b0d
0x00b52b1d
0x00b52b23
0x00b52b29
0x00b52b2b
0x00000000
0x00000000
0x00b52b30
0x00b52b31
0x00b52b34
0x00b52b37
0x00b52b39
0x00000000
0x00000000
0x00000000
0x00b52b39
0x00b52b48
0x00b52b49
0x00000000
0x00b52b49
0x00b5269c
0x00b5269f
0x00b526a2
0x00b52af0
0x00000000
0x00b52af0
0x00b526a8
0x00b526b1
0x00b526bd
0x00b526c3
0x00b526c9
0x00b526cf
0x00b526d4
0x00b526d5
0x00b526d6
0x00b526de
0x00b526ef
0x00b526f7
0x00b526fa
0x00b52707
0x00b5270d
0x00b5270f
0x00b52846
0x00b5284b
0x00b52856
0x00b5285c
0x00b5285f
0x00b52884
0x00b52889
0x00b5288c
0x00b52893
0x00000000
0x00000000
0x00b5289e
0x00b528a5
0x00b528a8
0x00b528ab
0x00b528ad
0x00b528b3
0x00b528b3
0x00b528b3
0x00b528b3
0x00b528af
0x00b528af
0x00b528af
0x00b528af
0x00b528c9
0x00b52a99
0x00b52a99
0x00b52aa0
0x00000000
0x00000000
0x00b528d3
0x00b528da
0x00000000
0x00000000
0x00b528e0
0x00b528e7
0x00b52904
0x00b52904
0x00b5290b
0x00b52912
0x00b52919
0x00b52920
0x00b52926
0x00b52926
0x00b5292f
0x00b52934
0x00b5293a
0x00b5293d
0x00b52966
0x00b5296f
0x00b52979
0x00b5297f
0x00b5293f
0x00b52942
0x00b52948
0x00b52955
0x00b52955
0x00b52985
0x00b52987
0x00b52abb
0x00b52ac2
0x00b52ac7
0x00b52ac9
0x00b52ac9
0x00b52ad4
0x00b52ad5
0x00b52ad6
0x00b52ae3
0x00000000
0x00b5298d
0x00b5298d
0x00b52993
0x00b52996
0x00b52998
0x00b5299b
0x00b529a7
0x00b529ac
0x00b529ac
0x00b529af
0x00b529b6
0x00b529c1
0x00b529c1
0x00b529cc
0x00b529cf
0x00b529fe
0x00b529fe
0x00b52a03
0x00b52a05
0x00b52a09
0x00b52a11
0x00b52a12
0x00b52a18
0x00b52a1b
0x00b52a1d
0x00b52a22
0x00b52a27
0x00b52a2a
0x00b52a2a
0x00b52a1b
0x00b52a30
0x00b52a36
0x00b52a38
0x00b52a45
0x00b52a4b
0x00b52a51
0x00b52a57
0x00b52a5c
0x00b52a5d
0x00b52a5e
0x00b52a66
0x00b52a77
0x00b52a7f
0x00b52a82
0x00b52a8f
0x00b52a95
0x00b52a97
0x00b52aab
0x00b52ab1
0x00000000
0x00000000
0x00000000
0x00000000
0x00b52a97
0x00b52987
0x00b528e9
0x00b528ef
0x00b528f4
0x00b528f6
0x00000000
0x00000000
0x00b528f9
0x00b528f9
0x00000000
0x00b52aa6
0x00000000
0x00b5285f
0x00b5271b
0x00b5271c
0x00000000
0x00b5271c
0x00b525b0
0x00b525b2
0x00b525b2
0x00b525b4
0x00b525ba
0x00b525d6
0x00b525e5
0x00b525ea
0x00b525f7
0x00b525fa
0x00b525ff
0x00b52607
0x00b5260b
0x00b52613
0x00b5262f
0x00b5263a
0x00b52654
0x00b52654
0x00b52656
0x00b52656
0x00b5265e
0x00b52662
0x00b5266e
0x00b52677
0x00b5267d
0x00b5267d
0x00000000
0x00b525ba
0x00b520ae
0x00b520ae
0x00b520ae
0x00000000
0x00b520b5
0x00b5201e
0x00b5203d
0x00b52048
0x00b52054
0x00b52055
0x00b52058
0x00b52059
0x00b5205d
0x00b52063
0x00b52066
0x00b5206e
0x00b52073
0x00b5207b
0x00000000
0x00000000
0x00b5207d
0x00b52083
0x00000000
0x00b52083
0x00b51fb2
0x00b51fb5
0x00b51fba
0x00b51fbc
0x00b51fbc
0x00b51fc2
0x00b51fc8
0x00b51fce
0x00b51fd0
0x00b51fd8
0x00b51fe5
0x00b51ff2
0x00000000

APIs

__EH_prolog3_GS.LIBCMT ref: 00B51F6A
srand.MSVCRT ref: 00B51FFE
GetCurrentThread.KERNEL32 ref: 00B52066
SetThreadGroupAffinity.KERNELBASE(00000000,?,00000000), ref: 00B52073
atoi.MSVCRT ref: 00B5212D
sprintf_s.MSVCRT ref: 00B52146
isalpha.MSVCRT ref: 00B52161
sprintf_s.MSVCRT ref: 00B52188
CreateFileA.KERNELBASE(?,-C0000001,00000003,00000000,00000003,00000080,00000000,?), ref: 00B5223D
SetFileInformationByHandle.KERNEL32(?,0000000C,?,00000004), ref: 00B522EC
GetFileSize.KERNEL32(?,?), ref: 00B52338
GetLastError.KERNEL32 ref: 00B5234B
__aulldiv.LIBCMT ref: 00B524C2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B526CF
SetFilePointerEx.KERNEL32(00000010,00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 00B52707
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 00B52715
GetLastError.KERNEL32 ref: 00B52744
GetLastError.KERNEL32(?,?,00000001,00000000), ref: 00B52785
GetLastError.KERNEL32 ref: 00B527FD
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 00B52856
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 00B52861
Sleep.KERNEL32(00000000,?,00000004,?,?,?), ref: 00B528F9
ReadFile.KERNEL32(00000010,00000001,00000004,?,00000000,?,00000004,?,?,?), ref: 00B52955
WriteFile.KERNEL32(00000010,00000000,00000000,00000000,00000004,?,00000000,?,00000004,?,?,?), ref: 00B52979
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B52A57
SetFilePointerEx.KERNEL32(00000010,00000000,?,00000000,00000000), ref: 00B52A8F

Part of subcall function 00B5813D: GetTickCount64.KERNEL32 ref: 00B58148

GetLastError.KERNEL32 ref: 00B52ACE
CreateIoCompletionPort.KERNELBASE(00000010,?,00000000,00000001,?,?), ref: 00B52B1D
GetLastError.KERNEL32 ref: 00B52B42
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B52C72
WaitForSingleObject.KERNEL32(?,000000FF,00000001,?,?), ref: 00B52D1E
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00B52D95
FindCloseChangeNotification.KERNELBASE(?), ref: 00B52DAA
CloseHandle.KERNEL32(?), ref: 00B52DC3
??3@YAXPAX@Z.MSVCRT ref: 00B52DD1

Strings

Failed to disable local caching (error %u). NOTE: only supported on remote filesystems with Windows 8 or newer., xrefs: 00B52727
thread %u starting: file '%s' relative thread %u random pattern, xrefs: 00B52474
SeLockMemoryPrivilege, xrefs: 00B520BC
read, xrefs: 00B52AC2
Warning - file size is less than MaxFileSize, xrefs: 00B52389
t[%u:%u] error during %s error code: %u), xrefs: 00B52ADE
thread %u: waiting for a signal to start, xrefs: 00B5283C, 00B52D04
thread %u: Error setting file pointer, xrefs: 00B52AB1
Error setting affinity mask in thread %u, xrefs: 00B52083
unable to create IO completion port (error code: %u), xrefs: 00B52B49
FATAL ERROR: invalid filename, xrefs: 00B5282A
\\.\PhysicalDrive%u, xrefs: 00B52134
thread %u: received signal to start, xrefs: 00B5287A, 00B52D35
t[%u:%u] initial I/O op at %I64u (starting in block: %I64u), xrefs: 00B52C93
\\.\%c:, xrefs: 00B52176
Error setting IO priority for file: %s [%u], xrefs: 00B5274C
affinitizing thread %u to Group %u / CPU %u, xrefs: 00B52032
Warning: thread %u transfered %u bytes instead of %u bytes, xrefs: 00B529A2
Waiting for a signal to start failed (error code: %u), xrefs: 00B52868
thread %u started (random seed: %u), xrefs: 00B5254C
The file is too small. File: '%s' relative thread %u size: %I64u, base offset: %I64u block size: %u, xrefs: 00B527D3
thread %u starting: file '%s' relative thread %u file offset: %I64u (starting in block: %I64u), xrefs: 00B524E2
ERROR:, xrefs: 00B520B7
Error opening file: %s [%u], xrefs: 00B52805
write, xrefs: 00B52AC9, 00B52AD5
Error setting file pointer. Error code: %d., xrefs: 00B5271C
FATAL ERROR: Could not allocate a buffer bytes for target '%s'. Error code: 0x%x, xrefs: 00B5278D
The file is too small or there has been an error during getting file size, xrefs: 00B52762
Error getting file size, xrefs: 00B52756
t[%u] initial I/O op at %I64u (starting in block: %I64u), xrefs: 00B526E9
t[%u] new I/O op at %I64u (starting in block: %I64u), xrefs: 00B52A71

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ErrorLast$File$Unothrow_t@std@@@__ehfuncinfo$??2@$CloseCreateHandleObjectPointerSingleThreadWaitsprintf_s$??3@AffinityChangeCompletionCount64CurrentFindFreeGroupH_prolog3_InformationNotificationPortReadSizeSleepTickVirtualWrite__aulldivatoiisalphasrand
String ID: ERROR:$Error getting file size$Error opening file: %s [%u]$Error setting IO priority for file: %s [%u]$Error setting affinity mask in thread %u$Error setting file pointer. Error code: %d.$FATAL ERROR: Could not allocate a buffer bytes for target '%s'. Error code: 0x%x$FATAL ERROR: invalid filename$Failed to disable local caching (error %u). NOTE: only supported on remote filesystems with Windows 8 or newer.$SeLockMemoryPrivilege$The file is too small or there has been an error during getting file size$The file is too small. File: '%s' relative thread %u size: %I64u, base offset: %I64u block size: %u$Waiting for a signal to start failed (error code: %u)$Warning - file size is less than MaxFileSize$Warning: thread %u transfered %u bytes instead of %u bytes$\\.\%c:$\\.\PhysicalDrive%u$affinitizing thread %u to Group %u / CPU %u$read$t[%u:%u] error during %s error code: %u)$t[%u:%u] initial I/O op at %I64u (starting in block: %I64u)$t[%u] initial I/O op at %I64u (starting in block: %I64u)$t[%u] new I/O op at %I64u (starting in block: %I64u)$thread %u started (random seed: %u)$thread %u starting: file '%s' relative thread %u file offset: %I64u (starting in block: %I64u)$thread %u starting: file '%s' relative thread %u random pattern$thread %u: Error setting file pointer$thread %u: received signal to start$thread %u: waiting for a signal to start$unable to create IO completion port (error code: %u)$write
API String ID: 2250426-2870866691
Opcode ID: 0825729049781bf267ff4c7d038fa1f89e3eba67f9e462a059489463166f4609
Instruction ID: c6ff9438972e6b74c1d74b1d4593a4e123572d4992c45676d2bcc840f3a285e4
Opcode Fuzzy Hash: 0825729049781bf267ff4c7d038fa1f89e3eba67f9e462a059489463166f4609
Instruction Fuzzy Hash: D1928D709012149FDF25DF64C885BA9B7F5EF06301F0480E9ED49AB292CB71AE89DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00B51175 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 57%

			E00B51175(CHAR* __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				int _t19;
				int _t21;
				long _t22;
				long _t31;
				CHAR* _t36;
				void* _t37;
				signed int _t38;

				_t35 = __edx;
				_t32 = __ecx;
				_t13 =  *0xb61000; // 0xba7e72c4
				_v8 = _t13 ^ _t38;
				_v28 = _v28 | 0xffffffff;
				_t37 = __edx;
				_t36 = __ecx;
				_t31 = 1;
				if(OpenProcessToken(GetCurrentProcess(), 0x20,  &_v28) != 0) {
					_v24.PrivilegeCount = 1;
					_v12 = 2;
					_t19 = LookupPrivilegeValueA(0, _t36,  &(_v24.Privileges)); // executed
					if(_t19 != 0) {
						_t32 = 0;
						_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0); // executed
						if(_t21 != 0) {
							_t22 = GetLastError();
							if(_t22 != 0) {
								goto L7;
							}
						} else {
							_t22 = GetLastError();
							L7:
							_push(_t22);
							_push(_t36);
							_push(_t37);
							_push("%s Error adjusting token privileges for %s (error code: %u)\n");
							goto L8;
						}
					} else {
						_push(GetLastError());
						_push(_t36);
						_push(_t37);
						_push("%s Error looking up privilege value %s (error code: %u)\n");
						L8:
						E00B51330(_t32);
						goto L9;
					}
				} else {
					_push(GetLastError());
					E00B51330(_t32, "%s Error opening process token (error code: %u)\n", _t37);
					L9:
					_t31 = 0;
				}
				if(_v28 != 0xffffffff) {
					FindCloseChangeNotification(_v28); // executed
				}
				return E00B5CFA0(_t31, _t31, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x00b51175
0x00b51175
0x00b5117d
0x00b51184
0x00b51187
0x00b51194
0x00b51198
0x00b5119a
0x00b511aa
0x00b511c6
0x00b511cd
0x00b511d4
0x00b511dc
0x00b511ee
0x00b511fb
0x00b51203
0x00b5120d
0x00b51215
0x00000000
0x00000000
0x00b51205
0x00b51205
0x00b51217
0x00b51217
0x00b51218
0x00b51219
0x00b5121a
0x00000000
0x00b5121a
0x00b511de
0x00b511e4
0x00b511e5
0x00b511e6
0x00b511e7
0x00b5121f
0x00b5121f
0x00000000
0x00b51224
0x00b511ac
0x00b511b2
0x00b511b9
0x00b51227
0x00b51227
0x00b51227
0x00b5122d
0x00b51232
0x00b51232
0x00b5124a

APIs

GetCurrentProcess.KERNEL32(00000020,000000FF,000000B8,?,?), ref: 00B5119B
OpenProcessToken.ADVAPI32(00000000,?,?), ref: 00B511A2
GetLastError.KERNEL32(?,?), ref: 00B511AC
LookupPrivilegeValueA.ADVAPI32(00000000,SeLockMemoryPrivilege,?), ref: 00B511D4
GetLastError.KERNEL32(?,?), ref: 00B511DE
FindCloseChangeNotification.KERNELBASE(000000FF,?,?), ref: 00B51232

Strings

%s Error adjusting token privileges for %s (error code: %u), xrefs: 00B5121A
%s Error looking up privilege value %s (error code: %u), xrefs: 00B511E7
SeLockMemoryPrivilege, xrefs: 00B511CA, 00B511E5, 00B51218
ERROR:, xrefs: 00B511B3, 00B511E6, 00B51219
%s Error opening process token (error code: %u), xrefs: 00B511B4

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ErrorLastProcess$ChangeCloseCurrentFindLookupNotificationOpenPrivilegeTokenValue
String ID: %s Error adjusting token privileges for %s (error code: %u)$%s Error looking up privilege value %s (error code: %u)$%s Error opening process token (error code: %u)$ERROR:$SeLockMemoryPrivilege
API String ID: 3977855488-962059016
Opcode ID: 88ca1da6954a4d5ceee5f0fbff67a08d6f66a9f96c452b86704ce3061228e50d
Instruction ID: 7e103606103229ab8297ffffabbe83fc55af6579ef347e779a2e6a1dd94d2bda
Opcode Fuzzy Hash: 88ca1da6954a4d5ceee5f0fbff67a08d6f66a9f96c452b86704ce3061228e50d
Instruction Fuzzy Hash: 12219D74640204AFEB14ABA99C4EFBF7BBDEB41352F0006E9F915D3190DA654909CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00B51446 Relevance: 1.5, APIs: 1, Instructions: 27
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E00B51446(void* __ecx, void* _a4, signed int _a8) {
				signed int _v8;
				void* __esi;
				signed int _t7;
				signed int _t11;
				void* _t14;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t24;
				signed int _t25;

				_t7 =  *0xb61000; // 0xba7e72c4
				_v8 = _t7 ^ _t25;
				 *0xb621f8(__ecx); // executed
				_t11 = NtQuerySystemInformation(8, _a4, _a8 * 0x30, 0); // executed
				_t24 = _t22;
				return E00B5CFA0(_t11 & 0xffffff00 | _t11 > 0x00000000, _t14, _v8 ^ _t25, _t20, _t21, _t24);
			}

0x00b5144c
0x00b51453
0x00b5146b
0x00b51471
0x00b51477
0x00b51488

APIs

NtQuerySystemInformation.NTDLL ref: 00B51471

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: f8c4253aaca9fbcbeec2ef247ee24cef30cfa7ecd9526c5b15d01ef125aa0cb2
Instruction ID: 8dc5b26d3637146f95926d3404c567c3605c6d2d530fbf7e7f910b8a95e36722
Opcode Fuzzy Hash: f8c4253aaca9fbcbeec2ef247ee24cef30cfa7ecd9526c5b15d01ef125aa0cb2
Instruction Fuzzy Hash: 84E09231604218AFDB04DF59DC12FAEBBADEB89360F05805AF80ADB1D0CE70AD04DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B4AB1C Relevance: 105.5, APIs: 14, Strings: 46, Instructions: 517
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E00B4AB1C(void* __ecx, void* __eflags, intOrPtr _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v4116;
				char _v4140;
				char _v4164;
				char* _v4168;
				char _v4172;
				intOrPtr _v4176;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t123;
				signed int _t124;
				void* _t128;
				void* _t139;
				char* _t142;
				char* _t145;
				char* _t148;
				char* _t151;
				intOrPtr _t156;
				void* _t172;
				char* _t180;
				intOrPtr _t183;
				intOrPtr _t221;
				intOrPtr _t228;
				void* _t236;
				void* _t241;
				void* _t246;
				void* _t251;
				void* _t261;
				char _t262;
				char* _t263;
				void* _t264;
				void* _t265;
				void* _t333;
				void* _t335;
				void* _t336;
				void* _t337;
				char* _t338;
				void* _t340;
				signed int _t341;
				void* _t342;
				void* _t344;
				void* _t352;

				_t352 = __eflags;
				E00B5DB30(0x1040);
				_t123 =  *0xb61000; // 0xba7e72c4
				_t124 = _t123 ^ _t341;
				_v20 = _t124;
				 *[fs:0x0] =  &_v16;
				_t337 = __ecx;
				_t334 = _a4;
				_t262 = 0;
				_v8 = 0;
				_v4176 = _a4;
				_v4172 = 0;
				E00B4A144(_a4, "<Target>\n");
				_v8 = 0;
				_v4172 = 1;
				_t331 = L00B4C681( &_v4164, "<Path>", _t352);
				_v8 = 1;
				_t128 = E00B4C716(0,  &_v4140, _t127, "</Path>\n");
				_v8 = 2;
				L00B4C5D8(0, _a4, _t127, _a4, _t337, _t128, 0, 0xffffffff);
				E00B4A1B9( &_v4140, 1, 0);
				_v8 = 0;
				E00B4A1B9( &_v4164, 1, 0);
				__imp__sprintf_s( &_v4116, 0x1000, "<BlockSize>%u</BlockSize>\n",  *((intOrPtr*)(_t337 + 0x18)), _t337, _t124, _t333, _t336, _t261,  *[fs:0x0], 0xb5dccb, 0xffffffff);
				E00B4C52F(0, _t334, _t127, _t334, _t337, _t352,  &_v4116);
				__imp__sprintf_s( &_v4116, 0x1000, "<BaseFileOffset>%I64u</BaseFileOffset>\n",  *((intOrPtr*)(_t337 + 0x30)),  *((intOrPtr*)(_t337 + 0x34)), E00B49AB6( &_v4116));
				_t139 = E00B49AB6( &_v4116);
				_t344 = _t342 + 0x2c;
				_push(_t139);
				E00B4C52F(0, _t334, _t127, _t334, _t337, _t352,  &_v4116);
				_t142 = "<SequentialScan>true</SequentialScan>\n";
				_t353 =  *((intOrPtr*)(_t337 + 0x88));
				if( *((intOrPtr*)(_t337 + 0x88)) == 0) {
					_t142 = "<SequentialScan>false</SequentialScan>\n";
				}
				_v4168 = _t142;
				_push(E00B49AB6(_t142));
				E00B4C52F(_t262, _t334, _t331, _t334, _t337, _t353, _v4168);
				_t354 =  *((char*)(_t337 + 0x89));
				_t145 = "<RandomAccess>true</RandomAccess>\n";
				if( *((char*)(_t337 + 0x89)) == 0) {
					_t145 = "<RandomAccess>false</RandomAccess>\n";
				}
				_v4168 = _t145;
				_push(E00B49AB6(_t145));
				E00B4C52F(_t262, _t334, _t331, _t334, _t337, _t354, _v4168);
				_t355 =  *((char*)(_t337 + 0x8a));
				_t148 = "<TemporaryFile>true</TemporaryFile>\n";
				if( *((char*)(_t337 + 0x8a)) == 0) {
					_t148 = "<TemporaryFile>false</TemporaryFile>\n";
				}
				_v4168 = _t148;
				_push(E00B49AB6(_t148));
				E00B4C52F(_t262, _t334, _t331, _t334, _t337, _t355, _v4168);
				_t356 =  *((char*)(_t337 + 0x8b));
				_t151 = "<UseLargePages>true</UseLargePages>\n";
				if( *((char*)(_t337 + 0x8b)) == 0) {
					_t151 = "<UseLargePages>false</UseLargePages>\n";
				}
				_v4168 = _t151;
				_push(E00B49AB6(_t151));
				E00B4C52F(_t262, _t334, _t331, _t334, _t337, _t356, _v4168); // executed
				_t156 =  *((intOrPtr*)(_t337 + 0x3c));
				if(_t156 == 0) {
					_push(E00B49AB6("<DisableOSCache>true</DisableOSCache>\n"));
					_push("<DisableOSCache>true</DisableOSCache>\n");
					goto L12;
				} else {
					_t358 = _t156 != 1;
					if(_t156 != 1) {
						L13:
						_t359 =  *((intOrPtr*)(_t337 + 0x40)) == 0;
						if( *((intOrPtr*)(_t337 + 0x40)) == 0) {
							_push(E00B49AB6("<WriteThrough>true</WriteThrough>\n"));
							E00B4C52F(_t262, _t334, _t331, _t334, _t337, _t359, "<WriteThrough>true</WriteThrough>\n");
						}
						_push(E00B49AB6("<WriteBufferContent>\n"));
						E00B4C52F(_t262, _t334, _t331, _t334, _t337, _t359, "<WriteBufferContent>\n");
						_t360 =  *((char*)(_t337 + 0x44));
						if( *((char*)(_t337 + 0x44)) == 0) {
							__eflags =  *(_t337 + 0x90) |  *(_t337 + 0x94);
							if(( *(_t337 + 0x90) |  *(_t337 + 0x94)) != 0) {
								E00B4C52F(_t262, _t334, _t331, _t334, _t337, __eflags, "<Pattern>random</Pattern>\n");
								E00B4C52F(_t262, _t334, _t331, _t334, _t337, __eflags, "<RandomDataSource>\n");
								__imp__sprintf_s( &_v4116, 0x1000, "<SizeInBytes>%I64u</SizeInBytes>\n",  *(_t337 + 0x90),  *(_t337 + 0x94), E00B49AB6("<RandomDataSource>\n"), E00B49AB6("<Pattern>random</Pattern>\n"));
								_t172 = E00B49AB6( &_v4116);
								_t344 = _t344 + 0x18;
								_push(_t172);
								E00B4C52F(_t262, _t334, _t331, _t334, _t337, __eflags,  &_v4116);
								_t331 = 0xb42118;
								__eflags = E00B4C755(_t337 + 0x98, 0xb42118, __eflags);
								if(__eflags == 0) {
									_push(_t337 + 0x98);
									_t331 = L00B4C681( &_v4140, "<FilePath>", __eflags);
									_v8 = 3;
									_t251 = E00B4C716(_t262,  &_v4164, _t250, "</FilePath>\n");
									_v8 = 4;
									L00B4C5D8(_t262, _t334, _t250, _t334, _t337, _t251, _t262, 0xffffffff);
									E00B4A1B9( &_v4164, 1, _t262);
									_v8 = _t262;
									E00B4A1B9( &_v4140, 1, _t262);
								}
								_push(E00B49AB6("</RandomDataSource>\n"));
								_push("</RandomDataSource>\n");
							} else {
								_push(E00B49AB6("<Pattern>sequential</Pattern>\n"));
								_push("<Pattern>sequential</Pattern>\n");
							}
						} else {
							_push(E00B49AB6("<Pattern>zero</Pattern>\n"));
							_push("<Pattern>zero</Pattern>\n");
						}
						E00B4C52F(_t262, _t334, _t331, _t334, _t337, _t360);
						_push(E00B49AB6("</WriteBufferContent>\n"));
						E00B4C52F(_t262, _t334, _t331, _t334, _t337, _t360, "</WriteBufferContent>\n");
						_t361 =  *((char*)(_t337 + 0x38));
						_t180 = "<ParallelAsyncIO>true</ParallelAsyncIO>\n";
						if( *((char*)(_t337 + 0x38)) == 0) {
							_t180 = "<ParallelAsyncIO>false</ParallelAsyncIO>\n";
						}
						_v4168 = _t180;
						_push(E00B49AB6(_t180));
						E00B4C52F(_t262, _t334, _t331, _t334, _t337, _t361, _v4168);
						_t362 =  *((char*)(_t337 + 0x74));
						if( *((char*)(_t337 + 0x74)) != 0) {
							__imp__sprintf_s( &_v4116, 0x1000, "<BurstSize>%u</BurstSize>\n",  *((intOrPtr*)(_t337 + 0x78)));
							_t246 = E00B49AB6( &_v4116);
							_t344 = _t344 + 0x14;
							_push(_t246);
							E00B4C52F(_t262, _t334, _t331, _t334, _t337, _t362,  &_v4116);
						}
						_t363 =  *((char*)(_t337 + 0x80));
						if( *((char*)(_t337 + 0x80)) != 0) {
							__imp__sprintf_s( &_v4116, 0x1000, "<ThinkTime>%u</ThinkTime>\n",  *((intOrPtr*)(_t337 + 0x7c)));
							_t241 = E00B49AB6( &_v4116);
							_t344 = _t344 + 0x14;
							_push(_t241);
							E00B4C52F(_t262, _t334, _t331, _t334, _t337, _t363,  &_v4116);
						}
						_t364 =  *((char*)(_t337 + 0x58));
						if( *((char*)(_t337 + 0x58)) != 0) {
							__imp__sprintf_s( &_v4116, 0x1000, "<FileSize>%I64u</FileSize>\n",  *((intOrPtr*)(_t337 + 0x60)),  *((intOrPtr*)(_t337 + 0x64)));
							_t236 = E00B49AB6( &_v4116);
							_t344 = _t344 + 0x18;
							_push(_t236);
							E00B4C52F(_t262, _t334, _t331, _t334, _t337, _t364,  &_v4116);
						}
						if( *((char*)(_t337 + 0x29)) == 0) {
							__eflags =  *((char*)(_t337 + 0x28));
							if( *((char*)(_t337 + 0x28)) == 0) {
								_t183 =  *((intOrPtr*)(_t337 + 0x18));
							} else {
								_t183 =  *((intOrPtr*)(_t337 + 0x20));
								_t262 =  *((intOrPtr*)(_t337 + 0x24));
							}
							__imp__sprintf_s( &_v4116, 0x1000, "<StrideSize>%I64u</StrideSize>\n", _t183, _t262);
							_push(E00B49AB6( &_v4116));
							E00B4C52F(_t262, _t334, _t331, _t334, _t337, __eflags,  &_v4116);
							__eflags =  *((char*)(_t337 + 0x39));
							_t263 = "<InterlockedSequential>true</InterlockedSequential>\n";
							if( *((char*)(_t337 + 0x39)) == 0) {
								_t263 = "<InterlockedSequential>false</InterlockedSequential>\n";
							}
							_push(E00B49AB6(_t263));
							E00B4C52F(_t263, _t334, _t331, _t334, _t337, __eflags, _t263);
							_t264 = 0x1000;
						} else {
							_t366 =  *((char*)(_t337 + 0x28));
							if( *((char*)(_t337 + 0x28)) == 0) {
								_t228 =  *((intOrPtr*)(_t337 + 0x18));
							} else {
								_t228 =  *((intOrPtr*)(_t337 + 0x20));
								_t262 =  *((intOrPtr*)(_t337 + 0x24));
							}
							_t264 = 0x1000;
							__imp__sprintf_s( &_v4116, 0x1000, "<Random>%I64u</Random>\n", _t228, _t262);
							_push(E00B49AB6( &_v4116));
							E00B4C52F(0x1000, _t334, _t331, _t334, _t337, _t366,  &_v4116);
						}
						__imp__sprintf_s( &_v4116, _t264, "<ThreadStride>%I64u</ThreadStride>\n",  *((intOrPtr*)(_t337 + 0x50)),  *((intOrPtr*)(_t337 + 0x54)));
						E00B4C52F(_t264, _t334, _t331, _t334, _t337, _t366,  &_v4116);
						__imp__sprintf_s( &_v4116, _t264, "<MaxFileSize>%I64u</MaxFileSize>\n",  *((intOrPtr*)(_t337 + 0x68)),  *((intOrPtr*)(_t337 + 0x6c)), E00B49AB6( &_v4116));
						E00B4C52F(_t264, _t334, _t331, _t334, _t337, _t366,  &_v4116);
						__imp__sprintf_s( &_v4116, _t264, "<RequestCount>%u</RequestCount>\n",  *((intOrPtr*)(_t337 + 0x1c)), E00B49AB6( &_v4116));
						E00B4C52F(_t264, _t334, _t331, _t334, _t337, _t366,  &_v4116);
						__imp__sprintf_s( &_v4116, _t264, "<WriteRatio>%u</WriteRatio>\n",  *((intOrPtr*)(_t337 + 0x70)), E00B49AB6( &_v4116));
						E00B4C52F(_t264, _t334, _t331, _t334, _t337, _t366,  &_v4116);
						__imp__sprintf_s( &_v4116, _t264, "<Throughput>%u</Throughput>\n",  *((intOrPtr*)(_t337 + 0x84)), E00B49AB6( &_v4116));
						E00B4C52F(_t264, _t334, _t331, _t334, _t337, _t366,  &_v4116);
						__imp__sprintf_s( &_v4116, _t264, "<ThreadsPerFile>%u</ThreadsPerFile>\n",  *((intOrPtr*)(_t337 + 0x48)), E00B49AB6( &_v4116));
						_push(E00B49AB6( &_v4116));
						E00B4C52F(_t264, _t334, _t331, _t334, _t337, _t366,  &_v4116);
						_t221 =  *((intOrPtr*)(_t337 + 0xb4));
						_t367 = _t221;
						if(_t221 != 0) {
							__eflags = _t221 - 1;
							if(_t221 != 1) {
								_t338 = "<IOPriority>3</IOPriority>\n";
								__eflags = _t221 - 2;
								if(_t221 != 2) {
									_t338 = "<IOPriority>* UNSUPPORTED *</IOPriority>\n";
								}
							} else {
								_t338 = "<IOPriority>2</IOPriority>\n";
							}
						} else {
							_t338 = "<IOPriority>1</IOPriority>\n";
						}
						_push(E00B49AB6(_t338));
						E00B4C52F(_t264, _t334, _t331, _t334, _t338, _t367, _t338);
						_push(E00B49AB6("</Target>\n"));
						E00B4C52F(_t264, _t334, _t331, _t334, "</Target>\n", _t367, "</Target>\n");
						 *[fs:0x0] = _v16;
						_pop(_t335);
						_pop(_t340);
						_pop(_t265);
						return E00B5CFA0(_t334, _t265, _v20 ^ _t341, _t331, _t335, _t340);
					}
					_push(E00B49AB6("<DisableLocalCache>true</DisableLocalCache>\n"));
					_push("<DisableLocalCache>true</DisableLocalCache>\n");
					L12:
					E00B4C52F(_t262, _t334, _t331, _t334, _t337, _t358);
					goto L13;
				}
			}

0x00b4ab1c
0x00b4ab34
0x00b4ab39
0x00b4ab3e
0x00b4ab40
0x00b4ab4a
0x00b4ab50
0x00b4ab52
0x00b4ab55
0x00b4ab57
0x00b4ab61
0x00b4ab67
0x00b4ab6d
0x00b4ab72
0x00b4ab81
0x00b4ab95
0x00b4ab97
0x00b4aba4
0x00b4abaf
0x00b4abb3
0x00b4abc1
0x00b4abcf
0x00b4abd2
0x00b4abeb
0x00b4ac0a
0x00b4ac26
0x00b4ac33
0x00b4ac38
0x00b4ac3d
0x00b4ac45
0x00b4ac4a
0x00b4ac4f
0x00b4ac55
0x00b4ac57
0x00b4ac57
0x00b4ac5d
0x00b4ac69
0x00b4ac72
0x00b4ac77
0x00b4ac7e
0x00b4ac83
0x00b4ac85
0x00b4ac85
0x00b4ac8b
0x00b4ac97
0x00b4aca0
0x00b4aca5
0x00b4acac
0x00b4acb1
0x00b4acb3
0x00b4acb3
0x00b4acb9
0x00b4acc5
0x00b4acce
0x00b4acd3
0x00b4acda
0x00b4acdf
0x00b4ace1
0x00b4ace1
0x00b4ace7
0x00b4acf3
0x00b4acfc
0x00b4ad05
0x00b4ad08
0x00b4ad2d
0x00b4ad2e
0x00000000
0x00b4ad0a
0x00b4ad0a
0x00b4ad0d
0x00b4ad3a
0x00b4ad3e
0x00b4ad41
0x00b4ad4e
0x00b4ad56
0x00b4ad56
0x00b4ad66
0x00b4ad6e
0x00b4ad73
0x00b4ad77
0x00b4ad95
0x00b4ad9b
0x00b4adc6
0x00b4adde
0x00b4ae00
0x00b4ae0d
0x00b4ae12
0x00b4ae17
0x00b4ae1f
0x00b4ae2a
0x00b4ae34
0x00b4ae36
0x00b4ae43
0x00b4ae54
0x00b4ae56
0x00b4ae63
0x00b4ae6e
0x00b4ae72
0x00b4ae80
0x00b4ae8e
0x00b4ae91
0x00b4ae91
0x00b4aea1
0x00b4aea2
0x00b4ad9d
0x00b4ada8
0x00b4ada9
0x00b4ada9
0x00b4ad79
0x00b4ad84
0x00b4ad85
0x00b4ad85
0x00b4aea9
0x00b4aeb9
0x00b4aec1
0x00b4aec6
0x00b4aeca
0x00b4aecf
0x00b4aed1
0x00b4aed1
0x00b4aed7
0x00b4aee3
0x00b4aeec
0x00b4aef1
0x00b4aef5
0x00b4af0b
0x00b4af18
0x00b4af1d
0x00b4af22
0x00b4af2a
0x00b4af2a
0x00b4af2f
0x00b4af36
0x00b4af4c
0x00b4af59
0x00b4af5e
0x00b4af63
0x00b4af6b
0x00b4af6b
0x00b4af70
0x00b4af74
0x00b4af8d
0x00b4af9a
0x00b4af9f
0x00b4afa4
0x00b4afac
0x00b4afac
0x00b4afb5
0x00b4b002
0x00b4b006
0x00b4b010
0x00b4b008
0x00b4b008
0x00b4b00b
0x00b4b00b
0x00b4b026
0x00b4b03d
0x00b4b045
0x00b4b04a
0x00b4b04e
0x00b4b053
0x00b4b055
0x00b4b055
0x00b4b061
0x00b4b065
0x00b4b06a
0x00b4afb7
0x00b4afb7
0x00b4afbb
0x00b4afc5
0x00b4afbd
0x00b4afbd
0x00b4afc0
0x00b4afc0
0x00b4afcf
0x00b4afdc
0x00b4aff3
0x00b4affb
0x00b4affb
0x00b4b082
0x00b4b0a1
0x00b4b0b9
0x00b4b0d8
0x00b4b0ed
0x00b4b10c
0x00b4b121
0x00b4b140
0x00b4b158
0x00b4b177
0x00b4b18c
0x00b4b1a3
0x00b4b1ab
0x00b4b1b0
0x00b4b1b6
0x00b4b1b8
0x00b4b1c1
0x00b4b1c4
0x00b4b1cd
0x00b4b1d2
0x00b4b1d5
0x00b4b1d7
0x00b4b1d7
0x00b4b1c6
0x00b4b1c6
0x00b4b1c6
0x00b4b1ba
0x00b4b1ba
0x00b4b1ba
0x00b4b1e3
0x00b4b1e7
0x00b4b1f8
0x00b4b1fc
0x00b4b206
0x00b4b20e
0x00b4b20f
0x00b4b210
0x00b4b21e
0x00b4b21e
0x00b4ad1a
0x00b4ad1b
0x00b4ad33
0x00b4ad35
0x00000000
0x00b4ad35

APIs

Part of subcall function 00B4A1B9: memcpy.MSVCRT ref: 00B4A1DB
Part of subcall function 00B4A1B9: ??3@YAXPAX@Z.MSVCRT ref: 00B4A1E4

sprintf_s.MSVCRT ref: 00B4ABEB
sprintf_s.MSVCRT ref: 00B4AC26
sprintf_s.MSVCRT ref: 00B4AE00
sprintf_s.MSVCRT ref: 00B4AF0B
sprintf_s.MSVCRT ref: 00B4AF4C
sprintf_s.MSVCRT ref: 00B4AF8D
sprintf_s.MSVCRT ref: 00B4AFDC
sprintf_s.MSVCRT ref: 00B4B026
sprintf_s.MSVCRT ref: 00B4B082
sprintf_s.MSVCRT ref: 00B4B0B9
sprintf_s.MSVCRT ref: 00B4B0ED
sprintf_s.MSVCRT ref: 00B4B121
sprintf_s.MSVCRT ref: 00B4B158
sprintf_s.MSVCRT ref: 00B4B18C

Strings

</Path>, xrefs: 00B4AB90
<UseLargePages>true</UseLargePages>, xrefs: 00B4ACDA
<IOPriority>* UNSUPPORTED *</IOPriority>, xrefs: 00B4B1D7, 00B4B1DC, 00B4B1E4
<RequestCount>%u</RequestCount>, xrefs: 00B4B0E6
<RandomDataSource>, xrefs: 00B4ADCB, 00B4ADD7
<Throughput>%u</Throughput>, xrefs: 00B4B151
<BurstSize>%u</BurstSize>, xrefs: 00B4AF00
</Target>, xrefs: 00B4B1EC, 00B4B1F1, 00B4B1F9
</RandomDataSource>, xrefs: 00B4AE96, 00B4AEA2
<InterlockedSequential>true</InterlockedSequential>, xrefs: 00B4B04E
<UseLargePages>false</UseLargePages>, xrefs: 00B4ACE1, 00B4ACE6
<Pattern>zero</Pattern>, xrefs: 00B4AD79, 00B4AD85
<SequentialScan>true</SequentialScan>, xrefs: 00B4AC4A
<FilePath>, xrefs: 00B4AE3E
<IOPriority>2</IOPriority>, xrefs: 00B4B1C6
<StrideSize>%I64u</StrideSize>, xrefs: 00B4B015
<ParallelAsyncIO>true</ParallelAsyncIO>, xrefs: 00B4AECA
<RandomAccess>true</RandomAccess>, xrefs: 00B4AC7E
<ThreadsPerFile>%u</ThreadsPerFile>, xrefs: 00B4B185
<IOPriority>3</IOPriority>, xrefs: 00B4B1CD
<WriteBufferContent>, xrefs: 00B4AD5B, 00B4AD67
<MaxFileSize>%I64u</MaxFileSize>, xrefs: 00B4B0B2
<SequentialScan>false</SequentialScan>, xrefs: 00B4AC57, 00B4AC5C
<Path>, xrefs: 00B4AB7C
<BlockSize>%u</BlockSize>, xrefs: 00B4ABE0
<RandomAccess>false</RandomAccess>, xrefs: 00B4AC85, 00B4AC8A
<Pattern>random</Pattern>, xrefs: 00B4ADB3, 00B4ADBF
</FilePath>, xrefs: 00B4AE4F
<DisableLocalCache>true</DisableLocalCache>, xrefs: 00B4AD0F, 00B4AD1B
<FileSize>%I64u</FileSize>, xrefs: 00B4AF82
<ThreadStride>%I64u</ThreadStride>, xrefs: 00B4B07B
<TemporaryFile>false</TemporaryFile>, xrefs: 00B4ACB3, 00B4ACB8
<WriteRatio>%u</WriteRatio>, xrefs: 00B4B11A
<ParallelAsyncIO>false</ParallelAsyncIO>, xrefs: 00B4AED1, 00B4AED6
<Target>, xrefs: 00B4AB5C
</WriteBufferContent>, xrefs: 00B4AEAE, 00B4AEBA
<InterlockedSequential>false</InterlockedSequential>, xrefs: 00B4B055, 00B4B05A, 00B4B062
<IOPriority>1</IOPriority>, xrefs: 00B4B1BA
<BaseFileOffset>%I64u</BaseFileOffset>, xrefs: 00B4AC1B
<TemporaryFile>true</TemporaryFile>, xrefs: 00B4ACAC
<Pattern>sequential</Pattern>, xrefs: 00B4AD9D, 00B4ADA9
<WriteThrough>true</WriteThrough>, xrefs: 00B4AD43, 00B4AD4F
<SizeInBytes>%I64u</SizeInBytes>, xrefs: 00B4ADF5
<DisableOSCache>true</DisableOSCache>, xrefs: 00B4AD22, 00B4AD2E
<ThinkTime>%u</ThinkTime>, xrefs: 00B4AF41
<Random>%I64u</Random>, xrefs: 00B4AFCA

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: sprintf_s$??3@memcpy
String ID: </FilePath>$</Path>$</RandomDataSource>$</Target>$</WriteBufferContent>$<BaseFileOffset>%I64u</BaseFileOffset>$<BlockSize>%u</BlockSize>$<BurstSize>%u</BurstSize>$<DisableLocalCache>true</DisableLocalCache>$<DisableOSCache>true</DisableOSCache>$<FilePath>$<FileSize>%I64u</FileSize>$<IOPriority>* UNSUPPORTED *</IOPriority>$<IOPriority>1</IOPriority>$<IOPriority>2</IOPriority>$<IOPriority>3</IOPriority>$<InterlockedSequential>false</InterlockedSequential>$<InterlockedSequential>true</InterlockedSequential>$<MaxFileSize>%I64u</MaxFileSize>$<ParallelAsyncIO>false</ParallelAsyncIO>$<ParallelAsyncIO>true</ParallelAsyncIO>$<Path>$<Pattern>random</Pattern>$<Pattern>sequential</Pattern>$<Pattern>zero</Pattern>$<Random>%I64u</Random>$<RandomAccess>false</RandomAccess>$<RandomAccess>true</RandomAccess>$<RandomDataSource>$<RequestCount>%u</RequestCount>$<SequentialScan>false</SequentialScan>$<SequentialScan>true</SequentialScan>$<SizeInBytes>%I64u</SizeInBytes>$<StrideSize>%I64u</StrideSize>$<Target>$<TemporaryFile>false</TemporaryFile>$<TemporaryFile>true</TemporaryFile>$<ThinkTime>%u</ThinkTime>$<ThreadStride>%I64u</ThreadStride>$<ThreadsPerFile>%u</ThreadsPerFile>$<Throughput>%u</Throughput>$<UseLargePages>false</UseLargePages>$<UseLargePages>true</UseLargePages>$<WriteBufferContent>$<WriteRatio>%u</WriteRatio>$<WriteThrough>true</WriteThrough>
API String ID: 615691289-193034654
Opcode ID: 12c3796b59272b0524a23a9d4598fe07b1f79f4dfe189ed0dee5952b928f56a3
Instruction ID: 067a6832cf60400e5185feff4d527394dd7d560fd8647e89e94b78e287183345
Opcode Fuzzy Hash: 12c3796b59272b0524a23a9d4598fe07b1f79f4dfe189ed0dee5952b928f56a3
Instruction Fuzzy Hash: D20278B1D002587BDF24EB60CC46EEF76EDEB44700F4405D9F695A3291DAB8AB84BB11

Uniqueness

Uniqueness Score: -1.00%

Function 00B4B845 Relevance: 66.8, APIs: 1, Strings: 37, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00B4B845(intOrPtr* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				signed int _v20;
				char _v4116;
				char _v4140;
				signed int _v4144;
				intOrPtr _v4148;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t45;
				signed int _t46;
				void* _t61;
				void* _t96;
				void* _t98;
				void* _t145;
				void* _t146;
				intOrPtr* _t147;
				intOrPtr _t148;
				void* _t149;
				void* _t150;
				char* _t153;
				char* _t154;
				intOrPtr _t156;
				void* _t159;
				char* _t160;
				char* _t161;
				char* _t162;
				char* _t163;
				char* _t164;
				char* _t165;
				char* _t166;
				char* _t167;
				char* _t168;
				char* _t169;
				char* _t170;
				char* _t171;
				char* _t172;
				signed int _t173;
				void* _t176;

				_t176 = __eflags;
				_t145 = __edx;
				E00B5DB30(0x1024);
				_t45 =  *0xb61000; // 0xba7e72c4
				_t46 = _t45 ^ _t173;
				_v20 = _t46;
				 *[fs:0x0] =  &_v16;
				_t147 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t97 = _a4;
				_v4144 = _v4144 & 0x00000000;
				_v4148 = _a4;
				E00B4A144(_a4, "<Profile>\n");
				_v8 = _v8 & 0x00000000;
				_v4144 = 1;
				__imp__sprintf_s( &_v4116, 0x1000, "<Progress>%u</Progress>\n",  *((intOrPtr*)(_t147 + 0x10)), _t46, _t146, _t150, _t96,  *[fs:0x0], 0xb5ddf3, 0xffffffff);
				_push(E00B49AB6( &_v4116));
				E00B4C52F(_t97, _t97, _t145, _t147, 1, _t176,  &_v4116);
				_t177 =  *((intOrPtr*)(_t147 + 0x2c));
				if( *((intOrPtr*)(_t147 + 0x2c)) != 0) {
					__eflags =  *((intOrPtr*)(_t147 + 0x2c)) - 1;
					_t153 = "<ResultFormat>xml</ResultFormat>\n";
					if( *((intOrPtr*)(_t147 + 0x2c)) != 1) {
						_t153 = "<ResultFormat>* UNSUPPORTED *</ResultFormat>\n";
					}
				} else {
					_t153 = "<ResultFormat>text</ResultFormat>\n";
				}
				_push(E00B49AB6(_t153));
				E00B4C52F(_t97, _t97, _t145, _t147, _t153, _t177, _t153);
				_t178 =  *((char*)(_t147 + 0xc));
				_t154 = "<Verbose>true</Verbose>\n";
				if( *((char*)(_t147 + 0xc)) == 0) {
					_t154 = "<Verbose>false</Verbose>\n";
				}
				_push(E00B49AB6(_t154));
				E00B4C52F(_t97, _t97, _t145, _t147, _t154, _t178, _t154);
				_t179 =  *((intOrPtr*)(_t147 + 0x30)) - 1;
				if( *((intOrPtr*)(_t147 + 0x30)) != 1) {
					__eflags =  *((intOrPtr*)(_t147 + 0x30)) - 2;
					if( *((intOrPtr*)(_t147 + 0x30)) != 2) {
						__eflags =  *((intOrPtr*)(_t147 + 0x30)) - 3;
						if( *((intOrPtr*)(_t147 + 0x30)) != 3) {
							goto L13;
						}
						_t172 = "<PrecreateFiles>CreateOnlyFilesWithConstantOrZeroSizes</PrecreateFiles>\n";
						goto L12;
					}
					_t172 = "<PrecreateFiles>CreateOnlyFilesWithConstantSizes</PrecreateFiles>\n";
					goto L12;
				} else {
					_t172 = "<PrecreateFiles>UseMaxSize</PrecreateFiles>\n";
					L12:
					_push(E00B49AB6(_t172));
					E00B4C52F(_t97, _t97, _t145, _t147, _t172, _t179, _t172);
					L13:
					if( *((char*)(_t147 + 0x34)) != 0) {
						_t181 =  *((char*)(_t147 + 0x35));
						_t160 = "<Process>true</Process>\n";
						if( *((char*)(_t147 + 0x35)) == 0) {
							_t160 = "<Process>false</Process>\n";
						}
						_push(E00B49AB6(_t160));
						E00B4C52F(_t97, _t97, _t145, _t147, _t160, _t181, _t160);
						_t182 =  *((char*)(_t147 + 0x36));
						_t161 = "<Thread>true</Thread>\n";
						if( *((char*)(_t147 + 0x36)) == 0) {
							_t161 = "<Thread>false</Thread>\n";
						}
						_push(E00B49AB6(_t161));
						E00B4C52F(_t97, _t97, _t145, _t147, _t161, _t182, _t161);
						_t183 =  *((char*)(_t147 + 0x37));
						_t162 = "<ImageLoad>true</ImageLoad>\n";
						if( *((char*)(_t147 + 0x37)) == 0) {
							_t162 = "<ImageLoad>false</ImageLoad>\n";
						}
						_push(E00B49AB6(_t162));
						E00B4C52F(_t97, _t97, _t145, _t147, _t162, _t183, _t162);
						_t184 =  *((char*)(_t147 + 0x38));
						_t163 = "<DiskIO>true</DiskIO>\n";
						if( *((char*)(_t147 + 0x38)) == 0) {
							_t163 = "<DiskIO>false</DiskIO>\n";
						}
						_push(E00B49AB6(_t163));
						E00B4C52F(_t97, _t97, _t145, _t147, _t163, _t184, _t163);
						_t185 =  *((char*)(_t147 + 0x39));
						_t164 = "<MemoryPageFaults>true</MemoryPageFaults>\n";
						if( *((char*)(_t147 + 0x39)) == 0) {
							_t164 = "<MemoryPageFaults>false</MemoryPageFaults>\n";
						}
						_push(E00B49AB6(_t164));
						E00B4C52F(_t97, _t97, _t145, _t147, _t164, _t185, _t164);
						_t186 =  *((char*)(_t147 + 0x3a));
						_t165 = "<MemoryHardFaults>true</MemoryHardFaults>\n";
						if( *((char*)(_t147 + 0x3a)) == 0) {
							_t165 = "<MemoryHardFaults>false</MemoryHardFaults>\n";
						}
						_push(E00B49AB6(_t165));
						E00B4C52F(_t97, _t97, _t145, _t147, _t165, _t186, _t165);
						_t187 =  *((char*)(_t147 + 0x3b));
						_t166 = "<Network>true</Network>\n";
						if( *((char*)(_t147 + 0x3b)) == 0) {
							_t166 = "<Network>false</Network>\n";
						}
						_push(E00B49AB6(_t166));
						E00B4C52F(_t97, _t97, _t145, _t147, _t166, _t187, _t166);
						_t188 =  *((char*)(_t147 + 0x3c));
						_t167 = "<Registry>true</Registry>\n";
						if( *((char*)(_t147 + 0x3c)) == 0) {
							_t167 = "<Registry>false</Registry>\n";
						}
						_push(E00B49AB6(_t167));
						E00B4C52F(_t97, _t97, _t145, _t147, _t167, _t188, _t167);
						_t189 =  *((char*)(_t147 + 0x3d));
						_t168 = "<UsePagedMemory>true</UsePagedMemory>\n";
						if( *((char*)(_t147 + 0x3d)) == 0) {
							_t168 = "<UsePagedMemory>false</UsePagedMemory>\n";
						}
						_push(E00B49AB6(_t168));
						E00B4C52F(_t97, _t97, _t145, _t147, _t168, _t189, _t168);
						_t190 =  *((char*)(_t147 + 0x3e));
						_t169 = "<UsePerfTimer>true</UsePerfTimer>\n";
						if( *((char*)(_t147 + 0x3e)) == 0) {
							_t169 = "<UsePerfTimer>false</UsePerfTimer>\n";
						}
						_push(E00B49AB6(_t169));
						E00B4C52F(_t97, _t97, _t145, _t147, _t169, _t190, _t169);
						_t191 =  *((char*)(_t147 + 0x3f));
						_t170 = "<UseSystemTimer>true</UseSystemTimer>\n";
						if( *((char*)(_t147 + 0x3f)) == 0) {
							_t170 = "<UseSystemTimer>false</UseSystemTimer>\n";
						}
						_push(E00B49AB6(_t170));
						E00B4C52F(_t97, _t97, _t145, _t147, _t170, _t191, _t170);
						_t192 =  *((char*)(_t147 + 0x40));
						_t171 = "<UseCyclesCounter>true</UseCyclesCounter>\n";
						if( *((char*)(_t147 + 0x40)) == 0) {
							_t171 = "<UseCyclesCounter>false</UseCyclesCounter>\n";
						}
						_push(E00B49AB6(_t171));
						E00B4C52F(_t97, _t97, _t145, _t147, _t171, _t192, _t171);
					}
					_t155 = "<TimeSpans>\n";
					_push(E00B49AB6("<TimeSpans>\n"));
					E00B4C52F(_t97, _t97, _t145, _t147, "<TimeSpans>\n", _t192, _t155);
					_t156 =  *_t147;
					_t148 =  *((intOrPtr*)(_t147 + 4));
					while(1) {
						_t193 = _t156 - _t148;
						if(_t156 == _t148) {
							break;
						}
						_t61 = E00B4B41D(_t156, _t145, __eflags,  &_v4140); // executed
						_v8 = 1;
						L00B4C5D8(_t97, _t97, _t145, _t148, _t156, _t61, 0, 0xffffffff);
						_v8 = 0;
						E00B4A1B9( &_v4140, 1, 0);
						_t156 = _t156 + 0x38;
						__eflags = _t156;
					}
					_t157 = "</TimeSpans>\n";
					_push(E00B49AB6("</TimeSpans>\n"));
					E00B4C52F(_t97, _t97, _t145, _t148, "</TimeSpans>\n", _t193, _t157);
					_t158 = "</Profile>\n";
					_push(E00B49AB6("</Profile>\n"));
					E00B4C52F(_t97, _t97, _t145, _t148, "</Profile>\n", _t193, _t158);
					 *[fs:0x0] = _v16;
					_pop(_t149);
					_pop(_t159);
					_pop(_t98);
					return E00B5CFA0(_t97, _t98, _v20 ^ _t173, _t145, _t149, _t159);
				}
			}

0x00b4b845
0x00b4b845
0x00b4b85d
0x00b4b862
0x00b4b867
0x00b4b869
0x00b4b873
0x00b4b879
0x00b4b87b
0x00b4b87f
0x00b4b884
0x00b4b890
0x00b4b896
0x00b4b89b
0x00b4b8b6
0x00b4b8bc
0x00b4b8d3
0x00b4b8db
0x00b4b8e0
0x00b4b8e4
0x00b4b8ed
0x00b4b8f0
0x00b4b8f5
0x00b4b8f7
0x00b4b8f7
0x00b4b8e6
0x00b4b8e6
0x00b4b8e6
0x00b4b903
0x00b4b907
0x00b4b90c
0x00b4b910
0x00b4b915
0x00b4b917
0x00b4b917
0x00b4b923
0x00b4b927
0x00b4b92c
0x00b4b930
0x00b4b939
0x00b4b93d
0x00b4b946
0x00b4b94a
0x00000000
0x00000000
0x00b4b94c
0x00000000
0x00b4b94c
0x00b4b93f
0x00000000
0x00b4b932
0x00b4b932
0x00b4b951
0x00b4b958
0x00b4b95c
0x00b4b961
0x00b4b965
0x00b4b96b
0x00b4b96f
0x00b4b974
0x00b4b976
0x00b4b976
0x00b4b982
0x00b4b986
0x00b4b98b
0x00b4b98f
0x00b4b994
0x00b4b996
0x00b4b996
0x00b4b9a2
0x00b4b9a6
0x00b4b9ab
0x00b4b9af
0x00b4b9b4
0x00b4b9b6
0x00b4b9b6
0x00b4b9c2
0x00b4b9c6
0x00b4b9cb
0x00b4b9cf
0x00b4b9d4
0x00b4b9d6
0x00b4b9d6
0x00b4b9e2
0x00b4b9e6
0x00b4b9eb
0x00b4b9ef
0x00b4b9f4
0x00b4b9f6
0x00b4b9f6
0x00b4ba02
0x00b4ba06
0x00b4ba0b
0x00b4ba0f
0x00b4ba14
0x00b4ba16
0x00b4ba16
0x00b4ba22
0x00b4ba26
0x00b4ba2b
0x00b4ba2f
0x00b4ba34
0x00b4ba36
0x00b4ba36
0x00b4ba42
0x00b4ba46
0x00b4ba4b
0x00b4ba4f
0x00b4ba54
0x00b4ba56
0x00b4ba56
0x00b4ba62
0x00b4ba66
0x00b4ba6b
0x00b4ba6f
0x00b4ba74
0x00b4ba76
0x00b4ba76
0x00b4ba82
0x00b4ba86
0x00b4ba8b
0x00b4ba8f
0x00b4ba94
0x00b4ba96
0x00b4ba96
0x00b4baa2
0x00b4baa6
0x00b4baab
0x00b4baaf
0x00b4bab4
0x00b4bab6
0x00b4bab6
0x00b4bac2
0x00b4bac6
0x00b4bacb
0x00b4bacf
0x00b4bad4
0x00b4bad6
0x00b4bad6
0x00b4bae2
0x00b4bae6
0x00b4bae6
0x00b4baeb
0x00b4baf7
0x00b4bafb
0x00b4bb00
0x00b4bb02
0x00b4bb3e
0x00b4bb3e
0x00b4bb40
0x00000000
0x00000000
0x00b4bb10
0x00b4bb1c
0x00b4bb23
0x00b4bb32
0x00b4bb36
0x00b4bb3b
0x00b4bb3b
0x00b4bb3b
0x00b4bb42
0x00b4bb4e
0x00b4bb52
0x00b4bb57
0x00b4bb63
0x00b4bb67
0x00b4bb71
0x00b4bb79
0x00b4bb7a
0x00b4bb7b
0x00b4bb89
0x00b4bb89

APIs

sprintf_s.MSVCRT ref: 00B4B8BC

Part of subcall function 00B4B41D: sprintf_s.MSVCRT ref: 00B4B51C
Part of subcall function 00B4B41D: sprintf_s.MSVCRT ref: 00B4B550

Part of subcall function 00B4A1B9: memcpy.MSVCRT ref: 00B4A1DB
Part of subcall function 00B4A1B9: ??3@YAXPAX@Z.MSVCRT ref: 00B4A1E4

Strings

<DiskIO>true</DiskIO>, xrefs: 00B4B9CF, 00B4B9DB, 00B4B9E3
<UseCyclesCounter>true</UseCyclesCounter>, xrefs: 00B4BACF, 00B4BADB, 00B4BAE3
<Network>true</Network>, xrefs: 00B4BA2F, 00B4BA3B, 00B4BA43
<Process>true</Process>, xrefs: 00B4B96F, 00B4B97B, 00B4B983
<UseCyclesCounter>false</UseCyclesCounter>, xrefs: 00B4BAD6
<Registry>true</Registry>, xrefs: 00B4BA4F, 00B4BA5B, 00B4BA63
</Profile>, xrefs: 00B4BB57, 00B4BB5C, 00B4BB64
<MemoryHardFaults>false</MemoryHardFaults>, xrefs: 00B4BA16
<ImageLoad>true</ImageLoad>, xrefs: 00B4B9AF, 00B4B9BB, 00B4B9C3
<DiskIO>false</DiskIO>, xrefs: 00B4B9D6
<ResultFormat>xml</ResultFormat>, xrefs: 00B4B8F0, 00B4B8FC, 00B4B904
</TimeSpans>, xrefs: 00B4BB42, 00B4BB47, 00B4BB4F
<UsePagedMemory>true</UsePagedMemory>, xrefs: 00B4BA6F, 00B4BA7B, 00B4BA83
<UseSystemTimer>false</UseSystemTimer>, xrefs: 00B4BAB6
<ImageLoad>false</ImageLoad>, xrefs: 00B4B9B6
<TimeSpans>, xrefs: 00B4BAEB, 00B4BAF0, 00B4BAF8
<Verbose>false</Verbose>, xrefs: 00B4B917
<UsePerfTimer>true</UsePerfTimer>, xrefs: 00B4BA8F, 00B4BA9B, 00B4BAA3
<Thread>false</Thread>, xrefs: 00B4B996
<UsePagedMemory>false</UsePagedMemory>, xrefs: 00B4BA76
<Thread>true</Thread>, xrefs: 00B4B98F, 00B4B99B, 00B4B9A3
<Progress>%u</Progress>, xrefs: 00B4B8AA
<MemoryPageFaults>false</MemoryPageFaults>, xrefs: 00B4B9F6
<UsePerfTimer>false</UsePerfTimer>, xrefs: 00B4BA96
<Registry>false</Registry>, xrefs: 00B4BA56
<PrecreateFiles>UseMaxSize</PrecreateFiles>, xrefs: 00B4B932
<MemoryHardFaults>true</MemoryHardFaults>, xrefs: 00B4BA0F, 00B4BA1B, 00B4BA23
<Verbose>true</Verbose>, xrefs: 00B4B910, 00B4B91C, 00B4B924
<PrecreateFiles>CreateOnlyFilesWithConstantSizes</PrecreateFiles>, xrefs: 00B4B93F
<ResultFormat>text</ResultFormat>, xrefs: 00B4B8E6
<Process>false</Process>, xrefs: 00B4B976
<PrecreateFiles>CreateOnlyFilesWithConstantOrZeroSizes</PrecreateFiles>, xrefs: 00B4B94C, 00B4B951, 00B4B959
<Profile>, xrefs: 00B4B88B
<UseSystemTimer>true</UseSystemTimer>, xrefs: 00B4BAAF, 00B4BABB, 00B4BAC3
<ResultFormat>* UNSUPPORTED *</ResultFormat>, xrefs: 00B4B8F7
<MemoryPageFaults>true</MemoryPageFaults>, xrefs: 00B4B9EF, 00B4B9FB, 00B4BA03
<Network>false</Network>, xrefs: 00B4BA36

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: sprintf_s$??3@memcpy
String ID: </Profile>$</TimeSpans>$<DiskIO>false</DiskIO>$<DiskIO>true</DiskIO>$<ImageLoad>false</ImageLoad>$<ImageLoad>true</ImageLoad>$<MemoryHardFaults>false</MemoryHardFaults>$<MemoryHardFaults>true</MemoryHardFaults>$<MemoryPageFaults>false</MemoryPageFaults>$<MemoryPageFaults>true</MemoryPageFaults>$<Network>false</Network>$<Network>true</Network>$<PrecreateFiles>CreateOnlyFilesWithConstantOrZeroSizes</PrecreateFiles>$<PrecreateFiles>CreateOnlyFilesWithConstantSizes</PrecreateFiles>$<PrecreateFiles>UseMaxSize</PrecreateFiles>$<Process>false</Process>$<Process>true</Process>$<Profile>$<Progress>%u</Progress>$<Registry>false</Registry>$<Registry>true</Registry>$<ResultFormat>* UNSUPPORTED *</ResultFormat>$<ResultFormat>text</ResultFormat>$<ResultFormat>xml</ResultFormat>$<Thread>false</Thread>$<Thread>true</Thread>$<TimeSpans>$<UseCyclesCounter>false</UseCyclesCounter>$<UseCyclesCounter>true</UseCyclesCounter>$<UsePagedMemory>false</UsePagedMemory>$<UsePagedMemory>true</UsePagedMemory>$<UsePerfTimer>false</UsePerfTimer>$<UsePerfTimer>true</UsePerfTimer>$<UseSystemTimer>false</UseSystemTimer>$<UseSystemTimer>true</UseSystemTimer>$<Verbose>false</Verbose>$<Verbose>true</Verbose>
API String ID: 615691289-2790193338
Opcode ID: 530f10105133b7a1918dd5e9a2a73e9c19891b526b92ebb4edd6f429e14c9f17
Instruction ID: 3cb8a2199aeb950083022c16746297ed39e1198452026e46038d101e89c1a2eb
Opcode Fuzzy Hash: 530f10105133b7a1918dd5e9a2a73e9c19891b526b92ebb4edd6f429e14c9f17
Instruction Fuzzy Hash: C581A262D015657AEB24AB218886FBF66DCEF15320F4801FAF90567382CF64AF4477E1

Uniqueness

Uniqueness Score: -1.00%

Function 00B4B41D Relevance: 49.3, APIs: 7, Strings: 21, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E00B4B41D(signed short** __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				signed int _v20;
				char _v4116;
				char _v4140;
				signed short** _v4144;
				signed int _v4148;
				intOrPtr _v4152;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t61;
				signed int _t62;
				void* _t100;
				void* _t109;
				void* _t124;
				void* _t131;
				void* _t166;
				char* _t168;
				char* _t169;
				char* _t170;
				char* _t171;
				signed short* _t175;
				void* _t176;
				signed short* _t178;
				signed short** _t180;
				signed short* _t181;
				void* _t184;
				signed short* _t185;
				signed int _t187;
				void* _t188;
				void* _t194;

				_t166 = __edx;
				_push(0xffffffff);
				_push(0xb5dd57);
				_push( *[fs:0x0]);
				E00B5DB30(0x1028);
				_t61 =  *0xb61000; // 0xba7e72c4
				_t62 = _t61 ^ _t187;
				_v20 = _t62;
				_push(_t62);
				 *[fs:0x0] =  &_v16;
				_t180 = __ecx;
				_v4144 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t130 = _a4;
				_v4148 = _v4148 & 0x00000000;
				_v4152 = _a4;
				E00B4A144(_a4, "<TimeSpan>\n");
				_v8 = _v8 & 0x00000000;
				_t168 = "<CompletionRoutines>true</CompletionRoutines>\n";
				_t196 = _t180[0xc];
				_v4148 = 1;
				if(_t180[0xc] == 0) {
					_t168 = "<CompletionRoutines>false</CompletionRoutines>\n";
				}
				_push(E00B49AB6(_t168));
				E00B4C52F(_t130, _t130, _t166, _t168, _t180, _t196, _t168);
				_t197 = _t180[0xc];
				_t169 = "<MeasureLatency>true</MeasureLatency>\n";
				if(_t180[0xc] == 0) {
					_t169 = "<MeasureLatency>false</MeasureLatency>\n";
				}
				_push(E00B49AB6(_t169));
				E00B4C52F(_t130, _t130, _t166, _t169, _t180, _t197, _t169);
				_t198 = _t180[0xc];
				_t170 = "<CalculateIopsStdDev>true</CalculateIopsStdDev>\n";
				if(_t180[0xc] == 0) {
					_t170 = "<CalculateIopsStdDev>false</CalculateIopsStdDev>\n";
				}
				_push(E00B49AB6(_t170));
				E00B4C52F(_t130, _t130, _t166, _t170, _t180, _t198, _t170);
				_t199 = _t180[8];
				_t171 = "<DisableAffinity>true</DisableAffinity>\n";
				if(_t180[8] == 0) {
					_t171 = "<DisableAffinity>false</DisableAffinity>\n";
				}
				E00B4C52F(_t130, _t130, _t166, _t171, _t180, _t199, _t171);
				__imp__sprintf_s( &_v4116, 0x1000, "<Duration>%u</Duration>\n", _t180[3], E00B49AB6(_t171));
				E00B4C52F(_t130, _t130, _t166, 0x1000, _t180, _t199,  &_v4116);
				__imp__sprintf_s( &_v4116, 0x1000, "<Warmup>%u</Warmup>\n", _t180[4], E00B49AB6( &_v4116));
				E00B4C52F(_t130, _t130, _t166, 0x1000, _t180, _t199,  &_v4116);
				__imp__sprintf_s( &_v4116, 0x1000, "<Cooldown>%u</Cooldown>\n", _t180[5], E00B49AB6( &_v4116));
				E00B4C52F(_t130, _t130, _t166, 0x1000, _t180, _t199,  &_v4116);
				__imp__sprintf_s( &_v4116, 0x1000, "<ThreadCount>%u</ThreadCount>\n", _t180[7], E00B49AB6( &_v4116));
				E00B4C52F(_t130, _t130, _t166, 0x1000, _t180, _t199,  &_v4116);
				__imp__sprintf_s( &_v4116, 0x1000, "<IoBucketDuration>%u</IoBucketDuration>\n", _t180[0xd], E00B49AB6( &_v4116));
				E00B4C52F(_t130, _t130, _t166, 0x1000, _t180, _t199,  &_v4116);
				__imp__sprintf_s( &_v4116, 0x1000, "<RandSeed>%u</RandSeed>\n", _t180[6], E00B49AB6( &_v4116));
				_t100 = E00B49AB6( &_v4116);
				_t194 = _t188 + 0x78;
				_push(_t100);
				E00B4C52F(_t130, _t130, _t166, 0x1000, _t180, _t199,  &_v4116);
				_t200 = _t180[0xa] - _t180[9] >> 2;
				if(_t180[0xa] - _t180[9] >> 2 != 0) {
					_t177 = "<Affinity>\n";
					_push(E00B49AB6("<Affinity>\n"));
					E00B4C52F(_t130, _t130, _t166, "<Affinity>\n", _t180, _t200, _t177);
					_t178 = _t180[0xa];
					_t185 = _t180[9];
					while(1) {
						_t201 = _t185 - _t178;
						if(_t185 == _t178) {
							break;
						}
						__imp__sprintf_s( &_v4116, 0x1000, "<AffinityGroupAssignment Group=\"%u\" Processor=\"%u\"/>\n",  *_t185 & 0x0000ffff, _t185[1] & 0x000000ff);
						_t124 = E00B49AB6( &_v4116);
						_t194 = _t194 + 0x18;
						_push(_t124);
						E00B4C52F(_t130, _t130, _t166, _t178, _t185, __eflags,  &_v4116);
						_t185 =  &(_t185[2]);
						__eflags = _t185;
					}
					_t186 = "</Affinity>\n";
					_push(E00B49AB6("</Affinity>\n"));
					E00B4C52F(_t130, _t130, _t166, _t178, "</Affinity>\n", _t201, _t186);
					_t180 = _v4144;
				}
				_t173 = "<Targets>\n";
				_push(E00B49AB6("<Targets>\n"));
				E00B4C52F(_t130, _t130, _t166, "<Targets>\n", _t180, _t201, _t173);
				_t181 =  *_t180;
				_t175 = _v4144[1];
				while(1) {
					_t202 = _t181 - _t175;
					if(_t181 == _t175) {
						break;
					}
					_t109 = E00B4AB1C(_t181, __eflags,  &_v4140); // executed
					_v8 = 1;
					L00B4C5D8(_t130, _t130, _t166, _t175, _t181, _t109, 0, 0xffffffff);
					_v8 = 0;
					E00B4A1B9( &_v4140, 1, 0);
					_t181 =  &(_t181[0x5c]);
					__eflags = _t181;
				}
				_t182 = "</Targets>\n";
				_push(E00B49AB6("</Targets>\n"));
				E00B4C52F(_t130, _t130, _t166, _t175, "</Targets>\n", _t202, _t182);
				_t183 = "</TimeSpan>\n";
				_push(E00B49AB6("</TimeSpan>\n"));
				E00B4C52F(_t130, _t130, _t166, _t175, "</TimeSpan>\n", _t202, _t183);
				 *[fs:0x0] = _v16;
				_pop(_t176);
				_pop(_t184);
				_pop(_t131);
				return E00B5CFA0(_t130, _t131, _v20 ^ _t187, _t166, _t176, _t184);
			}

0x00b4b41d
0x00b4b422
0x00b4b424
0x00b4b42f
0x00b4b435
0x00b4b43a
0x00b4b43f
0x00b4b441
0x00b4b447
0x00b4b44b
0x00b4b451
0x00b4b453
0x00b4b459
0x00b4b45d
0x00b4b462
0x00b4b46e
0x00b4b474
0x00b4b479
0x00b4b47d
0x00b4b482
0x00b4b486
0x00b4b490
0x00b4b492
0x00b4b492
0x00b4b49e
0x00b4b4a2
0x00b4b4a7
0x00b4b4ab
0x00b4b4b0
0x00b4b4b2
0x00b4b4b2
0x00b4b4be
0x00b4b4c2
0x00b4b4c7
0x00b4b4cb
0x00b4b4d0
0x00b4b4d2
0x00b4b4d2
0x00b4b4de
0x00b4b4e2
0x00b4b4e7
0x00b4b4eb
0x00b4b4f0
0x00b4b4f2
0x00b4b4f2
0x00b4b502
0x00b4b51c
0x00b4b53b
0x00b4b550
0x00b4b56f
0x00b4b584
0x00b4b5a3
0x00b4b5b8
0x00b4b5d7
0x00b4b5ec
0x00b4b60b
0x00b4b620
0x00b4b62d
0x00b4b632
0x00b4b637
0x00b4b63f
0x00b4b64d
0x00b4b64f
0x00b4b651
0x00b4b65d
0x00b4b661
0x00b4b666
0x00b4b669
0x00b4b6af
0x00b4b6af
0x00b4b6b1
0x00000000
0x00000000
0x00b4b688
0x00b4b695
0x00b4b69a
0x00b4b69f
0x00b4b6a7
0x00b4b6ac
0x00b4b6ac
0x00b4b6ac
0x00b4b6b3
0x00b4b6bf
0x00b4b6c3
0x00b4b6c8
0x00b4b6c8
0x00b4b6ce
0x00b4b6da
0x00b4b6de
0x00b4b6e9
0x00b4b6eb
0x00b4b72a
0x00b4b72a
0x00b4b72c
0x00000000
0x00000000
0x00b4b6f9
0x00b4b705
0x00b4b70c
0x00b4b71b
0x00b4b71f
0x00b4b724
0x00b4b724
0x00b4b724
0x00b4b72e
0x00b4b73a
0x00b4b73e
0x00b4b743
0x00b4b74f
0x00b4b753
0x00b4b75d
0x00b4b765
0x00b4b766
0x00b4b767
0x00b4b775

APIs

sprintf_s.MSVCRT ref: 00B4B51C
sprintf_s.MSVCRT ref: 00B4B550
sprintf_s.MSVCRT ref: 00B4B584
sprintf_s.MSVCRT ref: 00B4B5B8
sprintf_s.MSVCRT ref: 00B4B5EC
sprintf_s.MSVCRT ref: 00B4B620
sprintf_s.MSVCRT ref: 00B4B688

Strings

<CalculateIopsStdDev>false</CalculateIopsStdDev>, xrefs: 00B4B4D2
<TimeSpan>, xrefs: 00B4B469
<Affinity>, xrefs: 00B4B651, 00B4B656, 00B4B65E
<Warmup>%u</Warmup>, xrefs: 00B4B549
<Duration>%u</Duration>, xrefs: 00B4B515
<IoBucketDuration>%u</IoBucketDuration>, xrefs: 00B4B5E5
<CompletionRoutines>false</CompletionRoutines>, xrefs: 00B4B492
<MeasureLatency>true</MeasureLatency>, xrefs: 00B4B4AB, 00B4B4B7, 00B4B4BF
<Targets>, xrefs: 00B4B6CE, 00B4B6D3, 00B4B6DB
<AffinityGroupAssignment Group="%u" Processor="%u"/>, xrefs: 00B4B677
<MeasureLatency>false</MeasureLatency>, xrefs: 00B4B4B2
<CompletionRoutines>true</CompletionRoutines>, xrefs: 00B4B47D, 00B4B497, 00B4B49F
</Targets>, xrefs: 00B4B72E, 00B4B733, 00B4B73B
<CalculateIopsStdDev>true</CalculateIopsStdDev>, xrefs: 00B4B4CB, 00B4B4D7, 00B4B4DF
<ThreadCount>%u</ThreadCount>, xrefs: 00B4B5B1
</TimeSpan>, xrefs: 00B4B743, 00B4B748, 00B4B750
<RandSeed>%u</RandSeed>, xrefs: 00B4B619
<DisableAffinity>false</DisableAffinity>, xrefs: 00B4B4F2
</Affinity>, xrefs: 00B4B6B3, 00B4B6B8, 00B4B6C0
<Cooldown>%u</Cooldown>, xrefs: 00B4B57D
<DisableAffinity>true</DisableAffinity>, xrefs: 00B4B4EB, 00B4B4F7, 00B4B4FF

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: sprintf_s
String ID: </Affinity>$</Targets>$</TimeSpan>$<Affinity>$<AffinityGroupAssignment Group="%u" Processor="%u"/>$<CalculateIopsStdDev>false</CalculateIopsStdDev>$<CalculateIopsStdDev>true</CalculateIopsStdDev>$<CompletionRoutines>false</CompletionRoutines>$<CompletionRoutines>true</CompletionRoutines>$<Cooldown>%u</Cooldown>$<DisableAffinity>false</DisableAffinity>$<DisableAffinity>true</DisableAffinity>$<Duration>%u</Duration>$<IoBucketDuration>%u</IoBucketDuration>$<MeasureLatency>false</MeasureLatency>$<MeasureLatency>true</MeasureLatency>$<RandSeed>%u</RandSeed>$<Targets>$<ThreadCount>%u</ThreadCount>$<TimeSpan>$<Warmup>%u</Warmup>
API String ID: 2907819478-3937871512
Opcode ID: 2148b2ce4b9ac740c442841ab8d148f85300a40e0ea17fc5dcd434ecded8cdea
Instruction ID: 6c661da536a80236a2ef4cb2218a00f718c686de2b3be29f64ca2053db47b17a
Opcode Fuzzy Hash: 2148b2ce4b9ac740c442841ab8d148f85300a40e0ea17fc5dcd434ecded8cdea
Instruction Fuzzy Hash: 58918372D002586ADB20EB608C46EAF77FCEF45710F0405EDF545A3281DA78EF84AB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B51733 Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 359
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00B51733(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				signed int* _t223;
				signed int _t224;
				signed int _t230;
				signed int _t235;
				int _t241;
				long _t243;
				intOrPtr _t249;
				intOrPtr _t250;
				intOrPtr _t253;
				signed int _t260;
				void _t264;
				void* _t269;
				void* _t272;
				void* _t287;
				signed int _t289;
				signed int _t290;
				signed int _t291;
				intOrPtr _t292;
				void* _t295;
				void* _t297;
				intOrPtr _t302;
				struct _OVERLAPPED* _t305;
				intOrPtr _t309;
				signed int _t314;
				signed int _t320;
				signed int _t323;
				signed int _t326;
				void* _t330;
				long _t336;
				long _t337;
				signed int* _t339;
				signed int _t341;
				signed int _t343;
				signed int _t347;
				signed int _t350;
				signed int _t353;
				intOrPtr _t354;
				long _t356;
				void* _t357;
				signed int _t359;
				long _t361;
				signed int _t362;
				long _t363;
				long _t364;
				intOrPtr _t367;
				char* _t368;
				void* _t369;
				intOrPtr _t370;
				void* _t371;
				void* _t372;
				void* _t387;

				_t387 = __fp0;
				_push(0x60);
				E00B5D114(0xb5e41e, __ebx, __edi, __esi);
				 *(_t371 - 0x50) = __edx;
				_t295 = __ecx;
				asm("cdq");
				_t359 = 0x14;
				 *(_t371 - 0x4c) = _t359;
				_t353 = ( *((intOrPtr*)(__ecx + 0x3c)) -  *((intOrPtr*)(__ecx + 0x38))) / _t359;
				 *((intOrPtr*)(_t371 - 0x24)) = 0;
				 *(_t371 - 0x60) = 0;
				 *(_t371 - 0x5c) = 0;
				 *((intOrPtr*)(_t371 - 0x58)) = 0;
				 *((char*)(_t371 - 0x3c)) =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 4)) + 0x31));
				asm("cdq");
				 *((intOrPtr*)(_t371 - 0x6c)) = 0;
				_t361 = ( *((intOrPtr*)(__ecx + 0xc)) -  *((intOrPtr*)(__ecx + 8))) / 0xb8;
				 *((intOrPtr*)(_t371 - 0x68)) = 0;
				 *((intOrPtr*)(_t371 - 0x64)) = 0;
				 *(_t371 - 0x34) = _t353;
				 *(_t371 - 0x28) = _t361;
				E00B54DD7(_t371 - 0x6c, _t361);
				 *(_t371 - 4) =  *(_t371 - 4) & 0x00000000;
				 *((char*)(_t371 - 0xd)) = 0;
				if(_t361 == 0) {
					L10:
					if(_t353 == 0) {
						L45:
						while( *0xb61634 != 0) {
							if( *0xb61640 != 0) {
								break;
							}
							 *(_t371 - 0x34) =  *(_t371 - 0x34) & 0x00000000;
							_t361 = _t361 | 0xffffffff;
							_t302 =  *((intOrPtr*)(_t371 - 0x58));
							_t354 =  *((intOrPtr*)(_t371 - 0x6c));
							 *(_t371 - 0x38) = _t361;
							if(_t302 == 0) {
								L31:
								if( *((char*)(_t371 - 0xd)) != 0) {
									asm("cdq");
									if(_t302 == ( *((intOrPtr*)(_t295 + 0x3c)) -  *((intOrPtr*)(_t295 + 0x38))) /  *(_t371 - 0x4c) && _t361 != 0xffffffff) {
										Sleep(_t361);
									}
								}
								if(GetQueuedCompletionStatus( *(_t371 - 0x50), _t371 - 0x40, _t371 - 0x54, _t371 - 0x14, 1) == 0) {
									if(GetLastError() != 0x102) {
										E00B51330(_t302, "error during overlapped IO operation (error code: %u)\n", _t218);
										L54:
										_t297 = 0;
										L47:
										if(_t354 != 0) {
											__imp__??3@YAXPAX@Z(_t354);
										}
										return E00B5D0E7(_t297);
									}
								} else {
									_t305 =  *(_t371 - 0x14);
									asm("cdq");
									_t362 = 0x14;
									_t336 =  *(_t371 - 0x40);
									_t355 = (_t305 -  *((intOrPtr*)(_t295 + 0x38))) / _t362;
									_t363 =  *( *((intOrPtr*)(_t295 + 0x44)) + (_t305 -  *((intOrPtr*)(_t295 + 0x38))) / _t362 * 4);
									 *(_t371 - 0x34) = _t363;
									_t260 = _t363 * 0xb8 +  *((intOrPtr*)(_t295 + 8));
									 *(_t371 - 0x38) = _t260;
									if(_t336 !=  *((intOrPtr*)(_t260 + 0x18))) {
										_push( *((intOrPtr*)(_t260 + 0x18)));
										_push(_t336);
										E00B51330(_t305, "Warning: thread %u transferred %u bytes instead of %u bytes\n",  *((intOrPtr*)(_t295 + 0x88)));
										_t305 =  *(_t371 - 0x14);
										_t372 = _t372 + 0x10;
									}
									 *(_t371 - 0x48) = _t305->OffsetHigh;
									 *(_t371 - 0x44) = _t305->Offset;
									if( *((char*)( *((intOrPtr*)(_t295 + 0x90)))) != 0) {
										E00B50D77(_t363 * 0xc8 +  *((intOrPtr*)( *((intOrPtr*)(_t295 + 0x98)))), _t336, _t387,  *(_t371 - 0x40),  *((intOrPtr*)( *((intOrPtr*)(_t295 + 0x5c)) + _t355 * 4)),  *((intOrPtr*)(_t295 + 0x68)) + _t355 * 8,  *((intOrPtr*)(_t295 + 0x94)),  *((intOrPtr*)(_t371 - 0x3c)),  *( *((intOrPtr*)(_t295 + 4)) + 0x32) & 0x000000ff);
									}
									_t264 =  *_t295;
									if( *((intOrPtr*)(_t264 + 0x10)) != 0) {
										_t309 =  *((intOrPtr*)(_t371 - 0x24)) + 1;
										 *((intOrPtr*)(_t371 - 0x24)) = _t309;
										if(_t309 ==  *((intOrPtr*)(_t264 + 0x10))) {
											_push(".");
											E00B512F0(_t309);
											 *((intOrPtr*)(_t371 - 0x24)) = 0;
										}
									}
									_push( *(_t371 - 0x48));
									_t337 = _t363;
									_t356 = E00B51490(_t295, _t337,  *(_t371 - 0x44));
									_t361 = _t337;
									 *(_t371 - 0x14)->Offset = _t356;
									 *(_t371 - 0x14)->OffsetHigh = _t361;
									_t269 = E00B5D910(_t356, _t361,  *((intOrPtr*)( *(_t371 - 0x38) + 0x18)), 0);
									_push(_t337);
									_push(_t269);
									_push(_t361);
									_push(_t356);
									_push( *(_t371 - 0x34));
									_t272 = E00B51370(_t295,  *( *_t295 + 0xc) & 0x000000ff, "t[%u:%u] new I/O op at %I64u (starting in block: %I64u)\n",  *((intOrPtr*)(_t295 + 0x88)));
									_t372 = _t372 + 0x20;
									E00B58208(_t272, _t371 - 0x60,  *(_t371 - 0x14));
								}
								continue;
							} else {
								goto L16;
							}
							do {
								L16:
								_t223 =  *(_t371 - 0x60);
								_t339 = _t223;
								 *(_t371 - 0x20) = _t339;
								_t224 =  *_t223;
								 *(_t371 - 0x60) = _t224;
								asm("sbb eax, eax");
								 *(_t371 - 0x5c) =  *(_t371 - 0x5c) &  ~_t224;
								asm("cdq");
								 *((intOrPtr*)(_t371 - 0x58)) = _t302 - 1;
								_t314 = 0x14;
								_t341 = (_t339 -  *((intOrPtr*)(_t295 + 0x38))) / _t314;
								 *(_t371 - 0x28) = _t341;
								_t230 =  *( *((intOrPtr*)(_t295 + 0x44)) + _t341 * 4);
								 *(_t371 - 0x1c) = _t230;
								 *(_t371 - 0x2c) = _t341 -  *((intOrPtr*)( *((intOrPtr*)(_t295 + 0x50)) + _t230 * 4));
								_t343 = _t230 * 0xb8;
								 *(_t371 - 0x44) = _t343;
								 *(_t371 - 0x18) =  *((intOrPtr*)(_t295 + 8)) + _t343;
								 *((intOrPtr*)(_t371 - 0x30)) =  *(_t371 - 0x1c) * 0x38 + _t354;
								_t235 = E00B5813D( *(_t371 - 0x1c) * 0x38 + _t354,  *(_t371 - 0x1c) * 0x38 + _t354, _t343);
								_t317 =  *((intOrPtr*)(_t371 - 0x30));
								if( *((char*)( *((intOrPtr*)(_t371 - 0x30)))) == 0 || _t235 == 0) {
									if( *((char*)(_t371 - 0x3c)) != 0) {
										_t367 =  *((intOrPtr*)(_t295 + 0x68));
										_t253 = E00B4A975(_t317);
										_t326 =  *(_t371 - 0x28);
										 *((intOrPtr*)(_t367 + _t326 * 8)) = _t253;
										 *(_t367 + 4 + _t326 * 8) = _t343;
									}
									_t364 = E00B5170C( *((intOrPtr*)( *(_t371 - 0x18) + 0x70)));
									 *(_t371 - 0x48) = _t364;
									_push( *(_t371 - 0x20));
									 *( *((intOrPtr*)(_t295 + 0x5c)) +  *(_t371 - 0x28) * 4) = _t364;
									_push(0);
									if(_t364 != 1) {
										_t320 =  *(_t371 - 0x1c);
										_t345 = _t320 << 2;
										_t321 = _t295;
										_t241 = WriteFile( *( *((intOrPtr*)(_t295 + 0x14)) + (_t320 << 2)), E00B4C075(_t295, _t320,  *(_t371 - 0x2c)),  *( *(_t371 - 0x18) + 0x18), ??, ??);
										_t364 =  *(_t371 - 0x48);
									} else {
										_t249 =  *((intOrPtr*)(_t295 + 8));
										_t323 =  *(_t371 - 0x44);
										_t347 =  *(_t371 - 0x1c) << 2;
										_t250 =  *((intOrPtr*)(_t295 + 0x2c));
										_t321 =  *(_t323 + _t249 + 0x18) *  *(_t371 - 0x2c) +  *((intOrPtr*)(_t250 + _t347));
										_t345 =  *(_t371 - 0x18);
										_t241 = ReadFile( *( *((intOrPtr*)(_t295 + 0x14)) + _t347),  *(_t323 + _t249 + 0x18) *  *(_t371 - 0x2c) +  *((intOrPtr*)(_t250 + _t347)),  *( *(_t371 - 0x18) + 0x18), ??, ??); // executed
										_t354 =  *((intOrPtr*)(_t371 - 0x6c));
									}
									if(_t241 != 0 || GetLastError() == 0x3e5) {
										_t322 =  *((intOrPtr*)(_t371 - 0x30));
										if( *((char*)( *((intOrPtr*)(_t371 - 0x30)))) != 0) {
											E00B581C5(_t322, _t345,  *( *(_t371 - 0x18) + 0x18));
										}
										goto L30;
									} else {
										_t368 = "read";
										if(_t364 != 1) {
											_t368 = "write";
										}
										_push(GetLastError());
										_push(_t368);
										E00B51330(_t321, "t[%u] error during %s error code: %u)\n",  *(_t371 - 0x28));
										goto L54;
									}
								} else {
									if(_t361 >= _t235) {
										 *(_t371 - 0x38) = _t235;
									}
									E00B58208(_t235, _t371 - 0x60,  *(_t371 - 0x20));
								}
								L30:
								_t302 =  *((intOrPtr*)(_t371 - 0x58));
								_t243 =  *(_t371 - 0x34) + 1;
								_t361 =  *(_t371 - 0x38);
								 *(_t371 - 0x34) = _t243;
							} while (_t243 < _t302);
							goto L31;
						}
						_t354 =  *((intOrPtr*)(_t371 - 0x6c));
						_t297 = 1;
						goto L47;
					}
					_t369 = 0;
					do {
						E00B58208( *((intOrPtr*)(_t295 + 0x38)) + _t369, _t371 - 0x60,  *((intOrPtr*)(_t295 + 0x38)) + _t369);
						_t287 = 0x14;
						_t369 = _t369 + _t287;
						_t353 = _t353 - 1;
					} while (_t353 != 0);
					goto L45;
				} else {
					_t370 =  *((intOrPtr*)(_t371 - 0x6c));
					_t357 = 0;
					do {
						_t330 =  *((intOrPtr*)(_t295 + 8)) + _t357;
						_t289 =  *( *((intOrPtr*)(_t295 + 4)) + 0x1c);
						 *(_t371 - 0x38) = _t289;
						_t290 =  *(_t330 + 0x78);
						if(_t289 == 0) {
							_t291 = _t290 /  *(_t330 + 0x48);
						} else {
							_t291 = _t290 /  *(_t371 - 0x38);
						}
						_t350 = _t291;
						_t292 =  *((intOrPtr*)(_t330 + 0x84));
						if(_t292 != 0 ||  *((intOrPtr*)(_t330 + 0x7c)) > _t292) {
							 *((char*)(_t371 - 0xd)) = 1;
							E00B580D1(_t370, _t350, _t292,  *((intOrPtr*)(_t330 + 0x18)),  *((intOrPtr*)(_t330 + 0x7c)), _t350);
						}
						_t357 = _t357 + 0xb8;
						_t370 = _t370 + 0x38;
						_t54 = _t371 - 0x28;
						 *_t54 =  *(_t371 - 0x28) - 1;
					} while ( *_t54 != 0);
					_t353 =  *(_t371 - 0x34);
					goto L10;
				}
			}

0x00b51733
0x00b51733
0x00b5173a
0x00b5173f
0x00b51742
0x00b5174c
0x00b5174f
0x00b51752
0x00b5175a
0x00b5175c
0x00b51762
0x00b51765
0x00b51768
0x00b5176e
0x00b51777
0x00b5177a
0x00b5177d
0x00b5177f
0x00b51782
0x00b51789
0x00b5178c
0x00b5178f
0x00b51794
0x00b51798
0x00b5179e
0x00b517fa
0x00b517fc
0x00000000
0x00b51af7
0x00b51828
0x00000000
0x00000000
0x00b5182e
0x00b51832
0x00b51835
0x00b51838
0x00b5183b
0x00b51840
0x00b51999
0x00b5199d
0x00b519a5
0x00b519ab
0x00b519b3
0x00b519b3
0x00b519ab
0x00b519d2
0x00b51af5
0x00b51b4d
0x00b51b54
0x00b51b54
0x00b51b0a
0x00b51b0c
0x00b51b0f
0x00b51b15
0x00b51b1d
0x00b51b1d
0x00b519d8
0x00b519d8
0x00b519e0
0x00b519e3
0x00b519e6
0x00b519e9
0x00b519ee
0x00b519f7
0x00b519fa
0x00b519fd
0x00b51a03
0x00b51a05
0x00b51a08
0x00b51a14
0x00b51a19
0x00b51a1c
0x00b51a1c
0x00b51a22
0x00b51a28
0x00b51a34
0x00b51a65
0x00b51a65
0x00b51a6a
0x00b51a70
0x00b51a75
0x00b51a76
0x00b51a7c
0x00b51a7e
0x00b51a83
0x00b51a8b
0x00b51a8b
0x00b51a7c
0x00b51a8e
0x00b51a91
0x00b51a9d
0x00b51a9f
0x00b51aa6
0x00b51aac
0x00b51ab7
0x00b51abc
0x00b51abd
0x00b51ac0
0x00b51ac1
0x00b51ac2
0x00b51ad5
0x00b51ada
0x00b51ae3
0x00b51ae3
0x00000000
0x00000000
0x00000000
0x00000000
0x00b51846
0x00b51846
0x00b51846
0x00b51849
0x00b5184b
0x00b51850
0x00b51852
0x00b51857
0x00b51859
0x00b51862
0x00b51863
0x00b51866
0x00b5186c
0x00b51871
0x00b51874
0x00b51877
0x00b5187d
0x00b51880
0x00b5188b
0x00b5188e
0x00b51899
0x00b5189c
0x00b518a1
0x00b518a7
0x00b518c8
0x00b518ca
0x00b518cd
0x00b518d2
0x00b518d5
0x00b518d8
0x00b518d8
0x00b518ea
0x00b518ef
0x00b518f2
0x00b518f5
0x00b518f8
0x00b518fd
0x00b51935
0x00b5193d
0x00b51949
0x00b51953
0x00b51959
0x00b518ff
0x00b518ff
0x00b51902
0x00b51908
0x00b51913
0x00b51916
0x00b5191e
0x00b51927
0x00b5192d
0x00b5192d
0x00b5195e
0x00b51971
0x00b51977
0x00b5197f
0x00b5197f
0x00000000
0x00b51b1e
0x00b51b21
0x00b51b26
0x00b51b28
0x00b51b28
0x00b51b33
0x00b51b34
0x00b51b3d
0x00000000
0x00b51b42
0x00b518ad
0x00b518af
0x00b518b1
0x00b518b1
0x00b518ba
0x00b518ba
0x00b51984
0x00b51987
0x00b5198a
0x00b5198b
0x00b5198e
0x00b51991
0x00000000
0x00b51846
0x00b51b04
0x00b51b09
0x00000000
0x00b51b09
0x00b51802
0x00b51804
0x00b5180d
0x00b51814
0x00b51815
0x00b51817
0x00b51817
0x00000000
0x00b517a0
0x00b517a0
0x00b517a3
0x00b517a5
0x00b517ad
0x00b517af
0x00b517b4
0x00b517b7
0x00b517ba
0x00b517c1
0x00b517bc
0x00b517bc
0x00b517bc
0x00b517c4
0x00b517c6
0x00b517ce
0x00b517d9
0x00b517e3
0x00b517e3
0x00b517e8
0x00b517ee
0x00b517f1
0x00b517f1
0x00b517f1
0x00b517f7
0x00000000
0x00b517f7

APIs

ReadFile.KERNELBASE(00000010,00000001,?,00000000,?,?,00000060,00B52D66), ref: 00B51927
WriteFile.KERNEL32(00000010,00000000,00000001,00000001,?,00000000,?,?,00000060,00B52D66), ref: 00B51953

Part of subcall function 00B51490: __aullrem.LIBCMT ref: 00B51502
Part of subcall function 00B51490: __aullrem.LIBCMT ref: 00B515DE

GetLastError.KERNEL32 ref: 00B51960
Sleep.KERNEL32(?,?,?,00000060,00B52D66), ref: 00B519B3
GetQueuedCompletionStatus.KERNEL32(00B52D66,?,00000060,00000010,00000001,?,00000060,00B52D66), ref: 00B519CA

Part of subcall function 00B4A975: QueryPerformanceCounter.KERNEL32(00000000,00000001,00000001,?,00B51E0F,000000B8,00000000,?), ref: 00B4A980

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B51AB7
??3@YAXPAX@Z.MSVCRT ref: 00B51B0F
GetLastError.KERNEL32 ref: 00B51B2D

Strings

t[%u] error during %s error code: %u), xrefs: 00B51B38
read, xrefs: 00B51B21
Warning: thread %u transferred %u bytes instead of %u bytes, xrefs: 00B51A0F
write, xrefs: 00B51B28, 00B51B34
error during overlapped IO operation (error code: %u), xrefs: 00B51B48
t[%u:%u] new I/O op at %I64u (starting in block: %I64u), xrefs: 00B51ACF

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ErrorFileLast__aullrem$??3@CompletionCounterPerformanceQueryQueuedReadSleepStatusUnothrow_t@std@@@Write__ehfuncinfo$??2@
String ID: Warning: thread %u transferred %u bytes instead of %u bytes$error during overlapped IO operation (error code: %u)$read$t[%u:%u] new I/O op at %I64u (starting in block: %I64u)$t[%u] error during %s error code: %u)$write
API String ID: 202472602-3846729189
Opcode ID: 8854c35f663907be558f8d920678da05599e2f2c31a1974d5e5f0f7d0f12ef86
Instruction ID: 49d28478afac7d53739ba08fb407410cf4f54e263867a28f45f5fb29a43a8afd
Opcode Fuzzy Hash: 8854c35f663907be558f8d920678da05599e2f2c31a1974d5e5f0f7d0f12ef86
Instruction Fuzzy Hash: 64E12871E002189FDF15DFA8C884BADBBF6EF48311F1444E9E919AB2A6DB319C45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B52E86 Relevance: 6.1, APIs: 4, Instructions: 60
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 39%

			E00B52E86(void* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				CHAR* _t11;
				long _t12;
				long _t15;
				void* _t18;
				void* _t22;
				void* _t24;
				char* _t26;
				signed int _t27;

				_t25 = __esi;
				_t23 = __edi;
				_t9 =  *0xb61000; // 0xba7e72c4
				_v8 = _t9 ^ _t27;
				if( *((char*)(__ecx + 1)) == 0x3a) {
					_t11 =  &_v268;
					__imp__strcpy_s(_t11, 0x104, __ecx);
					if(_t11 == 0) {
						_push(__esi);
						_push(__edi);
						_t26 =  &_v268;
						if(_v268 == 0) {
							L13:
							_t12 = 0;
						} else {
							_t24 = 0;
							do {
								if( *_t26 != 0x5c || _t24 < 3) {
									goto L12;
								} else {
									 *_t26 = 0;
									_t15 = GetFileAttributesA( &_v268); // executed
									if(_t15 != 0xffffffff || CreateDirectoryA( &_v268, 0) != 0) {
										 *_t26 = 0x5c;
										goto L12;
									} else {
										_t12 = GetLastError();
									}
								}
								goto L14;
								L12:
								_t26 = _t26 + 1;
								_t24 = _t24 + 1;
							} while ( *_t26 != 0);
							goto L13;
						}
						L14:
						_pop(_t23);
						_pop(_t25);
					} else {
						_push(0x6f);
						goto L2;
					}
				} else {
					_push(0x32);
					L2:
					_pop(_t12);
				}
				return E00B5CFA0(_t12, _t18, _v8 ^ _t27, _t22, _t23, _t25);
			}

0x00b52e86
0x00b52e86
0x00b52e91
0x00b52e98
0x00b52e9f
0x00b52ea7
0x00b52eb3
0x00b52ebe
0x00b52ecb
0x00b52ecc
0x00b52ecd
0x00b52ed3
0x00b52f13
0x00b52f13
0x00b52ed5
0x00b52ed5
0x00b52ed7
0x00b52eda
0x00000000
0x00b52ee1
0x00b52ee7
0x00b52eeb
0x00b52ef4
0x00b52f09
0x00000000
0x00b52f25
0x00b52f25
0x00b52f25
0x00b52ef4
0x00000000
0x00b52f0c
0x00b52f0c
0x00b52f0d
0x00b52f0e
0x00000000
0x00b52ed7
0x00b52f15
0x00b52f15
0x00b52f16
0x00b52ec0
0x00b52ec0
0x00000000
0x00b52ec0
0x00b52ea1
0x00b52ea1
0x00b52ea3
0x00b52ea3
0x00b52ea3
0x00b52f24

APIs

strcpy_s.MSVCRT ref: 00B52EB3
GetFileAttributesA.KERNELBASE(00000000), ref: 00B52EEB
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00B52EFF
GetLastError.KERNEL32 ref: 00B52F25

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: AttributesCreateDirectoryErrorFileLaststrcpy_s
String ID:
API String ID: 354552961-0
Opcode ID: 9de36d8b077c4999971bb3df3d48b5ad8f1ad2030f42937b7e492001ac528752
Instruction ID: 51dfd957b904297453c3c6b865e90709fde62fb84ec9f55b2364c8cb51393978
Opcode Fuzzy Hash: 9de36d8b077c4999971bb3df3d48b5ad8f1ad2030f42937b7e492001ac528752
Instruction Fuzzy Hash: 18112331908344AAEB358B24EC49BAA7BF8DB47316F1404D8EDC6E30C1DBB489C8CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BFD5 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLargePageMinimum.KERNEL32 ref: 00B4BFF6
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 00B4C01B
memset.MSVCRT ref: 00B4C03D

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: AllocLargeMinimumPageVirtualmemset
String ID:
API String ID: 3383278933-0
Opcode ID: 1a9f03d64d08abb5e62606c4b7bb65697c95c5813b5e0bd403189dc26e9fc650
Instruction ID: 9c05ff0e21ab6ad954c8e9a7704e8a9c178e72f29ad47a82f42037bc3ee48127
Opcode Fuzzy Hash: 1a9f03d64d08abb5e62606c4b7bb65697c95c5813b5e0bd403189dc26e9fc650
Instruction Fuzzy Hash: 981136B1D06219BFEB208B658880BBBBFE8EB11B40F044099E94493341C6755E49D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00B4A58F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E00B4A58F(void* __ebx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v20;
				signed short _v24;
				signed int _v28;
				intOrPtr* _v32;
				signed int _v36;
				char _v84;
				struct _SYSTEMTIME* _v88;
				struct _SYSTEMTIME* _v92;
				intOrPtr _t55;
				signed short _t62;
				signed short _t63;
				signed int _t64;
				signed int _t65;
				signed short _t80;
				long _t92;
				signed short _t94;
				intOrPtr* _t95;
				void* _t96;
				signed short _t97;
				signed short _t98;
				intOrPtr* _t99;
				struct _SYSTEMTIME* _t102;
				unsigned int _t110;
				signed short _t111;
				signed short _t116;
				signed int _t119;
				unsigned int _t121;
				void* _t122;
				void* _t123;
				void* _t124;
				intOrPtr* _t125;
				struct _SYSTEMTIME* _t127;

				_t124 = __esi;
				_t122 = __edi;
				_t96 = __ebx;
				_t55 = _a4;
				_t99 = 0;
				if(_t55 == 0) {
					L3:
					return _t99;
				} else {
					if(_t55 > 0xffffffff) {
						L4:
						E00B5CBE6();
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						E00B5D114(0xb5dbf5, _t96, _t122, _t124);
						_t125 = _t99;
						_v32 = _t125;
						_t97 = 0;
						 *_t125 = 0;
						 *(_t125 + 4) = 0;
						 *(_t125 + 8) = 0;
						_v8 = 0;
						_v20 = 0x400;
						_t123 = E00B5D7E6();
						_t62 =  &_v20;
						__imp__GetLogicalProcessorInformationEx(4, _t123, _t62, 0x400, 0x14);
						__eflags = _t62;
						if(_t62 != 0) {
							L8:
							 *(_t125 + 0xc) = _t97;
							__eflags = 0 -  *((intOrPtr*)(_t123 + 0xa));
							_t63 = _t97;
							while(1) {
								_v24 = _t63;
								if(__eflags >= 0) {
									goto L23;
								}
								_t116 =  *(_t125 + 4);
								_t102 =  *(_t125 + 8);
								_t64 = _t63 & 0x0000ffff;
								_v36 = _t64;
								_t65 = _t64 * 0x2c;
								_v28 = _t65;
								__eflags = _t116 - _t102;
								if(_t116 != _t102) {
									L19:
									_t97 =  *(_t125 + 4);
									__eflags = _t97;
									if(_t97 != 0) {
										 *_t97 = _v24;
										_t125 = _v32;
										 *((char*)(_t97 + 2)) =  *((intOrPtr*)(_t65 + _t123 + 0x20));
										 *((char*)(_t97 + 3)) =  *((intOrPtr*)(_t65 + _t123 + 0x21));
										 *((intOrPtr*)(_t97 + 4)) =  *((intOrPtr*)(_t65 + _t123 + 0x48));
									}
									 *(_t125 + 4) =  *(_t125 + 4) + 8;
									 *(_t125 + 0xc) =  *(_t125 + 0xc) + ( *( *_t125 + 2 + _v36 * 8) & 0x000000ff);
									_t63 = _v24 + 1;
									__eflags = _t63 -  *((intOrPtr*)(_t123 + 0xa));
									continue;
								} else {
									__eflags = _t102 - _t116 >> 3 - 1;
									if(_t102 - _t116 >> 3 >= 1) {
										L18:
										_t65 = _v28;
										goto L19;
									} else {
										_t119 = _t116 -  *_t125 >> 3;
										__eflags = 0x1fffffff - _t119 - 1;
										if(0x1fffffff - _t119 < 1) {
											E00B4C465(_t97, _t102, _t119, _t123, _t125);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											E00B5D14C(0xb5dc2b, _t97, _t123, _t125);
											_t127 = _t102;
											_v88 = _t127;
											 *((intOrPtr*)(_t127 + 0x24)) = 0xf;
											 *((intOrPtr*)(_t127 + 0x20)) = 0;
											_v92 = _t127;
											 *((char*)(_t127 + 0x10)) = 0;
											_v8 = 0;
											L5();
											_v8 = 1;
											_t80 =  &_v84;
											_v88 = 0x40;
											__imp__GetComputerNameExA(5, _t80,  &_v88, 0x4c);
											__eflags = _t80;
											if(_t80 != 0) {
												E00B4A3CA(_t127 + 0x10,  &_v84, E00B49AB6( &_v84));
											}
											GetSystemTime(_t127);
											return E00B5D100(_t97, _t123, _t127);
										} else {
											_t98 = _t119 + 1;
											_t110 = _t102 -  *_t125 >> 3;
											_t121 = _t110 >> 1;
											__eflags = 0x1fffffff - _t121 - _t110;
											if(0x1fffffff - _t121 >= _t110) {
												_t111 = _t110 + _t121;
												__eflags = _t111;
											} else {
												_t111 = 0;
											}
											__eflags = _t111 - _t98;
											if(_t111 < _t98) {
												_t111 = _t98;
											}
											_push(_t111);
											E00B4C77E(_t98, _t125, _t123, _t125);
											goto L18;
										}
									}
								}
								goto L28;
							}
							goto L23;
						} else {
							_t92 = GetLastError();
							__eflags = _t92 - 0x7a;
							if(_t92 != 0x7a) {
								L23:
								__imp__??_V@YAXPAX@Z(_t123);
								return E00B5D0E7(_t125);
							} else {
								__imp__??_V@YAXPAX@Z(_t123);
								_t123 = E00B5D7E6();
								_t94 =  &_v20;
								__imp__GetLogicalProcessorInformationEx(4, _t123, _t94, _v20);
								__eflags = _t94;
								if(_t94 == 0) {
									goto L23;
								} else {
									goto L8;
								}
							}
						}
					} else {
						_push(_t55); // executed
						_t95 = E00B5CA2B(); // executed
						_t99 = _t95;
						if(_t99 == 0) {
							goto L4;
						} else {
							goto L3;
						}
					}
				}
				L28:
			}

0x00b4a58f
0x00b4a58f
0x00b4a58f
0x00b4a594
0x00b4a597
0x00b4a59b
0x00b4a5af
0x00b4a5b2
0x00b4a59d
0x00b4a5a0
0x00b4a5b5
0x00b4a5b5
0x00b4a5ba
0x00b4a5bb
0x00b4a5bc
0x00b4a5bd
0x00b4a5be
0x00b4a5bf
0x00b4a5c7
0x00b4a5cc
0x00b4a5ce
0x00b4a5d1
0x00b4a5d3
0x00b4a5d5
0x00b4a5d8
0x00b4a5e0
0x00b4a5e4
0x00b4a5ed
0x00b4a5ef
0x00b4a5f6
0x00b4a5fc
0x00b4a5fe
0x00b4a637
0x00b4a639
0x00b4a63c
0x00b4a640
0x00b4a6ea
0x00b4a6ea
0x00b4a6ed
0x00000000
0x00000000
0x00b4a647
0x00b4a64a
0x00b4a64d
0x00b4a650
0x00b4a653
0x00b4a656
0x00b4a659
0x00b4a65b
0x00b4a6ac
0x00b4a6ac
0x00b4a6af
0x00b4a6b1
0x00b4a6c2
0x00b4a6c5
0x00b4a6c8
0x00b4a6cb
0x00b4a6ce
0x00b4a6ce
0x00b4a6d1
0x00b4a6df
0x00b4a6e5
0x00b4a6e6
0x00000000
0x00b4a65d
0x00b4a664
0x00b4a667
0x00b4a6a9
0x00b4a6a9
0x00000000
0x00b4a669
0x00b4a670
0x00b4a675
0x00b4a678
0x00b4a703
0x00b4a708
0x00b4a709
0x00b4a70a
0x00b4a70b
0x00b4a70c
0x00b4a70d
0x00b4a715
0x00b4a71a
0x00b4a71c
0x00b4a721
0x00b4a728
0x00b4a72b
0x00b4a72e
0x00b4a734
0x00b4a737
0x00b4a73f
0x00b4a744
0x00b4a747
0x00b4a751
0x00b4a757
0x00b4a759
0x00b4a76d
0x00b4a76d
0x00b4a773
0x00b4a780
0x00b4a67e
0x00b4a680
0x00b4a683
0x00b4a68d
0x00b4a691
0x00b4a693
0x00b4a699
0x00b4a699
0x00b4a695
0x00b4a695
0x00b4a695
0x00b4a69b
0x00b4a69d
0x00b4a69f
0x00b4a69f
0x00b4a6a1
0x00b4a6a4
0x00000000
0x00b4a6a4
0x00b4a678
0x00b4a667
0x00000000
0x00b4a65b
0x00000000
0x00b4a600
0x00b4a600
0x00b4a606
0x00b4a609
0x00b4a6f3
0x00b4a6f4
0x00b4a702
0x00b4a60f
0x00b4a610
0x00b4a620
0x00b4a622
0x00b4a629
0x00b4a62f
0x00b4a631
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4a631
0x00b4a609
0x00b4a5a2
0x00b4a5a2
0x00b4a5a3
0x00b4a5a9
0x00b4a5ad
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4a5ad
0x00b4a5a0
0x00000000

APIs

std::tr1::_Xmem.LIBCPMT ref: 00B4A5B5

Part of subcall function 00B5CA2B: malloc.MSVCRT ref: 00B5CA42

Strings

@, xrefs: 00B4A747

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: Xmemmallocstd::tr1::_
String ID: @
API String ID: 257571584-2766056989
Opcode ID: 399b7a485d091a66600d6952dbfa20f3ceafde20b4a6854d3a2a6daddf43b3a4
Instruction ID: 02e4fa468e2c91c7d6e2796bb38a6372cfef5aa113c4dcd70c58597ad0332bef
Opcode Fuzzy Hash: 399b7a485d091a66600d6952dbfa20f3ceafde20b4a6854d3a2a6daddf43b3a4
Instruction Fuzzy Hash: DAD0A77134830F0F5F1C657D541652E36C9CF5877231401BE7927C65C0EE20EE00505A

Uniqueness

Uniqueness Score: -1.00%

Function 00B4A49C Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00B4A49C(unsigned int __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t29;
				void* _t33;
				int _t36;
				unsigned int _t39;
				void* _t42;
				signed int _t47;
				void* _t49;
				void* _t50;

				_t35 = __ebx;
				_push(0x14);
				E00B5D187(0xb5dbcd, __ebx, __edi, __esi);
				_t49 = __ecx;
				 *((intOrPtr*)(_t50 - 0x1c)) = __ecx;
				_t47 =  *(_t50 + 8) | 0x0000000f;
				if(_t47 <= 0xfffffffe) {
					 *(_t50 - 0x18) = 3;
					_t35 =  *(__ecx + 0x14);
					_t39 = _t35 >> 1;
					if(_t39 > _t47 /  *(_t50 - 0x18)) {
						_t33 = 0xfffffffe;
						if(_t35 > _t33 - _t39) {
							_t47 = 0xfffffffe;
						} else {
							_t47 = _t39 + _t35;
						}
					}
				} else {
					_t47 =  *(_t50 + 8);
				}
				 *(_t50 - 4) =  *(_t50 - 4) & 0x00000000;
				_t15 = _t47 + 1; // 0xff
				_t29 = E00B4A58F(_t35, _t47, _t49, _t15); // executed
				_t36 =  *(_t50 + 0xc);
				 *(_t50 - 0x18) = _t29;
				if(_t36 != 0) {
					if( *(_t49 + 0x14) < 0x10) {
						_t42 = _t49;
					} else {
						_t42 =  *_t49;
					}
					if(_t36 != 0) {
						memcpy(_t29, _t42, _t36);
					}
				}
				_t30 = E00B4A1B9(_t49, 1, 0);
				if(_t49 != 0) {
					_t30 =  *(_t50 - 0x18);
					 *_t49 =  *(_t50 - 0x18);
				}
				 *(_t49 + 0x14) = _t47;
				 *(_t49 + 0x10) = _t36;
				if(_t47 >= 0x10) {
					_t49 =  *_t49;
				}
				 *((char*)(_t49 + _t36)) = 0;
				return E00B5D0E7(_t30);
			}

0x00b4a49c
0x00b4a49c
0x00b4a4a3
0x00b4a4a8
0x00b4a4aa
0x00b4a4b0
0x00b4a4b6
0x00b4a4bf
0x00b4a4c8
0x00b4a4d0
0x00b4a4d4
0x00b4a4d8
0x00b4a4dd
0x00b4a4e6
0x00b4a4df
0x00b4a4df
0x00b4a4df
0x00b4a4dd
0x00b4a4b8
0x00b4a4b8
0x00b4a4b8
0x00b4a4e7
0x00b4a4eb
0x00b4a4f2
0x00b4a522
0x00b4a525
0x00b4a52a
0x00b4a530
0x00b4a536
0x00b4a532
0x00b4a532
0x00b4a532
0x00b4a53a
0x00b4a53f
0x00b4a544
0x00b4a53a
0x00b4a54d
0x00b4a554
0x00b4a556
0x00b4a559
0x00b4a559
0x00b4a55b
0x00b4a55e
0x00b4a564
0x00b4a566
0x00b4a566
0x00b4a568
0x00b4a571

APIs

__EH_prolog3_catch.LIBCMT ref: 00B4A4A3
memcpy.MSVCRT ref: 00B4A53F

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: H_prolog3_catchmemcpy
String ID:
API String ID: 1910038392-0
Opcode ID: d8a81858599bc935b4baca7769f985860636f8c88aed1af8c75e8b448bfac57a
Instruction ID: f9e06d7c5ce17ff64ce890222ce0105f56034eadf96dfdec5f6035cb45923af8
Opcode Fuzzy Hash: d8a81858599bc935b4baca7769f985860636f8c88aed1af8c75e8b448bfac57a
Instruction Fuzzy Hash: F02124B1A402019BDB34DF58C98177EB7F5EFA4720F10069DE9526B3C1CBB0AB459792

Uniqueness

Uniqueness Score: -1.00%

Function 00B5834C Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00B5834C(void* __ebx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, char _a12) {
				signed int _v8;
				void _v4104;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t13;
				void* _t20;
				void* _t22;
				void* _t28;
				signed int _t31;
				void* _t34;

				_t34 = __eflags;
				_t28 = __edx;
				E00B5DB30(0x1004);
				_t13 =  *0xb61000; // 0xba7e72c4
				_v8 = _t13 ^ _t31;
				_t30 = _a4;
				memset( &_v4104, 0, 0x1000);
				__imp__vsprintf_s( &_v4104, 0x1000, _a8,  &_a12);
				_t20 = E00B49AB6( &_v4104);
				_t22 = E00B4C52F(__ebx, _a4 + 4, _t28, 0x1000, _a4, _t34,  &_v4104); // executed
				return E00B5CFA0(_t22, __ebx, _v8 ^ _t31, _t28, 0x1000, _t30, _t20);
			}

0x00b5834c
0x00b5834c
0x00b58356
0x00b5835b
0x00b58362
0x00b58366
0x00b58379
0x00b5838d
0x00b5839a
0x00b583ad
0x00b583c1

APIs

memset.MSVCRT ref: 00B58379
vsprintf_s.MSVCRT ref: 00B5838D

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: memsetvsprintf_s
String ID:
API String ID: 3742729749-0
Opcode ID: 3a265459afd9e4a84250c88f846ea40ea102ba739d19754b2c3f395ede6adab2
Instruction ID: 1b3eb1664a82d2ec1750dfb61cf22d30a31ac4f92b971afb64f91189710e2017
Opcode Fuzzy Hash: 3a265459afd9e4a84250c88f846ea40ea102ba739d19754b2c3f395ede6adab2
Instruction Fuzzy Hash: A901817290024CABCF21EF95DC45EDFB7BDEB48712F0005D5BA08D3140DA74EA898BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00B55DF7 Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E00B55DF7(void** __ecx, void* __edx, void* __eflags, signed int _a4) {
				void* _t11;
				void* _t15;
				signed int _t18;
				void* _t25;
				void** _t26;

				_t26 = __ecx; // executed
				_t11 = E00B4EBCD(__edx, _a4); // executed
				_t25 = _t11;
				memmove(_t25,  *_t26, _t26[1] -  *_t26 & 0xfffffffc);
				_t18 = _t26[1] -  *_t26 >> 2;
				if( *_t26 != 0) {
					__imp__??3@YAXPAX@Z( *_t26);
				}
				 *_t26 = _t25;
				_t26[2] = _t25 + _a4 * 4;
				_t15 = _t25 + _t18 * 4;
				_t26[1] = _t15;
				return _t15;
			}

0x00b55e02
0x00b55e04
0x00b55e0c
0x00b55e17
0x00b55e25
0x00b55e2b
0x00b55e2f
0x00b55e35
0x00b55e39
0x00b55e3e
0x00b55e41
0x00b55e45
0x00b55e4b

APIs

memmove.MSVCRT ref: 00B55E17
??3@YAXPAX@Z.MSVCRT ref: 00B55E2F

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ??3@memmove
String ID:
API String ID: 1783365933-0
Opcode ID: 63cc22f5af6532d08e0b5790981d07e09e9397cf898e62dd7a99ca16082e7564
Instruction ID: 8bc0ec39881ae7b3b165d17b9eb232e40854985f7dc0946255af9c3014d55776
Opcode Fuzzy Hash: 63cc22f5af6532d08e0b5790981d07e09e9397cf898e62dd7a99ca16082e7564
Instruction Fuzzy Hash: 51F0AF32400604EFC3318F28D884893FBF9FF85360724862EE99583254C731A910CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B5CA2B Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E00B5CA2B(int _a4) {
				intOrPtr _v12;
				char _v20;
				intOrPtr _v24;
				char _v44;
				void* _v52;
				void* _v72;
				void* _t14;
				char* _t21;
				intOrPtr _t29;
				void* _t31;
				void* _t32;
				void* _t33;
				void* _t35;
				void* _t36;
				void* _t37;

				while(1) {
					_t14 = malloc(_a4); // executed
					if(_t14 != 0) {
						break;
					}
					_push(_a4);
					L00B5D08C();
					if(_t14 == 0) {
						_t31 = _t35;
						_t36 = _t35 - 0xc;
						E00B5CA88( &_v20);
						_push(0xb605b0);
						_push( &_v20);
						L00B5D0DC();
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t31);
						_t32 = _t36;
						_t37 = _t36 - 0xc;
						E00B5CAE8( &_v44, _v24);
						_push(0xb605e8);
						_push( &_v44);
						L00B5D0DC();
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t32);
						_t33 = _t37;
						E00B5CB48(_t33 - 0xc,  *((intOrPtr*)(_t33 + 8)));
						_push(0xb60624);
						_push(_t33 - 0xc);
						L00B5D0DC();
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t33);
						_t21 = "f";
						if( *0xb41764 == 0) {
							L12:
							return 0;
						} else {
							_t29 = _v12;
							while( *_t21 != _t29) {
								_t21 =  &(_t21[8]);
								if(_t21[4] != 0) {
									continue;
								} else {
									goto L12;
								}
								goto L14;
							}
							_t13 =  &(_t21[4]); // 0xb419d8
							return  *_t13;
						}
					} else {
						continue;
					}
					L14:
				}
				return _t14;
				goto L14;
			}

0x00b5ca3f
0x00b5ca42
0x00b5ca4b
0x00000000
0x00000000
0x00b5ca32
0x00b5ca35
0x00b5ca3d
0x00b5cbe9
0x00b5cbeb
0x00b5cbf1
0x00b5cbf6
0x00b5cbfe
0x00b5cbff
0x00b5cc04
0x00b5cc05
0x00b5cc06
0x00b5cc07
0x00b5cc08
0x00b5cc09
0x00b5cc0c
0x00b5cc0d
0x00b5cc0f
0x00b5cc18
0x00b5cc1d
0x00b5cc25
0x00b5cc26
0x00b5cc2b
0x00b5cc2c
0x00b5cc2d
0x00b5cc2e
0x00b5cc2f
0x00b5cc30
0x00b5cc33
0x00b5cc34
0x00b5cc3f
0x00b5cc44
0x00b5cc4c
0x00b5cc4d
0x00b5cc52
0x00b5cc53
0x00b5cc54
0x00b5cc55
0x00b5cc56
0x00b5cc57
0x00b5cc5a
0x00b5cc64
0x00b5cc69
0x00b5cc7b
0x00b5cc7e
0x00b5cc6b
0x00b5cc6b
0x00b5cc6e
0x00b5cc72
0x00b5cc79
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00b5cc79
0x00b5cc7f
0x00b5cc83
0x00b5cc83
0x00000000
0x00000000
0x00000000
0x00000000
0x00b5ca3d
0x00b5ca4e
0x00000000

APIs

_callnewh.MSVCRT ref: 00B5CA35
malloc.MSVCRT ref: 00B5CA42

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: _callnewhmalloc
String ID:
API String ID: 2285944120-0
Opcode ID: 1ef2acdca06566fd0d42032c84c10431bd4676cf06edfdaf746e63c1ab75934c
Instruction ID: 2cd07cf4d11c0644ce5abef562f993e3ff35b34ad3866c49cea9b15387b66303
Opcode Fuzzy Hash: 1ef2acdca06566fd0d42032c84c10431bd4676cf06edfdaf746e63c1ab75934c
Instruction Fuzzy Hash: 62D0A93900870EAA8F20AA19EC2472A3EDAEA40B6272800E0FC08864A8EF21CC599440

Uniqueness

Uniqueness Score: -1.00%

Function 00B4EBCD Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 35%

			E00B4EBCD(void* __edx, signed int _a4) {
				signed int _v0;
				signed int _v12;
				intOrPtr* _v20;
				intOrPtr _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t23;
				intOrPtr _t26;
				intOrPtr _t34;
				intOrPtr* _t37;
				void* _t38;
				intOrPtr _t39;
				intOrPtr _t41;
				intOrPtr* _t42;
				intOrPtr _t44;
				void* _t48;
				void* _t51;
				intOrPtr _t52;
				intOrPtr* _t55;
				signed int _t57;

				_t48 = __edx;
				_t23 = _a4;
				_t42 = 0;
				if(_t23 == 0) {
					L3:
					return _t42;
				} else {
					if(_t23 > 0x3fffffff) {
						L4:
						E00B5CBE6();
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t38);
						_push(_t51);
						_t55 = _t42;
						_v20 = _t55;
						_t26 = E00B4C4F6(_t38, _t48, _t51, _t55, _v0);
						_push(_v28);
						_t39 = _t26;
						_push(_t42);
						_push(_t42);
						_v24 = _t39;
						E00B4EDA9( *_t55,  *((intOrPtr*)(_t55 + 4)), _t39);
						_t44 =  *((intOrPtr*)(_t55 + 4));
						_t52 =  *_t55;
						asm("cdq");
						_v12 = 0xb8;
						_v28 = (_t44 - _t52) / _v12;
						if(_t52 != 0) {
							if(_t52 != _t44) {
								_t57 = _v12;
								_t41 = _t44;
								do {
									E00B49CF3(_t52);
									_t52 = _t52 + _t57;
								} while (_t52 != _t41);
								_t55 = _v20;
								_t39 = _v24;
							}
							__imp__??3@YAXPAX@Z( *_t55);
						}
						 *_t55 = _t39;
						 *((intOrPtr*)(_t55 + 8)) = _v0 * 0xb8 + _t39;
						_t34 = _v28 * 0xb8 + _t39;
						 *((intOrPtr*)(_t55 + 4)) = _t34;
						return _t34;
					} else {
						_push(_t23 << 2); // executed
						_t37 = E00B5CA2B(); // executed
						_t42 = _t37;
						if(_t42 == 0) {
							goto L4;
						} else {
							goto L3;
						}
					}
				}
			}

0x00b4ebcd
0x00b4ebd2
0x00b4ebd5
0x00b4ebd9
0x00b4ebf2
0x00b4ebf5
0x00b4ebdb
0x00b4ebe0
0x00b4ebf8
0x00b4ebf8
0x00b4ebfd
0x00b4ebfe
0x00b4ebff
0x00b4ec00
0x00b4ec01
0x00b4ec02
0x00b4ec0b
0x00b4ec0d
0x00b4ec11
0x00b4ec13
0x00b4ec16
0x00b4ec1b
0x00b4ec21
0x00b4ec23
0x00b4ec24
0x00b4ec28
0x00b4ec2b
0x00b4ec30
0x00b4ec35
0x00b4ec39
0x00b4ec3a
0x00b4ec44
0x00b4ec49
0x00b4ec4d
0x00b4ec4f
0x00b4ec52
0x00b4ec54
0x00b4ec56
0x00b4ec5b
0x00b4ec5d
0x00b4ec61
0x00b4ec64
0x00b4ec64
0x00b4ec69
0x00b4ec6f
0x00b4ec78
0x00b4ec7c
0x00b4ec86
0x00b4ec88
0x00b4ec90
0x00b4ebe2
0x00b4ebe5
0x00b4ebe6
0x00b4ebec
0x00b4ebf0
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4ebf0
0x00b4ebe0

APIs

std::tr1::_Xmem.LIBCPMT ref: 00B4EBF8

Part of subcall function 00B5CA2B: malloc.MSVCRT ref: 00B5CA42

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: Xmemmallocstd::tr1::_
String ID:
API String ID: 257571584-0
Opcode ID: f0ad478dba8e2f6475ea0f60988791a944f8e226c44f4ae9953444f3b242845a
Instruction ID: 3a04138fe3db34274c1a1ea43dea7ff4b97f13270a6d458ba0c9b7d5d9185231
Opcode Fuzzy Hash: f0ad478dba8e2f6475ea0f60988791a944f8e226c44f4ae9953444f3b242845a
Instruction Fuzzy Hash: F3D05E7130832A076F28666D545692E36C9DA8877135445BAB937CA580DD20DE019119

Uniqueness

Uniqueness Score: -1.00%

Function 00B49D40 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B49D40(char* _a4, void* _a8) {
				int _t3;

				_t3 = vprintf(_a4, _a8); // executed
				return _t3;
			}

0x00b49d4b
0x00b49d54

APIs

vprintf.MSVCRT ref: 00B49D4B

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: vprintf
String ID:
API String ID: 1895932477-0
Opcode ID: 842d0c5b7cbeb229d3b0fa8cfb1308379e192f2ecf570ba17314a1bfda869501
Instruction ID: 82908733af9e68c63c985f0517b874a08f4bb206d7582585283ebd34c397d16e
Opcode Fuzzy Hash: 842d0c5b7cbeb229d3b0fa8cfb1308379e192f2ecf570ba17314a1bfda869501
Instruction Fuzzy Hash: 98C09B3300C20CBF9B051F41FC05C8A7F59E7953717118016F518050609F73A565D754

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B4D640 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 167
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E00B4D640(intOrPtr _a4, intOrPtr _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed int _t23;
				signed char _t38;
				signed char _t39;
				char _t53;
				intOrPtr* _t55;
				char _t56;
				signed int _t58;
				void* _t62;

				_t55 = _a4 + 1;
				_t53 =  *_t55;
				if(_t53 != 0) {
					__eflags = _t53 - 0x67;
					if(_t53 != 0x67) {
						L4:
						_v16 = _v16 & 0x00000000;
						_t39 = 0;
						_t23 = 2;
						_t58 = 0;
						_v12 = _t23;
						_v5 = 0;
						_t38 = 0;
						__eflags = 0;
						do {
							__eflags = _t53 - 0x30;
							if(_t53 < 0x30) {
								L8:
								__eflags = _t53 - 0x67;
								if(_t53 != 0x67) {
									__eflags = _t53 - 0x2c;
									if(_t53 != 0x2c) {
										_t38 = 0;
										__eflags = 0;
										L20:
										__eflags = _t38;
										if(_t38 == 0) {
											L25:
											__eflags = _v5;
											if(_v5 != 0) {
												L27:
												_t38 = 0;
												__eflags = 0;
												L28:
												__eflags = _t38;
												if(_t38 == 0) {
													L32:
													__eflags =  *_t55;
													if( *_t55 == 0) {
														_push("ERROR: incomplete affinity specification\n");
														L38:
														fprintf(E00B5D7CD(_t23, 2), ??);
														__eflags = _t38;
														if(_t38 == 0) {
															L40:
															return _t38;
														}
														L39:
														E00B4CA4A(_a8, _v16, _t58);
														goto L40;
													}
													_push(_a4);
													_t23 = fprintf(E00B5D7CD(_t23, 2), "ERROR: syntax error parsing affinity at highlighted character\n-%s\n");
													_t56 = _v12;
													__eflags = _t56;
													if(_t56 == 0) {
														L35:
														_push("^\n");
														goto L38;
													} else {
														goto L34;
													}
													do {
														L34:
														_t23 = fprintf(E00B5D7CD(_t23, 2), " ");
														_t56 = _t56 - 1;
														__eflags = _t56;
													} while (_t56 != 0);
													goto L35;
												}
												__eflags = _t58 - 0xff;
												if(_t58 > 0xff) {
													_push(_t58);
													_t23 = fprintf(E00B5D7CD(_t23, 2), "ERROR: core %u is out of range\n");
													_t62 = _t62 + 0xc;
													_t38 = 0;
													__eflags = 0;
												}
												__eflags = _t38;
												if(_t38 != 0) {
													goto L39;
												} else {
													goto L32;
												}
											}
											L26:
											__eflags = _t38;
											if(_t38 != 0) {
												goto L28;
											}
											goto L27;
										}
										goto L21;
									}
									__eflags = _t39;
									if(_t39 == 0) {
										__eflags = _t38;
										if(_t38 == 0) {
											L24:
											_t38 = 0;
											__eflags = 0;
											goto L25;
										}
										_push(_t58);
										__eflags = _t58 - 0xff;
										if(_t58 > 0xff) {
											_t23 = fprintf(E00B5D7CD(_t23, 2), "ERROR: core %u is out of range\n");
											_t62 = _t62 + 0xc;
											_t38 = 0;
											goto L26;
										}
										_push(_v16);
										E00B4CA4A(_a8);
										_t58 = 0;
										_t38 = 0;
										__eflags = 0;
										L18:
										_t23 = _v12;
										_t39 = _v5;
										goto L20;
									}
									__eflags = _t38;
									if(_t38 == 0) {
										goto L24;
									}
									__eflags = _t58 - 0xffff;
									if(_t58 > 0xffff) {
										_push(_t58);
										_t23 = fprintf(E00B5D7CD(_t23, 2), "ERROR: group %u is out of range\n");
										_t62 = _t62 + 0xc;
										goto L24;
									}
									_v16 = _t58;
									_t58 = 0;
									_t39 = 0;
									_v5 = 0;
									goto L20;
								}
								__eflags = _t39;
								_t39 = 1;
								_v5 = 1;
								_t38 = _t38 & (_t23 & 0xffffff00 | __eflags != 0x00000000) - 0x00000001;
								_t23 = _v12;
								goto L20;
							}
							__eflags = _t53 - 0x39;
							if(_t53 > 0x39) {
								goto L8;
							}
							_t38 = 1;
							_t58 = _t53 + 0xffffffd0 + _t58 * 0xa;
							goto L18;
							L21:
							_t55 = _t55 + 1;
							_t23 = _t23 + 1;
							_v12 = _t23;
							_t53 =  *_t55;
							__eflags = _t53;
						} while (_t53 != 0);
						goto L25;
					}
					__eflags =  *((char*)(_t55 + 1));
					if( *((char*)(_t55 + 1)) == 0) {
						goto L1;
					}
					goto L4;
				}
				L1:
				return 1;
			}

0x00b4d64f
0x00b4d650
0x00b4d654
0x00b4d65d
0x00b4d660
0x00b4d668
0x00b4d668
0x00b4d66c
0x00b4d671
0x00b4d672
0x00b4d674
0x00b4d677
0x00b4d67a
0x00b4d67a
0x00b4d67c
0x00b4d67c
0x00b4d67f
0x00b4d695
0x00b4d695
0x00b4d698
0x00b4d6ad
0x00b4d6b0
0x00b4d6f6
0x00b4d6f6
0x00b4d6f8
0x00b4d6f8
0x00b4d6fa
0x00b4d727
0x00b4d727
0x00b4d72b
0x00b4d731
0x00b4d731
0x00b4d731
0x00b4d733
0x00b4d733
0x00b4d735
0x00b4d761
0x00b4d761
0x00b4d764
0x00b4d7c7
0x00b4d7cc
0x00b4d7d5
0x00b4d7dd
0x00b4d7df
0x00b4d7ed
0x00000000
0x00b4d7ef
0x00b4d7e1
0x00b4d7e8
0x00000000
0x00b4d7e8
0x00b4d766
0x00b4d777
0x00b4d77d
0x00b4d783
0x00b4d785
0x00b4d7a2
0x00b4d7a2
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4d787
0x00b4d787
0x00b4d795
0x00b4d79d
0x00b4d79d
0x00b4d79d
0x00000000
0x00b4d787
0x00b4d737
0x00b4d73d
0x00b4d73f
0x00b4d74e
0x00b4d754
0x00b4d757
0x00b4d757
0x00b4d757
0x00b4d759
0x00b4d75b
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4d75b
0x00b4d72d
0x00b4d72d
0x00b4d72f
0x00000000
0x00000000
0x00000000
0x00b4d72f
0x00000000
0x00b4d6fa
0x00b4d6b2
0x00b4d6b4
0x00b4d6ce
0x00b4d6d0
0x00b4d725
0x00b4d725
0x00b4d725
0x00000000
0x00b4d725
0x00b4d6d2
0x00b4d6d3
0x00b4d6d9
0x00b4d7b7
0x00b4d7bd
0x00b4d7c0
0x00000000
0x00b4d7c0
0x00b4d6df
0x00b4d6e5
0x00b4d6ea
0x00b4d6ec
0x00b4d6ec
0x00b4d6ee
0x00b4d6ee
0x00b4d6f1
0x00000000
0x00b4d6f1
0x00b4d6b6
0x00b4d6b8
0x00000000
0x00000000
0x00b4d6ba
0x00b4d6c0
0x00b4d70d
0x00b4d71c
0x00b4d722
0x00000000
0x00b4d722
0x00b4d6c2
0x00b4d6c5
0x00b4d6c7
0x00b4d6c9
0x00000000
0x00b4d6c9
0x00b4d69a
0x00b4d69c
0x00b4d69e
0x00b4d6a6
0x00b4d6a8
0x00000000
0x00b4d6a8
0x00b4d681
0x00b4d684
0x00000000
0x00000000
0x00b4d689
0x00b4d691
0x00000000
0x00b4d6fc
0x00b4d6fc
0x00b4d6fd
0x00b4d6fe
0x00b4d701
0x00b4d703
0x00b4d703
0x00000000
0x00b4d70b
0x00b4d662
0x00b4d666
0x00000000
0x00000000
0x00000000
0x00b4d666
0x00b4d656
0x00000000

APIs

fprintf.MSVCRT ref: 00B4D74E
fprintf.MSVCRT ref: 00B4D777
fprintf.MSVCRT ref: 00B4D795
fprintf.MSVCRT ref: 00B4D7D5

Strings

ERROR: core %u is out of range, xrefs: 00B4D740, 00B4D7A9
ERROR: incomplete affinity specification, xrefs: 00B4D7C7
ERROR: syntax error parsing affinity at highlighted character-%s, xrefs: 00B4D769
ERROR: group %u is out of range, xrefs: 00B4D70E

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: fprintf
String ID: ERROR: core %u is out of range$ERROR: group %u is out of range$ERROR: incomplete affinity specification$ERROR: syntax error parsing affinity at highlighted character-%s
API String ID: 383729395-1019511092
Opcode ID: b4ae4e3101e20f0964598dadbd7b652ff2bdeba0506fac28933a38591b883a77
Instruction ID: 34ff99032d328b8f5471932fa528a33dcaf4109ff27ef4660be4df24c98f35b9
Opcode Fuzzy Hash: b4ae4e3101e20f0964598dadbd7b652ff2bdeba0506fac28933a38591b883a77
Instruction Fuzzy Hash: 60412831A44254AFEB205B64E89E7EE6BE4CF02750F1841D9EC58672D3D9760F48EA81

Uniqueness

Uniqueness Score: -1.00%

Function 00B51085 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 95
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00B51085(void* __ebx, void* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v28;
				void _v32;
				long _v36;
				struct _OVERLAPPED _v56;
				void* __edi;
				void* __esi;
				signed int _t21;
				void* _t24;
				void* _t30;
				long _t35;
				void* _t41;
				void* _t52;
				signed int _t54;

				_t42 = __ecx;
				_t41 = __ebx;
				_t21 =  *0xb61000; // 0xba7e72c4
				_v8 = _t21 ^ _t54;
				asm("stosd");
				_t52 = __ecx;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t24 = CreateEventA(0, 0, 0, 0);
				_v56.hEvent = _t24;
				if(_t24 != 0) {
					_v36 = 0;
					_t52 = DeviceIoControl(_t52, 0x70000, 0, 0,  &_v32, 0x18,  &_v36,  &_v56);
					if(_t52 == 0) {
						_t35 = GetLastError();
						if(_t35 != 0x3e5) {
							_push(_t35);
							_push("ERROR: Could not obtain drive geometry (error code: %u)\n");
							goto L9;
						} else {
							if(WaitForSingleObject(_v56.hEvent, 0xffffffff) == 0) {
								_t52 = 1;
							} else {
								_push(GetLastError());
								_push("ERROR: Failed while waiting for event to be signaled (error code: %u)\n");
								L9:
								E00B51330(_t42);
							}
						}
					}
					CloseHandle(_v56.hEvent);
					if(_t52 == 0) {
						goto L2;
					} else {
						_t32 = _v20;
						_t49 = _v20 * _v16 >> 0x20;
						_t30 = E00B5D9C0(E00B5D9C0(_t32 * _v16, _v20 * _v16 >> 0x20, _v12, 0), _v20 * _v16 >> 0x20, _v32, _v28);
					}
				} else {
					E00B51330(_t42, "ERROR: Failed to create event (error code: %u)\n", GetLastError());
					L2:
					_t30 = 0;
					_t49 = 0;
				}
				return E00B5CFA0(_t30, _t41, _v8 ^ _t54, _t49, 0, _t52);
			}

0x00b51085
0x00b51085
0x00b5108d
0x00b51094
0x00b5109e
0x00b5109f
0x00b510a1
0x00b510a2
0x00b510a3
0x00b510a4
0x00b510ab
0x00b510b1
0x00b510b6
0x00b510d7
0x00b510f3
0x00b510f7
0x00b510f9
0x00b51104
0x00b51128
0x00b51129
0x00000000
0x00b51106
0x00b51113
0x00b51125
0x00b51115
0x00b5111b
0x00b5111c
0x00b5112e
0x00b5112e
0x00b51134
0x00b51113
0x00b51104
0x00b51138
0x00b51140
0x00000000
0x00b51142
0x00b51142
0x00b51145
0x00b5115b
0x00b5115b
0x00b510b8
0x00b510c4
0x00b510cb
0x00b510cb
0x00b510cd
0x00b510cd
0x00b5116f

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00B510AB
GetLastError.KERNEL32 ref: 00B510B8
DeviceIoControl.KERNEL32(?,00070000,00000000,00000000,00000001,00000018,?,?), ref: 00B510ED
GetLastError.KERNEL32 ref: 00B510F9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B5110B
GetLastError.KERNEL32 ref: 00B51115
CloseHandle.KERNEL32(?), ref: 00B51138

Strings

ERROR: Could not obtain drive geometry (error code: %u), xrefs: 00B51129
ERROR: Failed to create event (error code: %u), xrefs: 00B510BF
ERROR: Failed while waiting for event to be signaled (error code: %u), xrefs: 00B5111C

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceEventHandleObjectSingleWait
String ID: ERROR: Could not obtain drive geometry (error code: %u)$ERROR: Failed to create event (error code: %u)$ERROR: Failed while waiting for event to be signaled (error code: %u)
API String ID: 3935222316-3021154126
Opcode ID: 5acd5bf7bd95db1c3163270169f1034d1121b5f675129ec80b14c8d7e733d099
Instruction ID: 602e324cf8301e8e9f315d925c06e12cc04c0a5e31d698db1987dc0749143e54
Opcode Fuzzy Hash: 5acd5bf7bd95db1c3163270169f1034d1121b5f675129ec80b14c8d7e733d099
Instruction Fuzzy Hash: AD21D632900544BFAB219BA9DC09FBFBBFEEB88712B1005D9FD01E31A0DE654D04CA65

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D498 Relevance: 7.6, APIs: 5, Instructions: 53
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B5D498() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t35;
				signed int _t36;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0xb61000; // 0xba7e72c4
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t35 = _v20 ^ _v24.LowPart;
					_t39 = _v8 ^ _t35;
					if(_t39 == 0xbb40e64e || ( *0xb61000 & 0xffff0000) == 0) {
						_t39 = 0xbb40e64f;
					}
					 *0xb61000 = _t39;
					 *0xb61004 =  !_t39;
					return _t35;
				} else {
					_t36 =  !_t23;
					 *0xb61004 = _t36;
					return _t36;
				}
			}

0x00b5d4a0
0x00b5d4a4
0x00b5d4a8
0x00b5d4bb
0x00b5d4ce
0x00b5d4da
0x00b5d4e3
0x00b5d4ec
0x00b5d4fd
0x00b5d504
0x00b5d50d
0x00b5d513
0x00b5d517
0x00b5d521
0x00b5d521
0x00b5d526
0x00b5d52e
0x00000000
0x00b5d4c1
0x00b5d4c1
0x00b5d4c3
0x00000000
0x00b5d4c3

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00B5D4CE
GetCurrentProcessId.KERNEL32 ref: 00B5D4DD
GetCurrentThreadId.KERNEL32 ref: 00B5D4E6
GetTickCount.KERNEL32 ref: 00B5D4EF
QueryPerformanceCounter.KERNEL32(?), ref: 00B5D504

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: eafc05e30a9174b2fad442f5d22c87a24b5b83e510167461b4cb6061c7da7714
Instruction ID: 556f5aefa8778a35acc9dda1dd4638df0d4e059c2dc4fd65f88030d98bc08a95
Opcode Fuzzy Hash: eafc05e30a9174b2fad442f5d22c87a24b5b83e510167461b4cb6061c7da7714
Instruction Fuzzy Hash: D4115B71D06208EBCF10CFB8E9586AEB7F4FF18352F55499AD806D7290EB749A44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B5D5FA Relevance: 6.0, APIs: 4, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B5D5FA(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00b5d601
0x00b5d60a
0x00b5d623

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00B5D735,00B41E98), ref: 00B5D601
UnhandledExceptionFilter.KERNEL32(00B5D735,?,00B5D735,00B41E98), ref: 00B5D60A
GetCurrentProcess.KERNEL32(C0000409,?,00B5D735,00B41E98), ref: 00B5D615
TerminateProcess.KERNEL32(00000000,?,00B5D735,00B41E98), ref: 00B5D61C

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 54a45dd30692cc6af2a61dbee32a09a6a6692aca20693a401b5f937c0100457d
Instruction ID: beea2990524e45a73226a52ce39aafc450ff4cd4a8023935722b7da46849a484
Opcode Fuzzy Hash: 54a45dd30692cc6af2a61dbee32a09a6a6692aca20693a401b5f937c0100457d
Instruction Fuzzy Hash: 2ED0C972004504BBE7002BE1EC0CA593E29EB44252F048401F70A830A0CEB94441CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B4CEC4 Relevance: 436.0, APIs: 130, Strings: 119, Instructions: 281
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00B4CEC4(char* _a4) {
				char* _t135;
				char* _t136;
				void* _t137;
				intOrPtr* _t138;
				intOrPtr* _t140;

				_t135 = "\n";
				printf(_t135);
				printf("Usage: %s [options] target1 [ target2 [ target3 ...] ]\n");
				printf("version %s (%s)\n");
				printf(_t135);
				printf("Available targets:\n");
				printf("       file_path\n");
				printf("       #<physical drive number>\n");
				printf("       <partition_drive_letter>:\n");
				printf(_t135);
				printf("Available options:\n");
				printf("  -?                    display usage information\n");
				printf("  -ag                   group affinity - affinitize threads round-robin to cores in Processor Groups 0 - n.\n");
				printf("                          Group 0 is filled before Group 1, and so forth.\n");
				_t138 = _t137 + 0x40;
				printf("                          [default; use -n to disable default affinity]\n");
				 *_t138 = "  -ag#,#[,#,...]>       advanced CPU affinity - affinitize threads round-robin to the CPUs provided. The g# notation\n";
				printf("2.0.17a");
				 *_t138 = "                          specifies Processor Groups for the following CPU core #s. Multiple Processor Groups\n";
				printf("2016/5/01");
				 *_t138 = "                          may be specified, and groups/cores may be repeated. If no group is specified, 0 is assumed.\n";
				printf(_a4);
				 *_t138 = "                          Additional groups/processors may be added, comma separated, or on separate parameters.\n";
				printf(??);
				 *_t138 = "                          Examples: -a0,1,2 and -ag0,0,1,2 are equivalent.\n";
				printf(??);
				 *_t138 = "                                    -ag0,0,1,2,g1,0,1,2 specifies the first three cores in groups 0 and 1.\n";
				printf(??);
				 *_t138 = "                                    -ag0,0,1,2 -ag1,0,1,2 is equivalent.\n";
				printf(??);
				 *_t138 = "  -b<size>[K|M|G]       block size in bytes or KiB/MiB/GiB [default=64K]\n";
				printf(??);
				 *_t138 = "  -B<offs>[K|M|G|b]     base target offset in bytes or KiB/MiB/GiB/blocks [default=0]\n";
				printf(??);
				 *_t138 = "                          (offset from the beginning of the file)\n";
				printf(??);
				 *_t138 = "  -c<size>[K|M|G|b]     create files of the given size.\n";
				printf(??);
				 *_t138 = "                          Size can be stated in bytes or KiB/MiB/GiB/blocks\n";
				printf(??);
				 *_t138 = "  -C<seconds>           cool down time - duration of the test after measurements finished [default=0s].\n";
				printf(??);
				 *_t138 = "  -D<milliseconds>      Capture IOPs statistics in intervals of <milliseconds>; these are per-thread\n";
				printf(??);
				 *_t138 = "                          per-target: text output provides IOPs standard deviation, XML provides the full\n";
				printf(??);
				 *_t138 = "                          IOPs time series in addition. [default=1000, 1 second].\n";
				printf(??);
				 *_t138 = "  -d<seconds>           duration (in seconds) to run test [default=10s]\n";
				printf(??);
				 *_t138 = "  -f<size>[K|M|G|b]     target size - use only the first <size> bytes or KiB/MiB/GiB/blocks of the file/disk/partition,\n";
				printf(??);
				 *_t138 = "                          for example to test only the first sectors of a disk\n";
				printf(??);
				 *_t138 = "  -f<rst>               open file with one or more additional access hints\n";
				printf(??);
				 *_t138 = "                          r : the FILE_FLAG_RANDOM_ACCESS hint\n";
				printf(??);
				 *_t138 = "                          s : the FILE_FLAG_SEQUENTIAL_SCAN hint\n";
				printf(??);
				 *_t138 = "                          t : the FILE_ATTRIBUTE_TEMPORARY hint\n";
				printf(??);
				 *_t138 = "                          [default: none]\n";
				printf(??);
				 *_t138 = "  -F<count>             total number of threads (conflicts with -t)\n";
				printf(??);
				 *_t138 = "  -g<bytes per ms>      throughput per-thread per-target throttled to given bytes per millisecond\n";
				printf(??);
				 *_t138 = "                          note that this can not be specified when using completion routines\n";
				printf(??);
				 *_t138 = "                          [default inactive]\n";
				printf(??);
				 *_t138 = "  -h                    deprecated, see -Sh\n";
				printf(??);
				 *_t138 = "  -i<count>             number of IOs per burst; see -j [default: inactive]\n";
				printf(??);
				 *_t138 = "  -j<milliseconds>      interval in <milliseconds> between issuing IO bursts; see -i [default: inactive]\n";
				printf(??);
				 *_t138 = "  -I<priority>          Set IO priority to <priority>. Available values are: 1-very low, 2-low, 3-normal (default)\n";
				printf(??);
				 *_t138 = "  -l                    Use large pages for IO buffers\n";
				printf(??);
				 *_t138 = "  -L                    measure latency statistics\n";
				printf(??);
				 *_t138 = "  -n                    disable default affinity (-a)\n";
				printf(??);
				 *_t138 = "  -o<count>             number of outstanding I/O requests per target per thread\n";
				printf(??);
				 *_t138 = "                          (1=synchronous I/O, unless more than 1 thread is specified with -F)\n";
				printf(??);
				 *_t138 = "                          [default=2]\n";
				printf(??);
				 *_t138 = "  -p                    start parallel sequential I/O operations with the same offset\n";
				printf(??);
				 *_t138 = "                          (ignored if -r is specified, makes sense only with -o2 or greater)\n";
				printf(??);
				 *_t138 = "  -P<count>             enable printing a progress dot after each <count> [default=65536]\n";
				printf(??);
				 *_t138 = "                          completed I/O operations, counted separately by each thread \n";
				printf(??);
				 *_t138 = "  -r<align>[K|M|G|b]    random I/O aligned to <align> in bytes/KiB/MiB/GiB/blocks (overrides -s)\n";
				printf(??);
				 *_t138 = "  -R<text|xml>          output format. Default is text.\n";
				printf(??);
				 *_t138 = "  -s[i]<size>[K|M|G|b]  sequential stride size, offset between subsequent I/O operations\n";
				printf(??);
				 *_t138 = "                          [default access=non-interlocked sequential, default stride=block size]\n";
				printf(??);
				 *_t138 = "                          In non-interlocked mode, threads do not coordinate, so the pattern of offsets\n";
				printf(??);
				 *_t138 = "                          as seen by the target will not be truly sequential.  Under -si the threads\n";
				printf(??);
				 *_t138 = "                          manipulate a shared offset with InterlockedIncrement, which may reduce throughput,\n";
				printf(??);
				 *_t138 = "                          but promotes a more sequential pattern.\n";
				printf(??);
				 *_t138 = "                          (ignored if -r specified, -si conflicts with -T and -p)\n";
				printf(??);
				 *_t138 = "  -S[bhruw]             control caching behavior [default: caching is enabled, no writethrough]\n";
				printf(??);
				 *_t138 = "                          non-conflicting flags may be combined in any order; ex: -Sbw, -Suw, -Swu\n";
				printf(??);
				 *_t138 = "  -S                    equivalent to -Su\n";
				printf(??);
				 *_t138 = "  -Sb                   enable caching (default, explicitly stated)\n";
				printf(??);
				 *_t138 = "  -Sh                   equivalent -Suw\n";
				printf(??);
				 *_t138 = "  -Su                   disable software caching, equivalent to FILE_FLAG_NO_BUFFERING\n";
				printf(??);
				 *_t138 = "  -Sr                   disable local caching, with remote sw caching enabled; only valid for remote filesystems\n";
				printf(??);
				 *_t138 = "  -Sw                   enable writethrough (no hardware write caching), equivalent to FILE_FLAG_WRITE_THROUGH\n";
				printf(??);
				 *_t138 = "  -t<count>             number of threads per target (conflicts with -F)\n";
				printf(??);
				 *_t138 = "  -T<offs>[K|M|G|b]     starting stride between I/O operations performed on the same target by different threads\n";
				printf(??);
				 *_t138 = "                          [default=0] (starting offset = base file offset + (thread number * <offs>)\n";
				printf(??);
				 *_t138 = "                          makes sense only with #threads > 1\n";
				printf(??);
				 *_t138 = "  -v                    verbose mode\n";
				printf(??);
				 *_t138 = "  -w<percentage>        percentage of write requests (-w and -w0 are equivalent and result in a read-only workload).\n";
				printf(??);
				 *_t138 = "                        absence of this switch indicates 100%% reads\n";
				printf(??);
				 *_t138 = "                          IMPORTANT: a write test will destroy existing data without a warning\n";
				printf(??);
				 *_t138 = "  -W<seconds>           warm up time - duration of the test before measurements start [default=5s]\n";
				printf(??);
				 *_t138 = "  -x                    use completion routines instead of I/O Completion Ports\n";
				printf(??);
				 *_t138 = "  -X<filepath>          use an XML file for configuring the workload. Cannot be used with other parameters.\n";
				printf(??);
				 *_t138 = "  -z[seed]              set random seed [with no -z, seed=0; with plain -z, seed is based on system run time]\n";
				printf(??);
				printf(_t135);
				printf("Write buffers:\n");
				printf("  -Z                        zero buffers used for write tests\n");
				printf("  -Z<size>[K|M|G|b]         use a <size> buffer filled with random data as a source for write operations.\n");
				printf("  -Z<size>[K|M|G|b],<file>  use a <size> buffer filled with data from <file> as a source for write operations.\n");
				printf(_t135);
				printf("  By default, the write buffers are filled with a repeating pattern (0, 1, 2, ..., 255, 0, 1, ...)\n");
				printf(_t135);
				printf("Synchronization:\n");
				printf("  -ys<eventname>     signals event <eventname> before starting the actual run (no warmup)\n");
				_t136 = "                       (creates a notification event if <eventname> does not exist)\n";
				printf(_t136);
				printf("  -yf<eventname>     signals event <eventname> after the actual run finishes (no cooldown)\n");
				printf(_t136);
				printf("  -yr<eventname>     waits on event <eventname> before starting the run (including warmup)\n");
				printf(_t136);
				printf("  -yp<eventname>     stops the run when event <eventname> is set; CTRL+C is bound to this event\n");
				printf(_t136);
				printf("  -ye<eventname>     sets event <eventname> and quits\n");
				printf(_t135);
				printf("Event Tracing:\n");
				printf("  -e<q|c|s>             Use query perf timer (qpc), cycle count, or system timer respectively.\n");
				printf("                          [default = q, query perf timer (qpc)]\n");
				printf("  -ep                   use paged memory for the NT Kernel Logger [default=non-paged memory]\n");
				printf("  -ePROCESS             process start & end\n");
				printf("  -eTHREAD              thread start & end\n");
				printf("  -eIMAGE_LOAD          image load\n");
				printf("  -eDISK_IO             physical disk IO\n");
				printf("  -eMEMORY_PAGE_FAULTS  all page faults\n");
				printf("  -eMEMORY_HARD_FAULTS  hard faults only\n");
				printf("  -eNETWORK             TCP/IP, UDP/IP send & receive\n");
				printf("  -eREGISTRY            registry calls\n");
				_t140 = _t138 + 0x80;
				printf("\n\n");
				 *_t140 = "Examples:\n\n";
				printf(??);
				 *_t140 = "Create 8192KB file and run read test on it for 1 second:\n\n";
				printf(??);
				_push(_a4);
				printf("  %s -c8192K -d1 testfile.dat\n");
				printf(_t135);
				printf("Set block size to 4KB, create 2 threads per file, 32 overlapped (outstanding)\n");
				printf("I/O operations per thread, disable all caching mechanisms and run block-aligned random\n");
				printf("access read test lasting 10 seconds:\n\n");
				_push(_a4);
				printf("  %s -b4K -t2 -r -o32 -d10 -h testfile.dat\n\n");
				printf("Create two 1GB files, set block size to 4KB, create 2 threads per file, affinitize threads\n");
				printf("to CPUs 0 and 1 (each file will have threads affinitized to both CPUs) and run read test\n");
				printf("lasting 10 seconds:\n\n");
				_push(_a4);
				printf("  %s -c1G -b4K -t2 -d10 -a0,1 testfile1.dat testfile2.dat\n");
				return printf(_t135);
			}

0x00b4cecb
0x00b4ced1
0x00b4cedf
0x00b4cef4
0x00b4cefb
0x00b4cf06
0x00b4cf11
0x00b4cf1c
0x00b4cf27
0x00b4cf2e
0x00b4cf39
0x00b4cf44
0x00b4cf4f
0x00b4cf5a
0x00b4cf60
0x00b4cf68
0x00b4cf6e
0x00b4cf75
0x00b4cf7b
0x00b4cf82
0x00b4cf88
0x00b4cf8f
0x00b4cf95
0x00b4cf9c
0x00b4cfa2
0x00b4cfa9
0x00b4cfaf
0x00b4cfb6
0x00b4cfbc
0x00b4cfc3
0x00b4cfc9
0x00b4cfd0
0x00b4cfd6
0x00b4cfdd
0x00b4cfe3
0x00b4cfea
0x00b4cff0
0x00b4cff7
0x00b4cffd
0x00b4d004
0x00b4d00a
0x00b4d011
0x00b4d017
0x00b4d01e
0x00b4d024
0x00b4d02b
0x00b4d031
0x00b4d038
0x00b4d03e
0x00b4d045
0x00b4d04b
0x00b4d052
0x00b4d058
0x00b4d05f
0x00b4d065
0x00b4d06c
0x00b4d072
0x00b4d079
0x00b4d07f
0x00b4d086
0x00b4d08c
0x00b4d093
0x00b4d099
0x00b4d0a0
0x00b4d0a6
0x00b4d0ad
0x00b4d0b3
0x00b4d0ba
0x00b4d0c0
0x00b4d0c7
0x00b4d0cd
0x00b4d0d4
0x00b4d0da
0x00b4d0e1
0x00b4d0e7
0x00b4d0ee
0x00b4d0f4
0x00b4d0fb
0x00b4d101
0x00b4d108
0x00b4d10e
0x00b4d115
0x00b4d11b
0x00b4d122
0x00b4d128
0x00b4d12f
0x00b4d135
0x00b4d13c
0x00b4d142
0x00b4d149
0x00b4d14f
0x00b4d156
0x00b4d15c
0x00b4d163
0x00b4d169
0x00b4d170
0x00b4d176
0x00b4d17d
0x00b4d183
0x00b4d18a
0x00b4d190
0x00b4d197
0x00b4d19d
0x00b4d1a4
0x00b4d1aa
0x00b4d1b1
0x00b4d1b7
0x00b4d1be
0x00b4d1c4
0x00b4d1cb
0x00b4d1d1
0x00b4d1d8
0x00b4d1de
0x00b4d1e5
0x00b4d1eb
0x00b4d1f2
0x00b4d1f8
0x00b4d1ff
0x00b4d205
0x00b4d20c
0x00b4d212
0x00b4d219
0x00b4d21f
0x00b4d226
0x00b4d22c
0x00b4d233
0x00b4d239
0x00b4d240
0x00b4d246
0x00b4d24d
0x00b4d253
0x00b4d25a
0x00b4d260
0x00b4d267
0x00b4d26d
0x00b4d274
0x00b4d27a
0x00b4d281
0x00b4d287
0x00b4d28e
0x00b4d294
0x00b4d29b
0x00b4d2a1
0x00b4d2a8
0x00b4d2ae
0x00b4d2b5
0x00b4d2bb
0x00b4d2c2
0x00b4d2c8
0x00b4d2cf
0x00b4d2d5
0x00b4d2dc
0x00b4d2e2
0x00b4d2e9
0x00b4d2ef
0x00b4d2f6
0x00b4d2fc
0x00b4d303
0x00b4d30a
0x00b4d315
0x00b4d320
0x00b4d32b
0x00b4d336
0x00b4d33d
0x00b4d348
0x00b4d34f
0x00b4d35a
0x00b4d365
0x00b4d36b
0x00b4d371
0x00b4d37c
0x00b4d383
0x00b4d38e
0x00b4d395
0x00b4d3a3
0x00b4d3aa
0x00b4d3b5
0x00b4d3bc
0x00b4d3c7
0x00b4d3d2
0x00b4d3dd
0x00b4d3e8
0x00b4d3f3
0x00b4d3fe
0x00b4d409
0x00b4d414
0x00b4d41f
0x00b4d42a
0x00b4d435
0x00b4d440
0x00b4d446
0x00b4d44e
0x00b4d454
0x00b4d45b
0x00b4d461
0x00b4d468
0x00b4d46e
0x00b4d476
0x00b4d47d
0x00b4d488
0x00b4d493
0x00b4d49e
0x00b4d4a4
0x00b4d4ac
0x00b4d4b7
0x00b4d4c2
0x00b4d4cd
0x00b4d4d3
0x00b4d4db
0x00b4d4ee

APIs

printf.MSVCRT ref: 00B4CED1
printf.MSVCRT ref: 00B4CEDF
printf.MSVCRT ref: 00B4CEF4
printf.MSVCRT ref: 00B4CEFB
printf.MSVCRT ref: 00B4CF06
printf.MSVCRT ref: 00B4CF11
printf.MSVCRT ref: 00B4CF1C
printf.MSVCRT ref: 00B4CF27
printf.MSVCRT ref: 00B4CF2E
printf.MSVCRT ref: 00B4CF39
printf.MSVCRT ref: 00B4CF44
printf.MSVCRT ref: 00B4CF4F
printf.MSVCRT ref: 00B4CF5A
printf.MSVCRT ref: 00B4CF68
printf.MSVCRT ref: 00B4CF75
printf.MSVCRT ref: 00B4CF82
printf.MSVCRT ref: 00B4CF8F
printf.MSVCRT ref: 00B4CF9C
printf.MSVCRT ref: 00B4CFA9
printf.MSVCRT ref: 00B4CFB6
printf.MSVCRT ref: 00B4CFC3
printf.MSVCRT ref: 00B4CFD0
printf.MSVCRT ref: 00B4CFDD
printf.MSVCRT ref: 00B4CFEA
printf.MSVCRT ref: 00B4CFF7
printf.MSVCRT ref: 00B4D004
printf.MSVCRT ref: 00B4D011
printf.MSVCRT ref: 00B4D01E
printf.MSVCRT ref: 00B4D02B
printf.MSVCRT ref: 00B4D038
printf.MSVCRT ref: 00B4D045
printf.MSVCRT ref: 00B4D052
printf.MSVCRT ref: 00B4D05F
printf.MSVCRT ref: 00B4D06C
printf.MSVCRT ref: 00B4D079
printf.MSVCRT ref: 00B4D086
printf.MSVCRT ref: 00B4D093
printf.MSVCRT ref: 00B4D0A0
printf.MSVCRT ref: 00B4D0AD
printf.MSVCRT ref: 00B4D0BA
printf.MSVCRT ref: 00B4D0C7
printf.MSVCRT ref: 00B4D0D4
printf.MSVCRT ref: 00B4D0E1
printf.MSVCRT ref: 00B4D0EE
printf.MSVCRT ref: 00B4D0FB
printf.MSVCRT ref: 00B4D108
printf.MSVCRT ref: 00B4D115
printf.MSVCRT ref: 00B4D122
printf.MSVCRT ref: 00B4D12F
printf.MSVCRT ref: 00B4D13C
printf.MSVCRT ref: 00B4D149
printf.MSVCRT ref: 00B4D156
printf.MSVCRT ref: 00B4D163
printf.MSVCRT ref: 00B4D170
printf.MSVCRT ref: 00B4D17D
printf.MSVCRT ref: 00B4D18A
printf.MSVCRT ref: 00B4D197
printf.MSVCRT ref: 00B4D1A4
printf.MSVCRT ref: 00B4D1B1
printf.MSVCRT ref: 00B4D1BE
printf.MSVCRT ref: 00B4D1CB
printf.MSVCRT ref: 00B4D1D8
printf.MSVCRT ref: 00B4D1E5
printf.MSVCRT ref: 00B4D1F2
printf.MSVCRT ref: 00B4D1FF
printf.MSVCRT ref: 00B4D20C
printf.MSVCRT ref: 00B4D219
printf.MSVCRT ref: 00B4D226
printf.MSVCRT ref: 00B4D233
printf.MSVCRT ref: 00B4D240
printf.MSVCRT ref: 00B4D24D
printf.MSVCRT ref: 00B4D25A
printf.MSVCRT ref: 00B4D267
printf.MSVCRT ref: 00B4D274
printf.MSVCRT ref: 00B4D281
printf.MSVCRT ref: 00B4D28E
printf.MSVCRT ref: 00B4D29B
printf.MSVCRT ref: 00B4D2A8
printf.MSVCRT ref: 00B4D2B5
printf.MSVCRT ref: 00B4D2C2
printf.MSVCRT ref: 00B4D2CF
printf.MSVCRT ref: 00B4D2DC
printf.MSVCRT ref: 00B4D2E9
printf.MSVCRT ref: 00B4D2F6
printf.MSVCRT ref: 00B4D303
printf.MSVCRT ref: 00B4D30A
printf.MSVCRT ref: 00B4D315
printf.MSVCRT ref: 00B4D320
printf.MSVCRT ref: 00B4D32B
printf.MSVCRT ref: 00B4D336
printf.MSVCRT ref: 00B4D33D
printf.MSVCRT ref: 00B4D348
printf.MSVCRT ref: 00B4D34F
printf.MSVCRT ref: 00B4D35A
printf.MSVCRT ref: 00B4D365
printf.MSVCRT ref: 00B4D371
printf.MSVCRT ref: 00B4D37C
printf.MSVCRT ref: 00B4D383
printf.MSVCRT ref: 00B4D38E
printf.MSVCRT ref: 00B4D395
printf.MSVCRT ref: 00B4D3A3
printf.MSVCRT ref: 00B4D3AA
printf.MSVCRT ref: 00B4D3B5
printf.MSVCRT ref: 00B4D3BC
printf.MSVCRT ref: 00B4D3C7
printf.MSVCRT ref: 00B4D3D2
printf.MSVCRT ref: 00B4D3DD
printf.MSVCRT ref: 00B4D3E8
printf.MSVCRT ref: 00B4D3F3
printf.MSVCRT ref: 00B4D3FE
printf.MSVCRT ref: 00B4D409
printf.MSVCRT ref: 00B4D414
printf.MSVCRT ref: 00B4D41F
printf.MSVCRT ref: 00B4D42A
printf.MSVCRT ref: 00B4D435
printf.MSVCRT ref: 00B4D440
printf.MSVCRT ref: 00B4D44E
printf.MSVCRT ref: 00B4D45B
printf.MSVCRT ref: 00B4D468
printf.MSVCRT ref: 00B4D476
printf.MSVCRT ref: 00B4D47D
printf.MSVCRT ref: 00B4D488
printf.MSVCRT ref: 00B4D493
printf.MSVCRT ref: 00B4D49E
printf.MSVCRT ref: 00B4D4AC
printf.MSVCRT ref: 00B4D4B7
printf.MSVCRT ref: 00B4D4C2
printf.MSVCRT ref: 00B4D4CD
printf.MSVCRT ref: 00B4D4DB
printf.MSVCRT ref: 00B4D4E2

Strings

-d<seconds> duration (in seconds) to run test [default=10s], xrefs: 00B4D03E
-f<rst> open file with one or more additional access hints, xrefs: 00B4D065
2016/5/01, xrefs: 00B4CEE5
-F<count> total number of threads (conflicts with -t), xrefs: 00B4D0A6
Examples: -a0,1,2 and -ag0,0,1,2 are equivalent., xrefs: 00B4CFA2
non-conflicting flags may be combined in any order; ex: -Sbw, -Suw, -Swu, xrefs: 00B4D212
-T<offs>[K|M|G|b] starting stride between I/O operations performed on the same target by different threads, xrefs: 00B4D27A
-ag#,#[,#,...]> advanced CPU affinity - affinitize threads round-robin to the CPUs provided. The g# notation, xrefs: 00B4CF6E
but promotes a more sequential pattern., xrefs: 00B4D1EB
Additional groups/processors may be added, comma separated, or on separate parameters., xrefs: 00B4CF95
-ag group affinity - affinitize threads round-robin to cores in Processor Groups 0 - n., xrefs: 00B4CF4A
r : the FILE_FLAG_RANDOM_ACCESS hint, xrefs: 00B4D072
-C<seconds> cool down time - duration of the test after measurements finished [default=0s]., xrefs: 00B4D00A
Size can be stated in bytes or KiB/MiB/GiB/blocks, xrefs: 00B4CFFD
-eREGISTRY registry calls, xrefs: 00B4D43B
file_path, xrefs: 00B4CF0C
-p start parallel sequential I/O operations with the same offset, xrefs: 00B4D15C
-ePROCESS process start & end, xrefs: 00B4D3EE
-x use completion routines instead of I/O Completion Ports, xrefs: 00B4D2E2
may be specified, and groups/cores may be repeated. If no group is specified, 0 is assumed., xrefs: 00B4CF88
-D<milliseconds> Capture IOPs statistics in intervals of <milliseconds>; these are per-thread, xrefs: 00B4D017
-I<priority> Set IO priority to <priority>. Available values are: 1-very low, 2-low, 3-normal (default), xrefs: 00B4D101
-Sr disable local caching, with remote sw caching enabled; only valid for remote filesystems, xrefs: 00B4D253
Synchronization:, xrefs: 00B4D355
-ag0,0,1,2,g1,0,1,2 specifies the first three cores in groups 0 and 1., xrefs: 00B4CFAF
[default: none], xrefs: 00B4D099
-j<milliseconds> interval in <milliseconds> between issuing IO bursts; see -i [default: inactive], xrefs: 00B4D0F4
[default inactive], xrefs: 00B4D0CD
Create 8192KB file and run read test on it for 1 second:, xrefs: 00B4D461
to CPUs 0 and 1 (each file will have threads affinitized to both CPUs) and run read test, xrefs: 00B4D4BD
completed I/O operations, counted separately by each thread , xrefs: 00B4D183
-? display usage information, xrefs: 00B4CF3F
#<physical drive number>, xrefs: 00B4CF17
-yr<eventname> waits on event <eventname> before starting the run (including warmup), xrefs: 00B4D389
-t<count> number of threads per target (conflicts with -F), xrefs: 00B4D26D
for example to test only the first sectors of a disk, xrefs: 00B4D058
[default=2], xrefs: 00B4D14F
-W<seconds> warm up time - duration of the test before measurements start [default=5s], xrefs: 00B4D2D5
IOPs time series in addition. [default=1000, 1 second]., xrefs: 00B4D031
[default = q, query perf timer (qpc)], xrefs: 00B4D3D8
-z[seed] set random seed [with no -z, seed=0; with plain -z, seed is based on system run time], xrefs: 00B4D2FC
(1=synchronous I/O, unless more than 1 thread is specified with -F), xrefs: 00B4D142
-ys<eventname> signals event <eventname> before starting the actual run (no warmup), xrefs: 00B4D360
-v verbose mode, xrefs: 00B4D2A1
2.0.17a, xrefs: 00B4CEEA
(ignored if -r specified, -si conflicts with -T and -p), xrefs: 00B4D1F8
makes sense only with #threads > 1, xrefs: 00B4D294
%s -b4K -t2 -r -o32 -d10 -h testfile.dat, xrefs: 00B4D4A7
-Sh equivalent -Suw, xrefs: 00B4D239
-ep use paged memory for the NT Kernel Logger [default=non-paged memory], xrefs: 00B4D3E3
-e<q|c|s> Use query perf timer (qpc), cycle count, or system timer respectively., xrefs: 00B4D3CD
[default; use -n to disable default affinity], xrefs: 00B4CF63
absence of this switch indicates 100%% reads, xrefs: 00B4D2BB
-b<size>[K|M|G] block size in bytes or KiB/MiB/GiB [default=64K], xrefs: 00B4CFC9
Available options:, xrefs: 00B4CF34
-Z zero buffers used for write tests, xrefs: 00B4D31B
(offset from the beginning of the file), xrefs: 00B4CFE3
note that this can not be specified when using completion routines, xrefs: 00B4D0C0
Set block size to 4KB, create 2 threads per file, 32 overlapped (outstanding), xrefs: 00B4D483
-g<bytes per ms> throughput per-thread per-target throttled to given bytes per millisecond, xrefs: 00B4D0B3
-w<percentage> percentage of write requests (-w and -w0 are equivalent and result in a read-only workload)., xrefs: 00B4D2AE
per-target: text output provides IOPs standard deviation, XML provides the full, xrefs: 00B4D024
-eNETWORK TCP/IP, UDP/IP send & receive, xrefs: 00B4D430
Create two 1GB files, set block size to 4KB, create 2 threads per file, affinitize threads, xrefs: 00B4D4B2
-o<count> number of outstanding I/O requests per target per thread, xrefs: 00B4D135
-eTHREAD thread start & end, xrefs: 00B4D3F9
-eMEMORY_HARD_FAULTS hard faults only, xrefs: 00B4D425
specifies Processor Groups for the following CPU core #s. Multiple Processor Groups, xrefs: 00B4CF7B
Group 0 is filled before Group 1, and so forth., xrefs: 00B4CF55
-f<size>[K|M|G|b] target size - use only the first <size> bytes or KiB/MiB/GiB/blocks of the file/disk/partition,, xrefs: 00B4D04B
access read test lasting 10 seconds:, xrefs: 00B4D499
-L measure latency statistics, xrefs: 00B4D11B
(creates a notification event if <eventname> does not exist), xrefs: 00B4D36B, 00B4D370, 00B4D382, 00B4D394, 00B4D3A9
-R<text|xml> output format. Default is text., xrefs: 00B4D19D
Usage: %s [options] target1 [ target2 [ target3 ...] ], xrefs: 00B4CEDA
-X<filepath> use an XML file for configuring the workload. Cannot be used with other parameters., xrefs: 00B4D2EF
-ye<eventname> sets event <eventname> and quits, xrefs: 00B4D3B0
<partition_drive_letter>:, xrefs: 00B4CF22
-S[bhruw] control caching behavior [default: caching is enabled, no writethrough], xrefs: 00B4D205
lasting 10 seconds:, xrefs: 00B4D4C8
-eDISK_IO physical disk IO, xrefs: 00B4D40F
-Su disable software caching, equivalent to FILE_FLAG_NO_BUFFERING, xrefs: 00B4D246
-h deprecated, see -Sh, xrefs: 00B4D0DA
-yp<eventname> stops the run when event <eventname> is set; CTRL+C is bound to this event, xrefs: 00B4D39E
-Sb enable caching (default, explicitly stated), xrefs: 00B4D22C
t : the FILE_ATTRIBUTE_TEMPORARY hint, xrefs: 00B4D08C
-l Use large pages for IO buffers, xrefs: 00B4D10E
Write buffers:, xrefs: 00B4D310
-n disable default affinity (-a), xrefs: 00B4D128
as seen by the target will not be truly sequential. Under -si the threads, xrefs: 00B4D1D1
%s -c1G -b4K -t2 -d10 -a0,1 testfile1.dat testfile2.dat, xrefs: 00B4D4D6
(ignored if -r is specified, makes sense only with -o2 or greater), xrefs: 00B4D169
-s[i]<size>[K|M|G|b] sequential stride size, offset between subsequent I/O operations, xrefs: 00B4D1AA
-ag0,0,1,2 -ag1,0,1,2 is equivalent., xrefs: 00B4CFBC
%s -c8192K -d1 testfile.dat, xrefs: 00B4D471
-i<count> number of IOs per burst; see -j [default: inactive], xrefs: 00B4D0E7
Available targets:, xrefs: 00B4CF01
By default, the write buffers are filled with a repeating pattern (0, 1, 2, ..., 255, 0, 1, ...), xrefs: 00B4D343
-yf<eventname> signals event <eventname> after the actual run finishes (no cooldown), xrefs: 00B4D377
version %s (%s), xrefs: 00B4CEEF
-c<size>[K|M|G|b] create files of the given size., xrefs: 00B4CFF0
-Z<size>[K|M|G|b],<file> use a <size> buffer filled with data from <file> as a source for write operations., xrefs: 00B4D331
-eIMAGE_LOAD image load, xrefs: 00B4D404
-S equivalent to -Su, xrefs: 00B4D21F
Event Tracing:, xrefs: 00B4D3C2
I/O operations per thread, disable all caching mechanisms and run block-aligned random, xrefs: 00B4D48E
-B<offs>[K|M|G|b] base target offset in bytes or KiB/MiB/GiB/blocks [default=0], xrefs: 00B4CFD6
-r<align>[K|M|G|b] random I/O aligned to <align> in bytes/KiB/MiB/GiB/blocks (overrides -s), xrefs: 00B4D190
-Sw enable writethrough (no hardware write caching), equivalent to FILE_FLAG_WRITE_THROUGH, xrefs: 00B4D260
manipulate a shared offset with InterlockedIncrement, which may reduce throughput,, xrefs: 00B4D1DE
-P<count> enable printing a progress dot after each <count> [default=65536], xrefs: 00B4D176
-eMEMORY_PAGE_FAULTS all page faults, xrefs: 00B4D41A
-Z<size>[K|M|G|b] use a <size> buffer filled with random data as a source for write operations., xrefs: 00B4D326
[default access=non-interlocked sequential, default stride=block size], xrefs: 00B4D1B7
s : the FILE_FLAG_SEQUENTIAL_SCAN hint, xrefs: 00B4D07F
In non-interlocked mode, threads do not coordinate, so the pattern of offsets, xrefs: 00B4D1C4
[default=0] (starting offset = base file offset + (thread number * <offs>), xrefs: 00B4D287
Examples:, xrefs: 00B4D454
IMPORTANT: a write test will destroy existing data without a warning, xrefs: 00B4D2C8

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: printf
String ID: -ag0,0,1,2 -ag1,0,1,2 is equivalent.$ -ag0,0,1,2,g1,0,1,2 specifies the first three cores in groups 0 and 1.$ (1=synchronous I/O, unless more than 1 thread is specified with -F)$ (ignored if -r is specified, makes sense only with -o2 or greater)$ (ignored if -r specified, -si conflicts with -T and -p)$ (offset from the beginning of the file)$ Additional groups/processors may be added, comma separated, or on separate parameters.$ Examples: -a0,1,2 and -ag0,0,1,2 are equivalent.$ Group 0 is filled before Group 1, and so forth.$ IMPORTANT: a write test will destroy existing data without a warning$ IOPs time series in addition. [default=1000, 1 second].$ In non-interlocked mode, threads do not coordinate, so the pattern of offsets$ Size can be stated in bytes or KiB/MiB/GiB/blocks$ [default = q, query perf timer (qpc)]$ [default access=non-interlocked sequential, default stride=block size]$ [default inactive]$ [default: none]$ [default; use -n to disable default affinity]$ [default=0] (starting offset = base file offset + (thread number * <offs>)$ [default=2]$ as seen by the target will not be truly sequential. Under -si the threads$ but promotes a more sequential pattern.$ completed I/O operations, counted separately by each thread $ for example to test only the first sectors of a disk$ makes sense only with #threads > 1$ manipulate a shared offset with InterlockedIncrement, which may reduce throughput,$ may be specified, and groups/cores may be repeated. If no group is specified, 0 is assumed.$ non-conflicting flags may be combined in any order; ex: -Sbw, -Suw, -Swu$ note that this can not be specified when using completion routines$ per-target: text output provides IOPs standard deviation, XML provides the full$ r : the FILE_FLAG_RANDOM_ACCESS hint$ s : the FILE_FLAG_SEQUENTIAL_SCAN hint$ specifies Processor Groups for the following CPU core #s. Multiple Processor Groups$ t : the FILE_ATTRIBUTE_TEMPORARY hint$ absence of this switch indicates 100%% reads$ (creates a notification event if <eventname> does not exist)$ #<physical drive number>$ <partition_drive_letter>:$ file_path$ %s -b4K -t2 -r -o32 -d10 -h testfile.dat$ %s -c1G -b4K -t2 -d10 -a0,1 testfile1.dat testfile2.dat$ %s -c8192K -d1 testfile.dat$ -? display usage information$ -B<offs>[K|M|G|b] base target offset in bytes or KiB/MiB/GiB/blocks [default=0]$ -C<seconds> cool down time - duration of the test after measurements finished [default=0s].$ -D<milliseconds> Capture IOPs statistics in intervals of <milliseconds>; these are per-thread$ -F<count> total number of threads (conflicts with -t)$ -I<priority> Set IO priority to <priority>. Available values are: 1-very low, 2-low, 3-normal (default)$ -L measure latency statistics$ -P<count> enable printing a progress dot after each <count> [default=65536]$ -R<text|xml> output format. Default is text.$ -S equivalent to -Su$ -S[bhruw] control caching behavior [default: caching is enabled, no writethrough]$ -Sb enable caching (default, explicitly stated)$ -Sh equivalent -Suw$ -Sr disable local caching, with remote sw caching enabled; only valid for remote filesystems$ -Su disable software caching, equivalent to FILE_FLAG_NO_BUFFERING$ -Sw enable writethrough (no hardware write caching), equivalent to FILE_FLAG_WRITE_THROUGH$ -T<offs>[K|M|G|b] starting stride between I/O operations performed on the same target by different threads$ -W<seconds> warm up time - duration of the test before measurements start [default=5s]$ -X<filepath> use an XML file for configuring the workload. Cannot be used with other parameters.$ -Z zero buffers used for write tests$ -Z<size>[K|M|G|b] use a <size> buffer filled with random data as a source for write operations.$ -Z<size>[K|M|G|b],<file> use a <size> buffer filled with data from <file> as a source for write operations.$ -ag group affinity - affinitize threads round-robin to cores in Processor Groups 0 - n.$ -ag#,#[,#,...]> advanced CPU affinity - affinitize threads round-robin to the CPUs provided. The g# notation$ -b<size>[K|M|G] block size in bytes or KiB/MiB/GiB [default=64K]$ -c<size>[K|M|G|b] create files of the given size.$ -d<seconds> duration (in seconds) to run test [default=10s]$ -e<q|c|s> Use query perf timer (qpc), cycle count, or system timer respectively.$ -eDISK_IO physical disk IO$ -eIMAGE_LOAD image load$ -eMEMORY_HARD_FAULTS hard faults only$ -eMEMORY_PAGE_FAULTS all page faults$ -eNETWORK TCP/IP, UDP/IP send & receive$ -ePROCESS process start & end$ -eREGISTRY registry calls$ -eTHREAD thread start & end$ -ep use paged memory for the NT Kernel Logger [default=non-paged memory]$ -f<rst> open file with one or more additional access hints$ -f<size>[K|M|G|b] target size - use only the first <size> bytes or KiB/MiB/GiB/blocks of the file/disk/partition,$ -g<bytes per ms> throughput per-thread per-target throttled to given bytes per millisecond$ -h deprecated, see -Sh$ -i<count> number of IOs per burst; see -j [default: inactive]$ -j<milliseconds> interval in <milliseconds> between issuing IO bursts; see -i [default: inactive]$ -l Use large pages for IO buffers$ -n disable default affinity (-a)$ -o<count> number of outstanding I/O requests per target per thread$ -p start parallel sequential I/O operations with the same offset$ -r<align>[K|M|G|b] random I/O aligned to <align> in bytes/KiB/MiB/GiB/blocks (overrides -s)$ -s[i]<size>[K|M|G|b] sequential stride size, offset between subsequent I/O operations$ -t<count> number of threads per target (conflicts with -F)$ -v verbose mode$ -w<percentage> percentage of write requests (-w and -w0 are equivalent and result in a read-only workload).$ -x use completion routines instead of I/O Completion Ports$ -ye<eventname> sets event <eventname> and quits$ -yf<eventname> signals event <eventname> after the actual run finishes (no cooldown)$ -yp<eventname> stops the run when event <eventname> is set; CTRL+C is bound to this event$ -yr<eventname> waits on event <eventname> before starting the run (including warmup)$ -ys<eventname> signals event <eventname> before starting the actual run (no warmup)$ -z[seed] set random seed [with no -z, seed=0; with plain -z, seed is based on system run time]$ By default, the write buffers are filled with a repeating pattern (0, 1, 2, ..., 255, 0, 1, ...)$2.0.17a$2016/5/01$Available options:$Available targets:$Create 8192KB file and run read test on it for 1 second:$Create two 1GB files, set block size to 4KB, create 2 threads per file, affinitize threads$Event Tracing:$Examples:$I/O operations per thread, disable all caching mechanisms and run block-aligned random$Set block size to 4KB, create 2 threads per file, 32 overlapped (outstanding)$Synchronization:$Usage: %s [options] target1 [ target2 [ target3 ...] ]$Write buffers:$access read test lasting 10 seconds:$lasting 10 seconds:$to CPUs 0 and 1 (each file will have threads affinitized to both CPUs) and run read test$version %s (%s)
API String ID: 3524737521-2699309960
Opcode ID: 5fd3b236a19c25eaf10e96671ffbf3f41ebd97513f9e120fb2bdcbfe443598c3
Instruction ID: 4980f479ffe26052c442201349fdaadf663679627b8c2953bceb3111e3f8b078
Opcode Fuzzy Hash: 5fd3b236a19c25eaf10e96671ffbf3f41ebd97513f9e120fb2bdcbfe443598c3
Instruction Fuzzy Hash: 2AD1BE7554AA80DFE7102F94E84D51DBEF4EA47702B058C59EEC6622E1CFF846D0AF22

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BB91 Relevance: 66.9, APIs: 18, Strings: 20, Instructions: 356
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00B4BB91(intOrPtr* __ecx, char _a4) {
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				signed int _v37;
				char _v38;
				intOrPtr _t98;
				signed int _t100;
				signed int _t104;
				char _t106;
				signed int _t110;
				signed int _t114;
				signed int _t121;
				signed int _t122;
				signed int _t139;
				intOrPtr _t140;
				signed int _t146;
				intOrPtr _t156;
				intOrPtr _t158;
				intOrPtr _t159;
				intOrPtr _t163;
				signed int _t167;
				signed int _t200;
				signed char _t201;
				signed int _t211;
				intOrPtr _t212;
				signed int _t213;
				intOrPtr* _t215;
				signed int _t216;
				intOrPtr* _t218;
				intOrPtr _t219;
				intOrPtr _t220;
				intOrPtr* _t221;
				intOrPtr _t223;
				signed int _t226;
				intOrPtr _t227;
				signed int _t228;
				signed int _t229;
				void* _t231;

				_t231 = (_t229 & 0xfffffff8) - 0x28;
				_t98 =  *0xb6161c; // 0x0
				_t100 = _t98 -  *0xb61618 >> 3;
				_v38 = 1;
				_t215 = __ecx;
				_t156 =  *0xb61624; // 0x2
				if(_t100 > 1 || _t156 > 0x40) {
					_push(_t156);
					_push(_t100);
					fprintf(E00B5D7CD(_t100, 2), "WARNING: Complete CPU utilization cannot currently be gathered within DISKSPD for this system.\n         Use alternate mechanisms to gather this data such as perfmon/logman.\n         Active KGroups %u > 1 and/or processor count %u > 64.\n");
					_t231 = _t231 + 0x10;
				}
				_t223 =  *((intOrPtr*)(_t215 + 4));
				_t158 =  *_t215;
				_t104 = _t223 - _t158;
				_t216 = 0x38;
				asm("cdq");
				_t105 = _t104 / _t216;
				_v20 = _t223;
				_v36 = _t158;
				_v24 = _t216;
				if(_t104 / _t216 != 0) {
					__eflags = _t158 - _t223;
					if(_t158 == _t223) {
						L79:
						_t106 = _v38;
						goto L80;
					} else {
						_t218 = _t158 + 0x28;
						_v32 = _t218;
						do {
							_t219 =  *_t218;
							_v28 = _t219;
							_t226 =  *(_v32 - 4);
							while(1) {
								__eflags = _t226 - _t219;
								if(_t226 == _t219) {
									break;
								}
								_t159 =  *0xb6161c; // 0x0
								_t211 =  *_t226 & 0x0000ffff;
								_t109 = _t159 -  *0xb61618 >> 3;
								__eflags = _t211 - _t159 -  *0xb61618 >> 3;
								if(_t211 < _t159 -  *0xb61618 >> 3) {
									_t110 = _v38;
								} else {
									_push(_t159 -  *0xb61618 >> 3);
									_push(_t211);
									fprintf(E00B5D7CD(_t109, 2), "ERROR: affinity assignment to group %u; system only has %u groups\n");
									_t231 = _t231 + 0x10;
									_t110 = 0;
									_v38 = 0;
								}
								__eflags = _t110;
								if(_t110 == 0) {
									L19:
									_t226 = _t226 + 4;
									__eflags = _t226;
									continue;
								} else {
									_t200 =  *_t226 & 0x0000ffff;
									_t212 =  *0xb61618; // 0x0
									_t139 =  *((intOrPtr*)(_t226 + 2));
									_v37 = _t139;
									__eflags = _t139 -  *(_t212 + 2 + _t200 * 8);
									if(_t139 >=  *(_t212 + 2 + _t200 * 8)) {
										_push( *(_t212 + 2 + _t200 * 8) & 0x000000ff);
										_push(_v37 & 0x000000ff);
										_push(_t200);
										fprintf(E00B5D7CD(_v37 & 0x000000ff, 2), "ERROR: affinity assignment to group %u core %u not possible; group only has %u cores\n");
										_t231 = _t231 + 0x14;
										_t139 = 0;
										__eflags = 0;
										_v38 = 0;
									}
									__eflags = _t139;
									if(_t139 == 0) {
										goto L19;
									} else {
										_t213 =  *_t226 & 0x0000ffff;
										_t140 =  *0xb61618; // 0x0
										_t201 =  *((intOrPtr*)(_t226 + 2));
										__eflags = _t201 -  *((intOrPtr*)(_t140 + 2 + _t213 * 8));
										if(_t201 >=  *((intOrPtr*)(_t140 + 2 + _t213 * 8))) {
											L18:
											_push( *((intOrPtr*)(_t140 + 4 + _t213 * 8)));
											_push(_t201 & 0x000000ff);
											_push(_t213);
											fprintf(E00B5D7CD(_t201 & 0x000000ff, 2), "ERROR: affinity assignment to group %u core %u not possible; core is not active (current mask 0x%Ix)\n");
											_t231 = _t231 + 0x14;
											_v38 = 0;
											goto L19;
										}
										_t220 =  *0xb61618; // 0x0
										_t146 = 1 << _t201;
										__eflags =  *(_t220 + 4 + _t213 * 8) & _t146;
										_t219 = _v28;
										if(( *(_t220 + 4 + _t213 * 8) & _t146) != 0) {
											goto L19;
										}
										_t140 =  *0xb61618; // 0x0
										goto L18;
									}
								}
							}
							_t221 = _v32;
							__eflags =  *((char*)(_t221 - 8));
							if( *((char*)(_t221 - 8)) != 0) {
								_t117 =  *_t221 -  *((intOrPtr*)(_t221 - 4)) >> 2;
								__eflags =  *_t221 -  *((intOrPtr*)(_t221 - 4)) >> 2;
								if( *_t221 -  *((intOrPtr*)(_t221 - 4)) >> 2 != 0) {
									fprintf(E00B5D7CD(_t117, 2), "ERROR: -n and -a parameters cannot be used together\n");
									_v38 = 0;
								}
							}
							_t112 = E00B4A7CE(_v36,  &_v16);
							_t227 = _v20;
							__eflags = _t227 - _v16;
							if(_t227 != _v16) {
								_t228 = _t227 + 0x48;
								__eflags = _t228;
								do {
									__eflags =  *(_t221 - 0xc) - 1;
									if( *(_t221 - 0xc) > 1) {
										L28:
										_v37 = 1;
										L29:
										__eflags =  *(_t221 - 0xc);
										if( *(_t221 - 0xc) > 0) {
											__eflags =  *_t228 - 1;
											if( *_t228 > 1) {
												_t112 = fprintf(E00B5D7CD(_t112, 2), "ERROR: -F and -t parameters cannot be used together\n");
												_v38 = 0;
											}
										}
										__eflags =  *(_t228 + 0x3c);
										if( *(_t228 + 0x3c) > 0) {
											__eflags =  *((char*)(_t221 + 8));
											if( *((char*)(_t221 + 8)) != 0) {
												fprintf(E00B5D7CD(_t112, 2), "ERROR: -g throughput control cannot be used with -x completion routines\n");
												_v38 = 0;
											}
										}
										_t120 =  *(_t228 + 0x34);
										__eflags = _t120;
										if(_t120 != 0) {
											L38:
											__eflags =  *(_t228 + 0x30);
											if( *(_t228 + 0x30) != 0) {
												goto L40;
											}
											goto L39;
										} else {
											__eflags =  *(_t228 + 0x30) - _t120;
											if( *(_t228 + 0x30) > _t120) {
												L39:
												_t120 = fprintf(E00B5D7CD(_t120, 2), "ERROR: need to specify -j<think time> with -i<burst size>\n");
												_v38 = 0;
												L40:
												__eflags =  *((char*)(_t228 - 0x1f));
												if( *((char*)(_t228 - 0x1f)) == 0) {
													__eflags =  *((char*)(_t228 - 0x10));
													if( *((char*)(_t228 - 0x10)) != 0) {
														__eflags =  *((intOrPtr*)(_t228 - 0x2c)) - 1;
														if( *((intOrPtr*)(_t228 - 0x2c)) == 1) {
															_t120 = fprintf(E00B5D7CD(_t120, 2), "WARNING: -p does not have effect unless outstanding I/O count (-o) is > 1\n");
														}
													}
													__eflags =  *(_t221 - 0x10);
													if( *(_t221 - 0x10) > 0) {
														_t120 = fprintf(E00B5D7CD(_t120, 2), "WARNING: -z is ignored if -r is not provided\n");
													}
													__eflags =  *((char*)(_t228 - 0xf));
													if( *((char*)(_t228 - 0xf)) == 0) {
														__eflags = _v37;
														_t121 =  *(_t228 + 8);
														if(_v37 == 0) {
															_t120 = _t121 |  *(_t228 + 0xc);
															__eflags = _t121 |  *(_t228 + 0xc);
															if((_t121 |  *(_t228 + 0xc)) == 0) {
																goto L69;
															}
															_push("ERROR: -T has no effect unless multiple threads per target are used\n");
															L67:
															fprintf(E00B5D7CD(_t120, 2), ??);
															_v38 = 0;
															goto L68;
														}
														_t120 = _t121 |  *(_t228 + 0xc);
														__eflags = _t121 |  *(_t228 + 0xc);
														if((_t121 |  *(_t228 + 0xc)) != 0) {
															goto L69;
														}
														_push("WARNING: target access pattern will not be sequential, consider -si\n");
														goto L61;
													} else {
														__eflags =  *(_t228 + 0xc);
														if( *(_t228 + 0xc) > 0) {
															L56:
															_t120 = fprintf(E00B5D7CD(_t120, 2), "ERROR: -si conflicts with -T\n");
															_v38 = 0;
															L57:
															__eflags =  *((char*)(_t228 - 0x10));
															if( *((char*)(_t228 - 0x10)) != 0) {
																_t120 = fprintf(E00B5D7CD(_t120, 2), "ERROR: -si conflicts with -p\n");
																_v38 = 0;
															}
															__eflags = _v37;
															if(_v37 != 0) {
																L69:
																_t167 =  *(_t228 + 0x4c);
																_t122 =  *(_t228 + 0x48);
																__eflags = _t167;
																if(__eflags != 0) {
																	L72:
																	if(__eflags > 0) {
																		L76:
																		__eflags = _a4;
																		if(_a4 != 0) {
																			goto L78;
																		}
																		goto L77;
																	}
																	if(__eflags < 0) {
																		L75:
																		_push( *((intOrPtr*)(_t228 - 0x30)));
																		_push(_t167);
																		_push(_t122);
																		fprintf(E00B5D7CD(_t122, 2), "ERROR: custom write buffer (-Z) is smaller than the block size. Write buffer size: %I64u block size: %u\n");
																		_t231 = _t231 + 0x14;
																		_v38 = 0;
																		goto L76;
																	}
																	__eflags = _t122 -  *((intOrPtr*)(_t228 - 0x30));
																	if(_t122 >=  *((intOrPtr*)(_t228 - 0x30))) {
																		goto L76;
																	}
																	goto L75;
																}
																__eflags = _t122;
																if(_t122 == 0) {
																	goto L76;
																}
																__eflags = _t167;
																goto L72;
															} else {
																_push("WARNING: single-threaded test, -si ignored\n");
																L61:
																fprintf(E00B5D7CD(_t120, 2), ??);
																L68:
																goto L69;
															}
														}
														__eflags =  *(_t228 + 8);
														if( *(_t228 + 8) <= 0) {
															goto L57;
														}
														goto L56;
													}
												}
												__eflags =  *(_t228 + 0xc);
												if( *(_t228 + 0xc) > 0) {
													L43:
													_t120 = fprintf(E00B5D7CD(_t120, 2), "ERROR: -T conflicts with -r\n");
													_v38 = 0;
													L44:
													__eflags =  *((char*)(_t228 - 0xf));
													if( *((char*)(_t228 - 0xf)) != 0) {
														_t120 = fprintf(E00B5D7CD(_t120, 2), "ERROR: -si conflicts with -r\n");
														_v38 = 0;
													}
													__eflags =  *((char*)(_t228 - 0x10));
													if( *((char*)(_t228 - 0x10)) == 0) {
														goto L69;
													} else {
														_push("ERROR: -p conflicts with -r\n");
														goto L67;
													}
												}
												__eflags =  *(_t228 + 8);
												if( *(_t228 + 8) <= 0) {
													goto L44;
												}
												goto L43;
											}
											__eflags = _t120;
											if(_t120 == 0) {
												goto L40;
											}
											goto L38;
										}
									}
									__eflags =  *_t228 - 1;
									_v37 = 0;
									if( *_t228 <= 1) {
										goto L29;
									}
									goto L28;
									L77:
									_t228 = _t228 + 0xb8;
									_t112 = _t228 - 0x48;
									__eflags = _t228 - 0x48 - _v12;
								} while (_t228 - 0x48 != _v12);
							}
							L78:
							E00B4A17A( &_v16);
							_t114 = _v24;
							_t163 = _v36 + _t114;
							_t218 = _t221 + _t114;
							_v36 = _t163;
							_v32 = _t218;
							__eflags = _t163 - _v20;
						} while (_t163 != _v20);
						goto L79;
					}
				} else {
					fprintf(E00B5D7CD(_t105, 2), "ERROR: no timespans specified\n");
					_t106 = 0;
					L80:
					return _t106;
				}
			}

0x00b4bb99
0x00b4bb9c
0x00b4bba8
0x00b4bbab
0x00b4bbb1
0x00b4bbb3
0x00b4bbbc
0x00b4bbc3
0x00b4bbc4
0x00b4bbd3
0x00b4bbd9
0x00b4bbd9
0x00b4bbdc
0x00b4bbe1
0x00b4bbe3
0x00b4bbe7
0x00b4bbe8
0x00b4bbe9
0x00b4bbeb
0x00b4bbef
0x00b4bbf3
0x00b4bbf9
0x00b4bc18
0x00b4bc1a
0x00b4bfc4
0x00b4bfc4
0x00000000
0x00b4bc20
0x00b4bc20
0x00b4bc23
0x00b4bc27
0x00b4bc2b
0x00b4bc2d
0x00b4bc31
0x00b4bd1e
0x00b4bd1e
0x00b4bd20
0x00000000
0x00000000
0x00b4bc39
0x00b4bc47
0x00b4bc4a
0x00b4bc4d
0x00b4bc4f
0x00b4bc7b
0x00b4bc51
0x00b4bc5a
0x00b4bc5b
0x00b4bc6a
0x00b4bc70
0x00b4bc73
0x00b4bc75
0x00b4bc75
0x00b4bc7f
0x00b4bc81
0x00b4bd1b
0x00b4bd1b
0x00b4bd1b
0x00000000
0x00b4bc87
0x00b4bc87
0x00b4bc8a
0x00b4bc90
0x00b4bc93
0x00b4bc97
0x00b4bc9b
0x00b4bca2
0x00b4bca8
0x00b4bca9
0x00b4bcb8
0x00b4bcbe
0x00b4bcc1
0x00b4bcc1
0x00b4bcc3
0x00b4bcc3
0x00b4bcc7
0x00b4bcc9
0x00000000
0x00b4bccb
0x00b4bccb
0x00b4bcce
0x00b4bcd3
0x00b4bcd6
0x00b4bcda
0x00b4bcf6
0x00b4bcf6
0x00b4bcfd
0x00b4bcfe
0x00b4bd0d
0x00b4bd13
0x00b4bd16
0x00000000
0x00b4bd16
0x00b4bcdc
0x00b4bce5
0x00b4bce7
0x00b4bceb
0x00b4bcef
0x00000000
0x00000000
0x00b4bcf1
0x00000000
0x00b4bcf1
0x00b4bcc9
0x00b4bc81
0x00b4bd26
0x00b4bd2a
0x00b4bd2e
0x00b4bd35
0x00b4bd38
0x00b4bd3a
0x00b4bd4a
0x00b4bd52
0x00b4bd52
0x00b4bd3a
0x00b4bd60
0x00b4bd65
0x00b4bd69
0x00b4bd6d
0x00b4bd73
0x00b4bd73
0x00b4bd76
0x00b4bd76
0x00b4bd7a
0x00b4bd86
0x00b4bd86
0x00b4bd8b
0x00b4bd8b
0x00b4bd8f
0x00b4bd91
0x00b4bd94
0x00b4bda4
0x00b4bdac
0x00b4bdac
0x00b4bd94
0x00b4bdb1
0x00b4bdb5
0x00b4bdb7
0x00b4bdbb
0x00b4bdcb
0x00b4bdd3
0x00b4bdd3
0x00b4bdbb
0x00b4bdd8
0x00b4bddb
0x00b4bddd
0x00b4bde8
0x00b4bde8
0x00b4bdec
0x00000000
0x00000000
0x00000000
0x00b4bddf
0x00b4bddf
0x00b4bde2
0x00b4bdee
0x00b4bdfc
0x00b4be04
0x00b4be09
0x00b4be09
0x00b4be0d
0x00b4be6b
0x00b4be6f
0x00b4be71
0x00b4be75
0x00b4be85
0x00b4be8c
0x00b4be75
0x00b4be8d
0x00b4be91
0x00b4bea1
0x00b4bea8
0x00b4bea9
0x00b4bead
0x00b4bf14
0x00b4bf19
0x00b4bf1c
0x00b4bf2a
0x00b4bf2a
0x00b4bf2d
0x00000000
0x00000000
0x00b4bf2f
0x00b4bf34
0x00b4bf3d
0x00b4bf43
0x00000000
0x00b4bf43
0x00b4bf1e
0x00b4bf1e
0x00b4bf21
0x00000000
0x00000000
0x00b4bf23
0x00000000
0x00b4beaf
0x00b4beaf
0x00b4beb3
0x00b4bebb
0x00b4bec9
0x00b4bed1
0x00b4bed6
0x00b4bed6
0x00b4beda
0x00b4beea
0x00b4bef2
0x00b4bef2
0x00b4bef7
0x00b4befc
0x00b4bf4a
0x00b4bf4a
0x00b4bf4d
0x00b4bf50
0x00b4bf52
0x00b4bf5a
0x00b4bf5a
0x00b4bf84
0x00b4bf84
0x00b4bf88
0x00000000
0x00000000
0x00000000
0x00b4bf88
0x00b4bf5c
0x00b4bf63
0x00b4bf63
0x00b4bf66
0x00b4bf67
0x00b4bf76
0x00b4bf7c
0x00b4bf7f
0x00000000
0x00b4bf7f
0x00b4bf5e
0x00b4bf61
0x00000000
0x00000000
0x00000000
0x00b4bf61
0x00b4bf54
0x00b4bf56
0x00000000
0x00000000
0x00b4bf58
0x00000000
0x00b4befe
0x00b4befe
0x00b4bf03
0x00b4bf0c
0x00b4bf48
0x00000000
0x00b4bf49
0x00b4befc
0x00b4beb5
0x00b4beb9
0x00000000
0x00000000
0x00000000
0x00b4beb9
0x00b4bead
0x00b4be0f
0x00b4be13
0x00b4be1b
0x00b4be29
0x00b4be31
0x00b4be36
0x00b4be36
0x00b4be3a
0x00b4be4a
0x00b4be52
0x00b4be52
0x00b4be57
0x00b4be5b
0x00000000
0x00b4be61
0x00b4be61
0x00000000
0x00b4be61
0x00b4be5b
0x00b4be15
0x00b4be19
0x00000000
0x00000000
0x00000000
0x00b4be19
0x00b4bde4
0x00b4bde6
0x00000000
0x00000000
0x00000000
0x00b4bde6
0x00b4bddd
0x00b4bd7c
0x00b4bd7f
0x00b4bd84
0x00000000
0x00000000
0x00000000
0x00b4bf8a
0x00b4bf8a
0x00b4bf90
0x00b4bf93
0x00b4bf93
0x00b4bd76
0x00b4bf9d
0x00b4bfa1
0x00b4bfaa
0x00b4bfae
0x00b4bfb0
0x00b4bfb2
0x00b4bfb6
0x00b4bfba
0x00b4bfba
0x00000000
0x00b4bc27
0x00b4bbfb
0x00b4bc09
0x00b4bc11
0x00b4bfc8
0x00b4bfcd
0x00b4bfcd

APIs

fprintf.MSVCRT ref: 00B4BBD3
fprintf.MSVCRT ref: 00B4BC09
fprintf.MSVCRT ref: 00B4BC6A
fprintf.MSVCRT ref: 00B4BCB8
fprintf.MSVCRT ref: 00B4BD0D
fprintf.MSVCRT ref: 00B4BD4A
fprintf.MSVCRT ref: 00B4BDA4
fprintf.MSVCRT ref: 00B4BDCB
fprintf.MSVCRT ref: 00B4BDFC
fprintf.MSVCRT ref: 00B4BE29
fprintf.MSVCRT ref: 00B4BE4A
fprintf.MSVCRT ref: 00B4BE85
fprintf.MSVCRT ref: 00B4BEA1
fprintf.MSVCRT ref: 00B4BEC9
fprintf.MSVCRT ref: 00B4BEEA
fprintf.MSVCRT ref: 00B4BF0C
fprintf.MSVCRT ref: 00B4BF3D
fprintf.MSVCRT ref: 00B4BF76

Part of subcall function 00B5D7CD: __iob_func.MSVCRT ref: 00B5D7D2

Strings

ERROR: affinity assignment to group %u core %u not possible; group only has %u cores, xrefs: 00B4BCAA
WARNING: -p does not have effect unless outstanding I/O count (-o) is > 1, xrefs: 00B4BE77
WARNING: -z is ignored if -r is not provided, xrefs: 00B4BE93
ERROR: affinity assignment to group %u; system only has %u groups, xrefs: 00B4BC5C
ERROR: no timespans specified, xrefs: 00B4BBFB
WARNING: target access pattern will not be sequential, consider -si, xrefs: 00B4BF23
ERROR: -p conflicts with -r, xrefs: 00B4BE61
WARNING: Complete CPU utilization cannot currently be gathered within DISKSPD for this system. Use alternate mechanisms to gather this data such as perfmon/logman. Active KGroups %u > 1 and/or processor count %u > 64., xrefs: 00B4BBC5
ERROR: -T conflicts with -r, xrefs: 00B4BE1B
ERROR: -n and -a parameters cannot be used together, xrefs: 00B4BD3C
ERROR: custom write buffer (-Z) is smaller than the block size. Write buffer size: %I64u block size: %u, xrefs: 00B4BF68
ERROR: -T has no effect unless multiple threads per target are used, xrefs: 00B4BF2F
ERROR: -F and -t parameters cannot be used together, xrefs: 00B4BD96
ERROR: affinity assignment to group %u core %u not possible; core is not active (current mask 0x%Ix), xrefs: 00B4BCFF
ERROR: -si conflicts with -r, xrefs: 00B4BE3C
WARNING: single-threaded test, -si ignored, xrefs: 00B4BEFE
ERROR: -si conflicts with -p, xrefs: 00B4BEDC
ERROR: need to specify -j<think time> with -i<burst size>, xrefs: 00B4BDEE
ERROR: -g throughput control cannot be used with -x completion routines, xrefs: 00B4BDBD
ERROR: -si conflicts with -T, xrefs: 00B4BEBB

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: fprintf$__iob_func
String ID: ERROR: -F and -t parameters cannot be used together$ERROR: -T conflicts with -r$ERROR: -T has no effect unless multiple threads per target are used$ERROR: -g throughput control cannot be used with -x completion routines$ERROR: -n and -a parameters cannot be used together$ERROR: -p conflicts with -r$ERROR: -si conflicts with -T$ERROR: -si conflicts with -p$ERROR: -si conflicts with -r$ERROR: affinity assignment to group %u core %u not possible; core is not active (current mask 0x%Ix)$ERROR: affinity assignment to group %u core %u not possible; group only has %u cores$ERROR: affinity assignment to group %u; system only has %u groups$ERROR: custom write buffer (-Z) is smaller than the block size. Write buffer size: %I64u block size: %u$ERROR: need to specify -j<think time> with -i<burst size>$ERROR: no timespans specified$WARNING: -p does not have effect unless outstanding I/O count (-o) is > 1$WARNING: -z is ignored if -r is not provided$WARNING: Complete CPU utilization cannot currently be gathered within DISKSPD for this system. Use alternate mechanisms to gather this data such as perfmon/logman. Active KGroups %u > 1 and/or processor count %u > 64.$WARNING: single-threaded test, -si ignored$WARNING: target access pattern will not be sequential, consider -si
API String ID: 2177900033-102208394
Opcode ID: 93b22566907f753cb2b43c16e3ff34d9ce2f00ff74ef2b291027fff28e190bad
Instruction ID: db30b0b535ed9dec3bc2bbc827f6a370629a67dd0f147fca4e89063d599e4c7a
Opcode Fuzzy Hash: 93b22566907f753cb2b43c16e3ff34d9ce2f00ff74ef2b291027fff28e190bad
Instruction Fuzzy Hash: 66C12731408340AEFB249B28D84AF2ABBD4EF45710F1849DDF685931D2DBB4EB44EB56

Uniqueness

Uniqueness Score: -1.00%

Function 00B4FFFD Relevance: 45.9, APIs: 1, Strings: 25, Instructions: 367
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00B4FFFD(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t183;
				intOrPtr _t203;
				intOrPtr _t209;
				void* _t211;
				void* _t212;
				void* _t213;

				_t213 = __eflags;
				_t204 = __ecx;
				_push(0x4c);
				E00B5D14C(0xb5e276, __ebx, __edi, __esi);
				_t203 =  *((intOrPtr*)(_t212 + 8));
				_t209 =  *((intOrPtr*)(_t212 + 0xc));
				 *((intOrPtr*)(_t212 - 0x20)) = 0xf;
				 *((intOrPtr*)(_t212 - 0x24)) = 0;
				 *((char*)(_t212 - 0x34)) = 0;
				 *((intOrPtr*)(_t212 - 4)) = 0;
				_push(_t212 - 0x34);
				_push("Path");
				_push(_t203);
				_t211 = E00B5086D(_t203, _t209, __esi, _t213);
				if(_t211 >= 0) {
					_t211 = E00B50A54(_t204, _t216, _t203, "BlockSize", _t212 - 0x3c);
					if(_t211 >= 0) {
						_t218 = _t211 - 1;
						if(_t211 != 1) {
							 *(_t209 + 0x18) =  *(_t212 - 0x3c);
						}
						_push(_t212 - 0x40);
						_push("StrideSize");
						_push(_t203);
						_t211 = E00B509AA(_t203, _t209, _t211, _t218);
						if(_t211 >= 0) {
							_push(_t212 - 0x35);
							_push("InterlockedSequential");
							_push(_t203);
							_t211 = E00B50A84(_t203, _t209, _t211, _t220);
							if(_t211 >= 0) {
								_t222 = _t211 - 1;
								if(_t211 != 1) {
									 *((char*)(_t209 + 0x39)) =  *((intOrPtr*)(_t212 - 0x35));
								}
								_push(_t212 - 0x40);
								_push("BaseFileOffset");
								_push(_t203);
								_t211 = E00B509AA(_t203, _t209, _t211, _t222);
								if(_t211 >= 0) {
									_push(_t212 - 0x35);
									_push("SequentialScan");
									_push(_t203);
									_t211 = E00B50A84(_t203, _t209, _t211, _t224);
									if(_t211 >= 0) {
										_t226 = _t211 - 1;
										if(_t211 != 1) {
											 *((char*)(_t209 + 0x88)) =  *((intOrPtr*)(_t212 - 0x35));
										}
										_push(_t212 - 0x35);
										_push("RandomAccess");
										_push(_t203);
										_t211 = E00B50A84(_t203, _t209, _t211, _t226);
										if(_t211 >= 0) {
											_push(_t212 - 0x35);
											_push("TemporaryFile");
											_push(_t203);
											_t211 = E00B50A84(_t203, _t209, _t211, _t228);
											if(_t211 >= 0) {
												_t230 = _t211 - 1;
												if(_t211 != 1) {
													 *((char*)(_t209 + 0x8a)) =  *((intOrPtr*)(_t212 - 0x35));
												}
												_push(_t212 - 0x35);
												_push("UseLargePages");
												_push(_t203);
												_t211 = E00B50A84(_t203, _t209, _t211, _t230);
												if(_t211 >= 0) {
													_t211 = E00B50A54(_t204, _t232, _t203, "RequestCount", _t212 - 0x3c);
													if(_t211 >= 0) {
														_t234 = _t211 - 1;
														if(_t211 != 1) {
															 *(_t209 + 0x1c) =  *(_t212 - 0x3c);
														}
														_push(_t212 - 0x40);
														_push("Random");
														_push(_t203);
														_t211 = E00B509AA(_t203, _t209, _t211, _t234);
														if(_t211 >= 0) {
															_t236 = _t211 - 1;
															if(_t211 != 1) {
																 *((intOrPtr*)(_t209 + 0x20)) =  *((intOrPtr*)(_t212 - 0x40));
																 *((short*)(_t209 + 0x28)) = 0x101;
																 *(_t209 + 0x24) =  *(_t212 - 0x3c);
															}
															_push(_t212 - 0x35);
															_push("DisableOSCache");
															_push(_t203);
															_t211 = E00B50A84(_t203, _t209, _t211, _t236);
															if(_t211 >= 0) {
																if(_t211 != 1) {
																	_t239 =  *((char*)(_t212 - 0x35));
																	if( *((char*)(_t212 - 0x35)) != 0) {
																		 *((intOrPtr*)(_t209 + 0x3c)) = 2;
																	}
																}
																_push(_t212 - 0x35);
																_push("DisableAllCache");
																_push(_t203);
																_t211 = E00B50A84(_t203, _t209, _t211, _t239);
																if(_t211 >= 0) {
																	if(_t211 != 1) {
																		_t242 =  *((char*)(_t212 - 0x35));
																		if( *((char*)(_t212 - 0x35)) != 0) {
																			_t183 = 2;
																			 *((intOrPtr*)(_t209 + 0x3c)) = _t183;
																			 *((intOrPtr*)(_t209 + 0x40)) = _t183;
																		}
																	}
																	_push(_t212 - 0x35);
																	_push("DisableLocalCache");
																	_push(_t203);
																	_t211 = E00B50A84(_t203, _t209, _t211, _t242);
																	if(_t211 >= 0) {
																		if(_t211 != 1) {
																			_t245 =  *((char*)(_t212 - 0x35));
																			if( *((char*)(_t212 - 0x35)) != 0) {
																				 *((intOrPtr*)(_t209 + 0x3c)) = 3;
																			}
																		}
																		_push(_t212 - 0x35);
																		_push("WriteThrough");
																		_push(_t203);
																		_t211 = E00B50A84(_t203, _t209, _t211, _t245);
																		if(_t211 >= 0) {
																			if(_t211 != 1) {
																				_t248 =  *((char*)(_t212 - 0x35));
																				if( *((char*)(_t212 - 0x35)) != 0) {
																					 *((intOrPtr*)(_t209 + 0x40)) = 2;
																				}
																			}
																			_push(_t209);
																			_push(_t203);
																			_t211 = E00B4FE7D(_t203, _t209, _t211, _t248);
																			_t249 = _t211;
																			if(_t211 >= 0) {
																				_t211 = E00B50A54(_t204, _t249, _t203, "BurstSize", _t212 - 0x3c);
																				if(_t211 >= 0) {
																					_t251 = _t211 - 1;
																					if(_t211 != 1) {
																						 *(_t209 + 0x78) =  *(_t212 - 0x3c);
																						 *((char*)(_t209 + 0x74)) = 1;
																					}
																					_t211 = E00B50A54(_t204, _t251, _t203, "ThinkTime", _t212 - 0x3c);
																					if(_t211 >= 0) {
																						_t253 = _t211 - 1;
																						if(_t211 != 1) {
																							 *(_t209 + 0x7c) =  *(_t212 - 0x3c);
																							 *((char*)(_t209 + 0x80)) = 1;
																						}
																						_t211 = E00B50A54(_t204, _t253, _t203, "Throughput", _t212 - 0x3c);
																						if(_t211 >= 0) {
																							_t255 = _t211 - 1;
																							if(_t211 != 1) {
																								 *(_t209 + 0x84) =  *(_t212 - 0x3c);
																							}
																							_t211 = E00B50A54(_t204, _t255, _t203, "ThreadsPerFile", _t212 - 0x3c);
																							if(_t211 >= 0) {
																								_t257 = _t211 - 1;
																								if(_t211 != 1) {
																									 *(_t209 + 0x48) =  *(_t212 - 0x3c);
																								}
																								_push(_t212 - 0x40);
																								_push("FileSize");
																								_push(_t203);
																								_t211 = E00B509AA(_t203, _t209, _t211, _t257);
																								if(_t211 >= 0) {
																									_t259 = _t211 - 1;
																									if(_t211 != 1) {
																										 *((intOrPtr*)(_t209 + 0x60)) =  *((intOrPtr*)(_t212 - 0x40));
																										 *(_t209 + 0x64) =  *(_t212 - 0x3c);
																										 *((char*)(_t209 + 0x58)) = 1;
																									}
																									_push(_t212 - 0x40);
																									_push("MaxFileSize");
																									_push(_t203);
																									_t211 = E00B509AA(_t203, _t209, _t211, _t259);
																									if(_t211 >= 0) {
																										_t261 = _t211 - 1;
																										if(_t211 != 1) {
																											 *((intOrPtr*)(_t209 + 0x68)) =  *((intOrPtr*)(_t212 - 0x40));
																											 *(_t209 + 0x6c) =  *(_t212 - 0x3c);
																										}
																										_push(_t212 - 0x3c);
																										_push("WriteRatio");
																										_push(_t203);
																										_t211 = E00B506E9(_t203, _t209, _t211, _t261);
																										if(_t211 >= 0) {
																											_t263 = _t211 - 1;
																											if(_t211 != 1) {
																												 *(_t209 + 0x70) =  *(_t212 - 0x3c);
																											}
																											_push(_t212 - 0x35);
																											_push("ParallelAsyncIO");
																											_push(_t203);
																											_t211 = E00B50A84(_t203, _t209, _t211, _t263);
																											if(_t211 >= 0) {
																												_t265 = _t211 - 1;
																												if(_t211 != 1) {
																													 *((char*)(_t209 + 0x38)) =  *((intOrPtr*)(_t212 - 0x35));
																												}
																												_push(_t212 - 0x40);
																												_push("ThreadStride");
																												_push(_t203);
																												_t211 = E00B509AA(_t203, _t209, _t211, _t265);
																												if(_t211 >= 0) {
																													_t267 = _t211 - 1;
																													if(_t211 != 1) {
																														 *((intOrPtr*)(_t209 + 0x50)) =  *((intOrPtr*)(_t212 - 0x40));
																														 *(_t209 + 0x54) =  *(_t212 - 0x3c);
																													}
																													_push(_t212 - 0x3c);
																													_push("IOPriority");
																													_push(_t203);
																													_t211 = E00B506E9(_t203, _t209, _t211, _t267);
																													if(_t211 >= 0 && _t211 != 1) {
																														 *(_t212 - 0x1c) =  *(_t212 - 0x1c) & 0x00000000;
																														 *((intOrPtr*)(_t212 - 0x18)) = 1;
																														 *((intOrPtr*)(_t212 - 0x14)) = 2;
																														 *((intOrPtr*)(_t209 + 0xb4)) =  *((intOrPtr*)(_t212 +  *(_t212 - 0x3c) * 4 - 0x20));
																													}
																												}
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				E00B4A1B9(_t212 - 0x34, 1, 0);
				return E00B5D100(_t203, _t209, _t211);
			}

0x00b4fffd
0x00b4fffd
0x00b4fffd
0x00b50004
0x00b50009
0x00b5000e
0x00b50011
0x00b50018
0x00b5001b
0x00b5001e
0x00b50024
0x00b50025
0x00b5002a
0x00b50030
0x00b50034
0x00b50081
0x00b50085
0x00b5008b
0x00b5008e
0x00b50093
0x00b50093
0x00b50099
0x00b5009a
0x00b5009f
0x00b500a5
0x00b500a9
0x00b500c7
0x00b500c8
0x00b500cd
0x00b500d3
0x00b500d7
0x00b500dd
0x00b500e0
0x00b500e5
0x00b500e5
0x00b500eb
0x00b500ec
0x00b500f1
0x00b500f7
0x00b500fb
0x00b50115
0x00b50116
0x00b5011b
0x00b50121
0x00b50125
0x00b5012b
0x00b5012e
0x00b50133
0x00b50133
0x00b5013c
0x00b5013d
0x00b50142
0x00b50148
0x00b5014c
0x00b50163
0x00b50164
0x00b50169
0x00b5016f
0x00b50173
0x00b50179
0x00b5017c
0x00b50181
0x00b50181
0x00b5018a
0x00b5018b
0x00b50190
0x00b50196
0x00b5019a
0x00b501bd
0x00b501c1
0x00b501c7
0x00b501ca
0x00b501cf
0x00b501cf
0x00b501d5
0x00b501d6
0x00b501db
0x00b501e1
0x00b501e5
0x00b501eb
0x00b501ee
0x00b501f3
0x00b501f9
0x00b501ff
0x00b501ff
0x00b50205
0x00b50206
0x00b5020b
0x00b50211
0x00b50215
0x00b5021e
0x00b50220
0x00b50224
0x00b50226
0x00b50226
0x00b50224
0x00b50230
0x00b50231
0x00b50236
0x00b5023c
0x00b50240
0x00b50249
0x00b5024b
0x00b5024f
0x00b50253
0x00b50254
0x00b50257
0x00b50257
0x00b5024f
0x00b5025d
0x00b5025e
0x00b50263
0x00b50269
0x00b5026d
0x00b50276
0x00b50278
0x00b5027c
0x00b5027e
0x00b5027e
0x00b5027c
0x00b50288
0x00b50289
0x00b5028e
0x00b50294
0x00b50298
0x00b502a1
0x00b502a3
0x00b502a7
0x00b502a9
0x00b502a9
0x00b502a7
0x00b502b0
0x00b502b1
0x00b502b7
0x00b502b9
0x00b502bb
0x00b502d0
0x00b502d4
0x00b502da
0x00b502dd
0x00b502e2
0x00b502e5
0x00b502e5
0x00b502f8
0x00b502fc
0x00b50302
0x00b50305
0x00b5030a
0x00b5030d
0x00b5030d
0x00b50323
0x00b50327
0x00b5032d
0x00b50330
0x00b50335
0x00b50335
0x00b5034a
0x00b5034e
0x00b50354
0x00b50357
0x00b5035c
0x00b5035c
0x00b50362
0x00b50363
0x00b50368
0x00b5036e
0x00b50372
0x00b50378
0x00b5037b
0x00b50380
0x00b50386
0x00b50389
0x00b50389
0x00b50390
0x00b50391
0x00b50396
0x00b5039c
0x00b503a0
0x00b503a6
0x00b503a9
0x00b503ae
0x00b503b4
0x00b503b4
0x00b503ba
0x00b503bb
0x00b503c0
0x00b503c6
0x00b503ca
0x00b503d0
0x00b503d3
0x00b503d8
0x00b503d8
0x00b503de
0x00b503df
0x00b503e4
0x00b503ea
0x00b503ee
0x00b503f0
0x00b503f3
0x00b503f8
0x00b503f8
0x00b503fe
0x00b503ff
0x00b50404
0x00b5040a
0x00b5040e
0x00b50410
0x00b50413
0x00b50418
0x00b5041e
0x00b5041e
0x00b50424
0x00b50425
0x00b5042a
0x00b50430
0x00b50434
0x00b5043e
0x00b50442
0x00b50449
0x00b50454
0x00b50454
0x00b50434
0x00b5040e
0x00b503ee
0x00b503ca
0x00b503a0
0x00b50372
0x00b5034e
0x00b50327
0x00b502fc
0x00b502d4
0x00b502bb
0x00b50298
0x00b5026d
0x00b50240
0x00b50215
0x00b501e5
0x00b501c1
0x00b5019a
0x00b50173
0x00b5014c
0x00b50125
0x00b500fb
0x00b500d7
0x00b500a9
0x00b50085
0x00b50461
0x00b5046d

APIs

__EH_prolog3_GS.LIBCMT ref: 00B50004

Part of subcall function 00B5086D: __EH_prolog3_GS.LIBCMT ref: 00B50877
Part of subcall function 00B5086D: memset.MSVCRT ref: 00B5090E
Part of subcall function 00B5086D: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000103,00000000,00000000), ref: 00B50949
Part of subcall function 00B5086D: SysFreeString.OLEAUT32(?), ref: 00B5097D
Part of subcall function 00B5086D: VariantClear.OLEAUT32(?), ref: 00B5098A

Part of subcall function 00B506E9: __EH_prolog3_GS.LIBCMT ref: 00B506F0
Part of subcall function 00B506E9: _wtoi.MSVCRT ref: 00B5075A
Part of subcall function 00B506E9: SysFreeString.OLEAUT32(?), ref: 00B50769
Part of subcall function 00B506E9: VariantClear.OLEAUT32(?), ref: 00B50773

Strings

Random, xrefs: 00B501D6
RandomAccess, xrefs: 00B5013D
BaseFileOffset, xrefs: 00B500EC
ThinkTime, xrefs: 00B502ED
FileSize, xrefs: 00B50363
RequestCount, xrefs: 00B501B2
StrideSize, xrefs: 00B5009A
TemporaryFile, xrefs: 00B50164
DisableAllCache, xrefs: 00B50231
Throughput, xrefs: 00B50318
WriteThrough, xrefs: 00B50289
SequentialScan, xrefs: 00B50116
MaxFileSize, xrefs: 00B50391
IOPriority, xrefs: 00B50425
BurstSize, xrefs: 00B502C5
DisableLocalCache, xrefs: 00B5025E
DisableOSCache, xrefs: 00B50206
Path, xrefs: 00B50025
InterlockedSequential, xrefs: 00B500C8
UseLargePages, xrefs: 00B5018B
ThreadsPerFile, xrefs: 00B5033F
ThreadStride, xrefs: 00B503FF
BlockSize, xrefs: 00B50076
ParallelAsyncIO, xrefs: 00B503DF
WriteRatio, xrefs: 00B503BB

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: H_prolog3_$ClearFreeStringVariant$ByteCharMultiWide_wtoimemset
String ID: BaseFileOffset$BlockSize$BurstSize$DisableAllCache$DisableLocalCache$DisableOSCache$FileSize$IOPriority$InterlockedSequential$MaxFileSize$ParallelAsyncIO$Path$Random$RandomAccess$RequestCount$SequentialScan$StrideSize$TemporaryFile$ThinkTime$ThreadStride$ThreadsPerFile$Throughput$UseLargePages$WriteRatio$WriteThrough
API String ID: 283221528-1607452813
Opcode ID: 2c500c41138c4546703e74addd4b8f7960006e51f646ad3f5c1b828c2383b4c1
Instruction ID: bd8be8ed599a70b6394971699ccb2941d6188152fd0f88fa765e92d83c229cb2
Opcode Fuzzy Hash: 2c500c41138c4546703e74addd4b8f7960006e51f646ad3f5c1b828c2383b4c1
Instruction Fuzzy Hash: BDD19D72D11626AACF22FAA8D881B9EB7F8AB05701F0541D2FD50B7312D7B0ED18C791

Uniqueness

Uniqueness Score: -1.00%

Function 00B51B60 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 181
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00B51B60(void* __ecx, void* __fp0, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v52;
				signed int _t95;
				signed int _t97;
				char _t99;
				intOrPtr _t100;
				void _t101;
				intOrPtr _t104;
				void* _t105;
				int _t108;
				intOrPtr _t111;
				signed int _t115;
				intOrPtr _t116;
				void* _t130;
				signed int _t133;
				signed int _t135;
				signed int _t138;
				intOrPtr _t142;
				signed int _t148;
				signed int _t149;
				intOrPtr _t150;
				signed int _t151;
				signed int _t154;
				signed int _t155;
				intOrPtr _t156;
				signed int _t158;
				intOrPtr _t159;
				intOrPtr _t161;
				signed int _t162;
				signed int _t163;
				signed int _t166;
				char* _t169;
				intOrPtr _t170;
				signed int _t171;
				void* _t173;
				void* _t178;

				_t178 = __fp0;
				_t173 = (_t171 & 0xfffffff8) - 0x1c;
				_t161 = _a12;
				_t130 =  *(_t161 + 0x10);
				_v20 =  *((intOrPtr*)( *((intOrPtr*)(_t130 + 4)) + 0x31));
				if(_a4 == 0) {
					_t95 = _t161 -  *((intOrPtr*)(_t130 + 0x38));
					asm("cdq");
					_t133 = 0x14;
					_t148 = _t95 % _t133;
					_t154 = _t95 / _t133;
					_v12 = _t154;
					_t97 =  *( *((intOrPtr*)(_t130 + 0x44)) + _t154 * 4);
					_t135 = _t97 * 0xb8;
					_v28 = _t97;
					_t99 =  *((intOrPtr*)(_t130 + 8)) + _t135;
					_v8 = _t135;
					_v24 = _t99;
					_t100 =  *((intOrPtr*)(_t99 + 0x18));
					if(_a8 != _t100) {
						_push(_t100);
						_push(_a8);
						E00B51330(_t135, "Warning: thread %u transferred %u bytes instead of %u bytes\n",  *((intOrPtr*)(_t130 + 0x88)));
						_t173 = _t173 + 0x10;
					}
					_t101 =  *_t130;
					if( *((intOrPtr*)(_t101 + 0x10)) != 0 &&  *((intOrPtr*)(_t101 + 0x10)) == 1) {
						_push(".");
						E00B512F0(_t135);
					}
					if( *((char*)( *((intOrPtr*)(_t130 + 0x90)))) == 0) {
						_t155 = _v28;
					} else {
						_t155 = _v28;
						E00B50D77(_t155 * 0xc8 +  *((intOrPtr*)( *((intOrPtr*)(_t130 + 0x98)))), _t148, _t178, _a8,  *((intOrPtr*)( *((intOrPtr*)(_t130 + 0x5c)) + _t154 * 4)),  *((intOrPtr*)(_t130 + 0x68)) + _t154 * 8,  *((intOrPtr*)(_t130 + 0x94)), _v20,  *( *((intOrPtr*)(_t130 + 4)) + 0x32) & 0x000000ff);
					}
					_push( *((intOrPtr*)(_t161 + 0xc)));
					_t149 = _t155;
					_t156 = E00B51490(_t130, _t149,  *((intOrPtr*)(_t161 + 8)));
					_t162 = _t149;
					_t104 = _a12;
					_t150 = _v32;
					 *((intOrPtr*)(_t104 + 8)) = _t156;
					 *(_t104 + 0xc) = _t162;
					_t105 = E00B5D910(_t156, _t162,  *((intOrPtr*)(_t150 + 0x18)), 0);
					_push(_t150);
					_push(_t105);
					_push(_t162);
					_t163 = _v52;
					_push(_t156);
					_push(_t163);
					_t108 = E00B51370(_t130,  *( *_t130 + 0xc) & 0x000000ff, "t[%u:%u] new I/O op at %I64u (starting in block: %I64u)\n",  *((intOrPtr*)(_t130 + 0x88)));
					if( *0xb61634 != 0 &&  *0xb61640 == 0) {
						_t158 = _v16;
						_t138 = _t163 << 2;
						_v20 = _t138;
						_t166 = _t158 -  *((intOrPtr*)( *((intOrPtr*)(_t130 + 0x50)) + _t138));
						_v16 = _t166;
						if(_v24 != 0) {
							_t170 =  *((intOrPtr*)(_t130 + 0x68));
							 *((intOrPtr*)(_t170 + _t158 * 8)) = E00B4A975(_t138);
							 *((intOrPtr*)(_t170 + 4 + _t158 * 8)) = _t150;
							_t166 = _v16;
						}
						_t111 = E00B5170C( *((intOrPtr*)(_v28 + 0x70)));
						_v24 = _t111;
						_push(E00B51B60);
						_push(_a12);
						 *((intOrPtr*)( *((intOrPtr*)(_t130 + 0x5c)) + _t158 * 4)) = _t111;
						if(_t111 != 1) {
							_t141 = _t130;
							_t159 = _v32;
							_t108 = WriteFileEx( *( *((intOrPtr*)(_t130 + 0x14)) + _v20), E00B4C075(_t130, _t159, _v16),  *(_v28 + 0x18), ??, ??);
						} else {
							_t142 =  *((intOrPtr*)(_t130 + 8));
							_t115 = _v12;
							_t151 = _v20;
							_t116 =  *((intOrPtr*)(_t130 + 0x2c));
							_t141 =  *(_t142 + _t115 + 0x18) * _t166 +  *((intOrPtr*)(_t116 + _t151));
							_t108 = ReadFileEx( *( *((intOrPtr*)(_t130 + 0x14)) + _t151),  *(_t142 + _t115 + 0x18) * _t166 +  *((intOrPtr*)(_t116 + _t151)),  *(_v28 + 0x18), ??, ??);
							_t159 = _v36;
						}
						if(_t108 == 0) {
							_t169 = "read";
							if(_v28 != 1) {
								_t169 = "write";
							}
							_push(GetLastError());
							_push(_t169);
							_push(_t159);
							_t108 = E00B51330(_t141, "t[%u:%u] error during %s error code: %u)\n",  *((intOrPtr*)(_t130 + 0x88)));
						}
					}
				} else {
					_push(_a4);
					_t108 = E00B51330(__ecx, "Thread %u failed executing an I/O operation (error code: %u)\n",  *((intOrPtr*)(_t130 + 0x88)));
				}
				return _t108;
			}

0x00b51b60
0x00b51b68
0x00b51b71
0x00b51b75
0x00b51b7e
0x00b51b82
0x00b51ba1
0x00b51ba4
0x00b51ba7
0x00b51ba8
0x00b51bad
0x00b51baf
0x00b51bb3
0x00b51bb6
0x00b51bbc
0x00b51bc3
0x00b51bc5
0x00b51bc9
0x00b51bcd
0x00b51bd3
0x00b51bd5
0x00b51bd6
0x00b51be4
0x00b51be9
0x00b51be9
0x00b51bec
0x00b51bf2
0x00b51bfa
0x00b51bff
0x00b51c04
0x00b51c0e
0x00b51c4b
0x00b51c10
0x00b51c2f
0x00b51c44
0x00b51c44
0x00b51c4f
0x00b51c52
0x00b51c5e
0x00b51c60
0x00b51c62
0x00b51c65
0x00b51c6b
0x00b51c6e
0x00b51c76
0x00b51c7b
0x00b51c7c
0x00b51c7f
0x00b51c80
0x00b51c84
0x00b51c89
0x00b51c96
0x00b51ca5
0x00b51cbd
0x00b51cc3
0x00b51cc6
0x00b51cca
0x00b51cd2
0x00b51cd6
0x00b51cd8
0x00b51ce0
0x00b51ce3
0x00b51ce7
0x00b51ce7
0x00b51cf2
0x00b51cfa
0x00b51cfe
0x00b51d03
0x00b51d06
0x00b51d0c
0x00b51d45
0x00b51d4a
0x00b51d62
0x00b51d0e
0x00b51d0e
0x00b51d11
0x00b51d15
0x00b51d1d
0x00b51d23
0x00b51d35
0x00b51d3b
0x00b51d3b
0x00b51d6a
0x00b51d71
0x00b51d76
0x00b51d78
0x00b51d78
0x00b51d83
0x00b51d84
0x00b51d85
0x00b51d91
0x00b51d96
0x00b51d6a
0x00b51b84
0x00b51b84
0x00b51b92
0x00b51b97
0x00b51d9f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B51C76

Strings

read, xrefs: 00B51D71, 00B51D84
Warning: thread %u transferred %u bytes instead of %u bytes, xrefs: 00B51BDF
t[%u:%u] error during %s error code: %u), xrefs: 00B51D8C
Thread %u failed executing an I/O operation (error code: %u), xrefs: 00B51B8D
write, xrefs: 00B51D78
t[%u:%u] new I/O op at %I64u (starting in block: %I64u), xrefs: 00B51C90

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: Thread %u failed executing an I/O operation (error code: %u)$Warning: thread %u transferred %u bytes instead of %u bytes$read$t[%u:%u] error during %s error code: %u)$t[%u:%u] new I/O op at %I64u (starting in block: %I64u)$write
API String ID: 885266447-1044934336
Opcode ID: 01b2bee46ca6a7a0634f94eca0fe4d4cc446fdac4ba6426f15dd541ed1b28aa6
Instruction ID: aea955a9895fa917ebbe1e4025a7365f9d46b0d55615ed075139948af32ee398
Opcode Fuzzy Hash: 01b2bee46ca6a7a0634f94eca0fe4d4cc446fdac4ba6426f15dd541ed1b28aa6
Instruction Fuzzy Hash: 79714A755042009FCB14DF58C884B6ABBE5FF89311F0948E9FC489B266C731ED49DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B50FB0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 85
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00B50FB0(void* __ebx, void* __ecx) {
				signed int _v8;
				intOrPtr _v28;
				intOrPtr _v32;
				void _v40;
				long _v44;
				struct _OVERLAPPED _v64;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t16;
				intOrPtr _t22;
				long _t24;
				void* _t30;
				intOrPtr _t38;
				void* _t41;
				signed int _t43;

				_t31 = __ecx;
				_t30 = __ebx;
				_t13 =  *0xb61000; // 0xba7e72c4
				_v8 = _t13 ^ _t43;
				asm("stosd");
				_t41 = __ecx;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t16 = CreateEventA(0, 0, 0, 0);
				_v64.hEvent = _t16;
				if(_t16 != 0) {
					_v44 = 0;
					_t41 = DeviceIoControl(_t41, 0x74004, 0, 0,  &_v40, 0x20,  &_v44,  &_v64);
					if(_t41 == 0) {
						_t24 = GetLastError();
						if(_t24 != 0x3e5) {
							_push(_t24);
							_push("ERROR: Could not obtain partition info (error code: %u)\n");
							goto L9;
						} else {
							if(WaitForSingleObject(_v64.hEvent, 0xffffffff) == 0) {
								_t41 = 1;
							} else {
								_push(GetLastError());
								_push("ERROR: Failed while waiting for event to be signaled (error code: %u)\n");
								L9:
								E00B51330(_t31);
							}
						}
					}
					CloseHandle(_v64.hEvent);
					if(_t41 == 0) {
						goto L2;
					} else {
						_t22 = _v32;
						_t38 = _v28;
					}
				} else {
					E00B51330(_t31, "ERROR: Failed to create event (error code: %u)\n", GetLastError());
					L2:
					_t22 = 0;
					_t38 = 0;
				}
				return E00B5CFA0(_t22, _t30, _v8 ^ _t43, _t38, 0, _t41);
			}

0x00b50fb0
0x00b50fb0
0x00b50fb8
0x00b50fbf
0x00b50fc9
0x00b50fca
0x00b50fcc
0x00b50fcd
0x00b50fce
0x00b50fcf
0x00b50fd6
0x00b50fdc
0x00b50fe1
0x00b50fff
0x00b5101b
0x00b5101f
0x00b51021
0x00b5102c
0x00b51050
0x00b51051
0x00000000
0x00b5102e
0x00b5103b
0x00b5104d
0x00b5103d
0x00b51043
0x00b51044
0x00b51056
0x00b51056
0x00b5105c
0x00b5103b
0x00b5102c
0x00b51060
0x00b51068
0x00000000
0x00b5106a
0x00b5106a
0x00b5106d
0x00b5106d
0x00b50fe3
0x00b50fef
0x00b50ff6
0x00b50ff6
0x00b50ff8
0x00b50ff8
0x00b5107f

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00B50FD6
GetLastError.KERNEL32 ref: 00B50FE3
DeviceIoControl.KERNEL32(?,00074004,00000000,00000000,?,00000020,?,00000003), ref: 00B51015
GetLastError.KERNEL32 ref: 00B51021
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B51033
GetLastError.KERNEL32 ref: 00B5103D
CloseHandle.KERNEL32(?), ref: 00B51060

Strings

ERROR: Failed to create event (error code: %u), xrefs: 00B50FEA
ERROR: Could not obtain partition info (error code: %u), xrefs: 00B51051
ERROR: Failed while waiting for event to be signaled (error code: %u), xrefs: 00B51044

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceEventHandleObjectSingleWait
String ID: ERROR: Could not obtain partition info (error code: %u)$ERROR: Failed to create event (error code: %u)$ERROR: Failed while waiting for event to be signaled (error code: %u)
API String ID: 3935222316-1037057180
Opcode ID: 72f21173223bbe9f113bb89262cf53970338627763f0eba98b25fd89bffabb91
Instruction ID: 8ec0af8809fe7da0bffbedec48cbf0911860f41e365dc1709661ada23a5a3b16
Opcode Fuzzy Hash: 72f21173223bbe9f113bb89262cf53970338627763f0eba98b25fd89bffabb91
Instruction Fuzzy Hash: 7D212B31904544BFA7209B68DC04FAFB7B9EB85711B104195FD01E31D0DE604C04C666

Uniqueness

Uniqueness Score: -1.00%

Function 00B5057C Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00B5057C(void* __ebx, short __edi, void* __esi, void* __eflags) {
				intOrPtr* _t42;
				void* _t44;
				intOrPtr* _t49;
				void* _t51;
				intOrPtr* _t52;
				int _t59;
				void* _t86;
				void* _t87;
				void* _t88;

				_t88 = __eflags;
				_t79 = __edi;
				E00B5D14C(0xb5e2fa, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t86 - 0x20)) = 0;
				 *((intOrPtr*)(_t86 - 4)) = 0;
				 *((short*)(_t86 - 0x38)) = 0;
				E00B4F15E(0, _t86 - 0x38, __edi, __esi, _t88);
				_t42 =  *((intOrPtr*)(_t86 + 8));
				 *((char*)(_t86 - 4)) = 1;
				 *0xb621f8(_t42,  *((intOrPtr*)(_t86 - 0x30)), _t86 - 0x20, "Affinity/AffinityGroupAssignment", 0x2c);
				_t44 =  *((intOrPtr*)( *((intOrPtr*)( *_t42 + 0x90))))();
				_t83 = _t44;
				if(_t44 < 0) {
					L12:
					__imp__#9(_t86 - 0x38);
					E00B4F72B(_t86 - 0x20);
					return E00B5D100(0, _t79, _t83);
				}
				_t49 =  *((intOrPtr*)(_t86 - 0x20));
				 *0xb621f8(_t49, _t86 - 0x24);
				_t51 =  *((intOrPtr*)( *((intOrPtr*)( *_t49 + 0x20))))();
				_t83 = _t51;
				if(_t51 < 0) {
					goto L12;
				}
				_t79 = 0;
				if( *((intOrPtr*)(_t86 - 0x24)) <= 0) {
					goto L12;
				} else {
					goto L3;
				}
				do {
					L3:
					 *((intOrPtr*)(_t86 - 0x1c)) = 0;
					 *((char*)(_t86 - 4)) = 2;
					_t52 =  *((intOrPtr*)(_t86 - 0x20));
					 *0xb621f8(_t52, _t79, _t86 - 0x1c);
					_t83 =  *((intOrPtr*)( *_t52 + 0x1c))();
					_t92 = _t83;
					if(_t83 >= 0) {
						 *((intOrPtr*)(_t86 - 0x18)) = 0;
						_push(_t86 - 0x18);
						_push("Group");
						_push( *((intOrPtr*)(_t86 - 0x1c)));
						 *((intOrPtr*)(_t86 - 0x14)) = 0;
						_t83 = E00B50790(0, _t79, _t83, _t92);
						_t93 = _t83;
						if(_t83 >= 0) {
							_push(_t86 - 0x14);
							_push("Processor");
							_push( *((intOrPtr*)(_t86 - 0x1c)));
							_t59 = E00B50790(0, _t79, _t83, _t93);
							if( *((intOrPtr*)(_t86 - 0x14)) > 0xff) {
								_push( *((intOrPtr*)(_t86 - 0x14)));
								_t59 = fprintf(E00B5D7CD(_t59, 2), "ERROR: profile specifies group assignment to core %u, out of range\n");
								_t87 = _t87 + 0xc;
								_t83 = 0x8007000d;
							}
							if( *((intOrPtr*)(_t86 - 0x18)) > 0xffff) {
								_push( *((intOrPtr*)(_t86 - 0x18)));
								fprintf(E00B5D7CD(_t59, 2), "ERROR: profile specifies group assignment group %u, out of range\n");
								_t87 = _t87 + 0xc;
								_t83 = 0x8007000d;
							}
							if(_t83 >= 0) {
								E00B4CA4A( *((intOrPtr*)(_t86 + 0xc)),  *((intOrPtr*)(_t86 - 0x18)),  *((intOrPtr*)(_t86 - 0x14)));
							}
						}
					}
					 *((char*)(_t86 - 4)) = 1;
					E00B4F72B(_t86 - 0x1c);
					_t79 = _t79 + 1;
				} while (_t79 <  *((intOrPtr*)(_t86 - 0x24)));
				goto L12;
			}

0x00b5057c
0x00b5057c
0x00b50583
0x00b5058a
0x00b5058f
0x00b5059a
0x00b5059e
0x00b505a3
0x00b505a9
0x00b505bc
0x00b505c2
0x00b505c4
0x00b505c8
0x00b506c8
0x00b506cc
0x00b506d5
0x00b506e1
0x00b506e1
0x00b505ce
0x00b505dd
0x00b505e3
0x00b505e5
0x00b505e9
0x00000000
0x00000000
0x00b505ef
0x00b505f4
0x00000000
0x00000000
0x00000000
0x00000000
0x00b505fa
0x00b505fa
0x00b505fa
0x00b505fd
0x00b50604
0x00b5060f
0x00b50618
0x00b5061a
0x00b5061c
0x00b50625
0x00b50628
0x00b50629
0x00b5062e
0x00b50631
0x00b50639
0x00b5063b
0x00b5063d
0x00b50642
0x00b50643
0x00b50648
0x00b5064b
0x00b50657
0x00b50659
0x00b5066a
0x00b50670
0x00b50673
0x00b50673
0x00b5067f
0x00b50681
0x00b50692
0x00b50698
0x00b5069b
0x00b5069b
0x00b506a2
0x00b506ad
0x00b506ad
0x00b506a2
0x00b5063d
0x00b506b5
0x00b506b9
0x00b506be
0x00b506bf
0x00000000

APIs

__EH_prolog3_GS.LIBCMT ref: 00B50583

Part of subcall function 00B4F15E: __EH_prolog3_GS.LIBCMT ref: 00B4F165
Part of subcall function 00B4F15E: VariantClear.OLEAUT32 ref: 00B4F17A
Part of subcall function 00B4F15E: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,-00000008,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F215
Part of subcall function 00B4F15E: SysAllocString.OLEAUT32(00000000), ref: 00B4F228
Part of subcall function 00B4F15E: free.MSVCRT(00000000,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F257

VariantClear.OLEAUT32(?), ref: 00B506CC

Part of subcall function 00B50790: __EH_prolog3_GS.LIBCMT ref: 00B50797
Part of subcall function 00B50790: _wtoi.MSVCRT ref: 00B5081D
Part of subcall function 00B50790: SysFreeString.OLEAUT32(?), ref: 00B5082C
Part of subcall function 00B50790: SysFreeString.OLEAUT32(?), ref: 00B5083D

fprintf.MSVCRT ref: 00B5066A
fprintf.MSVCRT ref: 00B50692

Part of subcall function 00B5D7CD: __iob_func.MSVCRT ref: 00B5D7D2

Strings

Group, xrefs: 00B50629
Affinity/AffinityGroupAssignment, xrefs: 00B50592
Processor, xrefs: 00B50643
ERROR: profile specifies group assignment to core %u, out of range, xrefs: 00B5065C
ERROR: profile specifies group assignment group %u, out of range, xrefs: 00B50684

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: H_prolog3_String$ClearFreeVariantfprintf$AllocByteCharMultiWide__iob_func_wtoifree
String ID: Affinity/AffinityGroupAssignment$ERROR: profile specifies group assignment group %u, out of range$ERROR: profile specifies group assignment to core %u, out of range$Group$Processor
API String ID: 1108869389-696485494
Opcode ID: 9e420c2421278bdeb03712e04e71598dd12738f591227bf695a039e94266eca7
Instruction ID: 2265f9f92dd4322467f3318f7e3111d3624998e0b0eb8525f16324c5e15e836e
Opcode Fuzzy Hash: 9e420c2421278bdeb03712e04e71598dd12738f591227bf695a039e94266eca7
Instruction Fuzzy Hash: C941B271D0122AAFDF10EFA4D845AAEBBF4AF08701F0040E8ED01B7251CB746E49DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B51DA7 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 146
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00B51DA7(signed int __ecx) {
				char _v5;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				long _t92;
				intOrPtr _t94;
				signed int _t97;
				int _t107;
				intOrPtr _t110;
				int _t115;
				signed int _t122;
				signed int _t124;
				intOrPtr _t125;
				signed int _t131;
				intOrPtr _t134;
				char* _t137;
				intOrPtr _t138;

				_t131 = __ecx;
				_v16 = _v16 & 0x00000000;
				_t117 = 0;
				_t115 = 1;
				_v12 = 0;
				_v5 =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 4)) + 0x31));
				asm("cdq");
				if(( *((intOrPtr*)(__ecx + 0xc)) -  *((intOrPtr*)(__ecx + 8))) / 0xb8 == 0) {
					goto L20;
				} else {
					_t94 = 0;
					_v32 = 0;
					while(1) {
						_v28 = _v28 & 0x00000000;
						_t134 =  *((intOrPtr*)(_t131 + 8)) + _t94;
						_v20 = _t134;
						if( *((intOrPtr*)(_t134 + 0x1c)) <= 0) {
							goto L12;
						}
						_v24 = _v16 * 0x14;
						L4:
						L4:
						if(_v5 != 0) {
							_t138 =  *((intOrPtr*)(_t131 + 0x68));
							_t110 = E00B4A975(_t117);
							_t122 = _v16;
							 *((intOrPtr*)(_t138 + _t122 * 8)) = _t110;
							 *(_t138 + 4 + _t122 * 8) = _t124;
							_t134 = _v20;
						}
						_t125 = E00B5170C( *((intOrPtr*)(_t134 + 0x70)));
						_v36 = _t125;
						_push(E00B51B60);
						 *((intOrPtr*)( *((intOrPtr*)(_t131 + 0x5c)) + _v16 * 4)) = _t125;
						if(_t125 != _t115) {
							_t117 = _t131;
							_t107 = WriteFileEx( *( *((intOrPtr*)(_t131 + 0x14)) + _v12 * 4), E00B4C075(_t131, _v12, _v28),  *(_v20 + 0x18),  *((intOrPtr*)(_t131 + 0x38)) + _v24);
							_t134 = _v20;
						} else {
							_t117 = _v12;
							_t134 = _v20;
							_t107 = ReadFileEx( *( *((intOrPtr*)(_t131 + 0x14)) + _v12 * 4),  *( *((intOrPtr*)(_t131 + 8)) + _v32 + 0x18) * _v28 +  *((intOrPtr*)( *((intOrPtr*)(_t131 + 0x2c)) + _v12 * 4)),  *(_t134 + 0x18),  *((intOrPtr*)(_t131 + 0x38)) + _v24);
						}
						if(_t107 == 0) {
							goto L14;
						}
						_v16 = _v16 + 1;
						_v24 = _v24 + 0x14;
						_t124 = _v28 + 1;
						_v28 = _t124;
						if(_t124 <  *((intOrPtr*)(_t134 + 0x1c))) {
							goto L4;
						} else {
							_t117 = _v12;
							_t94 = _v32;
							goto L12;
						}
						goto L24;
						L14:
						_t137 = "read";
						if(_v36 != _t115) {
							_t137 = "write";
						}
						_push(GetLastError());
						_push(_t137);
						_push(_v12);
						E00B51330(_t117, "t[%u:%u] error during %s error code: %u)\n",  *((intOrPtr*)(_t131 + 0x88)));
						L23:
						_t115 = 0;
						goto L24;
						L12:
						_t117 = _t117 + 1;
						_v12 = _t117;
						_v32 = _t94 + 0xb8;
						_t97 =  *((intOrPtr*)(_t131 + 0xc)) -  *((intOrPtr*)(_t131 + 8));
						asm("cdq");
						_t124 = _t97 % 0xb8;
						if(_t117 >= _t97 / 0xb8) {
							L20:
							while( *0xb61634 != 0) {
								if( *0xb61640 == 0) {
									_t92 = WaitForSingleObjectEx( *(_t131 + 0xa8), 0xffffffff, _t115);
									if(_t92 == 0xc0 || _t92 == 0) {
										continue;
									} else {
										E00B51330(_t117, "Error in thread %u during WaitForSingleObjectEx (in completion routines)\n",  *((intOrPtr*)(_t131 + 0x88)));
										goto L23;
									}
								}
								goto L24;
							}
						} else {
							_t94 = _v32;
							continue;
						}
						goto L24;
					}
				}
				L24:
				return _t115;
			}

0x00b51db2
0x00b51db4
0x00b51dbf
0x00b51dc1
0x00b51dc2
0x00b51dcb
0x00b51dd4
0x00b51dd9
0x00000000
0x00b51ddf
0x00b51ddf
0x00b51de1
0x00b51de4
0x00b51de7
0x00b51deb
0x00b51ded
0x00b51df4
0x00000000
0x00000000
0x00b51dfe
0x00000000
0x00b51e01
0x00b51e05
0x00b51e07
0x00b51e0a
0x00b51e0f
0x00b51e12
0x00b51e15
0x00b51e19
0x00b51e19
0x00b51e27
0x00b51e2c
0x00b51e2f
0x00b51e34
0x00b51e39
0x00b51e71
0x00b51e92
0x00b51e98
0x00b51e3b
0x00b51e47
0x00b51e56
0x00b51e66
0x00b51e66
0x00b51e9d
0x00000000
0x00000000
0x00b51ea2
0x00b51ea5
0x00b51ea9
0x00b51eaa
0x00b51eb0
0x00000000
0x00b51eb6
0x00b51eb6
0x00b51eb9
0x00000000
0x00b51eb9
0x00000000
0x00b51edf
0x00b51edf
0x00b51ee7
0x00b51ee9
0x00b51ee9
0x00b51ef4
0x00b51ef5
0x00b51ef6
0x00b51f04
0x00b51f4e
0x00b51f4e
0x00000000
0x00b51ebc
0x00b51ec1
0x00b51ec4
0x00b51ec7
0x00b51ecd
0x00b51ed0
0x00b51ed1
0x00b51ed5
0x00000000
0x00b51f31
0x00b51f15
0x00b51f20
0x00b51f2b
0x00000000
0x00b51f3c
0x00b51f47
0x00000000
0x00b51f4d
0x00b51f2b
0x00000000
0x00b51f15
0x00b51ed7
0x00b51ed7
0x00000000
0x00b51ed7
0x00000000
0x00b51ed5
0x00b51de4
0x00b51f52
0x00b51f58

APIs

ReadFileEx.KERNEL32(00000010,00000000,00000004,?,00B51B60,000000B8,00000000,?), ref: 00B51E66
WriteFileEx.KERNEL32(00000010,00000000,?,00000000,00000004,?,00B51B60,000000B8,00000000,?), ref: 00B51E92
GetLastError.KERNEL32 ref: 00B51EEE
WaitForSingleObjectEx.KERNEL32(?,000000FF,00000001,000000B8,00000000,?), ref: 00B51F20

Strings

Error in thread %u during WaitForSingleObjectEx (in completion routines), xrefs: 00B51F42
read, xrefs: 00B51EDF
t[%u:%u] error during %s error code: %u), xrefs: 00B51EFF
write, xrefs: 00B51EE9, 00B51EF5

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: File$ErrorLastObjectReadSingleWaitWrite
String ID: Error in thread %u during WaitForSingleObjectEx (in completion routines)$read$t[%u:%u] error during %s error code: %u)$write
API String ID: 781436170-3983133461
Opcode ID: c8a46b8453c430d82f957edd6201d1023b1d629a551d918528158f9bf56debe4
Instruction ID: eaa60ef4c30d483014dddc71715aef3968b8467a496752da4a32a7a45f2cf785
Opcode Fuzzy Hash: c8a46b8453c430d82f957edd6201d1023b1d629a551d918528158f9bf56debe4
Instruction Fuzzy Hash: 7F515A75E00619AFCB14CF99C881BAEBBF5FB48311F1589E9E815A3650C730AD55CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B4FE7D Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00B4FE7D(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t49;
				signed int _t54;
				void* _t56;
				signed int _t57;
				void* _t64;
				void* _t66;
				void* _t68;
				intOrPtr _t72;
				void* _t82;
				void* _t84;
				void* _t86;
				void* _t98;
				void* _t99;

				_t99 = __eflags;
				E00B5D14C(0xb5e23c, __ebx, __edi, __esi);
				_t90 =  *(_t98 + 8);
				_t72 =  *((intOrPtr*)(_t98 + 0xc));
				 *(_t98 - 0x30) =  *(_t98 - 0x30) & 0x00000000;
				 *(_t98 - 4) =  *(_t98 - 4) & 0x00000000;
				 *((short*)(_t98 - 0x48)) = 0;
				E00B4F15E(_t72, _t98 - 0x48, _t90, __esi, _t99);
				 *(_t98 - 4) = 1;
				 *0xb621f8(_t90,  *((intOrPtr*)(_t98 - 0x40)), _t98 - 0x30, "WriteBufferContent", 0x3c);
				_t49 =  *((intOrPtr*)( *((intOrPtr*)( *_t90 + 0x90))))();
				_t94 = _t49;
				if(_t49 < 0) {
					L14:
					__imp__#9(_t98 - 0x48);
					E00B4F72B(_t98 - 0x30);
					return E00B5D100(_t72, _t90, _t94);
				}
				_t54 =  *(_t98 - 0x30);
				 *0xb621f8(_t54, _t98 - 0x34);
				_t56 =  *((intOrPtr*)( *((intOrPtr*)( *_t54 + 0x20))))();
				_t94 = _t56;
				if(_t56 < 0 ||  *((intOrPtr*)(_t98 - 0x34)) != 1) {
					goto L14;
				} else {
					 *(_t98 - 0x2c) =  *(_t98 - 0x2c) & 0x00000000;
					 *(_t98 - 4) = 2;
					_t57 =  *(_t98 - 0x30);
					 *0xb621f8(_t57, 0, _t98 - 0x2c);
					_t94 =  *((intOrPtr*)( *_t57 + 0x1c))();
					_t103 = _t94;
					if(_t94 < 0) {
						L13:
						E00B4F72B(_t98 - 0x2c);
						goto L14;
					} else {
						 *(_t98 - 0x18) =  *(_t98 - 0x18) & 0x00000000;
						 *((intOrPtr*)(_t98 - 0x14)) = 0xf;
						 *((char*)(_t98 - 0x28)) = 0;
						 *(_t98 - 4) = 3;
						_push(_t98 - 0x28);
						_push("Pattern");
						_push( *(_t98 - 0x2c));
						_t94 = E00B5086D(_t72, _t90, _t94, _t103);
						if(_t94 >= 0 && _t94 != 1) {
							_t90 = "sequential";
							_t64 = E00B49AB6("sequential");
							_pop(_t82);
							if(E00B4C383(_t98 - 0x28, _t82,  *(_t98 - 0x18), "sequential", _t64) != 0) {
								_t90 = "zero";
								_t66 = E00B49AB6("zero");
								_pop(_t84);
								if(E00B4C383(_t98 - 0x28, _t84,  *(_t98 - 0x18), "zero", _t66) != 0) {
									_t97 = "random";
									_t68 = E00B49AB6("random");
									_pop(_t86);
									__eflags = E00B4C383(_t98 - 0x28, _t86,  *(_t98 - 0x18), "random", _t68);
									if(__eflags != 0) {
										_t94 = 0x80070057;
									} else {
										_push(_t72);
										_push( *(_t98 - 0x2c));
										_t94 = E00B4FD31(_t72, _t90, _t97, __eflags);
									}
								} else {
									 *((char*)(_t72 + 0x44)) = 1;
								}
							}
						}
						E00B4A1B9(_t98 - 0x28, 1, 0);
						goto L13;
					}
				}
			}

0x00b4fe7d
0x00b4fe84
0x00b4fe89
0x00b4fe8c
0x00b4fe8f
0x00b4fe93
0x00b4fea1
0x00b4fea5
0x00b4feaa
0x00b4fec0
0x00b4fec6
0x00b4fec8
0x00b4fecc
0x00b4ffdc
0x00b4ffe0
0x00b4ffe9
0x00b4fff5
0x00b4fff5
0x00b4fed2
0x00b4fee1
0x00b4fee7
0x00b4fee9
0x00b4feed
0x00000000
0x00b4fefd
0x00b4fefd
0x00b4ff01
0x00b4ff08
0x00b4ff14
0x00b4ff1d
0x00b4ff1f
0x00b4ff21
0x00b4ffd4
0x00b4ffd7
0x00000000
0x00b4ff27
0x00b4ff27
0x00b4ff2b
0x00b4ff32
0x00b4ff39
0x00b4ff3d
0x00b4ff3e
0x00b4ff43
0x00b4ff4b
0x00b4ff4f
0x00b4ff56
0x00b4ff5c
0x00b4ff61
0x00b4ff72
0x00b4ff74
0x00b4ff7a
0x00b4ff7f
0x00b4ff90
0x00b4ff98
0x00b4ff9e
0x00b4ffa3
0x00b4ffb2
0x00b4ffb4
0x00b4ffc3
0x00b4ffb6
0x00b4ffb6
0x00b4ffb7
0x00b4ffbf
0x00b4ffbf
0x00b4ff92
0x00b4ff92
0x00b4ff92
0x00b4ff90
0x00b4ff72
0x00b4ffcf
0x00000000
0x00b4ffcf
0x00b4ff21

APIs

__EH_prolog3_GS.LIBCMT ref: 00B4FE84

Part of subcall function 00B4F15E: __EH_prolog3_GS.LIBCMT ref: 00B4F165
Part of subcall function 00B4F15E: VariantClear.OLEAUT32 ref: 00B4F17A
Part of subcall function 00B4F15E: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,-00000008,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F215
Part of subcall function 00B4F15E: SysAllocString.OLEAUT32(00000000), ref: 00B4F228
Part of subcall function 00B4F15E: free.MSVCRT(00000000,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F257

VariantClear.OLEAUT32(?), ref: 00B4FFE0

Part of subcall function 00B5086D: __EH_prolog3_GS.LIBCMT ref: 00B50877
Part of subcall function 00B5086D: memset.MSVCRT ref: 00B5090E
Part of subcall function 00B5086D: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000103,00000000,00000000), ref: 00B50949
Part of subcall function 00B5086D: SysFreeString.OLEAUT32(?), ref: 00B5097D
Part of subcall function 00B5086D: VariantClear.OLEAUT32(?), ref: 00B5098A

Part of subcall function 00B4C383: memcmp.MSVCRT ref: 00B4C3AF

Strings

zero, xrefs: 00B4FF74, 00B4FF79, 00B4FF81, 00B4FF85
Pattern, xrefs: 00B4FF3E
WriteBufferContent, xrefs: 00B4FE9C
random, xrefs: 00B4FF98, 00B4FF9D, 00B4FFA5, 00B4FFA9
sequential, xrefs: 00B4FF56, 00B4FF5B, 00B4FF63, 00B4FF67

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ClearH_prolog3_Variant$ByteCharMultiStringWide$AllocFreefreememcmpmemset
String ID: Pattern$WriteBufferContent$random$sequential$zero
API String ID: 1455204710-842192564
Opcode ID: 96dc4e26816f0f7a9f7df7283221f4ef94e0c3efe6728219b8293039f1e2476a
Instruction ID: f13f56c0cec2db1038a40abf97f062f44b6abef789a3d1fa058042585a44fd96
Opcode Fuzzy Hash: 96dc4e26816f0f7a9f7df7283221f4ef94e0c3efe6728219b8293039f1e2476a
Instruction Fuzzy Hash: 06416132C01626AFDB11EBA0D845BFE7BF4AF05720F1540A5F901B7291DB706E49EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B49D90 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00B49D90(intOrPtr _a4) {

				if(_a4 != 0) {
					return 0;
				}
				printf("\n*** Interrupted by Ctrl-C. Stopping I/O Request Generator. ***\n");
				if(SetEvent( *0xb614a8) == 0) {
					_push(GetLastError());
					fprintf(E00B5D7CD(_t8, 2), "Warning: Setting abort event failed (error code: %u)\n");
				}
				SetConsoleCtrlHandler(E00B49D90, 0);
				return 1;
			}

0x00b49d99
0x00000000
0x00b49de7
0x00b49da0
0x00b49db5
0x00b49dbd
0x00b49dcc
0x00b49dd2
0x00b49ddc
0x00000000

APIs

printf.MSVCRT ref: 00B49DA0
SetEvent.KERNEL32 ref: 00B49DAD
GetLastError.KERNEL32 ref: 00B49DB7

Part of subcall function 00B5D7CD: __iob_func.MSVCRT ref: 00B5D7D2

fprintf.MSVCRT ref: 00B49DCC
SetConsoleCtrlHandler.KERNEL32(00B49D90,00000000), ref: 00B49DDC

Strings

*** Interrupted by Ctrl-C. Stopping I/O Request Generator. ***, xrefs: 00B49D9B
Warning: Setting abort event failed (error code: %u), xrefs: 00B49DBE

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ConsoleCtrlErrorEventHandlerLast__iob_funcfprintfprintf
String ID: *** Interrupted by Ctrl-C. Stopping I/O Request Generator. ***$Warning: Setting abort event failed (error code: %u)
API String ID: 2832824574-2030963000
Opcode ID: 558037552afe4cf5fb765d2e081730ac67f6016e494666bc974173002a83b9f8
Instruction ID: 8650541b281308cfa1a2197ab2d0e6937099e022556488326c20fa9584db6ce7
Opcode Fuzzy Hash: 558037552afe4cf5fb765d2e081730ac67f6016e494666bc974173002a83b9f8
Instruction Fuzzy Hash: 3AF03035944640BFF7102BA5EC0EB273A99DB44712F504864F505920E1DEF54594E921

Uniqueness

Uniqueness Score: -1.00%

Function 00B58DF8 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00B5834C: memset.MSVCRT ref: 00B58379
Part of subcall function 00B5834C: vsprintf_s.MSVCRT ref: 00B5838D

sprintf_s.MSVCRT ref: 00B58F18
sprintf_s.MSVCRT ref: 00B58FED

Strings

-------------------------------------------, xrefs: 00B58E50, 00B58F90
CPU | Usage | User | Kernel | Idle, xrefs: 00B58E41
avg.| %6.2lf%%| %6.2lf%%| %6.2lf%%| %6.2lf%%, xrefs: 00B58FE2
%4u| %6.2lf%%| %6.2lf%%| %6.2lf%%| %6.2lf%%, xrefs: 00B58F0D

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: sprintf_s$memsetvsprintf_s
String ID: CPU | Usage | User | Kernel | Idle$%4u| %6.2lf%%| %6.2lf%%| %6.2lf%%| %6.2lf%%$-------------------------------------------$avg.| %6.2lf%%| %6.2lf%%| %6.2lf%%| %6.2lf%%
API String ID: 1157834829-6584663
Opcode ID: c14ade80fce47102e203e32a1f7c4794c3a2b13e50bcfea408b7f468e4b85561
Instruction ID: 941e5b808161d8fa8c42143eea6c11b968f2e4bd62753f52f2d8f4e4edd29852
Opcode Fuzzy Hash: c14ade80fce47102e203e32a1f7c4794c3a2b13e50bcfea408b7f468e4b85561
Instruction Fuzzy Hash: 0D518E71A08B05A7D3057F64D449A5BBBF8FB84380F614C88F5C4611A9EF318A78D7C6

Uniqueness

Uniqueness Score: -1.00%

Function 00B51250 Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00B51250(void* __ecx) {
				long _v8;
				void* _v24;
				struct _OVERLAPPED _v28;
				void* _t12;
				void* _t23;
				long _t26;

				_t26 = 0;
				_v28.Internal = 0;
				asm("stosd");
				_t23 = __ecx;
				asm("stosd");
				_v8 = 0;
				asm("stosd");
				asm("stosd");
				_t12 = CreateEventA(0, 1, 0, 0);
				_v28.hEvent = _t12;
				if(_t12 == 0) {
					return GetLastError();
				}
				if(DeviceIoControl(_t23, 0x902b8, 0, 0, 0, 0, 0,  &_v28) == 0) {
					_t26 = GetLastError();
					if(_t26 == 0x3e5) {
						if(GetOverlappedResult(_t23,  &_v28,  &_v8, 1) != 0) {
							_t26 = _v28.Internal;
						} else {
							_t26 = GetLastError();
						}
					}
				}
				if(_v28.hEvent != 0) {
					CloseHandle(_v28.hEvent);
				}
				return _t26;
			}

0x00b5125b
0x00b51260
0x00b51265
0x00b51266
0x00b5126c
0x00b5126e
0x00b51271
0x00b51272
0x00b51273
0x00b51279
0x00b5127e
0x00000000
0x00b51280
0x00b5129f
0x00b512a7
0x00b512af
0x00b512c4
0x00b512d0
0x00b512c6
0x00b512cc
0x00b512cc
0x00b512c4
0x00b512af
0x00b512d7
0x00b512dc
0x00b512dc
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?), ref: 00B51273
GetLastError.KERNEL32 ref: 00B51280
DeviceIoControl.KERNEL32(00000000,000902B8,00000000,00000000,00000000,00000000,00000000,?), ref: 00B51297
GetLastError.KERNEL32 ref: 00B512A1
GetOverlappedResult.KERNEL32(00000000,?,00000000,00000001), ref: 00B512BC
GetLastError.KERNEL32 ref: 00B512C6
CloseHandle.KERNEL32(00000000), ref: 00B512DC

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceEventHandleOverlappedResult
String ID:
API String ID: 2847295715-0
Opcode ID: fe4167b973cd0b24916c240d32034f333921258630dce80b3c043e4458fdfa95
Instruction ID: 3cd105a29db1c380bd0024053f2f87dbd32f5faf7e246ebfe99e40898d336803
Opcode Fuzzy Hash: fe4167b973cd0b24916c240d32034f333921258630dce80b3c043e4458fdfa95
Instruction Fuzzy Hash: EA114F75900619BBF7109BA9DC49BEFBAADEB08352F0005A1EE05E3190DAB14D49CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B55E88 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00B55EB7
??3@YAXPAX@Z.MSVCRT ref: 00B55ECF
std::tr1::_Xmem.LIBCPMT ref: 00B55EEF
??3@YAXPAX@Z.MSVCRT ref: 00B55F4B

Part of subcall function 00B5CA2B: malloc.MSVCRT ref: 00B5CA42

std::tr1::_Xmem.LIBCPMT ref: 00B55F70
??3@YAXPAX@Z.MSVCRT ref: 00B55FC2

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ??3@$Xmemstd::tr1::_$mallocmemmove
String ID:
API String ID: 4037358618-0
Opcode ID: 071d88588cef0237f8db1715b90657fdfa997d640026aedcf8dbfd8effb50f4b
Instruction ID: b178f9151f9dbed44ef8538e48da0c0bffb51cb649549afab82daa91af01db4a
Opcode Fuzzy Hash: 071d88588cef0237f8db1715b90657fdfa997d640026aedcf8dbfd8effb50f4b
Instruction Fuzzy Hash: 1E41E472500614EFDB24DF68D995A5AFBEDEF8A722B1441EAF904CB244DB71DD00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B4F15E Relevance: 9.1, APIs: 6, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00B4F15E(void* __ebx, short** __ecx, void* __edi, void* __esi, void* __eflags) {
				short* _t26;
				void* _t29;
				char _t31;
				signed int _t32;
				unsigned int _t33;
				unsigned int _t40;
				short* _t44;
				char* _t45;
				signed int _t47;
				char* _t51;
				int _t54;
				void* _t58;
				void* _t59;
				short* _t60;

				E00B5D14C(0xb5e083, __ebx, __edi, __esi);
				_t40 = __ecx;
				 *(_t59 - 0x20) = __ecx;
				_t54 = 0;
				_t58 = 0;
				 *(_t59 - 0x1c) = 0;
				 *((intOrPtr*)(_t59 - 4)) = 0;
				__imp__#9(__ecx, 0x14);
				_t26 = 8;
				 *__ecx = _t26;
				if( *(_t59 + 8) == 0) {
					L14:
					__imp__#2(_t54);
					 *(_t40 + 8) = _t26;
					if(_t26 != 0 ||  *(_t59 + 8) == _t26) {
						L20:
						if(_t58 != 0) {
							goto L19;
						}
						return E00B5D100(_t40, _t54, _t58);
					} else {
						_t29 = 0xa;
						_t44 = 0x8007000e;
						 *_t40 = _t29;
						 *(_t40 + 8) = 0x8007000e;
						L18:
						L00B4F0E9(_t44, _t58);
						L19:
						_t58 =  *_t58;
						free(_t58);
						goto L20;
					}
				}
				_t45 =  *(_t59 + 8);
				_t51 =  &(_t45[1]);
				do {
					_t31 =  *_t45;
					_t45 =  &(_t45[1]);
				} while (_t31 != 0);
				_t32 = _t45 - _t51 + 1;
				_t47 = 2;
				_t33 = _t32 * _t47;
				_t40 = _t33;
				_t26 = _t33 + 0x80000000;
				asm("adc edx, edi");
				 *(_t59 - 0x14) = _t32 * _t47 >> 0x20;
				if(_t26 != 0 || _t26 > 0xffffffff) {
					L13:
					_t40 =  *(_t59 - 0x20);
					goto L14;
				} else {
					_t67 = _t40 - 0x400;
					if(_t40 > 0x400) {
						L8:
						__eflags = (_t26 | 0xffffffff) - _t40 - 8;
						if((_t26 | 0xffffffff) - _t40 < 8) {
							_t44 = 0x80070057;
							goto L18;
						}
						_t26 = malloc(_t40 + 8);
						__eflags = _t26;
						if(_t26 == 0) {
							goto L13;
						}
						_t58 = _t26;
						 *_t26 = _t54;
						_t26 =  &(_t26[4]);
						__eflags = _t26;
						 *(_t59 - 0x1c) = _t58;
						 *(_t59 - 0x14) = _t26;
						L11:
						if(_t26 != 0) {
							 *_t26 = 0;
							_t26 = MultiByteToWideChar(3, _t54,  *(_t59 + 8), 0xffffffff, _t26, _t40 >> 1);
							asm("sbb edi, edi");
							_t54 =  ~_t26 &  *(_t59 - 0x14);
						}
						goto L13;
					}
					_t26 = E00B4F002(_t40, _t40, 0, 0, _t67);
					if(_t26 == 0) {
						goto L8;
					}
					E00B5DA00(_t40);
					_t26 = _t60;
					 *(_t59 - 0x14) = _t60;
					goto L11;
				}
			}

0x00b4f165
0x00b4f16a
0x00b4f16c
0x00b4f16f
0x00b4f171
0x00b4f173
0x00b4f177
0x00b4f17a
0x00b4f182
0x00b4f183
0x00b4f189
0x00b4f227
0x00b4f228
0x00b4f22e
0x00b4f233
0x00b4f25e
0x00b4f260
0x00000000
0x00000000
0x00b4f26c
0x00b4f23a
0x00b4f23c
0x00b4f23d
0x00b4f242
0x00b4f245
0x00b4f24f
0x00b4f24f
0x00b4f254
0x00b4f255
0x00b4f257
0x00000000
0x00b4f25d
0x00b4f233
0x00b4f18f
0x00b4f192
0x00b4f195
0x00b4f195
0x00b4f197
0x00b4f198
0x00b4f1a0
0x00b4f1a3
0x00b4f1a4
0x00b4f1a6
0x00b4f1a8
0x00b4f1ad
0x00b4f1af
0x00b4f1b2
0x00b4f224
0x00b4f224
0x00000000
0x00b4f1b9
0x00b4f1b9
0x00b4f1bf
0x00b4f1da
0x00b4f1df
0x00b4f1e2
0x00b4f24a
0x00000000
0x00b4f24a
0x00b4f1e8
0x00b4f1ef
0x00b4f1f1
0x00000000
0x00000000
0x00b4f1f3
0x00b4f1f5
0x00b4f1f7
0x00b4f1f7
0x00b4f1fa
0x00b4f1fd
0x00b4f200
0x00b4f202
0x00b4f20f
0x00b4f215
0x00b4f21f
0x00b4f221
0x00b4f221
0x00000000
0x00b4f202
0x00b4f1c3
0x00b4f1ca
0x00000000
0x00000000
0x00b4f1ce
0x00b4f1d3
0x00b4f1d5
0x00000000
0x00b4f1d5

APIs

__EH_prolog3_GS.LIBCMT ref: 00B4F165
VariantClear.OLEAUT32 ref: 00B4F17A
malloc.MSVCRT ref: 00B4F1E8
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,-00000008,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F215
SysAllocString.OLEAUT32(00000000), ref: 00B4F228
free.MSVCRT(00000000,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F257

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: AllocByteCharClearH_prolog3_MultiStringVariantWidefreemalloc
String ID:
API String ID: 1623262104-0
Opcode ID: 897b7a50da0659d38ee4678574c4135e5d632ecbf570a9ab1a05c01ad688f18a
Instruction ID: 53f543c040ebfa04aa0ddee6cedc9bbb023cca54dbe4c725cb4ed3b2640f2121
Opcode Fuzzy Hash: 897b7a50da0659d38ee4678574c4135e5d632ecbf570a9ab1a05c01ad688f18a
Instruction Fuzzy Hash: 05312235900A07DBDF248F68DC806BD77E4EF85320B2442BAF905EB291DAB48E00DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B4CC0B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 142
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00B4CC0B(signed int __ecx, intOrPtr* _a4, intOrPtr* _a8) {
				intOrPtr* _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				struct _IO_FILE* _t33;
				intOrPtr _t35;
				void* _t36;
				void* _t37;
				void* _t38;
				void* _t41;
				signed int _t43;
				intOrPtr* _t44;
				signed int _t47;
				intOrPtr* _t49;
				signed int _t51;
				void* _t53;
				signed int _t55;
				intOrPtr _t57;
				signed int _t59;
				void* _t61;
				void* _t66;

				_t43 = __ecx;
				_t61 = (_t59 & 0xfffffff8) - 0x14;
				_t47 =  *_a4;
				_t55 = 0;
				_t51 = 0;
				_v8 = __ecx;
				_v24 = 0;
				_v20 = 0;
				_t41 = 0;
				while(_t47 != 0) {
					if(_t41 != 0) {
						L27:
						_t41 = 0;
						__eflags = 0;
					} else {
						_t27 = _t47;
						if(_t47 - 0x30 > 9) {
							__imp__toupper(_t27);
							__eflags = _t27 - 0x42;
							if(_t27 == 0x42) {
								L13:
								_t57 = 0;
								_t53 = 0;
								__eflags = _t27 - 0x42;
								if(_t27 != 0x42) {
									__eflags = _t27 - 0x4b;
									if(_t27 != 0x4b) {
										__eflags = _t27 - 0x4d;
										if(_t27 != 0x4d) {
											__eflags = _t27 - 0x47;
											if(_t27 == 0x47) {
												_t57 = 0x40000000;
												goto L21;
											}
										} else {
											_t57 = 0x100000;
											goto L21;
										}
									} else {
										_t57 = 0x400;
										goto L21;
									}
								} else {
									_t57 =  *_v8;
									L21:
									_t53 = 0;
									__eflags = 0;
								}
								_t28 = E00B5DA40(0xffffffff, 0xffffffff, _t57, _t53);
								_t43 = _v36;
								_v28 = _t28;
								__eflags = _t43 - _t47;
								if(__eflags > 0) {
									L26:
									_t55 = _v24;
									_t51 = _v20;
									goto L27;
								} else {
									_t29 = _v24;
									if(__eflags < 0) {
										L25:
										_t55 = E00B5D9C0(_t57, _t53, _t29, _t43);
										_t51 = _t47;
										_v40 = _t55;
										_t41 = 1;
										_v36 = _t51;
									} else {
										__eflags = _t29 - _v12;
										if(_t29 > _v12) {
											goto L26;
										} else {
											goto L25;
										}
									}
								}
							} else {
								__eflags = _t27 - 0x4b;
								if(_t27 == 0x4b) {
									goto L13;
								} else {
									__eflags = _t27 - 0x4d;
									if(_t27 == 0x4d) {
										goto L13;
									} else {
										__eflags = _t27 - 0x47;
										if(_t27 == 0x47) {
											goto L13;
										} else {
											_t41 = 0;
											_push(_t27);
											_push("Invalid size specifier \'%c\'. Valid ones are: K - KB, M - MB, G - GB, B - block\n");
											_t33 = E00B5D7CD(_t27, 2);
											_pop(_t43);
											fprintf(_t33, ??);
											_t61 = _t61 + 0xc;
										}
									}
								}
							}
						} else {
							_t35 = _t27 - 0x30;
							asm("cdq");
							_t43 = (_t43 | 0xffffffff) - _t35;
							_v16 = _t35;
							_t36 = 0xffffffff;
							asm("sbb eax, edx");
							_v12 = _t47;
							_t37 = E00B5DA40(_t43, _t36, 0xa, 0);
							_t66 = _t51 - _t47;
							if(_t66 > 0 || _t66 >= 0 && _t55 > _t37) {
								goto L27;
							} else {
								_t38 = E00B5D9C0(_t55, _t51, 0xa, 0);
								_t51 = _t47;
								_t55 = _t38 + _v32;
								_v40 = _t55;
								asm("adc edi, [esp+0x18]");
								_v36 = _t51;
							}
						}
					}
					_t49 = _a4 + 1;
					_a4 = _t49;
					_t47 =  *_t49;
					if(_t41 != 0) {
						continue;
					}
					break;
				}
				if(_t41 != 0) {
					_t44 = _a8;
					 *_t44 = _t55;
					 *(_t44 + 4) = _t51;
				}
				return _t41;
			}

0x00b4cc0b
0x00b4cc13
0x00b4cc1c
0x00b4cc1e
0x00b4cc20
0x00b4cc22
0x00b4cc28
0x00b4cc2c
0x00b4cc30
0x00b4cc32
0x00b4cc3c
0x00b4cd4f
0x00b4cd4f
0x00b4cd4f
0x00b4cc42
0x00b4cc47
0x00b4cc4a
0x00b4cca4
0x00b4ccab
0x00b4ccad
0x00b4ccda
0x00b4ccda
0x00b4ccdc
0x00b4ccde
0x00b4cce0
0x00b4ccea
0x00b4ccec
0x00b4ccf5
0x00b4ccf7
0x00b4cd00
0x00b4cd02
0x00b4cd04
0x00000000
0x00b4cd04
0x00b4ccf9
0x00b4ccf9
0x00000000
0x00b4ccf9
0x00b4ccee
0x00b4ccee
0x00000000
0x00b4ccee
0x00b4cce2
0x00b4cce6
0x00b4cd09
0x00b4cd09
0x00b4cd09
0x00b4cd09
0x00b4cd11
0x00b4cd16
0x00b4cd1a
0x00b4cd1e
0x00b4cd20
0x00b4cd47
0x00b4cd47
0x00b4cd4b
0x00000000
0x00b4cd22
0x00b4cd22
0x00b4cd26
0x00b4cd2e
0x00b4cd37
0x00b4cd39
0x00b4cd3b
0x00b4cd3f
0x00b4cd41
0x00b4cd28
0x00b4cd28
0x00b4cd2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4cd2c
0x00b4cd26
0x00b4ccaf
0x00b4ccaf
0x00b4ccb1
0x00000000
0x00b4ccb3
0x00b4ccb3
0x00b4ccb5
0x00000000
0x00b4ccb7
0x00b4ccb7
0x00b4ccb9
0x00000000
0x00b4ccbb
0x00b4ccbe
0x00b4ccc0
0x00b4ccc1
0x00b4ccc8
0x00b4cccd
0x00b4cccf
0x00b4ccd5
0x00b4ccd5
0x00b4ccb9
0x00b4ccb5
0x00b4ccb1
0x00b4cc4c
0x00b4cc4c
0x00b4cc52
0x00b4cc55
0x00b4cc57
0x00b4cc5b
0x00b4cc60
0x00b4cc62
0x00b4cc68
0x00b4cc6d
0x00b4cc6f
0x00000000
0x00b4cc7f
0x00b4cc85
0x00b4cc8c
0x00b4cc8e
0x00b4cc92
0x00b4cc96
0x00b4cc9a
0x00b4cc9a
0x00b4cc6f
0x00b4cc4a
0x00b4cd54
0x00b4cd55
0x00b4cd58
0x00b4cd5c
0x00000000
0x00000000
0x00000000
0x00b4cd5c
0x00b4cd64
0x00b4cd66
0x00b4cd69
0x00b4cd6b
0x00b4cd6b
0x00b4cd76

APIs

__aulldiv.LIBCMT ref: 00B4CC68
toupper.MSVCRT ref: 00B4CCA4
fprintf.MSVCRT ref: 00B4CCCF
__aulldiv.LIBCMT ref: 00B4CD11

Strings

Invalid size specifier '%c'. Valid ones are: K - KB, M - MB, G - GB, B - block, xrefs: 00B4CCC1

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: __aulldiv$fprintftoupper
String ID: Invalid size specifier '%c'. Valid ones are: K - KB, M - MB, G - GB, B - block
API String ID: 2363179844-1600532622
Opcode ID: d54b4d2bd6b25810a665aa31927e878e48e54c4f2a84a5c9567117c665b2c415
Instruction ID: 55f8623717dc3b7d4d460885d9b9fe62cc24fd0d3cb523d2a3d3c89c0e33cef8
Opcode Fuzzy Hash: d54b4d2bd6b25810a665aa31927e878e48e54c4f2a84a5c9567117c665b2c415
Instruction Fuzzy Hash: FE41EF71D452109FC760CF2C884076B7FD4EBC6B60F1546BAF8999B290C3309E01A7C6

Uniqueness

Uniqueness Score: -1.00%

Function 00B4FD31 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00B4FD31(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t48;
				signed int _t53;
				void* _t55;
				signed int _t56;
				intOrPtr _t71;
				intOrPtr* _t85;
				void* _t93;
				void* _t94;
				void* _t96;

				_t96 = __eflags;
				E00B5D14C(0xb5e1f2, __ebx, __edi, __esi);
				_t85 =  *((intOrPtr*)(_t93 + 8));
				_t71 =  *((intOrPtr*)(_t93 + 0xc));
				 *(_t93 - 0x30) =  *(_t93 - 0x30) & 0x00000000;
				 *(_t93 - 4) =  *(_t93 - 4) & 0x00000000;
				 *((short*)(_t93 - 0x50)) = 0;
				E00B4F15E(_t71, _t93 - 0x50, _t85, __esi, _t96, "RandomDataSource");
				 *(_t93 - 4) = 1;
				 *0xb621f8(_t85,  *((intOrPtr*)(_t93 - 0x48)), _t93 - 0x30, 0x44);
				_t48 =  *((intOrPtr*)( *((intOrPtr*)( *_t85 + 0x90))))();
				_t90 = _t48;
				if(_t48 < 0) {
					L11:
					__imp__#9(_t93 - 0x50);
					E00B4F72B(_t93 - 0x30);
					return E00B5D100(_t71, _t85, _t90);
				}
				_t53 =  *(_t93 - 0x30);
				 *0xb621f8(_t53, _t93 - 0x34);
				_t55 =  *((intOrPtr*)( *((intOrPtr*)( *_t53 + 0x20))))();
				_t90 = _t55;
				if(_t55 < 0) {
					goto L11;
				}
				_t85 = 1;
				if( *((intOrPtr*)(_t93 - 0x34)) == 1) {
					 *(_t93 - 0x2c) =  *(_t93 - 0x2c) & 0x00000000;
					 *(_t93 - 4) = 2;
					_t56 =  *(_t93 - 0x30);
					 *0xb621f8(_t56, 0, _t93 - 0x2c);
					_t90 =  *((intOrPtr*)( *_t56 + 0x1c))();
					_t100 = _t90;
					if(_t90 >= 0) {
						_push(_t93 - 0x40);
						_push("SizeInBytes");
						_push( *(_t93 - 0x2c));
						_t90 = E00B509AA(_t71, 1, _t90, _t100);
						if(_t90 >= 0) {
							_t102 = _t90 - 1;
							if(_t90 != 1) {
								 *(_t93 - 0x18) =  *(_t93 - 0x18) & 0x00000000;
								 *((intOrPtr*)(_t71 + 0x90)) =  *((intOrPtr*)(_t93 - 0x40));
								 *((intOrPtr*)(_t71 + 0x94)) =  *((intOrPtr*)(_t93 - 0x3c));
								 *((intOrPtr*)(_t93 - 0x14)) = 0xf;
								 *((char*)(_t93 - 0x28)) = 0;
								 *(_t93 - 4) = 3;
								_push(_t93 - 0x28);
								_push("FilePath");
								_push( *(_t93 - 0x2c));
								_t90 = E00B5086D(_t71, 1, _t90, _t102);
								if(_t90 >= 0) {
									_t104 = _t90 - 1;
									if(_t90 != 1) {
										E00B4C26E(_t94 - 0x18, _t93 - 0x28);
										E00B4C9C7(_t71, _t71, 1, _t90, _t104);
									}
								}
								E00B4A1B9(_t93 - 0x28, _t85, 0);
							}
						}
					}
					E00B4F72B(_t93 - 0x2c);
				}
			}

0x00b4fd31
0x00b4fd38
0x00b4fd3d
0x00b4fd40
0x00b4fd43
0x00b4fd47
0x00b4fd55
0x00b4fd59
0x00b4fd5e
0x00b4fd74
0x00b4fd7a
0x00b4fd7c
0x00b4fd80
0x00b4fe5c
0x00b4fe60
0x00b4fe69
0x00b4fe75
0x00b4fe75
0x00b4fd86
0x00b4fd95
0x00b4fd9b
0x00b4fd9d
0x00b4fda1
0x00000000
0x00000000
0x00b4fda9
0x00b4fdad
0x00b4fdb3
0x00b4fdb7
0x00b4fdbe
0x00b4fdca
0x00b4fdd3
0x00b4fdd5
0x00b4fdd7
0x00b4fddc
0x00b4fddd
0x00b4fde2
0x00b4fdea
0x00b4fdee
0x00b4fdf0
0x00b4fdf2
0x00b4fdf7
0x00b4fdfb
0x00b4fe04
0x00b4fe0a
0x00b4fe11
0x00b4fe18
0x00b4fe1c
0x00b4fe1d
0x00b4fe22
0x00b4fe2a
0x00b4fe2e
0x00b4fe30
0x00b4fe32
0x00b4fe3d
0x00b4fe44
0x00b4fe44
0x00b4fe32
0x00b4fe4f
0x00b4fe4f
0x00b4fdf2
0x00b4fdee
0x00b4fe57
0x00b4fe57

APIs

__EH_prolog3_GS.LIBCMT ref: 00B4FD38

Part of subcall function 00B4F15E: __EH_prolog3_GS.LIBCMT ref: 00B4F165
Part of subcall function 00B4F15E: VariantClear.OLEAUT32 ref: 00B4F17A
Part of subcall function 00B4F15E: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,-00000008,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F215
Part of subcall function 00B4F15E: SysAllocString.OLEAUT32(00000000), ref: 00B4F228
Part of subcall function 00B4F15E: free.MSVCRT(00000000,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F257

VariantClear.OLEAUT32(?), ref: 00B4FE60

Part of subcall function 00B509AA: __EH_prolog3_GS.LIBCMT ref: 00B509B1
Part of subcall function 00B509AA: _wtoi64.MSVCRT ref: 00B50A1B
Part of subcall function 00B509AA: SysFreeString.OLEAUT32(?), ref: 00B50A2D
Part of subcall function 00B509AA: VariantClear.OLEAUT32(?), ref: 00B50A37

Part of subcall function 00B5086D: __EH_prolog3_GS.LIBCMT ref: 00B50877
Part of subcall function 00B5086D: memset.MSVCRT ref: 00B5090E
Part of subcall function 00B5086D: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000103,00000000,00000000), ref: 00B50949
Part of subcall function 00B5086D: SysFreeString.OLEAUT32(?), ref: 00B5097D
Part of subcall function 00B5086D: VariantClear.OLEAUT32(?), ref: 00B5098A

Strings

SizeInBytes, xrefs: 00B4FDDD
RandomDataSource, xrefs: 00B4FD50
FilePath, xrefs: 00B4FE1D

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ClearH_prolog3_Variant$String$ByteCharFreeMultiWide$Alloc_wtoi64freememset
String ID: FilePath$RandomDataSource$SizeInBytes
API String ID: 315616386-221587684
Opcode ID: 3a1275c8d69892cbf662aab740977296ffbbeb5e7ab373bcdd8f3cff3bfc153b
Instruction ID: 24921d57b97552d69536b43529f48daa5537ad17aa9543d070853de687d48648
Opcode Fuzzy Hash: 3a1275c8d69892cbf662aab740977296ffbbeb5e7ab373bcdd8f3cff3bfc153b
Instruction Fuzzy Hash: C941B231D006299FCF11EBA8C855BEDBBF4AF08711F0541A8ED15BB252DB706E09DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B50475 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00B50475(void* __ebx, short __edi, void* __esi, void* __eflags) {
				intOrPtr* _t35;
				void* _t37;
				intOrPtr* _t42;
				void* _t44;
				intOrPtr* _t45;
				void* _t47;
				intOrPtr* _t49;
				void* _t51;
				void* _t78;
				void* _t79;

				_t79 = __eflags;
				_t70 = __edi;
				E00B5D14C(0xb5e2b8, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t78 - 0x14)) = 0;
				 *((intOrPtr*)(_t78 - 4)) = 0;
				 *((short*)(_t78 - 0x30)) = 0;
				E00B4F15E(0, _t78 - 0x30, __edi, __esi, _t79, "Affinity/AffinityAssignment");
				_t35 =  *((intOrPtr*)(_t78 + 8));
				 *((char*)(_t78 - 4)) = 1;
				 *0xb621f8(_t35,  *((intOrPtr*)(_t78 - 0x28)), _t78 - 0x14, 0x24);
				_t37 =  *((intOrPtr*)( *((intOrPtr*)( *_t35 + 0x90))))();
				_t74 = _t37;
				if(_t37 < 0) {
					L7:
					__imp__#9(_t78 - 0x30);
					E00B4F72B(_t78 - 0x14);
					return E00B5D100(0, _t70, _t74);
				}
				_t42 =  *((intOrPtr*)(_t78 - 0x14));
				 *0xb621f8(_t42, _t78 - 0x20);
				_t44 =  *((intOrPtr*)( *((intOrPtr*)( *_t42 + 0x20))))();
				_t74 = _t44;
				if(_t44 < 0) {
					goto L7;
				}
				_t70 = 0;
				if( *((intOrPtr*)(_t78 - 0x20)) <= 0) {
					goto L7;
				} else {
					goto L3;
				}
				do {
					L3:
					 *((intOrPtr*)(_t78 - 0x18)) = 0;
					 *((char*)(_t78 - 4)) = 2;
					_t45 =  *((intOrPtr*)(_t78 - 0x14));
					 *0xb621f8(_t45, _t70, _t78 - 0x18);
					_t47 =  *((intOrPtr*)( *_t45 + 0x1c))();
					_t74 = _t47;
					if(_t47 >= 0) {
						_t49 =  *((intOrPtr*)(_t78 - 0x18));
						 *0xb621f8(_t49, _t78 - 0x1c);
						_t51 =  *((intOrPtr*)( *((intOrPtr*)( *_t49 + 0x68))))();
						_t74 = _t51;
						if(_t51 >= 0) {
							__imp___wtoi( *((intOrPtr*)(_t78 - 0x1c)));
							E00B4CA4A( *((intOrPtr*)(_t78 + 0xc)), 0, _t51);
							__imp__#6( *((intOrPtr*)(_t78 - 0x1c)));
						}
					}
					 *((char*)(_t78 - 4)) = 1;
					E00B4F72B(_t78 - 0x18);
					_t70 = _t70 + 1;
				} while (_t70 <  *((intOrPtr*)(_t78 - 0x20)));
				goto L7;
			}

0x00b50475
0x00b50475
0x00b5047c
0x00b50483
0x00b50488
0x00b50493
0x00b50497
0x00b5049c
0x00b504a2
0x00b504b5
0x00b504bb
0x00b504bd
0x00b504c1
0x00b5055b
0x00b5055f
0x00b50568
0x00b50574
0x00b50574
0x00b504c7
0x00b504d6
0x00b504dc
0x00b504de
0x00b504e2
0x00000000
0x00000000
0x00b504e4
0x00b504e9
0x00000000
0x00000000
0x00000000
0x00000000
0x00b504eb
0x00b504eb
0x00b504eb
0x00b504ee
0x00b504f5
0x00b50500
0x00b50506
0x00b50509
0x00b5050d
0x00b5050f
0x00b5051e
0x00b50524
0x00b50526
0x00b5052a
0x00b5052f
0x00b5053b
0x00b50543
0x00b50543
0x00b5052a
0x00b5054c
0x00b50550
0x00b50555
0x00b50556
0x00000000

APIs

__EH_prolog3_GS.LIBCMT ref: 00B5047C

Part of subcall function 00B4F15E: __EH_prolog3_GS.LIBCMT ref: 00B4F165
Part of subcall function 00B4F15E: VariantClear.OLEAUT32 ref: 00B4F17A
Part of subcall function 00B4F15E: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,-00000008,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F215
Part of subcall function 00B4F15E: SysAllocString.OLEAUT32(00000000), ref: 00B4F228
Part of subcall function 00B4F15E: free.MSVCRT(00000000,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F257

_wtoi.MSVCRT ref: 00B5052F
SysFreeString.OLEAUT32(?), ref: 00B50543
VariantClear.OLEAUT32(?), ref: 00B5055F

Strings

Affinity/AffinityAssignment, xrefs: 00B5048B

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ClearH_prolog3_StringVariant$AllocByteCharFreeMultiWide_wtoifree
String ID: Affinity/AffinityAssignment
API String ID: 1474463088-139104479
Opcode ID: e7dea837bac4dcd42449d906de17ff74757b0bb8de776189c0896124802a47cc
Instruction ID: e54657659d2d44abfe1948fc12cb4b28db6ca0f03951a49fa943cb26fe7faba8
Opcode Fuzzy Hash: e7dea837bac4dcd42449d906de17ff74757b0bb8de776189c0896124802a47cc
Instruction Fuzzy Hash: 42318431D0062ADFDF11EFA4D885AAEBBB4FF49311F014098E906B7250DB74AE05DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B50A84 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E00B50A84(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t25;
				signed int _t32;
				signed int _t34;
				void* _t54;
				void* _t55;

				_t55 = __eflags;
				_t48 = __edi;
				_t37 = __ebx;
				E00B5D14C(0xb5e334, __ebx, __edi, __esi);
				 *(_t54 - 0x18) =  *(_t54 - 0x18) & 0x00000000;
				 *(_t54 - 4) =  *(_t54 - 4) & 0x00000000;
				 *((short*)(_t54 - 0x2c)) = 0;
				E00B4F15E(__ebx, _t54 - 0x2c, __edi, __esi, _t55,  *((intOrPtr*)(_t54 + 0xc)));
				_t25 =  *((intOrPtr*)(_t54 + 8));
				 *(_t54 - 4) = 1;
				 *0xb621f8(_t25,  *((intOrPtr*)(_t54 - 0x24)), _t54 - 0x18, 0x20);
				_t52 =  *((intOrPtr*)( *((intOrPtr*)( *_t25 + 0x94))))();
				if(_t52 >= 0 && _t52 != 1) {
					_t32 =  *(_t54 - 0x18);
					 *0xb621f8(_t32, _t54 - 0x1c);
					_t34 =  *((intOrPtr*)( *((intOrPtr*)( *_t32 + 0x68))))();
					_t52 = _t34;
					if(_t34 >= 0) {
						__imp___wcsicmp(L"true",  *((intOrPtr*)(_t54 - 0x1c)));
						asm("sbb al, al");
						 *((char*)( *((intOrPtr*)(_t54 + 0x10)))) =  ~_t34 + 1;
						__imp__#6( *((intOrPtr*)(_t54 - 0x1c)));
					}
				}
				__imp__#9(_t54 - 0x2c);
				E00B4F72B(_t54 - 0x18);
				return E00B5D100(_t37, _t48, _t52);
			}

0x00b50a84
0x00b50a84
0x00b50a84
0x00b50a8b
0x00b50a90
0x00b50a94
0x00b50aa0
0x00b50aa4
0x00b50aa9
0x00b50aaf
0x00b50ac2
0x00b50aca
0x00b50ace
0x00b50ad5
0x00b50ae4
0x00b50aea
0x00b50aec
0x00b50af0
0x00b50afa
0x00b50b0a
0x00b50b0e
0x00b50b10
0x00b50b10
0x00b50af0
0x00b50b1a
0x00b50b23
0x00b50b2f

APIs

__EH_prolog3_GS.LIBCMT ref: 00B50A8B

Part of subcall function 00B4F15E: __EH_prolog3_GS.LIBCMT ref: 00B4F165
Part of subcall function 00B4F15E: VariantClear.OLEAUT32 ref: 00B4F17A
Part of subcall function 00B4F15E: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,-00000008,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F215
Part of subcall function 00B4F15E: SysAllocString.OLEAUT32(00000000), ref: 00B4F228
Part of subcall function 00B4F15E: free.MSVCRT(00000000,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F257

_wcsicmp.MSVCRT ref: 00B50AFA
SysFreeString.OLEAUT32(?), ref: 00B50B10
VariantClear.OLEAUT32(?), ref: 00B50B1A

Strings

true, xrefs: 00B50AF5

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ClearH_prolog3_StringVariant$AllocByteCharFreeMultiWide_wcsicmpfree
String ID: true
API String ID: 1156377413-4261170317
Opcode ID: 819a95cf148487d760b0a98ce738d722317155fa6a7b0ac6086205b0a03e00d0
Instruction ID: a1ad46d490319a5677122bfafbb3a66069dc27cf77a6aed0e5c5b74f40369568
Opcode Fuzzy Hash: 819a95cf148487d760b0a98ce738d722317155fa6a7b0ac6086205b0a03e00d0
Instruction Fuzzy Hash: D9117C31D0061ADFDF05ABA8C845BAE7BF4EF09715F018084E915B72A1DB75AE09CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B5086D Relevance: 7.6, APIs: 5, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00B5086D(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t39;
				void* _t41;
				short _t44;
				short* _t59;
				short* _t66;
				int _t68;
				void* _t74;
				void* _t77;

				_t77 = __eflags;
				E00B5D14C(0xb5e3b6, __ebx, __edi, __esi);
				_t68 =  *((intOrPtr*)(_t74 + 8));
				_t52 =  *((intOrPtr*)(_t74 + 0x10));
				 *(_t74 - 0x13c) =  *(_t74 - 0x13c) & 0x00000000;
				 *(_t74 - 4) =  *(_t74 - 4) & 0x00000000;
				 *((short*)(_t74 - 0x14c)) = 0;
				E00B4F15E( *((intOrPtr*)(_t74 + 0x10)), _t74 - 0x14c, _t68, __esi, _t77,  *((intOrPtr*)(_t74 + 0xc)));
				 *(_t74 - 4) = 1;
				 *0xb621f8(_t68,  *((intOrPtr*)(_t74 - 0x144)), _t74 - 0x13c, 0x140);
				_t72 =  *((intOrPtr*)( *((intOrPtr*)( *_t68 + 0x94))))();
				if(_t72 >= 0 && _t72 != 1) {
					_t39 =  *(_t74 - 0x13c);
					 *0xb621f8(_t39, _t74 - 0x138);
					_t41 =  *((intOrPtr*)( *((intOrPtr*)( *_t39 + 0x68))))();
					_t72 = _t41;
					if(_t41 >= 0) {
						_t68 = 0;
						memset(_t74 - 0x11c, 0, 0x104);
						_t59 =  *(_t74 - 0x138);
						_t66 =  &(_t59[1]);
						do {
							_t44 =  *_t59;
							_t59 =  &(_t59[1]);
						} while (_t44 != 0);
						WideCharToMultiByte(0xfde9, 0,  *(_t74 - 0x138), _t59 - _t66 >> 1, _t74 - 0x11c, 0x103, 0, 0);
						E00B4EA01(_t52, E00B4A144(_t74 - 0x134, _t74 - 0x11c));
						E00B4A1B9(_t74 - 0x134, 1, 0);
					}
					__imp__#6( *(_t74 - 0x138));
				}
				__imp__#9(_t74 - 0x14c);
				E00B4F72B(_t74 - 0x13c);
				return E00B5D100(_t52, _t68, _t72);
			}

0x00b5086d
0x00b50877
0x00b5087c
0x00b50882
0x00b50885
0x00b5088c
0x00b50892
0x00b508a0
0x00b508a5
0x00b508c1
0x00b508c9
0x00b508cd
0x00b508dc
0x00b508f1
0x00b508f7
0x00b508f9
0x00b508fd
0x00b50904
0x00b5090e
0x00b50913
0x00b5091c
0x00b5091f
0x00b5091f
0x00b50922
0x00b50925
0x00b50949
0x00b50964
0x00b50972
0x00b50972
0x00b5097d
0x00b5097d
0x00b5098a
0x00b50996
0x00b509a2

APIs

__EH_prolog3_GS.LIBCMT ref: 00B50877

Part of subcall function 00B4F15E: __EH_prolog3_GS.LIBCMT ref: 00B4F165
Part of subcall function 00B4F15E: VariantClear.OLEAUT32 ref: 00B4F17A
Part of subcall function 00B4F15E: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,-00000008,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F215
Part of subcall function 00B4F15E: SysAllocString.OLEAUT32(00000000), ref: 00B4F228
Part of subcall function 00B4F15E: free.MSVCRT(00000000,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F257

memset.MSVCRT ref: 00B5090E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000103,00000000,00000000), ref: 00B50949
SysFreeString.OLEAUT32(?), ref: 00B5097D
VariantClear.OLEAUT32(?), ref: 00B5098A

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ByteCharClearH_prolog3_MultiStringVariantWide$AllocFreefreememset
String ID:
API String ID: 3350116639-0
Opcode ID: 1ac5783d0f9749c5522800ae212de61192d7f153813b0408b21744bfe2c7c5c8
Instruction ID: 674ff18236c5d2db4698563b625a97943e4bdf9b87e2a2f07f6e42882acbd43f
Opcode Fuzzy Hash: 1ac5783d0f9749c5522800ae212de61192d7f153813b0408b21744bfe2c7c5c8
Instruction Fuzzy Hash: 9C316A359002299BDB25EB24CC59FDEB7B9EF45700F0140D9FA0AA7291DA706F85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B513B6 Relevance: 6.3, APIs: 5, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00B513B6(void* __ecx, signed int __edx) {
				signed int _v8;
				signed int _t21;
				signed int _t22;
				signed int _t27;
				signed int _t29;
				signed int _t34;
				signed int _t39;
				signed int _t42;
				signed int _t46;
				signed int _t56;
				signed int _t59;

				_t46 = __edx;
				_t21 = rand();
				asm("cdq");
				_t56 = _t21;
				_t22 = rand();
				asm("cdq");
				_t39 = _t22 & 0x00007fff | _t56 << 0x0000000f;
				_v8 = ((_t46 | (_t46 << 0x00000020 | _t56) << 0xf) << 0x00000020 | _t39) << 0xf;
				_t27 = rand();
				asm("cdq");
				_t59 = _t27 & 0x00007fff | _t39 << 0x0000000f;
				_t29 = rand();
				asm("cdq");
				_t42 = _t29 & 0x00007fff | _t59 << 0x0000000f;
				_v8 = ((_t46 | ((_t46 | _v8) << 0x00000020 | _t59) << 0xf) << 0x00000020 | _t42) << 0xf;
				_t34 = rand();
				asm("cdq");
				return _t34 & 0x00007fff | _t42 << 0x0000000f;
			}

0x00b513b6
0x00b513bf
0x00b513c5
0x00b513c6
0x00b513d1
0x00b513dc
0x00b513e1
0x00b513e9
0x00b513ef
0x00b513fa
0x00b51402
0x00b5140b
0x00b51416
0x00b5141b
0x00b51423
0x00b51429
0x00b51435
0x00b51440

APIs

rand.MSVCRT ref: 00B513BF
rand.MSVCRT ref: 00B513D1
rand.MSVCRT ref: 00B513EF
rand.MSVCRT ref: 00B5140B
rand.MSVCRT ref: 00B51429

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: rand
String ID:
API String ID: 415692148-0
Opcode ID: ec10fd6ca9697bec8e46338bd2e53dc90c94d33312eeaf3ed524d3f2dcae512a
Instruction ID: 1915b86d040d8d8ee9a950813f0065df9a773b4727968cc9fb3538a514bef357
Opcode Fuzzy Hash: ec10fd6ca9697bec8e46338bd2e53dc90c94d33312eeaf3ed524d3f2dcae512a
Instruction Fuzzy Hash: 4501F773E1562A6BF3409BA4CC863297692DB84250F0A0130FA3CE72C1CD7C9C21A6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00B51490 Relevance: 6.1, APIs: 4, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00B51490(intOrPtr __ecx, signed int __edx, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int _v52;
				intOrPtr _v60;
				intOrPtr _t75;
				intOrPtr _t76;
				intOrPtr _t78;
				intOrPtr _t79;
				void* _t80;
				void* _t85;
				intOrPtr _t87;
				intOrPtr _t88;
				intOrPtr* _t90;
				void* _t92;
				intOrPtr _t96;
				intOrPtr _t100;
				intOrPtr _t103;
				intOrPtr _t107;
				signed int _t109;
				signed int _t114;
				signed int _t116;
				intOrPtr _t118;
				intOrPtr _t119;
				void* _t124;
				signed int _t128;
				void* _t137;

				_t118 = __ecx;
				_v36 = __edx;
				_v20 = __ecx;
				_t96 = __edx * 0xb8 +  *((intOrPtr*)(__ecx + 8));
				_v8 = _t96;
				if( *((char*)(_t96 + 0x28)) == 0) {
					_t107 =  *((intOrPtr*)(_t96 + 0x18));
					_t126 = 0;
				} else {
					_t107 =  *((intOrPtr*)(_t96 + 0x20));
					_t126 =  *(_t96 + 0x24);
				}
				_t75 =  *((intOrPtr*)(_t96 + 0x30));
				_v32 =  *((intOrPtr*)(_t96 + 0x34));
				_v12 =  *((intOrPtr*)(_t96 + 0x18));
				_t114 = _v36;
				_v40 = _t126;
				_v44 = _t107;
				_v24 = _t75;
				if( *((char*)(_t96 + 0x29)) == 0) {
					if( *((char*)(_t96 + 0x38)) == 0) {
						if( *((char*)(_t96 + 0x39)) == 0) {
							_t76 =  *((intOrPtr*)(_t118 + 0x74));
							 *((intOrPtr*)(_t76 + _t114 * 8)) =  *((intOrPtr*)(_t76 + _t114 * 8)) + _t107;
							_t119 =  *((intOrPtr*)(_t76 + _t114 * 8));
							asm("adc [eax+edx*8+0x4], esi");
							_t126 =  *(_t76 + 4 + _t114 * 8);
							goto L13;
						}
						_t90 =  *((intOrPtr*)(_t118 + 0x80)) + _t114 * 8;
						_v28 = _t90;
						do {
							_t119 =  *_t90;
							_t128 =  *((intOrPtr*)(_t90 + 4));
							_v16 = _t128;
							asm("adc ecx, [esp+0x14]");
							_t116 = _t128;
							asm("lock cmpxchg8b [esi]");
							_t126 = _v16;
							_t107 = _v44;
							_t90 = _v28;
						} while (_t119 != _t119 || _t116 != _t126);
						goto L11;
					}
					asm("sbb esi, [esp+0x1c]");
					_t119 = _t107 - _t75 + _a4;
					asm("adc esi, [ebp+0xc]");
					goto L13;
				} else {
					_t92 = E00B513B6(_t107, _t114);
					_t126 = _t114;
					_t124 = _t92;
					_t119 = _t124 - E00B5DAB0(_t124, _t126, _v44, _v40);
					asm("sbb esi, edx");
					L11:
					_t114 = _v36;
					_t107 = _v44;
					L13:
					_t78 =  *((intOrPtr*)(_v20 + 0x20));
					_t79 =  *((intOrPtr*)(_t78 + 4 + _t114 * 8));
					asm("sbb eax, 0x0");
					_v28 =  *((intOrPtr*)(_t78 + _t114 * 8)) - _v12 - _v24;
					_t100 = _v8;
					asm("sbb eax, [esp+0x1c]");
					if( *((char*)(_t100 + 0x29)) != 0 ||  *((char*)(_t100 + 0x39)) != 0) {
						_t80 = E00B5DA40(_v28, _t79, _t107, _v40);
						asm("adc edx, 0x0");
						_t119 = E00B5DAB0(_t119, _t126, E00B5D9C0(_t80 + 1, _t114, _v60, _v40), _t114);
						_t126 = _t114;
					} else {
						_t137 = _t126 - _t79;
						if(_t137 >= 0 && (_t137 > 0 || _t119 > _v28)) {
							_t103 = _v20;
							_t85 = E00B51640(_t103, _t114);
							asm("sbb edx, [esp+0x24]");
							_t87 = E00B5DAB0(_t85 - _v24, _t114, _v44, _v40);
							_t109 = _v52;
							_t119 = _t87;
							_t88 =  *((intOrPtr*)(_t103 + 0x74));
							_t126 = _t114;
							 *((intOrPtr*)(_t88 + _t109 * 8)) = _t119;
							 *(_t88 + 4 + _t109 * 8) = _t114;
						}
					}
					asm("adc esi, [esp+0x1c]");
					return _t119 + _v24;
				}
			}

0x00b514a4
0x00b514a6
0x00b514aa
0x00b514ae
0x00b514b1
0x00b514b9
0x00b514c3
0x00b514c6
0x00b514bb
0x00b514bb
0x00b514be
0x00b514be
0x00b514cf
0x00b514d2
0x00b514d9
0x00b514dd
0x00b514e1
0x00b514e5
0x00b514e9
0x00b514ed
0x00b51511
0x00b51527
0x00b51573
0x00b51576
0x00b51579
0x00b5157c
0x00b51580
0x00000000
0x00b51580
0x00b5152f
0x00b51532
0x00b51536
0x00b51536
0x00b5153a
0x00b51541
0x00b51545
0x00b5154b
0x00b51551
0x00b51555
0x00b5155b
0x00b5155f
0x00b5155f
0x00000000
0x00b51536
0x00b51517
0x00b5151b
0x00b5151e
0x00000000
0x00b514ef
0x00b514ef
0x00b514f8
0x00b514fa
0x00b51507
0x00b51509
0x00b51569
0x00b51569
0x00b5156d
0x00b51584
0x00b51588
0x00b51592
0x00b51596
0x00b5159d
0x00b515a1
0x00b515a5
0x00b515ad
0x00b51602
0x00b5160f
0x00b51622
0x00b51624
0x00b515b5
0x00b515b5
0x00b515b7
0x00b515c1
0x00b515c7
0x00b515d8
0x00b515de
0x00b515e3
0x00b515e7
0x00b515e9
0x00b515ec
0x00b515ee
0x00b515f1
0x00b515f1
0x00b515b7
0x00b5162c
0x00b51638
0x00b51638

APIs

__aullrem.LIBCMT ref: 00B51502
__aullrem.LIBCMT ref: 00B515DE
__aulldiv.LIBCMT ref: 00B51602
__aullrem.LIBCMT ref: 00B5161D

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: __aullrem$__aulldiv
String ID:
API String ID: 3670715282-0
Opcode ID: 754fef53222c85af97132c4c6f2970ad45c246b85e278bd0114cd496febdb416
Instruction ID: 366a7ec0f4d99998b03a4ad6bf2e4a29c5b00a6a03a1439b0a841a0504cc55b3
Opcode Fuzzy Hash: 754fef53222c85af97132c4c6f2970ad45c246b85e278bd0114cd496febdb416
Instruction Fuzzy Hash: EC5137B1A083119FC714DF28D580B1ABBE6EFC8754F154A99F884A7212DA30ED58CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00B50790 Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E00B50790(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t34;
				signed int _t37;
				signed int _t42;
				void* _t44;
				signed int _t46;
				intOrPtr _t48;
				void* _t65;
				void* _t68;

				_t49 = __ebx;
				E00B5D14C(0xb5e376, __ebx, __edi, __esi);
				 *(_t68 - 0x18) =  *(_t68 - 0x18) & 0x00000000;
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				E00B4F10B(_t68 - 0x20, __esi,  *((intOrPtr*)(_t68 + 0xc)));
				_t34 =  *((intOrPtr*)(_t68 + 8));
				 *(_t68 - 4) = 1;
				_t67 =  *((intOrPtr*)( *_t34 + 0x44));
				 *0xb621f8(_t34, _t68 - 0x18, 0x14);
				_t65 =  *((intOrPtr*)( *((intOrPtr*)( *_t34 + 0x44))))();
				if(_t65 >= 0 && _t65 != 1) {
					 *(_t68 - 0x14) =  *(_t68 - 0x14) & 0x00000000;
					 *(_t68 - 4) = 2;
					_t42 =  *(_t68 - 0x18);
					_t67 =  *_t42;
					 *0xb621f8(_t42,  *((intOrPtr*)(_t68 - 0x20)), _t68 - 0x14);
					_t44 =  *((intOrPtr*)( *_t42 + 0x1c))();
					if(_t44 >= 0 && _t44 != 1) {
						_t46 =  *(_t68 - 0x14);
						_t67 =  *((intOrPtr*)( *_t46 + 0x68));
						 *0xb621f8(_t46, _t68 - 0x1c);
						_t48 =  *((intOrPtr*)( *((intOrPtr*)( *_t46 + 0x68))))();
						if(_t48 >= 0) {
							__imp___wtoi( *((intOrPtr*)(_t68 - 0x1c)));
							 *((intOrPtr*)( *((intOrPtr*)(_t68 + 0x10)))) = _t48;
							__imp__#6( *((intOrPtr*)(_t68 - 0x1c)));
						}
					}
					E00B4F72B(_t68 - 0x14);
				}
				__imp__#6( *((intOrPtr*)(_t68 - 0x20)));
				 *(_t68 - 4) =  *(_t68 - 4) | 0xffffffff;
				_t37 =  *(_t68 - 0x18);
				if(_t37 != 0) {
					_t67 =  *((intOrPtr*)( *_t37 + 8));
					 *0xb621f8(_t37);
					 *((intOrPtr*)( *((intOrPtr*)( *_t37 + 8))))();
				}
				return E00B5D100(_t49, _t65, _t67);
			}

0x00b50790
0x00b50797
0x00b5079c
0x00b507a3
0x00b507aa
0x00b507af
0x00b507b5
0x00b507bd
0x00b507c2
0x00b507ca
0x00b507ce
0x00b507d5
0x00b507d9
0x00b507e0
0x00b507e7
0x00b507ed
0x00b507f3
0x00b507f8
0x00b507ff
0x00b50809
0x00b5080e
0x00b50814
0x00b50818
0x00b5081d
0x00b5082a
0x00b5082c
0x00b5082c
0x00b50818
0x00b50835
0x00b50835
0x00b5083d
0x00b50843
0x00b50847
0x00b5084c
0x00b50851
0x00b50856
0x00b5085c
0x00b5085c
0x00b50865

APIs

__EH_prolog3_GS.LIBCMT ref: 00B50797

Part of subcall function 00B4F10B: SysFreeString.OLEAUT32 ref: 00B4F143

_wtoi.MSVCRT ref: 00B5081D
SysFreeString.OLEAUT32(?), ref: 00B5082C
SysFreeString.OLEAUT32(?), ref: 00B5083D

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: FreeString$H_prolog3__wtoi
String ID:
API String ID: 2138719750-0
Opcode ID: 9ee89e89233b9cce89110bb895f1d5ac73c8bc4b6aefb0d2b57c0d21ce552e48
Instruction ID: 8e68d07d5ec7f51d4cf28faa18b3887d12885d01038460ec59bee5cee6e07531
Opcode Fuzzy Hash: 9ee89e89233b9cce89110bb895f1d5ac73c8bc4b6aefb0d2b57c0d21ce552e48
Instruction Fuzzy Hash: D9218F31A0060ADFDF05EF64CC54BAD7BB5EF48315F104098E912B72A0CB75AD46DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B509AA Relevance: 6.1, APIs: 4, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00B509AA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t26;
				signed int _t33;
				intOrPtr _t35;
				intOrPtr* _t44;
				intOrPtr _t45;
				void* _t52;
				void* _t53;

				_t53 = __eflags;
				_t46 = __edi;
				_t36 = __ebx;
				E00B5D14C(0xb5e334, __ebx, __edi, __esi);
				 *(_t52 - 0x18) =  *(_t52 - 0x18) & 0x00000000;
				 *(_t52 - 4) =  *(_t52 - 4) & 0x00000000;
				 *((short*)(_t52 - 0x2c)) = 0;
				E00B4F15E(__ebx, _t52 - 0x2c, __edi, __esi, _t53,  *((intOrPtr*)(_t52 + 0xc)));
				_t26 =  *((intOrPtr*)(_t52 + 8));
				 *(_t52 - 4) = 1;
				 *0xb621f8(_t26,  *((intOrPtr*)(_t52 - 0x24)), _t52 - 0x18, 0x20);
				_t50 =  *((intOrPtr*)( *((intOrPtr*)( *_t26 + 0x94))))();
				if(_t50 >= 0 && _t50 != 1) {
					_t33 =  *(_t52 - 0x18);
					_t45 = _t52 - 0x1c;
					 *0xb621f8(_t33, _t45);
					_t35 =  *((intOrPtr*)( *((intOrPtr*)( *_t33 + 0x68))))();
					_t50 = _t35;
					if(_t35 >= 0) {
						__imp___wtoi64( *((intOrPtr*)(_t52 - 0x1c)));
						_t44 =  *((intOrPtr*)(_t52 + 0x10));
						 *_t44 = _t35;
						 *((intOrPtr*)(_t44 + 4)) = _t45;
					}
					__imp__#6( *((intOrPtr*)(_t52 - 0x1c)));
				}
				__imp__#9(_t52 - 0x2c);
				E00B4F72B(_t52 - 0x18);
				return E00B5D100(_t36, _t46, _t50);
			}

0x00b509aa
0x00b509aa
0x00b509aa
0x00b509b1
0x00b509b6
0x00b509ba
0x00b509c6
0x00b509ca
0x00b509cf
0x00b509d5
0x00b509e8
0x00b509f0
0x00b509f4
0x00b509fb
0x00b509fe
0x00b50a0a
0x00b50a10
0x00b50a12
0x00b50a16
0x00b50a1b
0x00b50a22
0x00b50a25
0x00b50a27
0x00b50a27
0x00b50a2d
0x00b50a2d
0x00b50a37
0x00b50a40
0x00b50a4c

APIs

__EH_prolog3_GS.LIBCMT ref: 00B509B1

Part of subcall function 00B4F15E: __EH_prolog3_GS.LIBCMT ref: 00B4F165
Part of subcall function 00B4F15E: VariantClear.OLEAUT32 ref: 00B4F17A
Part of subcall function 00B4F15E: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,-00000008,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F215
Part of subcall function 00B4F15E: SysAllocString.OLEAUT32(00000000), ref: 00B4F228
Part of subcall function 00B4F15E: free.MSVCRT(00000000,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F257

_wtoi64.MSVCRT ref: 00B50A1B
SysFreeString.OLEAUT32(?), ref: 00B50A2D
VariantClear.OLEAUT32(?), ref: 00B50A37

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ClearH_prolog3_StringVariant$AllocByteCharFreeMultiWide_wtoi64free
String ID:
API String ID: 109575796-0
Opcode ID: efcd8bfb56c101c089db0e933faf06320274c684f0b85159874ef47332f69dfc
Instruction ID: 5ae2b66726448ef2d405ebb147e1ca8a7389073df5e222571cf3a81ba15ae481
Opcode Fuzzy Hash: efcd8bfb56c101c089db0e933faf06320274c684f0b85159874ef47332f69dfc
Instruction Fuzzy Hash: 40117931D0061ADFDF05EBA8C854AEDBBF4EF08315F018098E915B72A0DB75AE06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B506E9 Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00B506E9(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t25;
				signed int _t32;
				intOrPtr _t34;
				void* _t51;
				void* _t52;

				_t52 = __eflags;
				_t45 = __edi;
				_t35 = __ebx;
				E00B5D14C(0xb5e334, __ebx, __edi, __esi);
				 *(_t51 - 0x18) =  *(_t51 - 0x18) & 0x00000000;
				 *(_t51 - 4) =  *(_t51 - 4) & 0x00000000;
				 *((short*)(_t51 - 0x2c)) = 0;
				E00B4F15E(__ebx, _t51 - 0x2c, __edi, __esi, _t52,  *((intOrPtr*)(_t51 + 0xc)));
				_t25 =  *((intOrPtr*)(_t51 + 8));
				 *(_t51 - 4) = 1;
				 *0xb621f8(_t25,  *((intOrPtr*)(_t51 - 0x24)), _t51 - 0x18, 0x20);
				_t49 =  *((intOrPtr*)( *((intOrPtr*)( *_t25 + 0x94))))();
				if(_t49 >= 0 && _t49 != 1) {
					_t32 =  *(_t51 - 0x18);
					 *0xb621f8(_t32, _t51 - 0x1c);
					_t34 =  *((intOrPtr*)( *((intOrPtr*)( *_t32 + 0x68))))();
					_t49 = _t34;
					if(_t34 >= 0) {
						__imp___wtoi( *((intOrPtr*)(_t51 - 0x1c)));
						 *((intOrPtr*)( *((intOrPtr*)(_t51 + 0x10)))) = _t34;
						__imp__#6( *((intOrPtr*)(_t51 - 0x1c)));
					}
				}
				__imp__#9(_t51 - 0x2c);
				E00B4F72B(_t51 - 0x18);
				return E00B5D100(_t35, _t45, _t49);
			}

0x00b506e9
0x00b506e9
0x00b506e9
0x00b506f0
0x00b506f5
0x00b506f9
0x00b50705
0x00b50709
0x00b5070e
0x00b50714
0x00b50727
0x00b5072f
0x00b50733
0x00b5073a
0x00b50749
0x00b5074f
0x00b50751
0x00b50755
0x00b5075a
0x00b50767
0x00b50769
0x00b50769
0x00b50755
0x00b50773
0x00b5077c
0x00b50788

APIs

__EH_prolog3_GS.LIBCMT ref: 00B506F0

Part of subcall function 00B4F15E: __EH_prolog3_GS.LIBCMT ref: 00B4F165
Part of subcall function 00B4F15E: VariantClear.OLEAUT32 ref: 00B4F17A
Part of subcall function 00B4F15E: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,-00000008,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F215
Part of subcall function 00B4F15E: SysAllocString.OLEAUT32(00000000), ref: 00B4F228
Part of subcall function 00B4F15E: free.MSVCRT(00000000,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F257

_wtoi.MSVCRT ref: 00B5075A
SysFreeString.OLEAUT32(?), ref: 00B50769
VariantClear.OLEAUT32(?), ref: 00B50773

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ClearH_prolog3_StringVariant$AllocByteCharFreeMultiWide_wtoifree
String ID:
API String ID: 1474463088-0
Opcode ID: 608e3a7497bd9081f7b952e54ea72544221e29106fceb18916f79f7d2755ad89
Instruction ID: e9b9cfd8a01bddc3c466a17595714b499059fb2bfb3f0b96cd72993428368e10
Opcode Fuzzy Hash: 608e3a7497bd9081f7b952e54ea72544221e29106fceb18916f79f7d2755ad89
Instruction Fuzzy Hash: F2116D31D0061ADFDF05EBA4C845AEDBBF5AF08315F018094E916B72A0DB75AD46CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B4F06F Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E00B4F06F(char* __ecx) {
				int _v8;
				short* _t5;
				short* _t6;
				char* _t9;
				void* _t13;
				short* _t14;
				void* _t16;
				short* _t17;

				_push(__ecx);
				_t9 = __ecx;
				if(__ecx == 0) {
					_t5 = 0;
				} else {
					_t17 = 0;
					_t6 = MultiByteToWideChar(3, 0, __ecx, 0xffffffff, 0, 0);
					_v8 = _t6;
					_t2 = _t6 - 1; // -1
					__imp__#4(0, _t2, _t13, _t16);
					_t14 = _t6;
					if(_t14 == 0 || MultiByteToWideChar(3, 0, _t9, 0xffffffff, _t14, _v8) == _v8) {
						_t17 = _t14;
					} else {
						__imp__#6(_t14);
					}
					_t5 = _t17;
				}
				return _t5;
			}

0x00b4f074
0x00b4f076
0x00b4f07a
0x00b4f0c8
0x00b4f07c
0x00b4f07e
0x00b4f088
0x00b4f08e
0x00b4f091
0x00b4f096
0x00b4f09c
0x00b4f0a0
0x00b4f0c0
0x00b4f0b7
0x00b4f0b8
0x00b4f0b8
0x00b4f0c3
0x00b4f0c5
0x00b4f0ce

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000), ref: 00B4F088
SysAllocStringLen.OLEAUT32(00000000,-00000001), ref: 00B4F096
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,?,?,000000FF,00000000,00000000), ref: 00B4F0AC
SysFreeString.OLEAUT32(00000000), ref: 00B4F0B8

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ByteCharMultiStringWide$AllocFree
String ID:
API String ID: 447844807-0
Opcode ID: 6ae0b7f7b28642aaf1549bf42c3cac0b85ebd0cbeecf2e761efa9c29a45055ab
Instruction ID: 843001ca1447be067dd65c40911afeb9de7571aa8ed43d663717a7a685c8df18
Opcode Fuzzy Hash: 6ae0b7f7b28642aaf1549bf42c3cac0b85ebd0cbeecf2e761efa9c29a45055ab
Instruction Fuzzy Hash: A7F0C832205516BBA7354B969C8CE7BBEACDBC6770B200266F51DD32D0DEA15E00D2B0

Uniqueness

Uniqueness Score: -1.00%

Function 00B4EA9A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E00B4EA9A(intOrPtr* __ecx, signed int _a4) {
				signed int _v4;
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int* _v24;
				signed int _v28;
				signed int _v32;
				signed int _v44;
				intOrPtr _v48;
				signed int _v60;
				signed int* _v68;
				signed int _v72;
				signed int _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t66;
				signed int _t67;
				signed int _t68;
				intOrPtr _t71;
				intOrPtr _t77;
				signed int _t81;
				signed int _t84;
				signed int _t92;
				signed int* _t95;
				unsigned int _t99;
				signed int _t104;
				intOrPtr _t106;
				signed int _t107;
				signed int _t109;
				intOrPtr _t112;
				intOrPtr* _t115;
				intOrPtr _t117;
				signed int* _t121;
				signed int _t123;
				signed int _t127;
				signed int _t130;
				unsigned int _t137;
				intOrPtr _t139;
				intOrPtr* _t141;
				intOrPtr _t143;
				signed int _t144;
				intOrPtr* _t149;
				signed int* _t151;
				signed int _t153;
				signed int* _t154;
				intOrPtr _t156;
				void* _t158;
				void* _t160;
				void* _t164;
				void* _t165;

				_t149 = __ecx;
				_t139 =  *((intOrPtr*)(__ecx + 8));
				_t112 =  *((intOrPtr*)(__ecx + 4));
				asm("cdq");
				_t66 = (_t139 - _t112) / 0xb8;
				if(_t66 >= 1) {
					L8:
					return _t66;
				} else {
					_t67 = _t112 -  *__ecx;
					asm("cdq");
					_t68 = _t67 / 0xb8;
					_t130 = _t67 % 0xb8;
					_t115 = 0x1642c85 - _t68;
					if(0x1642c85 < 1) {
						E00B4C465(0x1642c85, _t115, _t130, _t139, __ecx);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t158 = _t164;
						_t165 = _t164 - 0x18;
						_push(0x1642c85);
						_t104 = _v4;
						_push(_t149);
						_push(_t139);
						_t151 = 0;
						_t141 = _t115;
						_v32 = _t141;
						_v24 = 0;
						if(_t104 == 0) {
							L13:
							_push(_v28);
							_push(_t115);
							_push(_t115);
							E00B4ED78( *_t141,  *((intOrPtr*)(_t141 + 4)), _t151);
							_t71 =  *((intOrPtr*)(_t141 + 4));
							_t117 =  *_t141;
							_v8 = _t71;
							asm("cdq");
							_v12 = 0x38;
							_v28 = (_t71 - _t117) / _v12;
							if(_t117 != 0) {
								if(_t117 != _v8) {
									_t143 = _v8;
									_t106 = _t117;
									_t153 = _v12;
									do {
										E00B4A107(_t106 + 0x24);
										E00B4A17A(_t106);
										_t106 = _t106 + _t153;
									} while (_t106 != _t143);
									_t151 = _v16;
									_t141 = _v24;
									_t104 = _a4;
								}
								__imp__??3@YAXPAX@Z( *_t141);
							}
							 *_t141 = _t151;
							 *((intOrPtr*)(_t141 + 8)) = _t104 * 0x38 + _t151;
							_t77 = _v28 * 0x38 + _t151;
							 *((intOrPtr*)(_t141 + 4)) = _t77;
							return _t77;
						} else {
							if(_t104 > 0x4924924) {
								L20:
								E00B5CBE6();
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t158);
								_t160 = _t165;
								_t81 = _v44;
								_t121 = 0;
								if(_t81 == 0) {
									L24:
									return _t121;
								} else {
									if(_t81 > 0x3fffffff) {
										L25:
										E00B5CBE6();
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t160);
										_push(_t104);
										_push(_t151);
										_push(_t141);
										_t154 = _t121;
										_v68 = _t154;
										_t84 = E00B4C4F6(_t104, _t130, _t141, _t154, _v48);
										_push(_v76);
										_t107 = _t84;
										_push(_t121);
										_push(_t121);
										_v72 = _t107;
										E00B4EDA9( *_t154, _t154[1], _t107);
										_t123 = _t154[1];
										_t144 =  *_t154;
										asm("cdq");
										_v60 = 0xb8;
										_v76 = (_t123 - _t144) / _v60;
										if(_t144 != 0) {
											if(_t144 != _t123) {
												_t156 = _v16;
												_t109 = _t123;
												do {
													E00B49CF3(_t144);
													_t144 = _t144 + _t156;
												} while (_t144 != _t109);
												_t154 = _v24;
												_t107 = _v28;
											}
											__imp__??3@YAXPAX@Z( *_t154);
										}
										 *_t154 = _t107;
										_t154[2] = _v4 * 0xb8 + _t107;
										_t92 = _v32 * 0xb8 + _t107;
										_t154[1] = _t92;
										return _t92;
									} else {
										_push(_t81 << 2); // executed
										_t95 = E00B5CA2B(); // executed
										_t121 = _t95;
										if(_t121 == 0) {
											goto L25;
										} else {
											goto L24;
										}
									}
								}
							} else {
								_push(_t104 * 0x38);
								_t151 = E00B5CA2B();
								_v16 = _t151;
								_pop(_t115);
								if(_t151 == 0) {
									goto L20;
								} else {
									goto L13;
								}
							}
						}
					} else {
						_t127 = _t68 + 1;
						asm("cdq");
						_t99 = (_t139 -  *__ecx) / 0xb8;
						_t137 = _t99 >> 1;
						if(0x1642c85 - _t137 >= _t99) {
							_t66 = _t99 + _t137;
						} else {
							_t66 = 0;
						}
						if(_t66 < _t127) {
							_t66 = _t127;
						}
						_push(_t66);
						L26();
						goto L8;
					}
				}
			}

0x00b4ea9e
0x00b4eaa6
0x00b4eaab
0x00b4eab0
0x00b4eab1
0x00b4eab6
0x00b4eafa
0x00b4eafd
0x00b4eab8
0x00b4eaba
0x00b4eabc
0x00b4eabd
0x00b4eabd
0x00b4eac6
0x00b4eacb
0x00b4eb00
0x00b4eb05
0x00b4eb06
0x00b4eb07
0x00b4eb08
0x00b4eb09
0x00b4eb0a
0x00b4eb0e
0x00b4eb10
0x00b4eb13
0x00b4eb14
0x00b4eb17
0x00b4eb18
0x00b4eb19
0x00b4eb1b
0x00b4eb1d
0x00b4eb20
0x00b4eb25
0x00b4eb46
0x00b4eb46
0x00b4eb4c
0x00b4eb4d
0x00b4eb51
0x00b4eb56
0x00b4eb59
0x00b4eb5b
0x00b4eb60
0x00b4eb61
0x00b4eb6b
0x00b4eb70
0x00b4eb75
0x00b4eb77
0x00b4eb7a
0x00b4eb7c
0x00b4eb7f
0x00b4eb82
0x00b4eb89
0x00b4eb8e
0x00b4eb90
0x00b4eb94
0x00b4eb97
0x00b4eb9a
0x00b4eb9a
0x00b4eb9f
0x00b4eba5
0x00b4eba9
0x00b4ebad
0x00b4ebb4
0x00b4ebb6
0x00b4ebbf
0x00b4eb27
0x00b4eb2d
0x00b4ebc2
0x00b4ebc2
0x00b4ebc7
0x00b4ebc8
0x00b4ebc9
0x00b4ebca
0x00b4ebcb
0x00b4ebcc
0x00b4ebcf
0x00b4ebd0
0x00b4ebd2
0x00b4ebd5
0x00b4ebd9
0x00b4ebf2
0x00b4ebf5
0x00b4ebdb
0x00b4ebe0
0x00b4ebf8
0x00b4ebf8
0x00b4ebfd
0x00b4ebfe
0x00b4ebff
0x00b4ec00
0x00b4ec01
0x00b4ec02
0x00b4ec05
0x00b4ec0b
0x00b4ec0c
0x00b4ec0d
0x00b4ec11
0x00b4ec13
0x00b4ec16
0x00b4ec1b
0x00b4ec21
0x00b4ec23
0x00b4ec24
0x00b4ec28
0x00b4ec2b
0x00b4ec30
0x00b4ec35
0x00b4ec39
0x00b4ec3a
0x00b4ec44
0x00b4ec49
0x00b4ec4d
0x00b4ec4f
0x00b4ec52
0x00b4ec54
0x00b4ec56
0x00b4ec5b
0x00b4ec5d
0x00b4ec61
0x00b4ec64
0x00b4ec64
0x00b4ec69
0x00b4ec6f
0x00b4ec78
0x00b4ec7c
0x00b4ec86
0x00b4ec88
0x00b4ec90
0x00b4ebe2
0x00b4ebe5
0x00b4ebe6
0x00b4ebec
0x00b4ebf0
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4ebf0
0x00b4ebe0
0x00b4eb33
0x00b4eb36
0x00b4eb3c
0x00b4eb3e
0x00b4eb41
0x00b4eb44
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4eb44
0x00b4eb2d
0x00b4eacd
0x00b4eacf
0x00b4ead9
0x00b4eada
0x00b4eade
0x00b4eae4
0x00b4eaea
0x00b4eae6
0x00b4eae6
0x00b4eae6
0x00b4eaee
0x00b4eaf0
0x00b4eaf0
0x00b4eaf2
0x00b4eaf5
0x00000000
0x00b4eaf5
0x00b4eacb

APIs

??3@YAXPAX@Z.MSVCRT ref: 00B4EB9F
std::tr1::_Xmem.LIBCPMT ref: 00B4EBC2

Strings

8, xrefs: 00B4EB61

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ??3@Xmemstd::tr1::_
String ID: 8
API String ID: 2676974237-4194326291
Opcode ID: e836a7f55c61a8fa35cee9b654ea8528f01d23694f2a597bc92ee503df3c9518
Instruction ID: cd598f935894fd25a4db288134b7cbe20294c9ee91ceb1ac4ddcf6ef55c4d230
Opcode Fuzzy Hash: e836a7f55c61a8fa35cee9b654ea8528f01d23694f2a597bc92ee503df3c9518
Instruction Fuzzy Hash: 2031B776B016169FCB04DFA9C9D545DFBE9FF98310B2445AEE916E3340D670EE009B90

Uniqueness

Uniqueness Score: -1.00%

Function 00B4FBF6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00B4FBF6(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t40;
				signed int _t45;
				void* _t47;
				signed int _t48;
				intOrPtr* _t73;
				void* _t80;
				void* _t81;

				_t81 = __eflags;
				E00B5D14C(0xb5e1a5, __ebx, __edi, __esi);
				_t73 =  *((intOrPtr*)(_t80 + 8));
				_t59 =  *((intOrPtr*)(_t80 + 0xc));
				 *((short*)(_t80 - 0xe8)) = 0;
				E00B4F15E( *((intOrPtr*)(_t80 + 0xc)), _t80 - 0xe8, _t73, __esi, _t81, "Targets/Target");
				 *(_t80 - 4) =  *(_t80 - 4) & 0x00000000;
				 *(_t80 - 0xcc) =  *(_t80 - 0xcc) & 0x00000000;
				 *(_t80 - 4) = 1;
				 *0xb621f8(_t73,  *((intOrPtr*)(_t80 - 0xe0)), _t80 - 0xcc, 0xdc);
				_t40 =  *((intOrPtr*)( *((intOrPtr*)( *_t73 + 0x90))))();
				_t77 = _t40;
				if(_t40 >= 0) {
					_t45 =  *(_t80 - 0xcc);
					 *0xb621f8(_t45, _t80 - 0xd4);
					_t47 =  *((intOrPtr*)( *((intOrPtr*)( *_t45 + 0x20))))();
					_t77 = _t47;
					if(_t47 >= 0) {
						_t73 = 0;
						if( *((intOrPtr*)(_t80 - 0xd4)) > 0) {
							do {
								 *(_t80 - 0xd0) =  *(_t80 - 0xd0) & 0x00000000;
								 *(_t80 - 4) = 2;
								_t48 =  *(_t80 - 0xcc);
								 *0xb621f8(_t48, _t73, _t80 - 0xd0);
								_t77 =  *((intOrPtr*)( *_t48 + 0x1c))();
								_t85 = _t77;
								if(_t77 >= 0) {
									_t68 = _t80 - 0xc8;
									E00B4C91D(_t80 - 0xc8);
									 *(_t80 - 4) = 3;
									E00B4FFFD(_t59, _t80 - 0xc8, _t73, _t77, _t85,  *(_t80 - 0xd0), _t68);
									_push(_t80 - 0xc8);
									E00B4CA85(_t59, _t59, _t73, _t77, _t85);
									E00B49CF3(_t80 - 0xc8);
								}
								 *(_t80 - 4) = 1;
								E00B4F72B(_t80 - 0xd0);
								_t73 = _t73 + 1;
							} while (_t73 <  *((intOrPtr*)(_t80 - 0xd4)));
						}
					}
				}
				E00B4F72B(_t80 - 0xcc);
				__imp__#9(_t80 - 0xe8);
				return E00B5D100(_t59, _t73, _t77);
			}

0x00b4fbf6
0x00b4fc00
0x00b4fc05
0x00b4fc0e
0x00b4fc18
0x00b4fc1f
0x00b4fc24
0x00b4fc28
0x00b4fc2f
0x00b4fc4b
0x00b4fc51
0x00b4fc53
0x00b4fc57
0x00b4fc5d
0x00b4fc72
0x00b4fc78
0x00b4fc7a
0x00b4fc7e
0x00b4fc84
0x00b4fc8c
0x00b4fc8e
0x00b4fc8e
0x00b4fc95
0x00b4fc9f
0x00b4fcad
0x00b4fcb6
0x00b4fcb8
0x00b4fcba
0x00b4fcbc
0x00b4fcc2
0x00b4fcc9
0x00b4fcd4
0x00b4fce1
0x00b4fce2
0x00b4fced
0x00b4fced
0x00b4fcf8
0x00b4fcfc
0x00b4fd01
0x00b4fd02
0x00b4fc8e
0x00b4fc8c
0x00b4fc7e
0x00b4fd10
0x00b4fd1c
0x00b4fd29

APIs

__EH_prolog3_GS.LIBCMT ref: 00B4FC00

Part of subcall function 00B4F15E: __EH_prolog3_GS.LIBCMT ref: 00B4F165
Part of subcall function 00B4F15E: VariantClear.OLEAUT32 ref: 00B4F17A
Part of subcall function 00B4F15E: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,-00000008,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F215
Part of subcall function 00B4F15E: SysAllocString.OLEAUT32(00000000), ref: 00B4F228
Part of subcall function 00B4F15E: free.MSVCRT(00000000,?,00000014,00B50AA9,?,00000020,00B4F785,?,//Profile/ETW/Process,?), ref: 00B4F257

VariantClear.OLEAUT32(?), ref: 00B4FD1C

Part of subcall function 00B4FFFD: __EH_prolog3_GS.LIBCMT ref: 00B50004

Part of subcall function 00B4CA85: __EH_prolog3_GS.LIBCMT ref: 00B4CA8F

Strings

Targets/Target, xrefs: 00B4FC13

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: H_prolog3_$ClearVariant$AllocByteCharMultiStringWidefree
String ID: Targets/Target
API String ID: 2883521150-4232948680
Opcode ID: b0d64bd5adbaadf3107cb7e42cfaf2c79a7273c5da8375813b3b040d04a14197
Instruction ID: e7fde9fc6abf31c6779ac3474ddd46f354b0f2f3ce802860660bf448398c97c8
Opcode Fuzzy Hash: b0d64bd5adbaadf3107cb7e42cfaf2c79a7273c5da8375813b3b040d04a14197
Instruction Fuzzy Hash: 9A31243190162ADFEB21EB64CC44BADB7B4AF44304F0181E9E909B3291DB706F89DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00B5C7D3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00B5C7D3(void* __ebx, signed int* __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				char _v16;
				intOrPtr _t36;
				signed int* _t40;
				char* _t43;
				signed int _t45;
				signed int _t49;
				signed int _t54;

				_t40 = __ecx;
				if(( *__ecx | __ecx[1]) == 0) {
					_t43 =  &_v16;
					E00B5829A(_t43, "IoBucketizer has not been initialized");
					_push(0xb60758);
					_push( &_v16);
					L00B5D0DC();
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t45 =  *(_t43 + 8);
					if( *((intOrPtr*)(_t43 + 0x10)) -  *((intOrPtr*)(_t43 + 0xc)) >> 2 <= _t45) {
						_t45 =  *((intOrPtr*)(_t43 + 0x10)) -  *((intOrPtr*)(_t43 + 0xc)) >> 2;
					}
					return _t45;
				} else {
					_t49 = E00B5DA40(_a4, _a8,  *__ecx, __ecx[1]);
					_t54 =  *((intOrPtr*)(_t40 + 0x10)) -  *((intOrPtr*)(_t40 + 0xc)) >> 2;
					_t7 = _t49 + 1; // 0x1
					_t35 = _t7;
					if(_t54 < _t7) {
						_t8 = _t40 + 0xc; // 0xcc
						E00B5C9B9(_t8, _t35);
						while(_t54 <= _t49) {
							 *( *((intOrPtr*)(_t40 + 0xc)) + _t54 * 4) =  *( *((intOrPtr*)(_t40 + 0xc)) + _t54 * 4) & 0x00000000;
							_t54 = _t54 + 1;
						}
					}
					_t36 =  *((intOrPtr*)(_t40 + 0xc));
					 *((intOrPtr*)(_t36 + _t49 * 4)) =  *((intOrPtr*)(_t36 + _t49 * 4)) + 1;
					return _t36;
				}
			}

0x00b5c7dc
0x00b5c7e5
0x00b5c834
0x00b5c837
0x00b5c83c
0x00b5c844
0x00b5c845
0x00b5c84a
0x00b5c84b
0x00b5c84c
0x00b5c84d
0x00b5c84e
0x00b5c84f
0x00b5c856
0x00b5c85e
0x00b5c866
0x00b5c866
0x00b5c86b
0x00b5c7e7
0x00b5c7fa
0x00b5c7ff
0x00b5c802
0x00b5c802
0x00b5c807
0x00b5c80a
0x00b5c80d
0x00b5c81c
0x00b5c817
0x00b5c81b
0x00b5c81b
0x00b5c81c
0x00b5c820
0x00b5c823
0x00b5c82c
0x00b5c82c

APIs

__aulldiv.LIBCMT ref: 00B5C7F2
_CxxThrowException.MSVCRT(?,00B60758), ref: 00B5C845

Strings

IoBucketizer has not been initialized, xrefs: 00B5C82F

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: ExceptionThrow__aulldiv
String ID: IoBucketizer has not been initialized
API String ID: 1607158013-2369748627
Opcode ID: 1f38c7cf934b5aec1fa67e524d876e136b69b202500b96a8c7d68b353b71e642
Instruction ID: c71f6ef9629197c783182d71ac45cd2882741be7d30ab5cba02e7df6fea0636b
Opcode Fuzzy Hash: 1f38c7cf934b5aec1fa67e524d876e136b69b202500b96a8c7d68b353b71e642
Instruction Fuzzy Hash: 1F015232500214AFCB11EE54C881A96BBE9FB44322B0581E1ED199F116D731F819CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B531FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00B531FA(void* __ecx, void* _a4, intOrPtr _a8) {
				int _t4;
				void* _t7;

				_t7 = __ecx;
				if(_a4 != 0) {
					 *0xb614b8 = 1;
					_t4 = SetEvent(_a4);
					if(_t4 == 0) {
						_push("Error signaling start event\n");
						E00B51330(_t7);
						return E00B531AA(_a8);
					}
					L4:
					while( *0xb614b4 > 0) {
						Sleep(0x64);
					}
				}
				return _t4;
			}

0x00b531fa
0x00b53203
0x00b53208
0x00b53212
0x00b5321a
0x00b5321c
0x00b53221
0x00000000
0x00b5322a
0x00000000
0x00b53239
0x00b53233
0x00b53233
0x00b53239
0x00b53243

APIs

SetEvent.KERNEL32(00000000), ref: 00B53212

Part of subcall function 00B531AA: TerminateThread.KERNEL32(?,00000000), ref: 00B531C9

Strings

Error signaling start event, xrefs: 00B5321C

Memory Dump Source

Source File: 0000000E.00000002.2357961710.0000000000B41000.00000020.00000001.01000000.00000011.sdmp, Offset: 00B40000, based on PE: true

Associated: 0000000E.00000002.2357880027.0000000000B40000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358099088.0000000000B61000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2358144387.0000000000B62000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b40000_diskspd.jbxd

Similarity

API ID: EventTerminateThread
String ID: Error signaling start event
API String ID: 2007589259-38563648
Opcode ID: a5dca48008c8c5e90c94881686311a87f4529b2c2e42fcae3e23fc2c7f2f00a1
Instruction ID: 0f680860f61943ec76eb4075ea5adf4719d2e08cbfb44a0e5c0ede033a7f332c
Opcode Fuzzy Hash: a5dca48008c8c5e90c94881686311a87f4529b2c2e42fcae3e23fc2c7f2f00a1
Instruction Fuzzy Hash: E1E01A31004A45EEE7106F55EC097993AD5EB00B92F5480D5FC05163E1CFFA9A98DE65

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SetupResources.exePID: 5888, Parent PID: 4152COMMON

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1260
Total number of Limit Nodes:	23

Executed Functions

Function 0040310D Relevance: 84.3, APIs: 25, Strings: 23, Instructions: 313
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				intOrPtr _t40;
				CHAR* _t44;
				char* _t47;
				signed int _t49;
				void* _t53;
				intOrPtr _t55;
				int _t57;
				signed int _t60;
				signed int _t61;
				int _t62;
				signed int _t64;
				signed int _t67;
				intOrPtr _t80;
				int _t84;
				intOrPtr _t86;
				void* _t88;
				void* _t100;
				intOrPtr* _t101;
				void* _t104;
				CHAR* _t109;
				signed int _t110;
				signed int _t111;
				signed int _t112;
				void* _t114;
				signed int _t116;
				char* _t118;
				signed int _t119;
				void* _t121;
				void* _t122;
				intOrPtr _t130;
				char _t139;

				 *(_t122 + 0x1c) = 0;
				 *((intOrPtr*)(_t122 + 0x14)) = "Error writing temporary file. Make sure your temp folder is valid.";
				_t111 = 0;
				 *(_t122 + 0x18) = 0x20;
				SetErrorMode(0x8001); // executed
				if(GetVersion() != 6) {
					_t101 = E00405F2D(0);
					if(_t101 != 0) {
						 *_t101(0xc00);
					}
				}
				E00405EC3("UXTHEME"); // executed
				E00405EC3("USERENV"); // executed
				E00405EC3("SETUPAPI"); // executed
				E00405F2D(0xd);
				_t40 = E00405F2D(0xb);
				 *0x42ec44 = _t40;
				__imp__#17();
				__imp__OleInitialize(0); // executed
				 *0x42ecf8 = _t40;
				SHGetFileInfoA(0x429078, 0, _t122 + 0x34, 0x160, 0); // executed
				E00405BA1("Fast! Resources Setup", "NSIS Error");
				_t44 = GetCommandLineA();
				_t118 = "C:\\Users\\alfredo\\AppData\\Local\\Temp\\SetupResources.exe";
				E00405BA1(_t118, _t44);
				 *0x42ec40 = GetModuleHandleA(0);
				_t47 = _t118;
				if("C:\\Users\\alfredo\\AppData\\Local\\Temp\\SetupResources.exe" == 0x22) {
					 *((char*)(_t122 + 0x14)) = 0x22;
					_t47 =  &M00434001;
				}
				_t49 = CharNextA(E004056BF(_t47,  *((intOrPtr*)(_t122 + 0x14))));
				 *(_t122 + 0x1c) = _t49;
				while(1) {
					_t104 =  *_t49;
					_t126 = _t104;
					if(_t104 == 0) {
						break;
					}
					__eflags = _t104 - 0x20;
					if(_t104 != 0x20) {
						L8:
						__eflags =  *_t49 - 0x22;
						 *((char*)(_t122 + 0x14)) = 0x20;
						if( *_t49 == 0x22) {
							_t49 = _t49 + 1;
							__eflags = _t49;
							 *((char*)(_t122 + 0x14)) = 0x22;
						}
						__eflags =  *_t49 - 0x2f;
						if( *_t49 != 0x2f) {
							L18:
							_t49 = E004056BF(_t49,  *((intOrPtr*)(_t122 + 0x14)));
							__eflags =  *_t49 - 0x22;
							if(__eflags == 0) {
								_t49 = _t49 + 1;
								__eflags = _t49;
							}
							continue;
						} else {
							_t49 = _t49 + 1;
							__eflags =  *_t49 - 0x53;
							if( *_t49 == 0x53) {
								__eflags = ( *(_t49 + 1) | 0x00000020) - 0x20;
								if(( *(_t49 + 1) | 0x00000020) == 0x20) {
									_t111 = _t111 | 0x00000002;
									__eflags = _t111;
								}
							}
							__eflags =  *_t49 - 0x4352434e;
							if( *_t49 == 0x4352434e) {
								__eflags = ( *(_t49 + 4) | 0x00000020) - 0x20;
								if(( *(_t49 + 4) | 0x00000020) == 0x20) {
									_t111 = _t111 | 0x00000004;
									__eflags = _t111;
								}
							}
							__eflags =  *((intOrPtr*)(_t49 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t49 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t49 - 2)) = 0;
								_t50 = _t49 + 2;
								__eflags = _t49 + 2;
								E00405BA1("C:\\Program Files (x86)\\Fast!", _t50);
								L23:
								_t109 = "C:\\Users\\alfredo\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t109);
								_t53 = E004030DC(_t126);
								_t127 = _t53;
								if(_t53 != 0) {
									L25:
									DeleteFileA("1033"); // executed
									_t55 = E00402C38(_t128, _t111); // executed
									 *((intOrPtr*)(_t122 + 0x10)) = _t55;
									if(_t55 != 0) {
										L35:
										E0040351A();
										__imp__OleUninitialize();
										_t135 =  *((intOrPtr*)(_t122 + 0x10));
										if( *((intOrPtr*)(_t122 + 0x10)) == 0) {
											__eflags =  *0x42ecd4; // 0x0
											if(__eflags == 0) {
												L62:
												_t57 =  *0x42ecec; // 0xffffffff
												__eflags = _t57 - 0xffffffff;
												if(_t57 != 0xffffffff) {
													 *(_t122 + 0x18) = _t57;
												}
												ExitProcess( *(_t122 + 0x18));
											}
											_t119 = E00405F2D(5);
											_t112 = E00405F2D(6);
											_t60 = E00405F2D(7);
											__eflags = _t119;
											_t110 = _t60;
											if(_t119 != 0) {
												__eflags = _t112;
												if(_t112 != 0) {
													__eflags = _t110;
													if(_t110 != 0) {
														_t67 =  *_t119(GetCurrentProcess(), 0x28, _t122 + 0x1c);
														__eflags = _t67;
														if(_t67 != 0) {
															 *_t112(0, "SeShutdownPrivilege", _t122 + 0x24);
															 *(_t122 + 0x38) = 1;
															 *(_t122 + 0x44) = 2;
															 *_t110( *((intOrPtr*)(_t122 + 0x30)), 0, _t122 + 0x28, 0, 0, 0);
														}
													}
												}
											}
											_t61 = E00405F2D(8);
											__eflags = _t61;
											if(_t61 == 0) {
												L60:
												_t62 = ExitWindowsEx(2, 0x80040002);
												__eflags = _t62;
												if(_t62 != 0) {
													goto L62;
												}
												goto L61;
											} else {
												_t64 =  *_t61(0, 0, 0, 0x25, 0x80040002);
												__eflags = _t64;
												if(_t64 == 0) {
													L61:
													E0040140B(9);
													goto L62;
												}
												goto L60;
											}
										}
										E00405462( *((intOrPtr*)(_t122 + 0x14)), 0x200010);
										ExitProcess(2);
									}
									_t130 =  *0x42ec5c; // 0x0
									if(_t130 == 0) {
										L34:
										 *0x42ecec =  *0x42ecec | 0xffffffff;
										 *(_t122 + 0x18) = E004035F4( *0x42ecec);
										goto L35;
									}
									_t116 = E004056BF(_t118, 0);
									while(_t116 >= _t118) {
										__eflags =  *_t116 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t116 = _t116 - 1;
										__eflags = _t116;
									}
									_t132 = _t116 - _t118;
									 *((intOrPtr*)(_t122 + 0x10)) = "Error launching installer";
									if(_t116 < _t118) {
										_t114 = E004053E9(_t135);
										lstrcatA(_t109, "~nsu");
										if(_t114 != 0) {
											lstrcatA(_t109, "A");
										}
										lstrcatA(_t109, ".tmp");
										_t120 = "C:\\Users\\alfredo\\AppData\\Local\\Temp";
										if(lstrcmpiA(_t109, "C:\\Users\\alfredo\\AppData\\Local\\Temp") != 0) {
											_push(_t109);
											if(_t114 == 0) {
												E004053CC();
											} else {
												E0040534F();
											}
											SetCurrentDirectoryA(_t109);
											_t139 = "C:\\Program Files (x86)\\Fast!"; // 0x43
											if(_t139 == 0) {
												E00405BA1("C:\\Program Files (x86)\\Fast!", _t120);
											}
											E00405BA1(0x42f000,  *(_t122 + 0x1c));
											 *0x42f400 = 0x41;
											_t121 = 0x1a;
											do {
												_t80 =  *0x42ec50; // 0x56e260
												E00405BC3(0, _t109, 0x428c78, 0x428c78,  *((intOrPtr*)(_t80 + 0x120)));
												DeleteFileA(0x428c78);
												if( *((intOrPtr*)(_t122 + 0x10)) != 0) {
													_t84 = CopyFileA("C:\\Users\\alfredo\\AppData\\Local\\Temp\\SetupResources.exe", 0x428c78, 1);
													_t141 = _t84;
													if(_t84 != 0) {
														_push(0);
														_push(0x428c78);
														E004058EF(_t141);
														_t86 =  *0x42ec50; // 0x56e260
														E00405BC3(0, _t109, 0x428c78, 0x428c78,  *((intOrPtr*)(_t86 + 0x124)));
														_t88 = E00405401(0x428c78);
														if(_t88 != 0) {
															CloseHandle(_t88);
															 *((intOrPtr*)(_t122 + 0x10)) = 0;
														}
													}
												}
												 *0x42f400 =  *0x42f400 + 1;
												_t121 = _t121 - 1;
												_t143 = _t121;
											} while (_t121 != 0);
											_push(0);
											_push(_t109);
											E004058EF(_t143);
										}
										goto L35;
									}
									 *_t116 = 0;
									_t117 = _t116 + 4;
									if(E00405775(_t132, _t116 + 4) == 0) {
										goto L35;
									}
									E00405BA1("C:\\Program Files (x86)\\Fast!", _t117);
									E00405BA1("C:\\Program Files (x86)\\Fast!", _t117);
									 *((intOrPtr*)(_t122 + 0x10)) = 0;
									goto L34;
								}
								GetWindowsDirectoryA(_t109, 0x3fb);
								lstrcatA(_t109, "\\Temp");
								_t100 = E004030DC(_t127);
								_t128 = _t100;
								if(_t100 == 0) {
									goto L35;
								}
								goto L25;
							} else {
								goto L18;
							}
						}
					} else {
						goto L7;
					}
					do {
						L7:
						_t49 = _t49 + 1;
						__eflags =  *_t49 - 0x20;
					} while ( *_t49 == 0x20);
					goto L8;
				}
				goto L23;
			}

APIs

SetErrorMode.KERNELBASE ref: 00403131
GetVersion.KERNEL32 ref: 00403137
#17.COMCTL32(0000000B,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00403185
OleInitialize.OLE32(00000000), ref: 0040318C
SHGetFileInfoA.SHELL32(00429078,00000000,?,00000160,00000000), ref: 004031A8
GetCommandLineA.KERNEL32(Fast! Resources Setup,NSIS Error), ref: 004031BD
GetModuleHandleA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000), ref: 004031D0
CharNextA.USER32(00000000,C:\Users\user\AppData\Local\Temp\SetupResources.exe,00409188), ref: 004031FB
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040328E
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004032A3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032AF
DeleteFileA.KERNELBASE(1033), ref: 004032C2

Part of subcall function 00405F2D: GetModuleHandleA.KERNEL32(?,?,00000000,00403179,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00405F3F
Part of subcall function 00405F2D: GetProcAddress.KERNEL32(00000000,?), ref: 00405F5A

OleUninitialize.OLE32(00000000), ref: 00403340
ExitProcess.KERNEL32 ref: 00403360
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,00000000), ref: 00403373
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00409148,C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,00000000), ref: 00403382
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000,00000000), ref: 0040338D
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp), ref: 00403399
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 004033B5
DeleteFileA.KERNEL32(00428C78,00428C78,?,0042F000,?), ref: 004033FF
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\SetupResources.exe,00428C78,00000001), ref: 00403413
CloseHandle.KERNEL32(00000000,00428C78,00428C78,?,00428C78,00000000), ref: 00403440
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000006,00000005), ref: 00403499
ExitWindowsEx.USER32(00000002,80040002), ref: 004034F1
ExitProcess.KERNEL32 ref: 00403514

Strings

C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 004031C3, 004031C9, 004032DF
NCRC, xrefs: 0040323B
UXTHEME, xrefs: 00403154
C:\Program Files (x86)\Fast!, xrefs: 0040331D
`V, xrefs: 004033ED, 00403424
Error launching installer, xrefs: 004032F8
1033, xrefs: 004032BD
C:\Users\user\AppData\Local\Temp, xrefs: 00403392, 00403397, 004033C3
SeShutdownPrivilege, xrefs: 004034AB
C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 0040340E
C:\Program Files (x86)\Fast!, xrefs: 00403279, 00403312, 004033BB, 004033C4
", xrefs: 0040321D
~nsu, xrefs: 0040336B
SETUPAPI, xrefs: 00403168
, xrefs: 0040312C
C:\Users\user\AppData\Local\Temp\, xrefs: 00403283, 00403288, 004032A2, 004032AE, 00403370, 00403381, 0040338C, 00403398, 004033A5, 004033B4, 00403454
_?=, xrefs: 004032E9
.tmp, xrefs: 00403387
NSIS Error, xrefs: 004031AE
USERENV, xrefs: 0040315E
/D=, xrefs: 00403251
\Temp, xrefs: 004032A9
Fast! Resources Setup, xrefs: 004031B3

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Filelstrcat$ExitHandleProcess$CurrentDeleteDirectoryModuleWindows$AddressCharCloseCommandCopyErrorInfoInitializeLineModeNextPathProcTempUninitializeVersionlstrcmpi
String ID: $ /D=$ _?=$"$.tmp$1033$C:\Program Files (x86)\Fast!$C:\Program Files (x86)\Fast!$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\SetupResources.exe$C:\Users\user\AppData\Local\Temp\SetupResources.exe$Error launching installer$Fast! Resources Setup$NCRC$NSIS Error$SETUPAPI$SeShutdownPrivilege$USERENV$UXTHEME$\Temp$`V$~nsu
API String ID: 728943206-4207593402
Opcode ID: 4dd452560eae24bc6de7938b16d62ef3ef61ce91039457760c5fd2ce1b0eb6ad
Instruction ID: 451575da7f46b68c591153a14feb1e54add6b468c03afba2ffefeba693a227d9
Opcode Fuzzy Hash: 4dd452560eae24bc6de7938b16d62ef3ef61ce91039457760c5fd2ce1b0eb6ad
Instruction Fuzzy Hash: 55A1E3705083416AE7216F629C4AF6B7EACEB4570AF04047FF541B61D2CB7C9A058A6F

Uniqueness

Uniqueness Score: -1.00%

Function 004035F4 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E004035F4(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				signed int _t24;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				int _t37;
				int _t38;
				intOrPtr _t39;
				int _t42;
				intOrPtr _t60;
				char _t62;
				CHAR* _t64;
				signed char _t68;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				intOrPtr _t81;
				CHAR* _t85;

				_t81 =  *0x42ec50; // 0x56e260
				_t20 = E00405F2D(3);
				_t88 = _t20;
				if(_t20 == 0) {
					_t79 = 0x42a0c0;
					"1033" = 0x7830;
					E00405A88(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x42a0c0, 0);
					__eflags =  *0x42a0c0;
					if(__eflags == 0) {
						E00405A88(0x80000003, ".DEFAULT\\Control Panel\\International",  &M004072F6, 0x42a0c0, 0);
					}
					lstrcatA("1033", _t79);
				} else {
					E00405AFF("1033",  *_t20() & 0x0000ffff);
				}
				E004038BD(_t76, _t88);
				_t24 =  *0x42ec58; // 0x80
				_t84 = "C:\\Program Files (x86)\\Fast!";
				 *0x42ecc0 = _t24 & 0x00000020;
				 *0x42ecdc = 0x10000;
				if(E00405775(_t88, "C:\\Program Files (x86)\\Fast!") != 0) {
					L16:
					if(E00405775(_t96, _t84) == 0) {
						E00405BC3(0, _t79, _t81, _t84,  *((intOrPtr*)(_t81 + 0x118))); // executed
					}
					_t28 = LoadImageA( *0x42ec40, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x42e428 = _t28;
					if( *((intOrPtr*)(_t81 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E004038BD(_t76, __eflags);
							__eflags =  *0x42ece0; // 0x1
							if(__eflags != 0) {
								_t31 = E00404F5F(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42e40c; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x42a098, 5);
							_t37 = E00405EC3("RichEd20");
							__eflags = _t37;
							if(_t37 == 0) {
								E00405EC3("RichEd32");
							}
							_t85 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t85, 0x42e3e0);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x42e3e0);
								 *0x42e404 = _t85;
								RegisterClassA(0x42e3e0);
							}
							_t39 =  *0x42e420; // 0x0
							_t42 = DialogBoxParamA( *0x42ec40, _t39 + 0x00000069 & 0x0000ffff, 0, E0040398A, 0);
							E00403544(E0040140B(5), 1);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t76 =  *0x42ec40; // 0x400000
						 *0x42e3f4 = _t28;
						_v20 = 0x624e5f;
						 *0x42e3e4 = E00401000;
						 *0x42e3f0 = _t76;
						 *0x42e404 =  &_v20;
						if(RegisterClassA(0x42e3e0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x42a098 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x42ec40, 0);
						goto L21;
					}
				} else {
					_t76 =  *(_t81 + 0x48);
					if(_t76 == 0) {
						goto L16;
					}
					_t60 =  *0x42ec78; // 0x56f560
					_t79 = 0x42dbe0;
					E00405A88( *((intOrPtr*)(_t81 + 0x44)), _t76,  *((intOrPtr*)(_t81 + 0x4c)) + _t60, 0x42dbe0, 0);
					_t62 =  *0x42dbe0; // 0x31
					if(_t62 == 0) {
						goto L16;
					}
					if(_t62 == 0x22) {
						_t79 = 0x42dbe1;
						 *((char*)(E004056BF(0x42dbe1, 0x22))) = 0;
					}
					_t64 = lstrlenA(_t79) + _t79 - 4;
					if(_t64 <= _t79 || lstrcmpiA(_t64, ?str?) != 0) {
						L15:
						E00405BA1(_t84, E00405694(_t79));
						goto L16;
					} else {
						_t68 = GetFileAttributesA(_t79);
						if(_t68 == 0xffffffff) {
							L14:
							E004056DB(_t79);
							goto L15;
						}
						_t96 = _t68 & 0x00000010;
						if((_t68 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

APIs

Part of subcall function 00405F2D: GetModuleHandleA.KERNEL32(?,?,00000000,00403179,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00405F3F
Part of subcall function 00405F2D: GetProcAddress.KERNEL32(00000000,?), ref: 00405F5A

lstrcatA.KERNEL32(1033,0042A0C0,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A0C0,00000000,00000003,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000000), ref: 00403665
lstrlenA.KERNEL32(0042DBE0,?,?,?,0042DBE0,00000000,C:\Program Files (x86)\Fast!,1033,0042A0C0,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A0C0,00000000,00000003,C:\Users\user\AppData\Local\Temp\), ref: 004036DA
lstrcmpiA.KERNEL32(?,.exe), ref: 004036ED
GetFileAttributesA.KERNEL32(0042DBE0), ref: 004036F8
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files (x86)\Fast!), ref: 00403741

Part of subcall function 00405AFF: wsprintfA.USER32 ref: 00405B0C

RegisterClassA.USER32 ref: 00403788
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 004037A0
CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 004037D9
ShowWindow.USER32(00000005,00000000), ref: 0040380F
GetClassInfoA.USER32(00000000,RichEdit20A,0042E3E0), ref: 0040383B
GetClassInfoA.USER32(00000000,RichEdit,0042E3E0), ref: 00403848
RegisterClassA.USER32(0042E3E0), ref: 00403851
DialogBoxParamA.USER32(?,00000000,0040398A,00000000), ref: 00403870

Strings

C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 004035F8
B, xrefs: 00403750
Control Panel\Desktop\ResourceLocale, xrefs: 00403628
`V, xrefs: 004035FA
_Nb, xrefs: 00403797, 0040379C
1033, xrefs: 00403614, 00403660
C:\Program Files (x86)\Fast!, xrefs: 00403674, 0040367C, 00403714, 0040371A, 0040372A
RichEdit, xrefs: 00403842
RichEd20, xrefs: 00403815
.exe, xrefs: 004036E7
C:\Users\user\AppData\Local\Temp\, xrefs: 00403600
.DEFAULT\Control Panel\International, xrefs: 00403650
RichEdit20A, xrefs: 00403833, 00403839
RichEd32, xrefs: 00403823

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Program Files (x86)\Fast!$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\SetupResources.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$`V$B
API String ID: 1975747703-2248816971
Opcode ID: ac045105ea430784d240a2a91794aa78d6c2f3841bae4eef558abf86d16be117
Instruction ID: 069ef0fb9a42e1b4956c000ddcdb280bce5473b1ca4ea0d36e0de5988d82752f
Opcode Fuzzy Hash: ac045105ea430784d240a2a91794aa78d6c2f3841bae4eef558abf86d16be117
Instruction Fuzzy Hash: EE61D8B16442007FD220AFA69C45F273A6CEB44749F44457FF940B32D1CA7DA9018A7E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C38 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00402C38(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				signed int _t54;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				intOrPtr* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\alfredo\\AppData\\Local\\Temp\\SetupResources.exe";
				 *0x42ec4c = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\alfredo\\AppData\\Local\\Temp\\SetupResources.exe", 0x400);
				_t89 = E00405878(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409014 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\alfredo\\AppData\\Local\\Temp";
				E00405BA1("C:\\Users\\alfredo\\AppData\\Local\\Temp", _t91);
				E00405BA1(0x436000, E004056DB(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x428c70 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402BD4(1);
					__eflags =  *0x42ec54 - _t82; // 0x9e00
					if(__eflags == 0) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t94 = GlobalAlloc(0x40, _v24);
						_t54 =  *0x42ec54; // 0x9e00
						E004030C5(_t54 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff);
						_t57 = E00402E71();
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x42ec50 = _t94;
							 *0x42ec58 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x42ec5c =  *0x42ec5c + 1;
								__eflags =  *0x42ec5c;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405839(0x42ec60, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E004030C5( *0x414c60);
					_t65 = E00403093( &_a4, 4); // executed
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t67 =  *0x42ec54; // 0x9e00
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~_t67 & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E00403093(0x420c70, _t90); // executed
						__eflags = _t71;
						if(_t71 == 0) {
							E00402BD4(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x42ec54;
						if( *0x42ec54 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402BD4(0);
							}
							goto L20;
						}
						E00405839( &_v44, 0x420c70, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x414c60; // 0x34d6c32
						 *0x42ece0 =  *0x42ece0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x42ec54 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t93 = _t80 - 4;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x428c70; // 0x34d80c0
						if(__eflags < 0) {
							_v12 = E00405F9C(_v12, 0x420c70, _t90);
						}
						 *0x414c60 =  *0x414c60 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 > 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402c40
0x00402c43
0x00402c46
0x00402c49
0x00402c4f
0x00402c60
0x00402c65
0x00402c78
0x00402c7d
0x00402c80
0x00402c86
0x00000000
0x00402c88
0x00402c93
0x00402c99
0x00402caa
0x00402cb1
0x00402cb7
0x00402cb9
0x00402cbe
0x00402cc0
0x00402dad
0x00402daf
0x00402db4
0x00402dbb
0x00000000
0x00000000
0x00402dbd
0x00402dc0
0x00402de4
0x00402def
0x00402df1
0x00402dfa
0x00402dff
0x00402e02
0x00402e03
0x00402e04
0x00402e06
0x00402e0b
0x00402e0e
0x00402e21
0x00402e25
0x00402e2d
0x00402e32
0x00402e34
0x00402e34
0x00402e34
0x00402e3c
0x00402e3c
0x00402e3f
0x00402e40
0x00402e40
0x00402e43
0x00402e45
0x00402e45
0x00402e45
0x00402e4f
0x00402e55
0x00402e63
0x00402e68
0x00000000
0x00402e68
0x00000000
0x00402e0e
0x00402dc8
0x00402dd3
0x00402dd8
0x00402dda
0x00000000
0x00000000
0x00402ddf
0x00402de2
0x00000000
0x00000000
0x00000000
0x00402cc6
0x00402ccb
0x00402ccb
0x00402cd0
0x00402cd4
0x00402cdb
0x00402ce0
0x00402ce2
0x00402ce4
0x00402ce4
0x00402ce8
0x00402ced
0x00402cef
0x00402e19
0x00402e10
0x00000000
0x00402e10
0x00402cf5
0x00402cfc
0x00402d78
0x00402d7c
0x00402d80
0x00402d85
0x00000000
0x00402d7c
0x00402d05
0x00402d0a
0x00402d0d
0x00402d12
0x00000000
0x00000000
0x00402d14
0x00402d1b
0x00000000
0x00000000
0x00402d1d
0x00402d24
0x00000000
0x00000000
0x00402d26
0x00402d2d
0x00000000
0x00000000
0x00402d2f
0x00402d36
0x00000000
0x00000000
0x00402d38
0x00402d3e
0x00402d47
0x00402d4d
0x00402d50
0x00402d52
0x00402d58
0x00000000
0x00000000
0x00402d5e
0x00402d62
0x00402d6a
0x00402d6a
0x00402d6d
0x00402d70
0x00402d72
0x00402d74
0x00402d74
0x00000000
0x00402d72
0x00402d64
0x00402d68
0x00000000
0x00000000
0x00000000
0x00402d86
0x00402d86
0x00402d8c
0x00402d98
0x00402d98
0x00402d9b
0x00402da1
0x00402da3
0x00402da3
0x00402dab
0x00402dab
0x00000000
0x00402dab

APIs

GetTickCount.KERNEL32 ref: 00402C49
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\SetupResources.exe,00000400), ref: 00402C65

Part of subcall function 00405878: GetFileAttributesA.KERNELBASE(00000003,00402C78,C:\Users\user\AppData\Local\Temp\SetupResources.exe,80000000,00000003), ref: 0040587C
Part of subcall function 00405878: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040589E

GetFileSize.KERNEL32(00000000,00000000,00436000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\SetupResources.exe,C:\Users\user\AppData\Local\Temp\SetupResources.exe,80000000,00000003), ref: 00402CB1

Strings

C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 00402C38
`V, xrefs: 00402E25
soft, xrefs: 00402D26
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C42
Error launching installer, xrefs: 00402C88
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E10
C:\Users\user\AppData\Local\Temp, xrefs: 00402C93, 00402C98, 00402C9E
C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 00402C4F, 00402C5E, 00402C72, 00402C92
Inst, xrefs: 00402D1D
Null, xrefs: 00402D2F

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\SetupResources.exe$C:\Users\user\AppData\Local\Temp\SetupResources.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$`V$soft
API String ID: 4283519449-3996096718
Opcode ID: 52dd5125f2beb4c5a01725ee1ecfb7cda6383a0ef784e60b7ebdc9a7c5e8d2b4
Instruction ID: d5d64c7dde767481ec9b836f5bb8cc7fe4476435a14377af370c0b56c56fa9d6
Opcode Fuzzy Hash: 52dd5125f2beb4c5a01725ee1ecfb7cda6383a0ef784e60b7ebdc9a7c5e8d2b4
Instruction Fuzzy Hash: 7B51D971901214ABDB219FA6DE89B9E7BB8FB40354F10413BF900B62D1D7BC9D418B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405BC3 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 197
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00405BC3(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t36;
				CHAR* _t37;
				signed int _t39;
				int _t40;
				char _t50;
				char _t51;
				char _t53;
				char _t55;
				void* _t63;
				signed int _t69;
				intOrPtr _t73;
				signed int _t74;
				signed int _t75;
				intOrPtr _t79;
				char _t83;
				void* _t85;
				CHAR* _t86;
				void* _t88;
				signed int _t95;
				signed int _t97;
				void* _t98;

				_t88 = __esi;
				_t85 = __edi;
				_t63 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t79 =  *0x42e41c; // 0x56fb66
					_t36 =  *(_t79 - 4 + _t36 * 4);
				}
				_t73 =  *0x42ec78; // 0x56f560
				_t74 = _t73 + _t36;
				_t37 = 0x42dbe0;
				_push(_t63);
				_push(_t88);
				_push(_t85);
				_t86 = 0x42dbe0;
				if(_a4 - 0x42dbe0 < 0x800) {
					_t86 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t83 =  *_t74;
					if(_t83 == 0) {
						break;
					}
					__eflags = _t86 - _t37 - 0x400;
					if(_t86 - _t37 >= 0x400) {
						break;
					}
					_t74 = _t74 + 1;
					__eflags = _t83 - 0xfc;
					_a8 = _t74;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t86 = _t83;
							_t86 =  &(_t86[1]);
							__eflags = _t86;
						} else {
							 *_t86 =  *_t74;
							_t86 =  &(_t86[1]);
							_t74 = _t74 + 1;
						}
						continue;
					}
					_t39 =  *(_t74 + 1);
					_t75 =  *_t74;
					_t95 = (_t39 & 0x0000007f) << 0x00000007 | _t75 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t75 | 0x00000080;
					_t69 = _t75;
					_v24 = _t69;
					__eflags = _t83 - 0xfe;
					_v20 = _t39 | 0x00000080;
					_v16 = _t39;
					if(_t83 != 0xfe) {
						__eflags = _t83 - 0xfd;
						if(_t83 != 0xfd) {
							__eflags = _t83 - 0xff;
							if(_t83 == 0xff) {
								__eflags = (_t39 | 0xffffffff) - _t95;
								E00405BC3(_t69, _t86, _t95, _t86, (_t39 | 0xffffffff) - _t95);
							}
							L41:
							_t40 = lstrlenA(_t86);
							_t74 = _a8;
							_t86 =  &(_t86[_t40]);
							_t37 = 0x42dbe0;
							continue;
						}
						__eflags = _t95 - 0x1d;
						if(_t95 != 0x1d) {
							__eflags = (_t95 << 0xa) + 0x42f000;
							E00405BA1(_t86, (_t95 << 0xa) + 0x42f000);
						} else {
							E00405AFF(_t86,  *0x42ec48);
						}
						__eflags = _t95 + 0xffffffeb - 7;
						if(_t95 + 0xffffffeb < 7) {
							L32:
							E00405E03(_t86);
						}
						goto L41;
					}
					_t97 = 2;
					_t50 = GetVersion();
					__eflags = _t50;
					if(_t50 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x42ecc4;
						if( *0x42ecc4 != 0) {
							_t97 = 4;
						}
						__eflags = _t69;
						if(_t69 >= 0) {
							__eflags = _t69 - 0x25;
							if(_t69 != 0x25) {
								__eflags = _t69 - 0x24;
								if(_t69 == 0x24) {
									GetWindowsDirectoryA(_t86, 0x400);
									_t97 = 0;
								}
								while(1) {
									__eflags = _t97;
									if(_t97 == 0) {
										goto L29;
									}
									_t51 =  *0x42ec44; // 0x746d1370
									_t97 = _t97 - 1;
									__eflags = _t51;
									if(_t51 == 0) {
										L25:
										_t53 = SHGetSpecialFolderLocation( *0x42ec48,  *(_t98 + _t97 * 4 - 0x18),  &_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											L27:
											 *_t86 =  *_t86 & 0x00000000;
											__eflags =  *_t86;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t86);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t55 =  *_t51( *0x42ec48,  *(_t98 + _t97 * 4 - 0x18), 0, 0, _t86);
									__eflags = _t55;
									if(_t55 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t86, 0x400);
							goto L29;
						} else {
							_t72 = (_t69 & 0x0000003f) +  *0x42ec78;
							E00405A88(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t69 & 0x0000003f) +  *0x42ec78, _t86, _t69 & 0x00000040); // executed
							__eflags =  *_t86;
							if( *_t86 != 0) {
								L30:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t86, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E00405BC3(_t72, _t86, _t97, _t86, _v16);
							L29:
							__eflags =  *_t86;
							if( *_t86 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t50 - 0x5a04;
					if(_t50 == 0x5a04) {
						goto L12;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L12;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t86 =  *_t86 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E00405BA1(_a4, _t37);
			}

APIs

GetVersion.KERNEL32(00000000,00429898,00000000,00404EC5,00429898,00000000), ref: 00405C6B
GetSystemDirectoryA.KERNEL32(0042DBE0,00000400), ref: 00405CE6
GetWindowsDirectoryA.KERNEL32(0042DBE0,00000400), ref: 00405CF9
SHGetSpecialFolderLocation.SHELL32(?,00418C68), ref: 00405D35
SHGetPathFromIDListA.SHELL32(00418C68,0042DBE0), ref: 00405D43
CoTaskMemFree.OLE32(00418C68), ref: 00405D4E
lstrcatA.KERNEL32(0042DBE0,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D70
lstrlenA.KERNEL32(0042DBE0,00000000,00429898,00000000,00404EC5,00429898,00000000), ref: 00405DC2

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405CB5
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D6A

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: 56c6644338f5748cd9e4adb5f2c50b348e185d39bfc66a16460e33acb065d9ec
Instruction ID: fa1e0b9f47c9474f0aa02006464afd466a30f7754b548aa089decd5b8df859b0
Opcode Fuzzy Hash: 56c6644338f5748cd9e4adb5f2c50b348e185d39bfc66a16460e33acb065d9ec
Instruction Fuzzy Hash: B8512531A04A15ABEB205B698C88BBB3B64DF11314F54827BE511BA2D0D37C5942DF4E

Uniqueness

Uniqueness Score: -1.00%

Function 00402E71 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00402E71(int _a4, void* _a8, long _a12, int _a16, signed char _a19) {
				signed int _v8;
				long _v12;
				void* _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				char _v92;
				void* _t67;
				void* _t68;
				long _t74;
				intOrPtr _t79;
				long _t80;
				void* _t82;
				int _t84;
				intOrPtr _t95;
				void* _t97;
				void* _t100;
				long _t101;
				signed int _t102;
				long _t103;
				int _t104;
				intOrPtr _t105;
				long _t106;
				void* _t107;

				_t102 = _a16;
				_t97 = _a12;
				_v12 = _t102;
				if(_t97 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_v16 = _t97;
				if(_t97 == 0) {
					_v16 = 0x418c68;
				}
				_t65 = _a4;
				if(_a4 >= 0) {
					_t95 =  *0x42ec98; // 0xa60b
					E004030C5(_t95 + _t65);
				}
				_t67 = E00403093( &_a16, 4); // executed
				if(_t67 == 0) {
					L34:
					_push(0xfffffffd);
					goto L35;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t97 == 0) {
							while(_a16 > 0) {
								_t103 = _v12;
								if(_a16 < _t103) {
									_t103 = _a16;
								}
								if(E00403093(0x414c68, _t103) == 0) {
									goto L34;
								} else {
									if(WriteFile(_a8, 0x414c68, _t103,  &_a12, 0) == 0 || _t103 != _a12) {
										L29:
										_push(0xfffffffe);
										L35:
										_pop(_t68);
										return _t68;
									} else {
										_v8 = _v8 + _t103;
										_a16 = _a16 - _t103;
										continue;
									}
								}
							}
							L45:
							return _v8;
						}
						if(_a16 < _t102) {
							_t102 = _a16;
						}
						if(E00403093(_t97, _t102) != 0) {
							_v8 = _t102;
							goto L45;
						} else {
							goto L34;
						}
					}
					_t74 = GetTickCount();
					 *0x40b5cc =  *0x40b5cc & 0x00000000;
					 *0x40b5c8 =  *0x40b5c8 & 0x00000000;
					_t14 =  &_a16;
					 *_t14 = _a16 & 0x7fffffff;
					_v20 = _t74;
					 *0x40b0b0 = 8;
					 *0x414c58 = 0x40cc50;
					 *0x414c54 = 0x40cc50;
					 *0x414c50 = 0x414c50;
					_a4 = _a16;
					if( *_t14 <= 0) {
						goto L45;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t104 = 0x4000;
						if(_a16 < 0x4000) {
							_t104 = _a16;
						}
						if(E00403093(0x414c68, _t104) == 0) {
							goto L34;
						}
						_a16 = _a16 - _t104;
						 *0x40b0a0 = 0x414c68;
						 *0x40b0a4 = _t104;
						while(1) {
							_t100 = _v16;
							 *0x40b0a8 = _t100;
							 *0x40b0ac = _v12;
							_t79 = E0040600A(0x40b0a0);
							_v28 = _t79;
							if(_t79 < 0) {
								break;
							}
							_t105 =  *0x40b0a8; // 0x418c68
							_t106 = _t105 - _t100;
							_t80 = GetTickCount();
							_t101 = _t80;
							if(( *0x42ecf4 & 0x00000001) != 0 && (_t80 - _v20 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v92, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t107 = _t107 + 0xc;
								E00404E8D(0,  &_v92);
								_v20 = _t101;
							}
							if(_t106 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L45;
							} else {
								if(_a12 != 0) {
									_t82 =  *0x40b0a8; // 0x418c68
									_v8 = _v8 + _t106;
									_v12 = _v12 - _t106;
									_v16 = _t82;
									L24:
									if(_v28 != 1) {
										continue;
									}
									goto L45;
								}
								_t84 = WriteFile(_a8, _v16, _t106,  &_v24, 0); // executed
								if(_t84 == 0 || _v24 != _t106) {
									goto L29;
								} else {
									_v8 = _v8 + _t106;
									goto L24;
								}
							}
						}
						_push(0xfffffffc);
						goto L35;
					}
					goto L34;
				}
			}

APIs

GetTickCount.KERNEL32 ref: 00402ED8
GetTickCount.KERNEL32 ref: 00402F7F
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402FA8
wsprintfA.USER32 ref: 00402FB8
WriteFile.KERNELBASE(00000000,00000000,00418C68,7FFFFFFF,00000000), ref: 00402FE6

Strings

hLA, xrefs: 0040304E
hLA, xrefs: 00402F2E
... %d%%, xrefs: 00402FB2

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%$hLA$hLA
API String ID: 4209647438-3864250065
Opcode ID: addaab61d9762357401ed889a56f94317b04aa9940b264370ab1ae8ac3205c02
Instruction ID: 8a95cf2a137d7550cfd21daf0583010478331d15a29cb338fc351ae0d0d0651f
Opcode Fuzzy Hash: addaab61d9762357401ed889a56f94317b04aa9940b264370ab1ae8ac3205c02
Instruction Fuzzy Hash: D261AE7190221AEBDB10DFA5DA44AAF7BB8EB40355F10417BF910B72C4D7789A40CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 00401734 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00401734(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402A0C(0x31);
				 *(_t85 - 0xc) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x28) & 0x00000007;
				_t33 = E00405701(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E00405694(E00405BA1(0x409c60, "C:\\Program Files (x86)\\Fast!")), ??);
				} else {
					_push(0x409c60);
					E00405BA1();
				}
				E00405E03(0x409c60);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405E9C(0x409c60);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x1c);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405859(0x409c60);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E00405878(0x409c60, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 8) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404E8D(0xffffffe2,  *(_t85 - 0xc));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x42ecc8;
						goto L32;
					} else {
						E00405BA1(0x40a460, 0x42f000);
						E00405BA1(0x42f000, 0x409c60);
						E00405BC3(_t75, 0x40a460, 0x409c60, 0x40a060,  *((intOrPtr*)(_t85 - 0x14)));
						E00405BA1(0x42f000, 0x40a460);
						_t62 = E00405462(0x40a060,  *(_t85 - 0x28) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x42ecc8 =  &( *0x42ecc8->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x409c60);
								_push(0xfffffffa);
								E00404E8D();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404E8D(0xffffffea,  *(_t85 - 0xc));
				 *0x42ecf4 =  *0x42ecf4 + 1;
				_t43 = E00402E71( *((intOrPtr*)(_t85 - 0x20)),  *(_t85 - 8), _t75, _t75); // executed
				 *0x42ecf4 =  *0x42ecf4 - 1;
				__eflags =  *(_t85 - 0x1c) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 8), _t85 - 0x1c, _t75, _t85 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 8)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405BC3(_t75, _t80, 0x409c60, 0x409c60, 0xffffffee);
					} else {
						E00405BC3(_t75, _t80, 0x409c60, 0x409c60, 0xffffffe9);
						lstrcatA(0x409c60,  *(_t85 - 0xc));
					}
					_push(0x200010);
					_push(0x409c60);
					E00405462();
					goto L29;
				}
				goto L33;
			}

APIs

lstrcatA.KERNEL32(00000000,00000000,C:\Program Files (x86)\Fast!\nwjs\locales\vi.pak,C:\Program Files (x86)\Fast!,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,C:\Program Files (x86)\Fast!\nwjs\locales\vi.pak,C:\Program Files (x86)\Fast!\nwjs\locales\vi.pak,00000000,00000000,C:\Program Files (x86)\Fast!\nwjs\locales\vi.pak,C:\Program Files (x86)\Fast!,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 00405BA1: lstrcpynA.KERNEL32(?,?,00000400,004031BD,Fast! Resources Setup,NSIS Error), ref: 00405BAE

Part of subcall function 00404E8D: lstrlenA.KERNEL32(00429898,00000000,00418C68,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000,?), ref: 00404EC6
Part of subcall function 00404E8D: lstrlenA.KERNEL32(00402FCC,00429898,00000000,00418C68,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000), ref: 00404ED6
Part of subcall function 00404E8D: lstrcatA.KERNEL32(00429898,00402FCC,00402FCC,00429898,00000000,00418C68,765F3130), ref: 00404EE9
Part of subcall function 00404E8D: SetWindowTextA.USER32(00429898,00429898), ref: 00404EFB
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F21
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F3B
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F49

Strings

C:\Program Files (x86)\Fast!, xrefs: 00401761
C:\Program Files (x86)\Fast!\nwjs\locales\vi.pak, xrefs: 00401750, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Program Files (x86)\Fast!$C:\Program Files (x86)\Fast!\nwjs\locales\vi.pak
API String ID: 1941528284-1995870858
Opcode ID: 861f3879c83e28eb07bb09eee35a09ef472ebd3ea5b24dd6fff8f590b62750ba
Instruction ID: e79ae9243306ab86068bc1e71be5748962656d45b0e0834c5e2f96de839f3da3
Opcode Fuzzy Hash: 861f3879c83e28eb07bb09eee35a09ef472ebd3ea5b24dd6fff8f590b62750ba
Instruction Fuzzy Hash: 71419632914514BADF107BB9CC45EAF3679EF01329B20823BF421F11E1D77C9A418A6E

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E004015B3(struct _SECURITY_ATTRIBUTES* __ebx) {
				struct _SECURITY_ATTRIBUTES** _t10;
				int _t19;
				struct _SECURITY_ATTRIBUTES* _t20;
				signed char _t22;
				struct _SECURITY_ATTRIBUTES* _t23;
				CHAR* _t25;
				struct _SECURITY_ATTRIBUTES** _t29;
				void* _t30;

				_t23 = __ebx;
				_t25 = E00402A0C(0xfffffff0);
				_t10 = E00405728(_t25);
				_t27 = _t10;
				if(_t10 != __ebx) {
					do {
						_t29 = E004056BF(_t27, 0x5c);
						 *_t29 = _t23;
						 *((char*)(_t30 + 0xb)) =  *_t29;
						_t19 = CreateDirectoryA(_t25, _t23); // executed
						if(_t19 == 0) {
							if(GetLastError() != 0xb7) {
								L4:
								 *((intOrPtr*)(_t30 - 4)) =  *((intOrPtr*)(_t30 - 4)) + 1;
							} else {
								_t22 = GetFileAttributesA(_t25); // executed
								if((_t22 & 0x00000010) == 0) {
									goto L4;
								}
							}
						}
						_t20 =  *((intOrPtr*)(_t30 + 0xb));
						 *_t29 = _t20;
						_t27 =  &(_t29[0]);
					} while (_t20 != _t23);
				}
				if( *((intOrPtr*)(_t30 - 0x24)) == _t23) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405BA1("C:\\Program Files (x86)\\Fast!", _t25);
					SetCurrentDirectoryA(_t25); // executed
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

APIs

Part of subcall function 00405728: CharNextA.USER32(004054DA,?,0042B4C8,00000000,0040578C,0042B4C8,0042B4C8,?,?,00000000,004054DA,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405736
Part of subcall function 00405728: CharNextA.USER32(00000000), ref: 0040573B
Part of subcall function 00405728: CharNextA.USER32(00000000), ref: 0040574A

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Program Files (x86)\Fast!,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Program Files (x86)\Fast!, xrefs: 00401617

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Program Files (x86)\Fast!
API String ID: 3751793516-1788482285
Opcode ID: 4119a9241f750ab8e997e3db940842f9a3b25b0b78736786cf3fc51800a7fa31
Instruction ID: bb8d1e4e690ad92a523629274e31cd42690718b140f669fc0321f517961e655e
Opcode Fuzzy Hash: 4119a9241f750ab8e997e3db940842f9a3b25b0b78736786cf3fc51800a7fa31
Instruction Fuzzy Hash: AB010831908140AFDB217B795D44D6F77B49E56365B24063FF491B22E1C53C0941962E

Uniqueness

Uniqueness Score: -1.00%

Function 00405EC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405EC3(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				_t5 = _t16 + 0x409010; // 0x5c
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
				_t14 = LoadLibraryA( &_v292); // executed
				return _t14;
			}

0x00405eda
0x00405ee3
0x00405ee5
0x00405ee5
0x00405ee9
0x00405efb
0x00405ef5
0x00405ef5
0x00405ef5
0x00405eff
0x00405f13
0x00405f23
0x00405f2a

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405EDA
wsprintfA.USER32 ref: 00405F13
LoadLibraryA.KERNELBASE(?), ref: 00405F23

Strings

%s%s.dll, xrefs: 00405F0D
\, xrefs: 00405EEB

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$\
API String ID: 2200240437-500877883
Opcode ID: bac9a2fc6f46d7ce26ef8fb07d33782f421afe65be062073a8d3b7340457a89d
Instruction ID: bb15d2e5d25401263bf0b052e26ed8f2ff91206720ea4b5c6b623b775464ebc4
Opcode Fuzzy Hash: bac9a2fc6f46d7ce26ef8fb07d33782f421afe65be062073a8d3b7340457a89d
Instruction Fuzzy Hash: 3FF02B309042095BDB149768DC0DEFB3B5CEB08304F1405BBA1C6E10D2E678ED558FD8

Uniqueness

Uniqueness Score: -1.00%

Function 004058A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004058A7(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

APIs

GetTickCount.KERNEL32 ref: 004058BA
GetTempFileNameA.KERNELBASE(?,0061736E,00000000,?), ref: 004058D4

Strings

C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 004058A7
C:\Users\user\AppData\Local\Temp\, xrefs: 004058AA, 004058AE
nsa, xrefs: 004058B3

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\SetupResources.exe$nsa
API String ID: 1716503409-4227314395
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 40dff32a3e5f00750648796d4805ff32b13dc741bded237dc881b6ef32aeca23
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: 91F0A73734820476E7105E55DC04B9B7F6DDF91750F14C027FD449A1C0D6B4995497A5

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				intOrPtr _t15;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t15 =  *0x42ec70; // 0x56e824
					_t6 = _t17 * 0x1c + _t15;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42e42c =  *0x42e42c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42e42c, 0x7530,  *0x42e414), 0);
					}
				}
				return 0;
			}

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(00000020,00000402,00000000), ref: 004013F4

Strings

$V, xrefs: 00401392

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: MessageSend
String ID: $V
API String ID: 3850602802-1629401774
Opcode ID: 42849ed48d919fde42c0d44f840d19e9f7e342482cf35ba8d4f2414d886d90f9
Instruction ID: 86a6a9173f7d20567c8ae2bb249fddc303668c970c82e3d032b9735ebafba260
Opcode Fuzzy Hash: 42849ed48d919fde42c0d44f840d19e9f7e342482cf35ba8d4f2414d886d90f9
Instruction Fuzzy Hash: B30128317242209BE7195B399C05B6A369CE714328F50853BF851F72F2DA78DC039B8D

Uniqueness

Uniqueness Score: -1.00%

Function 00405A88 Relevance: 4.5, APIs: 3, Instructions: 45
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E00405A88(void* _a4, int _a8, char* _a12, int _a16, void* _a20) {
				long _t20;
				long _t23;
				long _t24;
				char* _t26;

				asm("sbb eax, eax");
				_t26 = _a16;
				 *_t26 = 0;
				_t20 = RegOpenKeyExA(_a4, _a8, 0,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				if(_t20 == 0) {
					_a8 = 0x400;
					_t23 = RegQueryValueExA(_a20, _a12, 0,  &_a16, _t26,  &_a8); // executed
					if(_t23 != 0 || _a16 != 1 && _a16 != 2) {
						 *_t26 = 0;
					}
					_t26[0x3ff] = 0;
					_t24 = RegCloseKey(_a20); // executed
					return _t24;
				}
				return _t20;
			}

0x00405a98
0x00405a9a
0x00405aa7
0x00405ab1
0x00405ab9
0x00405abe
0x00405ad2
0x00405ada
0x00405ae8
0x00405ae8
0x00405aed
0x00405af3
0x00000000
0x00405af3
0x00405afc

APIs

RegOpenKeyExA.KERNELBASE(80000002,00405CC4,00000000,00000002,?,00000002,001408E9,?,00405CC4,80000002,Software\Microsoft\Windows\CurrentVersion,001408E9,0042DBE0,0056F561), ref: 00405AB1
RegQueryValueExA.KERNELBASE(001408E9,?,00000000,00405CC4,001408E9,00405CC4), ref: 00405AD2
RegCloseKey.KERNELBASE(?), ref: 00405AF3

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 67b3e0d3ded8972df4b5bccd868b78f6ad8d4f27bd32828d0c76414c952c029f
Instruction ID: 73a274855f42cec9a7ce3e58aeff3d3433a4445e8632c2ebf8a036d33102cd28
Opcode Fuzzy Hash: 67b3e0d3ded8972df4b5bccd868b78f6ad8d4f27bd32828d0c76414c952c029f
Instruction Fuzzy Hash: 8701487114020AEFDF128F64EC88AEB3FACEF14358F004126F904A6160D235D964DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405F2D Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405F2D(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x409228);
				_t5 = GetModuleHandleA( *(_t10 + 0x409228));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40922c));
				}
				_t5 = E00405EC3(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00405f35
0x00405f38
0x00405f3f
0x00405f47
0x00405f53
0x00000000
0x00405f5a
0x00405f4a
0x00405f51
0x00000000
0x00405f62
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,00403179,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00405F3F
GetProcAddress.KERNEL32(00000000,?), ref: 00405F5A

Part of subcall function 00405EC3: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405EDA
Part of subcall function 00405EC3: wsprintfA.USER32 ref: 00405F13
Part of subcall function 00405EC3: LoadLibraryA.KERNELBASE(?), ref: 00405F23

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 1ff86fa5640f02b1d9e100387d52f784ab4969e574a7c6b0b5bb7fb3ea5c422e
Instruction ID: 5a94b1a02772503a3f00306f9b3f9683cc322e661ee482fd999d4dc3ca30496d
Opcode Fuzzy Hash: 1ff86fa5640f02b1d9e100387d52f784ab4969e574a7c6b0b5bb7fb3ea5c422e
Instruction Fuzzy Hash: 3AE0863260861176D6105B74AD0496B72A8DE8C7503054C7EF945F6190D738DC119AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405878 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00405878(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x0040587c
0x00405889
0x0040589e
0x004058a4

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C78,C:\Users\user\AppData\Local\Temp\SetupResources.exe,80000000,00000003), ref: 0040587C
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040589E

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction ID: 518821d5ca0a74227a37217cadb520a33af9faec79942caa6648154b48e23ab6
Opcode Fuzzy Hash: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction Fuzzy Hash: DDD09E71658301AFEF098F20DE1AF2E7AA2EB84B01F10962CB646940E0D6715C15DB16

Uniqueness

Uniqueness Score: -1.00%

Function 00405859 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405859(CHAR* _a4) {
				signed char _t3;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					return SetFileAttributesA(_a4, _t3 & 0x000000fe);
				}
				return _t3;
			}

0x0040585d
0x00405866
0x00000000
0x0040586f
0x00405875

APIs

GetFileAttributesA.KERNELBASE(?,00405664,?,?,?), ref: 0040585D
SetFileAttributesA.KERNEL32(?,00000000), ref: 0040586F

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 074f941138e9f1df105fff9ec0b177d36ae7deb3ea45ba36f2ce8c3e98632dd9
Instruction ID: 15299d6900fb3f0dcfcb805ba40550cd3d393431f2dda1ea0104ff8e742be84e
Opcode Fuzzy Hash: 074f941138e9f1df105fff9ec0b177d36ae7deb3ea45ba36f2ce8c3e98632dd9
Instruction Fuzzy Hash: 8AC04CB1808505BBD6016B35DF4DC1F7B66EB50321B108B35F569A01F0CB319C66DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 004053CC Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004053CC(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x004053d2
0x004053da
0x00000000
0x004053e0
0x00000000

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403100,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 004053D2
GetLastError.KERNEL32 ref: 004053E0

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 62594c709cce2f5b8fb8ca5d54e7f3286412bfa0f130784d9dc04a2d264f0cc1
Instruction ID: 0a32bba0594ce4c50c7d18531d00583a5fdebb7a5bad339d624f0ac39b1a71a3
Opcode Fuzzy Hash: 62594c709cce2f5b8fb8ca5d54e7f3286412bfa0f130784d9dc04a2d264f0cc1
Instruction Fuzzy Hash: B0C04C30A08501EBD6105B31AE49B177AE49B547C1F1045366506E41E0D7B49411D93E

Uniqueness

Uniqueness Score: -1.00%

Function 00403093 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403093(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409014, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x00403097
0x004030aa
0x004030b2
0x00000000
0x004030b9
0x00000000
0x004030bb

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,00402EC0,000000FF,00000004,00000000,00000000,00000000), ref: 004030AA

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0be395bbe571093c8e78859d05ee89954336de5599fe3087c5eab9dc4054fae4
Instruction ID: fff8dc69d300bf088447089d7068fb6aaa903b2c1760e3ba56c5ad9840b64b03
Opcode Fuzzy Hash: 0be395bbe571093c8e78859d05ee89954336de5599fe3087c5eab9dc4054fae4
Instruction Fuzzy Hash: BAE08C32161118BBCF215E52EC00EE73B5CEB047A2F008033BA14E62A0D670EA14DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004030C5 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030C5(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409014, _a4, 0, 0); // executed
				return _t2;
			}

0x004030d3
0x004030d9

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402DFF,00009DE4), ref: 004030D3

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1fe8ad6970e23be315a08abdb90e0b058f57890677f29add635e0ec7003afc6f
Instruction ID: 89776e93a0172b97a38fb7948c015c90ed7fb14eba3da05579cbd58eb2c2bcc6
Opcode Fuzzy Hash: 1fe8ad6970e23be315a08abdb90e0b058f57890677f29add635e0ec7003afc6f
Instruction Fuzzy Hash: 87B01271644200BFDB214F00DF06F057B61A794701F108030B744380F082712830EB1E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004047DC Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E004047DC(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				intOrPtr _t183;
				int _t189;
				int _t196;
				intOrPtr _t198;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				intOrPtr _t231;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				signed int _t242;
				signed int _t245;
				signed int _t247;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t274;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				signed int* _t284;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				int _t294;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				intOrPtr _t309;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;
				void* _t328;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x42ec68; // 0x56e40c
				_t320 = SendMessageA;
				_v8 = _t182;
				_t183 =  *0x42ec50; // 0x56e260
				_t315 = 0;
				_v32 = _t280;
				_v20 = _t183 + 0x94;
				if(_a8 != 0x110) {
					L23:
					__eflags = _a8 - 0x405;
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					__eflags = _a8 - 0x4e;
					if(_a8 == 0x4e) {
						L28:
						__eflags = _a8 - 0x413;
						_v16 = _t289;
						if(_a8 == 0x413) {
							L30:
							__eflags =  *0x42ec59 & 0x00000002;
							if(( *0x42ec59 & 0x00000002) != 0) {
								L41:
								__eflags = _v16 - _t315;
								if(_v16 != _t315) {
									_t232 = _v16;
									__eflags =  *((intOrPtr*)(_t232 + 8)) - 0xfffffe6e;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									__eflags =  *((intOrPtr*)(_t233 + 8)) - 0xfffffe6a;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										__eflags =  *((intOrPtr*)(_t233 + 0xc)) - 2;
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											_t284 =  *(_t233 + 0x5c) * 0x418 + _t280 + 8;
											 *_t284 =  *_t284 & 0xffffffdf;
											__eflags =  *_t284;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							__eflags = _a8 - 0x413;
							if(_a8 == 0x413) {
								L33:
								__eflags = _a8 - 0x413;
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E0040475C(_v8, _a8 != 0x413);
								__eflags = _t240 - _t315;
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									__eflags = _t289 & 0x00000010;
									if((_t289 & 0x00000010) == 0) {
										__eflags = _t289 & 0x00000040;
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
											__eflags = _t298;
										} else {
											_t300 = _t289 ^ 0x00000080;
											__eflags = _t300;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t242 =  *0x42ec58; // 0x80
										_t289 = 1;
										_a8 = 0x40f;
										_t245 =  !_t242 >> 0x00000008 & 1;
										__eflags = _t245;
										_a12 = 1;
										_a16 = _t245;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							__eflags =  *((intOrPtr*)(_t289 + 8)) - 0xfffffffe;
							if( *((intOrPtr*)(_t289 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						}
						__eflags =  *((intOrPtr*)(_t289 + 4)) - 0x408;
						if( *((intOrPtr*)(_t289 + 4)) != 0x408) {
							goto L48;
						}
						goto L30;
					} else {
						__eflags = _a8 - 0x413;
						if(_a8 != 0x413) {
							L48:
							__eflags = _a8 - 0x111;
							if(_a8 != 0x111) {
								L56:
								__eflags = _a8 - 0x200;
								if(_a8 == 0x200) {
									SendMessageA(_v8, 0x200, _t315, _t315);
								}
								__eflags = _a8 - 0x40b;
								if(_a8 == 0x40b) {
									_t220 =  *0x42a09c;
									__eflags = _t220 - _t315;
									if(_t220 != _t315) {
										ImageList_Destroy(_t220);
									}
									_t221 =  *0x42a0b4;
									__eflags = _t221 - _t315;
									if(_t221 != _t315) {
										GlobalFree(_t221);
									}
									 *0x42a09c = _t315;
									 *0x42a0b4 = _t315;
									 *0x42eca0 = _t315;
								}
								__eflags = _a8 - 0x40f;
								if(_a8 != 0x40f) {
									L86:
									__eflags = _a8 - 0x420;
									if(_a8 == 0x420) {
										__eflags =  *0x42ec59 & 0x00000001;
										if(( *0x42ec59 & 0x00000001) != 0) {
											__eflags = _a16 - 0x20;
											_t189 = (0 | _a16 == 0x00000020) << 3;
											__eflags = _t189;
											_t316 = _t189;
											ShowWindow(_v8, _t316);
											ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
										}
									}
									goto L89;
								} else {
									E004011EF(_t289, _t315, _t315);
									__eflags = _a12 - _t315;
									if(_a12 != _t315) {
										E0040140B(8);
									}
									__eflags = _a16 - _t315;
									if(_a16 == _t315) {
										L73:
										E004011EF(_t289, _t315, _t315);
										__eflags =  *0x42ec6c - _t315; // 0x1
										_v32 =  *0x42a0b4;
										_t196 =  *0x42ec68; // 0x56e40c
										_v60 = 0xf030;
										_v16 = _t315;
										if(__eflags <= 0) {
											L84:
											InvalidateRect(_v8, _t315, 1);
											_t198 =  *0x42e41c; // 0x56fb66
											__eflags =  *((intOrPtr*)(_t198 + 0x10)) - _t315;
											if( *((intOrPtr*)(_t198 + 0x10)) != _t315) {
												E00404717(0x3ff, 0xfffffffb, E0040472F(5));
											}
											goto L86;
										} else {
											_t142 = _t196 + 8; // 0x56e414
											_t281 = _t142;
											do {
												_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
												__eflags = _t202 - _t315;
												if(_t202 != _t315) {
													_t291 =  *_t281;
													_v68 = _t202;
													__eflags = _t291 & 0x00000001;
													_v72 = 8;
													if((_t291 & 0x00000001) != 0) {
														_t151 =  &(_t281[4]); // 0x56e424
														_v72 = 9;
														_v56 = _t151;
														_t154 =  &(_t281[0]);
														 *_t154 = _t281[0] & 0x000000fe;
														__eflags =  *_t154;
													}
													__eflags = _t291 & 0x00000040;
													if((_t291 & 0x00000040) == 0) {
														_t206 = (_t291 & 0x00000001) + 1;
														__eflags = _t291 & 0x00000010;
														if((_t291 & 0x00000010) != 0) {
															_t206 = _t206 + 3;
															__eflags = _t206;
														}
													} else {
														_t206 = 3;
													}
													_t294 = (_t291 >> 0x00000005 & 0x00000001) + 1;
													__eflags = _t294;
													_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
													SendMessageA(_v8, 0x1102, _t294, _v68);
													SendMessageA(_v8, 0x110d, _t315,  &_v72);
												}
												_v16 = _v16 + 1;
												_t281 =  &(_t281[0x106]);
												__eflags = _v16 -  *0x42ec6c; // 0x1
											} while (__eflags < 0);
											goto L84;
										}
									} else {
										_t282 = E004012E2( *0x42a0b4);
										E00401299(_t282);
										_t217 = 0;
										_t289 = 0;
										__eflags = _t282 - _t315;
										if(_t282 <= _t315) {
											L72:
											SendMessageA(_v12, 0x14e, _t289, _t315);
											_a16 = _t282;
											_a8 = 0x420;
											goto L73;
										} else {
											goto L69;
										}
										do {
											L69:
											_t309 = _v20;
											__eflags =  *((intOrPtr*)(_t309 + _t217 * 4)) - _t315;
											if( *((intOrPtr*)(_t309 + _t217 * 4)) != _t315) {
												_t289 = _t289 + 1;
												__eflags = _t289;
											}
											_t217 = _t217 + 1;
											__eflags = _t217 - _t282;
										} while (_t217 < _t282);
										goto L72;
									}
								}
							}
							__eflags = _a12 - 0x3f9;
							if(_a12 != 0x3f9) {
								goto L89;
							}
							__eflags = _a12 >> 0x10 - 1;
							if(_a12 >> 0x10 != 1) {
								goto L89;
							}
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							__eflags = _t227 - 0xffffffff;
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							__eflags = _t283 - 0xffffffff;
							if(_t283 == 0xffffffff) {
								L54:
								_t283 = 0x20;
								L55:
								E00401299(_t283);
								SendMessageA(_a4, 0x420, _t315, _t283);
								_a12 = 1;
								_a16 = _t315;
								_a8 = 0x40f;
								goto L56;
							}
							_t231 = _v20;
							__eflags =  *((intOrPtr*)(_t231 + _t283 * 4)) - _t315;
							if( *((intOrPtr*)(_t231 + _t283 * 4)) != _t315) {
								goto L55;
							}
							goto L54;
						}
						goto L28;
					}
				} else {
					 *0x42eca0 = _a4;
					_t247 =  *0x42ec6c; // 0x1
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x42a0b4 = GlobalAlloc(0x40, _t247 << 2);
					_t250 = LoadBitmapA( *0x42ec40, 0x6e);
					 *0x42a0a8 =  *0x42a0a8 | 0xffffffff;
					_v24 = _t250;
					 *0x42a0b0 = SetWindowLongA(_v8, 0xfffffffc, E00404DDD);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x42a09c = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x42a09c);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t315, E00405BC3(_t286, _t315, _t320, _t315, _t258)), _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403E5D(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403E5D(_a4);
					_t318 = 0;
					_t288 = 0;
					_t328 =  *0x42ec6c - _t318; // 0x1
					if(_t328 <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									__eflags = _t269 & 0x00000004;
									if((_t269 & 0x00000004) == 0) {
										 *( *0x42a0b4 + _t318 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v84);
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_v28 = 1;
									 *( *0x42a0b4 + _t318 * 4) = _t274;
									_t288 =  *( *0x42a0b4 + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_t331 = _t318 -  *0x42ec6c; // 0x1
							_v24 = _t311;
						} while (_t331 < 0);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403E92(_v8);
								_t280 = _v32;
								_t315 = 0;
								__eflags = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403E92(_v12);
								L89:
								return E00403EC4(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

APIs

GetDlgItem.USER32(?,000003F9), ref: 004047F3
GetDlgItem.USER32(?,00000408), ref: 00404800
GlobalAlloc.KERNEL32(00000040,00000001), ref: 0040484C
LoadBitmapA.USER32(0000006E), ref: 0040485F
SetWindowLongA.USER32(?,000000FC,00404DDD), ref: 00404879
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040488D
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 004048A1
SendMessageA.USER32(?,00001109,00000002), ref: 004048B6
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004048C2
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004048D4
DeleteObject.GDI32(?), ref: 004048D9
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404904
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404910
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049A5
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 004049D0
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049E4
GetWindowLongA.USER32(?,000000F0), ref: 00404A13
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A21
ShowWindow.USER32(?,00000005), ref: 00404A32
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404B35
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404B9A
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404BAF
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404BD3
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404BF9
ImageList_Destroy.COMCTL32(?), ref: 00404C0E
GlobalFree.KERNEL32(?), ref: 00404C1E
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404C8E
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404D37
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404D46
InvalidateRect.USER32(?,00000000,00000001), ref: 00404D66
ShowWindow.USER32(?,00000000), ref: 00404DB4
GetDlgItem.USER32(?,000003FE), ref: 00404DBF
ShowWindow.USER32(00000000), ref: 00404DC6

Strings

, xrefs: 00404D9E
M, xrefs: 0040498C
`V, xrefs: 00404811
N, xrefs: 00404A70

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N$`V
API String ID: 1638840714-2064312147
Opcode ID: 4e63ca6e9464e87f5d4ab94560d5c99c95fe02dad02888ea5b3d52ac9d8c04b8
Instruction ID: 458a4472cc575749f24c7bcde6f1b2e9246033a2a8d3a9469834700d3721ba37
Opcode Fuzzy Hash: 4e63ca6e9464e87f5d4ab94560d5c99c95fe02dad02888ea5b3d52ac9d8c04b8
Instruction Fuzzy Hash: E7028EB0A00209EFDB21DF55DD85AAE7BB5FB84314F10813AF610BA2E1C7799A41DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004054C6 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E004054C6(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E00405775(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72);
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x42ecc8 =  *0x42ecc8 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E00405BA1(0x42b0c8, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E004056DB(_t72);
					} else {
						lstrcatA(0x42b0c8, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x409010);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]);
						_t37 = FindFirstFileA(0x42b0c8,  &_v332);
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E004056BF( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E00405BA1(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E00405859(_t72);
									_t52 = DeleteFileA(_t72);
									__eflags = _t52;
									if(_t52 != 0) {
										E00404E8D(0xfffffff2, _t72);
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x42ecc8 =  *0x42ecc8 + 1;
										} else {
											E00404E8D(0xfffffff1, _t72);
											E004058EF(__eflags, _t72, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E004054C6(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332);
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4);
						goto L29;
					}
					__eflags =  *0x42b0c8 - 0x5c;
					if( *0x42b0c8 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405E9C(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E00405694(_t72);
							E00405859(_t72);
							_t37 = RemoveDirectoryA(_t72);
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404E8D(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404E8D(0xfffffff1, _t72);
							return E004058EF(__eflags, _t72, 0);
						}
						L33:
						 *0x42ecc8 =  *0x42ecc8 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

APIs

DeleteFileA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004054E4
lstrcatA.KERNEL32(0042B0C8,\*.*,0042B0C8,?,00000000,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040552E
lstrcatA.KERNEL32(?,00409010,?,0042B0C8,?,00000000,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040554F
lstrlenA.KERNEL32(?,?,00409010,?,0042B0C8,?,00000000,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405555
FindFirstFileA.KERNEL32(0042B0C8,?,?,?,00409010,?,0042B0C8,?,00000000,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405566
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 00405618
FindClose.KERNEL32(?), ref: 00405629

Strings

C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 004054C6
\*.*, xrefs: 00405528
C:\Users\user\AppData\Local\Temp\, xrefs: 004054D0

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\SetupResources.exe$\*.*
API String ID: 2035342205-1458416746
Opcode ID: 49a23bcb4989eb2bc55f989632ffb7892a432e638327651476ee734d0b1ae01c
Instruction ID: 7349ebf4964971957ddff473b41d0a41d9b63905a7032000284e6e99f459cf31
Opcode Fuzzy Hash: 49a23bcb4989eb2bc55f989632ffb7892a432e638327651476ee734d0b1ae01c
Instruction Fuzzy Hash: 6C51F130404A487ADB226B228C45BBF3A69DF42318F50853BF909711D1DB7D9982DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00404FCB Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404FCB(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				unsigned int _t93;
				int _t94;
				int _t95;
				long _t98;
				void* _t101;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x42e424; // 0x0
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00404F5F, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							__eflags = _a12 - _t154;
							if(_a12 != _t154) {
								goto L20;
							}
							_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
							__eflags = _t87 - _t149;
							_a8 = _t87;
							if(_t87 <= _t149) {
								L37:
								return 0;
							}
							_t160 = CreatePopupMenu();
							AppendMenuA(_t160, _t149, 1, E00405BC3(_t149, _t154, _t160, _t149, 0xffffffe1));
							_t92 = _a16;
							__eflags = _t92 - 0xffffffff;
							if(_t92 != 0xffffffff) {
								_t150 = _t92;
								_t93 = _t92 >> 0x10;
								__eflags = _t93;
								_t94 = _t93;
							} else {
								GetWindowRect(_t154,  &_v28);
								_t150 = _v28.left;
								_t94 = _v28.top;
							}
							_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
							_t162 = 1;
							__eflags = _t95 - 1;
							if(_t95 == 1) {
								_v60 = _t149;
								_v48 = 0x42a0c0;
								_v44 = 0xfff;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t98 = SendMessageA(_v8, 0x102d, _a4,  &_v68);
									__eflags = _a4 - _t149;
									_t162 = _t162 + _t98 + 2;
								} while (_a4 != _t149);
								OpenClipboard(_t149);
								EmptyClipboard();
								_t101 = GlobalAlloc(0x42, _t162);
								_a4 = _t101;
								_t163 = GlobalLock(_t101);
								do {
									_v48 = _t163;
									_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
									 *_t164 = 0xa0d;
									_t163 = _t164 + 2;
									_t149 = _t149 + 1;
									__eflags = _t149 - _a8;
								} while (_t149 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L37;
						}
						__eflags =  *0x42e40c - _t149; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x42ec48, 8);
							__eflags =  *0x42eccc - _t149; // 0x0
							if(__eflags == 0) {
								E00404E8D( *((intOrPtr*)( *0x429890 + 0x34)), _t149);
							}
							E00403E36(1);
							goto L25;
						}
						 *0x429488 = 2;
						E00403E36(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00403EC4(_a8, _a12, _a16);
						}
						ShowWindow( *0x42e410, _t149);
						ShowWindow(_t154, 8);
						E00403E92(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x42ec50; // 0x56e260
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x42e410 = GetDlgItem(_a4, 0x403);
				 *0x42e408 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x42e424 = _t127;
				_v8 = _t127;
				E00403E92( *0x42e410);
				 *0x42e414 = E0040472F(4);
				 *0x42e42c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403E5D(_a4);
				if(( *0x42ec58 & 0x00000003) != 0) {
					ShowWindow( *0x42e410, _t149);
					if(( *0x42ec58 & 0x00000002) != 0) {
						 *0x42e410 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403E92( *0x42e408);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x42ec58 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

0x00404fd4
0x00404fda
0x00404fe3
0x00404fe6
0x00405177
0x0040517e
0x004051a2
0x004051a2
0x004051a8
0x004051b5
0x004051d3
0x004051d3
0x004051da
0x00405231
0x00405231
0x00405235
0x00000000
0x00000000
0x00405237
0x0040523a
0x00000000
0x00000000
0x00405244
0x0040524a
0x0040524c
0x0040524f
0x00405348
0x00000000
0x00405348
0x0040525e
0x0040526a
0x00405270
0x00405273
0x00405276
0x0040528b
0x0040528e
0x0040528e
0x00405291
0x00405278
0x0040527d
0x00405283
0x00405286
0x00405286
0x004052a1
0x004052a9
0x004052aa
0x004052ac
0x004052b5
0x004052b8
0x004052bf
0x004052c6
0x004052ce
0x004052ce
0x004052dc
0x004052e2
0x004052e5
0x004052e5
0x004052ec
0x004052f2
0x004052fb
0x00405302
0x0040530b
0x0040530d
0x00405310
0x0040531f
0x00405321
0x00405327
0x00405328
0x00405329
0x00405329
0x00405331
0x0040533c
0x00405342
0x00405342
0x00000000
0x004052ac
0x004051dc
0x004051e2
0x00405212
0x00405214
0x0040521a
0x00405225
0x00405225
0x0040522c
0x00000000
0x0040522c
0x004051e6
0x004051f0
0x00000000
0x004051b7
0x004051b7
0x004051bd
0x004051f5
0x00000000
0x004051fe
0x004051c6
0x004051cb
0x004051ce
0x00000000
0x004051ce
0x004051b5
0x00404fec
0x00404ff0
0x00404ff9
0x00405000
0x00405003
0x00405006
0x00405009
0x0040500a
0x0040500b
0x00405024
0x00405027
0x00405031
0x00405040
0x00405048
0x00405050
0x00405055
0x00405058
0x00405064
0x0040506d
0x00405076
0x00405099
0x0040509f
0x004050b0
0x004050b5
0x004050c3
0x004050d1
0x004050d1
0x004050d6
0x004050e4
0x004050e4
0x004050e9
0x004050ec
0x004050f1
0x004050fd
0x00405106
0x00405113
0x00405122
0x00405115
0x0040511a
0x0040511a
0x0040512e
0x0040512e
0x00405142
0x0040514b
0x00405154
0x00405164
0x00405170
0x00405170
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 0040502A
GetDlgItem.USER32(?,000003EE), ref: 00405039
GetClientRect.USER32(?,?), ref: 00405076
GetSystemMetrics.USER32(00000015), ref: 0040507E
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 0040509F
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004050B0
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 004050C3
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 004050D1
SendMessageA.USER32(?,00001024,00000000,?), ref: 004050E4
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405106
ShowWindow.USER32(?,00000008), ref: 0040511A
GetDlgItem.USER32(?,000003EC), ref: 0040513B
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040514B
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405164
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 00405170
GetDlgItem.USER32(?,000003F8), ref: 00405048

Part of subcall function 00403E92: SendMessageA.USER32(00000028,?,00000001,00403CC3), ref: 00403EA0

GetDlgItem.USER32(?,000003EC), ref: 0040518D
CreateThread.KERNEL32(00000000,00000000,Function_00004F5F,00000000), ref: 0040519B
CloseHandle.KERNEL32(00000000), ref: 004051A2
ShowWindow.USER32(00000000), ref: 004051C6
ShowWindow.USER32(00000000,00000008), ref: 004051CB
ShowWindow.USER32(00000008), ref: 00405212
SendMessageA.USER32(00000000,00001004,00000000,00000000), ref: 00405244
CreatePopupMenu.USER32 ref: 00405255
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 0040526A
GetWindowRect.USER32(00000000,?), ref: 0040527D
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004052A1
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004052DC
OpenClipboard.USER32(00000000), ref: 004052EC
EmptyClipboard.USER32 ref: 004052F2
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004052FB
GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405305
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405319
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405331
SetClipboardData.USER32(00000001,00000000), ref: 0040533C
CloseClipboard.USER32 ref: 00405342

Strings

`V, xrefs: 0040500B
{, xrefs: 00405231

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: `V${
API String ID: 590372296-3528009822
Opcode ID: 81a5edb01f2c481cc91269a3399b72ec91bb31aab1936338fad3c8b3eb1c2df1
Instruction ID: 9773a58430cbfeecb670b401eb949321dafbae4239e93fa01985779c5be3160a
Opcode Fuzzy Hash: 81a5edb01f2c481cc91269a3399b72ec91bb31aab1936338fad3c8b3eb1c2df1
Instruction Fuzzy Hash: ADA14A70900208BFDB11AFA1DC89AAE7F79FB08354F40853AFA04BA1A0C7755A51DF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040398A Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040398A(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				intOrPtr _t44;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t142;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x42a0a4 = _t35;
					if(_t115 == 0x110) {
						 *0x42ec48 = _t125;
						 *0x42a0b8 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x429080 = _t91;
						E00403E5D(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x42e428);
						 *0x42e40c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x42a0a4 = 1;
					}
					_t122 =  *0x4091cc; // 0xffffffff
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x42ec60;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403EA9(0x40b);
						while(1) {
							_t37 =  *0x42a0a4;
							 *0x4091cc =  *0x4091cc + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091cc; // 0xffffffff
							__eflags = _t39 -  *0x42ec64; // 0x2
							if(__eflags == 0) {
								E0040140B(1);
							}
							__eflags =  *0x42e40c - _t133; // 0x0
							if(__eflags != 0) {
								break;
							}
							_t44 =  *0x42ec64; // 0x2
							__eflags =  *0x4091cc - _t44; // 0xffffffff
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E00405BC3(_t116, _t125, _t130, 0x436800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403E5D(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403E5D(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403E5D(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x42eccc - _t133; // 0x0
							_v32 = _t49;
							if(__eflags != 0) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008);
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100);
							E00403E7F(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x429080, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x42eccc - _t133; // 0x0
							if(__eflags == 0) {
								_push( *0x42a0b8);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x429080);
							}
							E00403E92();
							E00405BA1(0x42a0c0, "Fast! Resources Setup");
							E00405BC3(0x42a0c0, _t125, _t130,  &(0x42a0c0[lstrlenA(0x42a0c0)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x42a0c0);
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x42e418);
									 *0x429890 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x42ec40,  *_t130 +  *0x42e420 & 0x0000ffff, _t125,  *(0x4091d0 +  *(_t130 + 4) * 4), _t130);
									__eflags = _t73 - _t133;
									 *0x42e418 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403E5D(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x42e418, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42e40c - _t133; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x42e418, 8);
									E00403EA9(0x405);
									goto L58;
								}
								__eflags =  *0x42eccc - _t133; // 0x0
								if(__eflags != 0) {
									goto L61;
								}
								__eflags =  *0x42ecc0 - _t133; // 0x1
								if(__eflags != 0) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x42e418);
						 *0x42ec48 = _t133;
						EndDialog(_t125,  *0x429488);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x42e418, 0x40f, 0, 1);
						__eflags =  *0x42e40c - _t133; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x42a098, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x42a098,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403EC4(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x42e418, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x42eccc - _t133; // 0x0
										if(__eflags == 0) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x429488 = 1;
											L21:
											_push(0x78);
											L22:
											E00403E36();
											goto L26;
										}
										E0040140B(_t127);
										 *0x429488 = _t127;
										goto L21;
									}
									__eflags =  *0x4091cc - _t133; // 0xffffffff
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x42e418);
						 *0x42e418 = _a12;
						L58:
						if( *0x42b0c0 == _t133) {
							_t142 =  *0x42e418 - _t133; // 0x0
							if(_t142 != 0) {
								ShowWindow(_t125, 0xa);
								 *0x42b0c0 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039C6
ShowWindow.USER32(?), ref: 004039E3
DestroyWindow.USER32 ref: 004039F7
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A13
GetDlgItem.USER32(?,?), ref: 00403A34
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A48
IsWindowEnabled.USER32(00000000), ref: 00403A4F
GetDlgItem.USER32(?,00000001), ref: 00403AFD
GetDlgItem.USER32(?,00000002), ref: 00403B07
SetClassLongA.USER32(?,000000F2,?), ref: 00403B21
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B72
GetDlgItem.USER32(?,00000003), ref: 00403C18
ShowWindow.USER32(00000000,?), ref: 00403C39
EnableWindow.USER32(?,?), ref: 00403C4B
EnableWindow.USER32(?,?), ref: 00403C66
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C7C
EnableMenuItem.USER32(00000000), ref: 00403C83
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403C9B
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403CAE
lstrlenA.KERNEL32(0042A0C0,?,0042A0C0,Fast! Resources Setup), ref: 00403CD7
SetWindowTextA.USER32(?,0042A0C0), ref: 00403CE6
ShowWindow.USER32(?,0000000A), ref: 00403E1A

Strings

Fast! Resources Setup, xrefs: 00403CC8

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: Fast! Resources Setup
API String ID: 184305955-2780696101
Opcode ID: f37d912e389ff35b5f2e3d6fe2aeb75ce8efd3987cf1f0c8c2098123954ad298
Instruction ID: 5f76212842cc3a2ea0064beba359403a4e9feef3dd5448b927816276c7a72de1
Opcode Fuzzy Hash: f37d912e389ff35b5f2e3d6fe2aeb75ce8efd3987cf1f0c8c2098123954ad298
Instruction Fuzzy Hash: 1BC1D431604205ABDB216F62ED85D2B3EACFB49706F40053EF541B62E1C739A942DF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00403FA5 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00403FA5(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char* _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				intOrPtr _t71;
				intOrPtr _t85;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x42a0a0 =  *0x42a0a0 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403EC4(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x42dbe0;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								ShellExecuteA(_a4, "open", _v8, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x42ec48, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x42ec48, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x42a0a0 != 0) {
						goto L25;
					} else {
						_t112 =  *0x429890 + 0x14;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403E7F(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404230();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t107 =  *0x42e41c; // 0x56fb66
					_t113 =  *(_t107 - 4 + _t113 * 4);
				}
				_t71 =  *0x42ec78; // 0x56f560
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 + _t71;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E00403F71;
				E00403E5D(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403E5D(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403E7F( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403E92(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t85 =  *0x42ec50; // 0x56e260
				_t86 =  *(_t85 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x429084 =  *0x429084 & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16);
				 *0x42a0a0 =  *0x42a0a0 & 0x00000000;
				return 0;
			}

0x00403fb5
0x004040db
0x00404137
0x0040413b
0x00404212
0x00404214
0x00404214
0x0040421a
0x0040421a
0x0040421d
0x00000000
0x00404224
0x00404149
0x0040414b
0x00404155
0x00404160
0x00404163
0x00404166
0x00404171
0x00404174
0x0040417b
0x00404189
0x004041a1
0x004041b4
0x004041c4
0x004041c6
0x004041c6
0x0040417b
0x004041d0
0x00000000
0x004041db
0x004041df
0x004041f0
0x004041f0
0x004041f6
0x00404204
0x00404204
0x00000000
0x00404208
0x004041d0
0x004040e6
0x00000000
0x004040fa
0x00404100
0x00404106
0x00000000
0x00000000
0x0040412b
0x0040412d
0x00404132
0x00000000
0x00404132
0x004040e6
0x00403fbb
0x00403fbe
0x00403fc3
0x00403fc5
0x00403fd4
0x00403fd4
0x00403fd6
0x00403fdb
0x00403fde
0x00403fe0
0x00403fe5
0x00403fee
0x00403ff4
0x00404000
0x00404003
0x0040400c
0x00404011
0x00404014
0x00404019
0x00404030
0x00404037
0x0040404a
0x0040404d
0x00404062
0x00404064
0x00404069
0x0040406e
0x00404073
0x00404073
0x00404082
0x00404091
0x00404093
0x004040a9
0x004040b8
0x004040ba
0x00000000

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404030
GetDlgItem.USER32(00000000,000003E8), ref: 00404044
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00404062
GetSysColor.USER32(?), ref: 00404073
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404082
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404091
lstrlenA.KERNEL32(?), ref: 0040409B
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004040A9
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004040B8
GetDlgItem.USER32(?,0000040A), ref: 0040411B
SendMessageA.USER32(00000000), ref: 0040411E
GetDlgItem.USER32(?,000003E8), ref: 00404149
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404189
LoadCursorA.USER32(00000000,00007F02), ref: 00404198
SetCursor.USER32(00000000), ref: 004041A1
ShellExecuteA.SHELL32(0000070B,open,0042DBE0,00000000,00000000,00000001), ref: 004041B4
LoadCursorA.USER32(00000000,00007F00), ref: 004041C1
SetCursor.USER32(00000000), ref: 004041C4
SendMessageA.USER32(00000111,00000001,00000000), ref: 004041F0
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404204

Strings

N, xrefs: 00404137
`V, xrefs: 00404064
open, xrefs: 004041AC
q?@, xrefs: 004041A9

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$`V$open$q?@
API String ID: 3615053054-3544252742
Opcode ID: 43e4b1bebc352cc37ab134c8e21d344cf3974b6da0146347b86895c6f7b453af
Instruction ID: 8cc316ab489d754ba064ab1d5a66df449127ca6112c148b2bdc2fdd16cb80ba7
Opcode Fuzzy Hash: 43e4b1bebc352cc37ab134c8e21d344cf3974b6da0146347b86895c6f7b453af
Instruction Fuzzy Hash: 9361DFB1A40209BFEB109F60CC45F6A3B68FB54745F10853AFB04BA2D1C7B8A951CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				intOrPtr _t115;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x42ec50; // 0x56e260
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, "Fast! Resources Setup", 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					_t115 =  *0x42ec48; // 0x0
					 *((intOrPtr*)(_t102 + 4)) = _t115;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Fast! Resources Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

`V, xrefs: 00401039
Fast! Resources Setup, xrefs: 00401150
F, xrefs: 0040100C

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Fast! Resources Setup$`V
API String ID: 941294808-728366960
Opcode ID: 9ef4e76bf49e76a01cd413a5d017736c2cab636d92d5aa9aaf47e7e990c9ee05
Instruction ID: 7d427dbe4d4bacd88da03279d54ab8fa369b0c74db3328ba00a5b4b95e7f032c
Opcode Fuzzy Hash: 9ef4e76bf49e76a01cd413a5d017736c2cab636d92d5aa9aaf47e7e990c9ee05
Instruction Fuzzy Hash: 0B41AC71804249AFCB058F95CD459BFBFB9FF44314F00802AF961AA2A0C738EA50DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004058EF Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004058EF(void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				intOrPtr _t18;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00405F2D(2);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x42ecd0 =  *0x42ecd0 + 1;
						return _t20;
					}
				}
				 *0x42c250 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x42bcc8, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x42b8c8, "%s=%s\r\n", 0x42c250, 0x42bcc8);
						_t18 =  *0x42ec50; // 0x56e260
						_t56 = _t55 + 0x10;
						E00405BC3(_t43, 0x400, 0x42bcc8, 0x42bcc8,  *((intOrPtr*)(_t18 + 0x128)));
						_t20 = E00405878(0x42bcc8, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E004057ED(_t51, "[Rename]\r\n") != 0) {
								_t28 = E004057ED(_t26 + 0xa, 0x409404);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E00405839(_t51 + _t29, 0x42b8c8, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E00405BA1(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E00405878(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x42c250, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

APIs

Part of subcall function 00405F2D: GetModuleHandleA.KERNEL32(?,?,00000000,00403179,0000000D,SETUPAPI,USERENV,UXTHEME), ref: 00405F3F
Part of subcall function 00405F2D: GetProcAddress.KERNEL32(00000000,?), ref: 00405F5A

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000002,?,00000000,?,?,00405684,?,00000000,000000F1,?), ref: 0040593C
GetShortPathNameA.KERNEL32(?,0042C250,00000400), ref: 00405945
GetShortPathNameA.KERNEL32(00000000,0042BCC8,00000400), ref: 00405962
wsprintfA.USER32 ref: 00405980
GetFileSize.KERNEL32(00000000,00000000,0042BCC8,C0000000,00000004,0042BCC8,?,?,?,00000000,000000F1,?), ref: 004059BB
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 004059CA
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 004059E0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,0042B8C8,00000000,-0000000A,00409404,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405A26
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 00405A38
GlobalFree.KERNEL32(00000000), ref: 00405A3F
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405A46

Part of subcall function 004057ED: lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059FB,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057F4
Part of subcall function 004057ED: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059FB,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405824

Strings

%s=%s, xrefs: 00405976
`V, xrefs: 00405988
[Rename], xrefs: 004059F0, 00405A02

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$[Rename]$`V
API String ID: 3445103937-1765686571
Opcode ID: 93dbfb435071f571f0ab808dd2be6fd4af636485bab0aeb09ba325dd39622752
Instruction ID: f45ed1bdfbf8c4b03de67142e423a5701368854c8b403738f0f2c648216b24c4
Opcode Fuzzy Hash: 93dbfb435071f571f0ab808dd2be6fd4af636485bab0aeb09ba325dd39622752
Instruction Fuzzy Hash: D741D471B05B157BD7206B619C89F6B3B5CDF85754F040136F905F62D2EA38E8018EAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040429B Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 273
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040429B(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr _t124;
				intOrPtr* _t138;
				CHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				struct HWND__* _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x429890;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xa) + 0x42f000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405446(0x3fb, _t146);
					E00405E03(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405446(0x3fb, _t146);
							if(E00405775(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E00405BA1(0x429088, _t146);
							_t87 = E00405F2D(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00405BA1(0x429088, _t146);
								_t89 = E00405728(0x429088);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x429088,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x429088) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x429088,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t159 = E004056DB(0x429088) - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x429088) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E0040472F(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x42e41c; // 0x56fb66
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E00404717(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x429078);
									} else {
										E00404652(_t168, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x42ece4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E00403E7F(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x42a0ac == _t158) {
									E00404230();
								}
								 *0x42a0ac = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x42a0c0;
							_v60 = E004045EC;
							_v56 = _t146;
							_v68 = E00405BC3(_t146, 0x42a0c0, _t166, 0x429490, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405694(_t146);
								_t124 =  *0x42ec50; // 0x56e260
								_t125 =  *((intOrPtr*)(_t124 + 0x11c));
								if( *((intOrPtr*)(_t124 + 0x11c)) != 0 && _t146 == "C:\\Program Files (x86)\\Fast!") {
									E00405BC3(_t146, 0x42a0c0, _t166, 0, _t125);
									if(lstrcmpiA(0x42dbe0, 0x42a0c0) != 0) {
										lstrcatA(_t146, 0x42dbe0);
									}
								}
								 *0x42a0ac =  *0x42a0ac + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E00405701(_t146) != 0 && E00405728(_t146) == 0) {
						E00405694(_t146);
					}
					 *0x42e418 = _t166;
					SetWindowTextA(_t165, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403E5D(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403E5D(_t166);
					E00403E92(_t165);
					_t138 = E00405F2D(0xa);
					if(_t138 == 0) {
						L53:
						return E00403EC4(_a8, _a12, _a16);
					} else {
						 *_t138(_t165, 1);
						goto L8;
					}
				}
			}

APIs

GetDlgItem.USER32(?,000003FB), ref: 004042EA
SetWindowTextA.USER32(00000000,?), ref: 00404314
SHBrowseForFolderA.SHELL32(?,00429490,?), ref: 004043C5
CoTaskMemFree.OLE32(00000000), ref: 004043D0
lstrcmpiA.KERNEL32(0042DBE0,0042A0C0), ref: 00404402
lstrcatA.KERNEL32(?,0042DBE0), ref: 0040440E
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404420

Part of subcall function 00405446: GetDlgItemTextA.USER32(?,?,00000400,00404457), ref: 00405459

Part of subcall function 00405E03: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\SetupResources.exe,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E5B
Part of subcall function 00405E03: CharNextA.USER32(?,?,?,00000000), ref: 00405E68
Part of subcall function 00405E03: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\SetupResources.exe,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E6D
Part of subcall function 00405E03: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E7D

GetDiskFreeSpaceA.KERNEL32(00429088,?,?,0000040F,?,00429088,00429088,?,00000001,00429088,?,?,000003FB,?), ref: 004044DE
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004044F9

Part of subcall function 00404652: lstrlenA.KERNEL32(0042A0C0,0042A0C0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040456D,000000DF,00000000,00000400,?), ref: 004046F0
Part of subcall function 00404652: wsprintfA.USER32 ref: 004046F8
Part of subcall function 00404652: SetDlgItemTextA.USER32(?,0042A0C0), ref: 0040470B

Strings

`V, xrefs: 004043DC
A, xrefs: 004043BE
C:\Program Files (x86)\Fast!, xrefs: 004043EB

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Program Files (x86)\Fast!$`V
API String ID: 2624150263-2596899485
Opcode ID: 651704e9fdbceafa19cbcaa3072621ff73f1ed0c40465ee915921c67da8dd18a
Instruction ID: 25cf576a769d2d8a049a3aeadb65d5b4cdf4f75aeaeb5f9dd55cec19ee375662
Opcode Fuzzy Hash: 651704e9fdbceafa19cbcaa3072621ff73f1ed0c40465ee915921c67da8dd18a
Instruction Fuzzy Hash: A6A170B1900218ABDB11AFA5DC41BAF77B8EF84315F10843BF611B62D1D77C9A418F69

Uniqueness

Uniqueness Score: -1.00%

Function 00405E03 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E03(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E00405701(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E004056BF("*?|<>/\":", _t5))) == 0) {
							E00405839(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

APIs

CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\SetupResources.exe,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E5B
CharNextA.USER32(?,?,?,00000000), ref: 00405E68
CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\SetupResources.exe,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E6D
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030E8,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 00405E7D

Strings

C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 00405E3F
C:\Users\user\AppData\Local\Temp\, xrefs: 00405E04, 00405E09
*?|<>/":, xrefs: 00405E4B

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\SetupResources.exe
API String ID: 589700163-1077076567
Opcode ID: 3b5f3268fa1fae19e58d0ad2ced72642c676bfd811e2c7a6988a98807c9a22ca
Instruction ID: 8c0debaa59703488c7458a94fa91a8896e4240cf3d31b331365b77cfd974a1c9
Opcode Fuzzy Hash: 3b5f3268fa1fae19e58d0ad2ced72642c676bfd811e2c7a6988a98807c9a22ca
Instruction Fuzzy Hash: 4E11B671804A912DEB3217289C44B777FC8CB66790F18447BD4D5723C2D67C5D428AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00403EC4 Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403EC4(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403EE1
GetSysColor.USER32(00000000), ref: 00403EFD
SetTextColor.GDI32(?,00000000), ref: 00403F09
SetBkMode.GDI32(?,?), ref: 00403F15
GetSysColor.USER32(?), ref: 00403F28
SetBkColor.GDI32(?,?), ref: 00403F38
DeleteObject.GDI32(?), ref: 00403F52
CreateBrushIndirect.GDI32(?), ref: 00403F5C

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 244050047767258f024cc5d970fbc24e44c9485df9f09a7a1d92820c249c5868
Instruction ID: 0d89a351d513fb24bb3d4bb4099581c898fc75933690e96f4850fc1bb23eeaf2
Opcode Fuzzy Hash: 244050047767258f024cc5d970fbc24e44c9485df9f09a7a1d92820c249c5868
Instruction Fuzzy Hash: 91214271904745ABCB219F78DD08B4B7FF8AF05715B048629F995A22E0D734E9048B65

Uniqueness

Uniqueness Score: -1.00%

Function 00402692 Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00402692(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *((intOrPtr*)(_t58 - 0xc)) = 0xfffffd66;
				_t52 = E00402A0C(0xfffffff0);
				 *(_t58 - 0x38) = _t24;
				if(E00405701(_t52) == 0) {
					E00402A0C(0xffffffed);
				}
				E00405859(_t52);
				_t27 = E00405878(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x42ec54; // 0x9e00
					 *(_t58 - 0x30) = _t32;
					_t51 = GlobalAlloc(0x40, _t32);
					if(_t51 != _t47) {
						E004030C5(_t47);
						E00403093(_t51,  *(_t58 - 0x30));
						_t56 = GlobalAlloc(0x40,  *(_t58 - 0x20));
						 *(_t58 - 0x34) = _t56;
						if(_t56 != _t47) {
							E00402E71( *((intOrPtr*)(_t58 - 0x24)), _t47, _t56,  *(_t58 - 0x20));
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x48) =  *_t56;
								E00405839( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x48);
							}
							GlobalFree( *(_t58 - 0x34));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x30), _t58 - 0x3c, _t47);
						GlobalFree(_t51);
						 *((intOrPtr*)(_t58 - 0xc)) = E00402E71(0xffffffff,  *(_t58 + 8), _t47, _t47);
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *((intOrPtr*)(_t58 - 0xc)) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x38));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

APIs

GlobalAlloc.KERNEL32(00000040,00009E00,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004026E6
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402702
GlobalFree.KERNEL32(?), ref: 0040273B
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,000000F0), ref: 0040274D
GlobalFree.KERNEL32(00000000), ref: 00402754
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040276C
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402780

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 9c2b519bab710da34c4f93b0ba9d6d86cd7c01b4cb3bb32b5413ac78432567f7
Instruction ID: 5b53ae4c2b613e87b8af51cb2b1d5881ebc53a54f05e9f53cd44442d287e2222
Opcode Fuzzy Hash: 9c2b519bab710da34c4f93b0ba9d6d86cd7c01b4cb3bb32b5413ac78432567f7
Instruction Fuzzy Hash: 3131A971C00128BBCF216FA5CE88DAE7F79EF05364F10423AF920762E1C67949408FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00404E8D Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E8D(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x42e424; // 0x0
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x42ecf4; // 0x0
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405BC3(0, _t39, 0x429898, 0x429898, _a4);
					}
					_t26 = lstrlenA(0x429898);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x42e408, 0x429898);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x429898;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52);
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0);
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x429898)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x429898, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

APIs

lstrlenA.KERNEL32(00429898,00000000,00418C68,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000,?), ref: 00404EC6
lstrlenA.KERNEL32(00402FCC,00429898,00000000,00418C68,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000), ref: 00404ED6
lstrcatA.KERNEL32(00429898,00402FCC,00402FCC,00429898,00000000,00418C68,765F3130), ref: 00404EE9
SetWindowTextA.USER32(00429898,00429898), ref: 00404EFB
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F21
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F3B
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F49

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b9bd97d855335461d49e39303d4d63c0ba14004c0d3fb8e2a59ec645a9842c76
Instruction ID: d5e3cfdbeb95b60488c6f1e99959168c2d2eab17d02c72d4f5409838ea1ae410
Opcode Fuzzy Hash: b9bd97d855335461d49e39303d4d63c0ba14004c0d3fb8e2a59ec645a9842c76
Instruction Fuzzy Hash: 2C21CF71900119BBDF11AFA5CD849DEBFB9EF45354F04807AF608B6290C779AE408FA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040475C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040475C(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404777
GetMessagePos.USER32 ref: 0040477F
ScreenToClient.USER32(?,?), ref: 00404799
SendMessageA.USER32(?,00001111,00000000,?), ref: 004047AB
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004047D1

Strings

f, xrefs: 004047AD

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b999d07b324019c2219c33d3107ce818a81de0efbbfc0766a2ac4245d0efef5f
Instruction ID: 1287270e3ce35f4bc81f554f3193770291cde8f8b01dc106229a8c11fbd36195
Opcode Fuzzy Hash: b999d07b324019c2219c33d3107ce818a81de0efbbfc0766a2ac4245d0efef5f
Instruction Fuzzy Hash: 99014071D00219BADB01DBA4DD85FFEBBFCAB59711F10412BBA10B72C0D7B465018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B51 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B51(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x414c60; // 0x34d6c32
					_t11 =  *0x428c70; // 0x34d80c0
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b5e
0x00402b6c
0x00402b72
0x00402b72
0x00402b80
0x00402b82
0x00402b88
0x00402b8f
0x00402b91
0x00402b91
0x00402ba7
0x00402bb7
0x00402bc9
0x00402bc9
0x00402bd1

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B6C
MulDiv.KERNEL32(034D6C32,00000064,034D80C0), ref: 00402B97
wsprintfA.USER32 ref: 00402BA7
SetWindowTextA.USER32(?,?), ref: 00402BB7
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BC9

Strings

verifying installer: %d%%, xrefs: 00402BA1

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: f4b40b60170e557e8e64fd1007bdae5203f411c8eb827d09f08439ceb1717922
Instruction ID: 170251b52dccb1bc1045efc101099eb7df8550efa5a7238432f4f3ca5a85e13a
Opcode Fuzzy Hash: f4b40b60170e557e8e64fd1007bdae5203f411c8eb827d09f08439ceb1717922
Instruction Fuzzy Hash: C501F470644209BBDB209F61DD49EED3779AB44305F008039FA06B52D0D7B599558F95

Uniqueness

Uniqueness Score: -1.00%

Function 004038BD Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038BD(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				intOrPtr _t15;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405B18(__ecx, "1033");
				while(1) {
					_t26 =  *0x42ec84; // 0x1
					if(_t26 == 0) {
						goto L7;
					}
					_t15 =  *0x42ec50; // 0x56e260
					_t16 =  *(_t15 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x42ec80;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x42e420 = _t18[1];
					 *0x42ece8 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42e41c = _t23;
						E00405AFF(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x42a098, E00405BC3(_t13, _t24, _t26, "Fast! Resources Setup", 0xfffffffe));
						_t11 =  *0x42ec6c; // 0x1
						_t27 =  *0x42ec68; // 0x56e40c
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t5 = _t27 + 0x18; // 0x56e424
								_t11 = E00405BC3(_t13, _t25, _t27, _t5, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

APIs

SetWindowTextA.USER32(00000000,Fast! Resources Setup), ref: 00403955

Strings

C:\Users\user\AppData\Local\Temp\SetupResources.exe, xrefs: 004038BE
`V, xrefs: 004038DB
1033, xrefs: 004038C1, 004038CB, 0040393C
Fast! Resources Setup, xrefs: 00403944

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: TextWindow
String ID: 1033$C:\Users\user\AppData\Local\Temp\SetupResources.exe$Fast! Resources Setup$`V
API String ID: 530164218-4212995179
Opcode ID: 5c55cf1dc77012d7b49c2afc24761aa4d87cc513fcd06e13f885861062bacd8d
Instruction ID: 93100a74eb761491cad5589d5ba72450eee8ba09b7e289b8bdcf135b4c9a781b
Opcode Fuzzy Hash: 5c55cf1dc77012d7b49c2afc24761aa4d87cc513fcd06e13f885861062bacd8d
Instruction Fuzzy Hash: A611F071B006108BC730EF56DC80A773BACEB85715368813BA801A73A0CA39AD028B9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040534F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040534F(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x407310;
				_v36.Group = 0x407310;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x407300;
				_v16.nLength = 0xc;
				if(CreateDirectoryA(_a4,  &_v16) != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

APIs

CreateDirectoryA.KERNEL32(?,?,00000000), ref: 00405392
GetLastError.KERNEL32 ref: 004053A6
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004053BB
GetLastError.KERNEL32 ref: 004053C5

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 0040534F

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 3449924974-3409409611
Opcode ID: 1936ad7c03f2b7d8793bf3b54e92df8b677be00562b78ee6b782fceed01fa342
Instruction ID: 0f194ad754f8d2153fe6bade7a67ae4222ab15fc701b17716cfd16251ec2b406
Opcode Fuzzy Hash: 1936ad7c03f2b7d8793bf3b54e92df8b677be00562b78ee6b782fceed01fa342
Instruction Fuzzy Hash: C5010871D04259EBEF119BA0D904BEFBFB8EF04354F00457AE905B6180D3B89614CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00402A4C Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A4C(void* _a4, char* _a8, long _a12) {
				void* _v8;
				char _v272;
				signed char _t16;
				long _t18;
				long _t25;
				intOrPtr* _t27;
				long _t28;

				_t16 =  *0x42ecf0; // 0x0
				_t18 = RegOpenKeyExA(_a4, _a8, 0, _t16 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						__eflags = _a12;
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							__eflags = 1;
							return 1;
						}
						_t25 = E00402A4C(_v8,  &_v272, 0);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00405F2D(4);
					if(_t27 == 0) {
						__eflags =  *0x42ecf0; // 0x0
						if(__eflags != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						__eflags = _t28;
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x42ecf0, 0);
				}
				return _t18;
			}

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A6D
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AA9
RegCloseKey.ADVAPI32(?), ref: 00402AB2
RegCloseKey.ADVAPI32(?), ref: 00402AD7
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AF5

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 87ccbfffecd7de7467de5c73c2002d88ab1ef4389744f866cc51cf150fc0b97d
Instruction ID: aab1c47b15b7d7dbd0304e6a384de86cdfdd1b9a1951722987da620561d60ced
Opcode Fuzzy Hash: 87ccbfffecd7de7467de5c73c2002d88ab1ef4389744f866cc51cf150fc0b97d
Instruction Fuzzy Hash: 45117F71A00009FFDF219F91DE49DAF3B69EB14394B004076FA06F00A0DBB49E52AF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CC1(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 8), __edx);
				GetClientRect(_t25, _t27 - 0x50);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E00402A0C(_t21), _t21,  *(_t27 - 0x48) *  *(_t27 - 0x20),  *(_t27 - 0x44) *  *(_t27 - 0x20), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ccb
0x00401cd2
0x00401d01
0x00401d09
0x00401d10
0x00401d10
0x004028a4
0x004028b0

APIs

GetDlgItem.USER32(?), ref: 00401CC5
GetClientRect.USER32(00000000,?), ref: 00401CD2
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CF3
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 80015c0295c996dc09a7a69a0851128c21454d925603859c5d6fd9af08ddf10e
Instruction ID: 0b6a49845d72fa48a9a579b1019c06f6c105053db178aa5042bb0eadc5b1df39
Opcode Fuzzy Hash: 80015c0295c996dc09a7a69a0851128c21454d925603859c5d6fd9af08ddf10e
Instruction Fuzzy Hash: 2DF0EC72A04114AFEB00EBA4DD88DAFB77CFB44305B044536F501F6191C678AD419B79

Uniqueness

Uniqueness Score: -1.00%

Function 00404652 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404652(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					_push(0x14);
					_pop(0);
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_t50 = 0x14;
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E00405BC3(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E00405BC3(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E00405BC3(_t41, _t47, 0x42a0c0, 0x42a0c0, _a8);
				wsprintfA(_t32 + lstrlenA(0x42a0c0), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				return SetDlgItemTextA( *0x42e418, _a4, 0x42a0c0);
			}

APIs

lstrlenA.KERNEL32(0042A0C0,0042A0C0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040456D,000000DF,00000000,00000400,?), ref: 004046F0
wsprintfA.USER32 ref: 004046F8
SetDlgItemTextA.USER32(?,0042A0C0), ref: 0040470B

Strings

%u.%u%s%s, xrefs: 004046DA

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: ec62b53d4e0dbb31f5b6c5a17a5348d37b593b8d10f93b7eb7b316986fd69fdf
Instruction ID: cfc8e6c3a4af003209a53fcdfac8cba24e816d3e629d82a7997265ded69b8fd0
Opcode Fuzzy Hash: ec62b53d4e0dbb31f5b6c5a17a5348d37b593b8d10f93b7eb7b316986fd69fdf
Instruction Fuzzy Hash: A0112773A0412827EB0065699C45EAF3298DB86334F254637FE25F71D1E9799C1285EC

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BAD() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 8) = E004029EF(3);
				 *(_t55 + 8) = E004029EF(4);
				if(( *(_t55 - 0x14) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 8)) = E00402A0C(0x33);
				}
				__eflags =  *(_t55 - 0x14) & 0x00000002;
				if(( *(_t55 - 0x14) & 0x00000002) != 0) {
					 *(_t55 + 8) = E00402A0C(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x2c)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E00402A0C();
					_t28 = E00402A0C();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 8),  *(_t55 + 8), _t31,  ~( *_t28) & _t28);
					goto L10;
				} else {
					_t52 = E004029EF();
					_t37 = E004029EF();
					_t48 =  *(_t55 - 0x14) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8));
						L10:
						 *(_t55 - 0xc) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8), _t42, _t48, _t55 - 0xc);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x28)) >= _t42) {
					_push( *(_t55 - 0xc));
					E00405AFF();
				}
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e392da7139347f63c408211002f75456f017542e4151f627b34d3607e76d39d5
Instruction ID: e2d4d96ca7e059e12ef29128c845d67dbcf5a6688523181a8ec59df7cc8b106d
Opcode Fuzzy Hash: e392da7139347f63c408211002f75456f017542e4151f627b34d3607e76d39d5
Instruction Fuzzy Hash: B021A171A44208BFEF01AFB5CD8AAAE7B75EF44344F14407AF501BA1D1D6B88A40DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00405694 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405694(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409010);
				}
				return _t7;
			}

0x00405695
0x004056ac
0x004056b4
0x004056b4
0x004056bc

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030FA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 0040569A
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030FA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403299), ref: 004056A3
lstrcatA.KERNEL32(?,00409010), ref: 004056B4

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405694

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-1360682300
Opcode ID: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction ID: 3169b85a74bfaa55460b422d3e3fbca7e168afda588c61a1877893bbaf19970e
Opcode Fuzzy Hash: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction Fuzzy Hash: 25D0A972606A302EE20226158C05F8B3A28CF52301B0448A2F640B22D2C7BC7E818FFE

Uniqueness

Uniqueness Score: -1.00%

Function 00401F67 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401F67(void* __ebx, void* __eflags) {
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x42ecf8");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x42ecc8 =  *0x42ecc8 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402A0C(0xfffffff0);
				 *(_t34 + 8) = E00402A0C(1);
				if( *((intOrPtr*)(_t34 - 0x18)) == __ebx) {
					L3:
					_t30 = LoadLibraryExA(_t32, _t27, 8);
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404E8D(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x20)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x42f000, 0x40b060, 0x409000);
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x20)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x1c)) == _t27 && E00403594(_t30) != 0) {
						FreeLibrary(_t30);
					}
					goto L16;
				}
				_t30 = GetModuleHandleA(_t32);
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00401f67
0x00401f67
0x00401f6c
0x00401f73
0x0040202f
0x0040217a
0x0040217a
0x004028a1
0x004028a4
0x004028b0
0x004028b0
0x00401f82
0x00401f8c
0x00401f8f
0x00401f9e
0x00401fa8
0x00401fac
0x00402028
0x00000000
0x00402028
0x00401fae
0x00401fb8
0x00401fbc
0x00402000
0x00401fbe
0x00401fc1
0x00401fc4
0x00401ff4
0x00401fc6
0x00401fc9
0x00401fd2
0x00401fd4
0x00401fd4
0x00401fd2
0x00401fc4
0x00402008
0x0040201d
0x0040201d
0x00000000
0x00402008
0x00401f98
0x00401f9c
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F92

Part of subcall function 00404E8D: lstrlenA.KERNEL32(00429898,00000000,00418C68,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000,?), ref: 00404EC6
Part of subcall function 00404E8D: lstrlenA.KERNEL32(00402FCC,00429898,00000000,00418C68,765F3130,?,?,?,?,?,?,?,?,?,00402FCC,00000000), ref: 00404ED6
Part of subcall function 00404E8D: lstrcatA.KERNEL32(00429898,00402FCC,00402FCC,00429898,00000000,00418C68,765F3130), ref: 00404EE9
Part of subcall function 00404E8D: SetWindowTextA.USER32(00429898,00429898), ref: 00404EFB
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F21
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F3B
Part of subcall function 00404E8D: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F49

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FA2
GetProcAddress.KERNEL32(00000000,?), ref: 00401FB2
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040201D

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: a8bda000f72a175a0f0ed6af68dae75491426ca2de135a58b3756a98873c7a0f
Instruction ID: c2750792bbdc63a1f1471102f5095df33ec689d5572da80d747626f78b0a8a56
Opcode Fuzzy Hash: a8bda000f72a175a0f0ed6af68dae75491426ca2de135a58b3756a98873c7a0f
Instruction Fuzzy Hash: 86210B32904115BBDF206FA5CE8CA6E3571BF44358F20423BF901B62E1DBBC49419A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00402319 Relevance: 6.1, APIs: 4, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00402319(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				char _t24;
				int _t27;
				signed int _t30;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402B01(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x18));
				 *(_t37 - 0x34) =  *(_t37 - 0x14);
				 *(_t37 - 0x38) = E00402A0C(2);
				_t18 = E00402A0C(0x11);
				_t30 =  *0x42ecf0; // 0x0
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27, _t30 | 0x00000002, _t27, _t37 + 8, _t27);
				if(_t19 == 0) {
					if(_t35 == 1) {
						E00402A0C(0x23);
						_t19 = lstrlenA(0x40a460) + 1;
					}
					if(_t35 == 4) {
						_t24 = E004029EF(3);
						 *0x40a460 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402E71( *((intOrPtr*)(_t37 - 0x1c)), _t27, 0x40a460, 0xc00);
					}
					if(RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x38), _t27,  *(_t37 - 0x34), 0x40a460, _t19) == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x42ecc8 =  *0x42ecc8 +  *(_t37 - 4);
				return 0;
			}

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402357
lstrlenA.KERNEL32(0040A460,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402377
RegSetValueExA.ADVAPI32(?,?,?,?,0040A460,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004023B0
RegCloseKey.ADVAPI32(?,?,?,0040A460,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402493

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: b6f4f247d7d0ae3319dc5e24e2c3de07eca660428b233407ae8b6eb34338d133
Instruction ID: 87e3eab27a64c54b83edf31c6fc5fb34a185908cb1e9cfdfcb2c5e910e3a0e9b
Opcode Fuzzy Hash: b6f4f247d7d0ae3319dc5e24e2c3de07eca660428b233407ae8b6eb34338d133
Instruction Fuzzy Hash: 74116371E00108BEEB10EFB5DE89EAF7A79EB50358F10403AF905B61D1D6B85D019A69

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D1B() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 8)), 0x5a);
				0x40b064->lfHeight =  ~(MulDiv(E004029EF(2), _t6, 0x48));
				 *0x40b074 = E004029EF(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x18));
				 *0x40b07b = 1;
				 *0x40b078 = _t11 & 0x00000001;
				 *0x40b079 = _t11 & 0x00000002;
				 *0x40b07a = _t11 & 0x00000004;
				E00405BC3(_t18, _t24, _t26, 0x40b080,  *((intOrPtr*)(_t28 - 0x24)));
				_t14 = CreateFontIndirectA(0x40b064);
				_push(_t14);
				_push(_t26);
				E00405AFF();
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d29
0x00401d42
0x00401d4c
0x00401d51
0x00401d5c
0x00401d63
0x00401d75
0x00401d7b
0x00401d80
0x00401d8a
0x004024ce
0x00401561
0x00402849
0x004028a4
0x004028b0

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(0040B064), ref: 00401D8A

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID:
API String ID: 3272661963-0
Opcode ID: 4aff2da1ecbc0b46b4ebb4a1bc3754d5e437124edce295b0be6ec486ba38634f
Instruction ID: 5e6b0a242ffc9277152ed6cf63edc70abaf129c53bcded44f01e7363494148ce
Opcode Fuzzy Hash: 4aff2da1ecbc0b46b4ebb4a1bc3754d5e437124edce295b0be6ec486ba38634f
Instruction Fuzzy Hash: 0BF04471E89240AEE7016770AF1AB9B7F64D715305F104475F651B62E2C77914048BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00402BD4 Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BD4(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x420c68; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x42ec4c;
						if(_t2 >  *0x42ec4c) {
							_t3 = CreateDialogParamA( *0x42ec40, 0x6f, 0, E00402B51, 0);
							 *0x420c68 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00405F69(0);
					}
				} else {
					_t6 =  *0x420c68; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x420c68 = 0;
					return _t6;
				}
			}

APIs

DestroyWindow.USER32(00000000,00000000,00402DB4,00000001), ref: 00402BE7
GetTickCount.KERNEL32 ref: 00402C05
CreateDialogParamA.USER32(0000006F,00000000,00402B51,00000000), ref: 00402C22
ShowWindow.USER32(00000000,00000005), ref: 00402C30

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: b254695f6d3024de6991e78bd902d51a9eabd2695cbf76f56ec73d281620ca3d
Instruction ID: fe7f2a60441318f0c2a90f6d59b101c1e11520174a0dcb1e75ef42172c75ba50
Opcode Fuzzy Hash: b254695f6d3024de6991e78bd902d51a9eabd2695cbf76f56ec73d281620ca3d
Instruction Fuzzy Hash: 7FF05470A0D121ABD6746F55FE8CD8B7BA4F744B017540576F000B11A4DA785882CFAD

Uniqueness

Uniqueness Score: -1.00%

Function 00402036 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402036() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E00402A0C(0xfffffff0);
				_t96 = E00402A0C(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x34)) = E00402A0C(2);
				 *((intOrPtr*)(_t100 - 0xc)) = E00402A0C(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x38)) = E00402A0C(0x45);
				if(E00405701(_t96) == 0) {
					E00402A0C(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x4074b8, _t75, 1, 0x4074a8, _t44);
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x4074c8, _t100 - 8);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, "C:\\Program Files (x86)\\Fast!");
						_t81 =  *(_t100 - 0x18);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x18);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 0xc)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 0xc)),  *(_t100 - 0x18) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x34)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x38)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x409458, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 8));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x409458, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 8));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x42ecc8 =  *0x42ecc8 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

APIs

CoCreateInstance.OLE32(004074B8,?,00000001,004074A8,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402089
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409458,00000400,?,00000001,004074A8,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402143

Strings

C:\Program Files (x86)\Fast!, xrefs: 004020C1

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Program Files (x86)\Fast!
API String ID: 123533781-1788482285
Opcode ID: 36078a608850ed5d6ba3cbed8c9731654616b1bc21e84282af2a803188abdfec
Instruction ID: 191a2b8eefbfb1bddfad8f8f84b6cbb7561eb223b9fb57f38d09f1a7a57a31e1
Opcode Fuzzy Hash: 36078a608850ed5d6ba3cbed8c9731654616b1bc21e84282af2a803188abdfec
Instruction Fuzzy Hash: 39413075A00104BFDB00EFA4CD89E9E7BBAEF49364B20426AF505EB2D1CA799D41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00404DDD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404DDD(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x42a0a8 != _t22) {
							 *0x42a0a8 = _t22;
							E00405BA1(0x42a0c0, 0x42f000);
							E00405AFF(0x42f000, _t22);
							E0040140B(6);
							E00405BA1(0x42f000, 0x42a0c0);
						}
						L11:
						return CallWindowProcA( *0x42a0b0, _a4, _a8, _a12, _t22);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E0040475C(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00403EA9(0x413);
				return 0;
			}

APIs

IsWindowVisible.USER32(?), ref: 00404E13
CallWindowProcA.USER32(?,00000200,?,?), ref: 00404E81

Part of subcall function 00403EA9: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403EBB

Strings

, xrefs: 00404DEB

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 284444f2568d96eb5f499d391233f43a2f88d41ae364e0567807da02f849ec1b
Instruction ID: 765017f4a7fe1763b93213a0743e5224a7b8bf10e0e2635d7465f91e9f3f1348
Opcode Fuzzy Hash: 284444f2568d96eb5f499d391233f43a2f88d41ae364e0567807da02f849ec1b
Instruction Fuzzy Hash: C5116D71500218BFDF215F51DC81E9B7669BB84365F00803AFA08792A1C37C49518BEE

Uniqueness

Uniqueness Score: -1.00%

Function 00405401 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405401(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x42c0c8->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x42c0c8,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x0040540a
0x00405426
0x0040542e
0x00405433
0x00000000
0x00405439
0x0040543d

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,0042C0C8,Error launching installer), ref: 00405426
CloseHandle.KERNEL32(?), ref: 00405433

Strings

Error launching installer, xrefs: 00405414

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 0925aebfc32c6642fbbb941080814cd4d7ece6f22c8f43fc911f16656fd02ce2
Instruction ID: 8ba2d39aa234bef1b68f753dd4085f5a0355ab0b72bc814b33162f1b9dafcc5c
Opcode Fuzzy Hash: 0925aebfc32c6642fbbb941080814cd4d7ece6f22c8f43fc911f16656fd02ce2
Instruction Fuzzy Hash: 40E0E675A00209ABDB109FA4DC45A6F7B7CFF10305B404521E914F3151D774D5148A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040355F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040355F() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x42907c;
				_t3 = E00403544(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x42907c =  *0x42907c & 0x00000000;
				return _t3;
			}

0x00403560
0x00403568
0x0040356f
0x00403572
0x00403572
0x00403574
0x00403579
0x00403580
0x00403586
0x0040358a
0x0040358b
0x00403593

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,00000000,00403537,00403340,00000000), ref: 00403579
GlobalFree.KERNEL32(?), ref: 00403580

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403571

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-1360682300
Opcode ID: 84b733c7cccae0041813714216a38e771799edba4f139ceaa0c0671ece6e2eb2
Instruction ID: bfe74e10b2793f4584c914afcf2a54bd359ebf4cfcfa0dffde5489d6b194198f
Opcode Fuzzy Hash: 84b733c7cccae0041813714216a38e771799edba4f139ceaa0c0671ece6e2eb2
Instruction Fuzzy Hash: CCE08C32901030A7DA211F15BC0475ABB6C6B49B32F01456AE801772B083742D424BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004056DB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056DB(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x004056dc
0x004056e6
0x004056e8
0x004056ef
0x004056f7
0x00000000
0x00000000
0x00000000
0x004056f7
0x004056f9
0x004056fe

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00402CA4,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\SetupResources.exe,C:\Users\user\AppData\Local\Temp\SetupResources.exe,80000000,00000003), ref: 004056E1
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,00402CA4,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\SetupResources.exe,C:\Users\user\AppData\Local\Temp\SetupResources.exe,80000000,00000003), ref: 004056EF

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004056DB

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-3409409611
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: 3f11d7040b39dee88ccc87d096f3af91d58a3172f7b65643d8c2c66232cec6f3
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: ADD0A76280ADB01EF30352108C04B8F7A58CF13300F0948A2E040A21D1C6B85C418FFD

Uniqueness

Uniqueness Score: -1.00%

Function 004057ED Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004057ED(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x004057f9
0x004057fb
0x00405823
0x00405808
0x0040580d
0x00405818
0x00000000
0x00405835
0x00405821
0x00405821
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059FB,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057F4
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040580D
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 0040581B
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059FB,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405824

Memory Dump Source

Source File: 00000017.00000002.2968330118.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.2968212753.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968565187.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968708407.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2968839217.000000000040B000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969660089.000000000042C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969744246.0000000000434000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.2969806757.000000000043C000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_SetupResources.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: b9005c049e247e33e5549b3e141599c62d2a38fed0f6fd2d3c1464f89547bebd
Instruction ID: 9d1965df737bf6a3caf75c2c412474092f11d9bf319c7f7f540ae1764f3f27e9
Opcode Fuzzy Hash: b9005c049e247e33e5549b3e141599c62d2a38fed0f6fd2d3c1464f89547bebd
Instruction Fuzzy Hash: 69F0A737209D51ABD202AB255C04D6B7FA4EF91314B14447AF840F2280D779A925DBBB

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	API monitoring, MBR, VBR
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup 2.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Fast!\FastSRV.exe

C:\Program Files (x86)\Fast!\fast!.exe

C:\Program Files (x86)\Fast!\nwjs\credits.html

C:\Program Files (x86)\Fast!\nwjs\d3dcompiler_47.dll

C:\Program Files (x86)\Fast!\nwjs\ffmpeg.dll

C:\Program Files (x86)\Fast!\nwjs\icudtl.dat

C:\Program Files (x86)\Fast!\nwjs\libEGL.dll

C:\Program Files (x86)\Fast!\nwjs\libGLESv2.dll

C:\Program Files (x86)\Fast!\nwjs\natives_blob.bin

C:\Program Files (x86)\Fast!\nwjs\node.dll

C:\Program Files (x86)\Fast!\ui\css\font-awesome.min.css

C:\Program Files (x86)\Fast!\ui\css\opensans.css

C:\Program Files (x86)\Fast!\ui\css\opensans1.woff2

C:\Program Files (x86)\Fast!\ui\css\opensans2.woff2

C:\Program Files (x86)\Fast!\ui\css\opensans3.woff2

C:\Program Files (x86)\Fast!\ui\css\opensans4.woff2

C:\Program Files (x86)\Fast!\ui\css\opensans5.woff2

C:\Program Files (x86)\Fast!\ui\css\opensans6.woff2

Windows Analysis Report
Setup 2.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre